^ Link to original article

This is an article I recently wrote for the Global Network of Extremism and Technology (GNET). You can find the original link here.

Propaganda ecosystems function as parallel trust infrastructures, enabling extremist organisations to coordinate financial activity outside formal financial systems. While extremist propaganda is typically studied as a tool for recruitment or ideological dissemination, these ecosystems also perform a critical financial function as generators of the reputational legitimacy and interpersonal trust necessary for decentralised financial networks to operate.

Over the past decade, violent extremist groups—particularly those affiliated with the Islamic State and al-Qaeda—have leveraged digital propaganda ecosystems to construct increasingly sophisticated parallel financial systems. Through repeated messaging, reputational signalling, and networked communication, these ecosystems enable dispersed actors to authenticate intermediaries, coordinate fundraising, and move resources across geographically fragmented spaces.

This Insight argues that extremist propaganda ecosystems function as trust infrastructures that enable decentralised terrorist financing systems to operate outside formal financial institutions. If propaganda ecosystems generate the trust required for decentralised financial coordination, then disrupting these trust nodes may offer earlier intervention points than traditional transaction-level counter-terrorist financing measures.

The Role of Trust in Institutional and Extremist Financial Systems

Across economic theory, there is broad agreement that financial systems depend on trust. Whereas formal financial systems rely on institutional trust generated by legal frameworks and regulatory institutions that govern banks and financial intermediaries, extremist networks are formally excluded from these channels. This exclusion has forced terrorist groups to build parallel systems that generate trust, enabling the financial coordination required to sustain operations—beginning with propaganda ecosystems.

From a financial perspective, these trust-generating ecosystems enable groups to solicit funds directly while identifying supporters with fundraising potential or financial expertise. At the same time, the rapid expansion of financial technologies—including cryptocurrencies and other fintech tools—has reduced the friction associated with transferring funds across informal networks, allowing extremist actors to mobilise financial resources more rapidly across geographically dispersed stakeholders. Finally, the shared narratives and reputational trust generated within these propaganda ecosystems allow larger organisations to both co-opt local militant groups with independent revenue streams and coordinate financially across otherwise fragmented networks.

To these ends, extremists leverage network-based trust as a substitute for formal institutional trust, enabling financial coordination across informal systems.

Case Studies: Propaganda-Enabled Financial Systems

The following cases illustrate how extremist propaganda ecosystems have contributed to the rise of parallel financial infrastructures used by terrorist groups. While these examples are limited to IS- and AQ-affiliated groups, they are not exhaustive.

Islamic State: Global Financial Facilitation Networks

Although IS affiliates lost the vast majority of their territorial holdings and operational revenue between 2014 and 2019, the broader global organisation has remained resilient in large part due to the continued dissemination of online propaganda. Safe havens such as Afghanistan allowed the organisation’s most active branch—the Islamic State Khorasan Province (ISKP)—to produce and distribute videos, press releases, and its monthly magazine The Voice of Khorasan across platforms including Telegram, Rocket.Chat, Instagram, Facebook, X, and Pinterest.

Beyond ideological messaging, these propaganda ecosystems play a critical role in generating trust across geographically dispersed supporters and operatives. Repeated messaging, shared narratives, and reputational signalling help establish a sense of authenticity and legitimacy within the network. In the absence of formal financial institutions, this reputational infrastructure reduces uncertainty about potential intermediaries and collaborators across geographically vast networks.

With these trust networks in place, the Islamic State organisation has been able to construct sophisticated cross-border financial systems that sustain its global operations. Many of these financial activities were centred in the Cal Miskaad mountain range of Puntland, Somalia, where the group’s al-Karrar office coordinated fundraising and financial transfers across Africa and Asia before a 2025 series of U.S. airstrikes and local military operations disrupted the hub. Arrests of financial operatives in Europe and the United States suggest elements of this architecture were already operating across multiple jurisdictions, suggesting a move toward a more decentralised model of interconnected trust nodes.

Islamic State propaganda ecosystems support these parallel financial systems in three primary ways. The first is direct fundraising, with outlets such as The Voice of Khorasan and individual operatives soliciting donations directly from supporters, often through QR codes linked to cryptocurrency transfers. Because these appeals circulate within trusted propaganda communities, potential donors face fewer informational barriers when deciding whether to contribute. Evidence shows that financial and propaganda roles intertwine: for example, French police arrested a man in November 2025 in relation to financing and disseminating propaganda for the ISKP.

The second function is coordination and network formation. Cryptocurrency transfers and hawala transactions are frequently arranged through encrypted messaging platforms such as WhatsApp by operatives who likely initially connected through propaganda communities on other social media platforms. In this sense, propaganda ecosystems act as authenticators, helping participants identify trusted intermediaries and facilitating financial coordination across dispersed networks.

The third function is integration, with the broader organisation inspiring local jihadist groups with independent revenue streams to join and contribute. Examples include the Islamic State Southeast Asia Province (ISEAP) in the Philippines and Islamic State–Mozambique, both of which operate locally embedded revenue systems while maintaining ties to the broader Islamic State network. In such cases, joining broader financial networks allows these groups to receive funds to expand their attacks or revenue generation, and contribute back to the larger organisation.

Figure 1: Image from the ISKP’s Voice of Khorasan magazine soliciting crypto donations in Monero

Al-Qaeda: Legitimacy, Trust, and Decentralised Finance

Al-Qaeda’s (AQ) global propaganda ecosystem provides the ideological legitimacy and reputational signalling necessary to sustain parallel financial systems across geographically dispersed affiliates. Unlike the Islamic State’s more centralised attempts to coordinate global operations, AQ’s model relies heavily on regional trust nodes that maintain operational autonomy while benefiting from the broader legitimacy of the organisational banner and its propaganda channels. This structure allows locally embedded militant groups to generate revenue independently while remaining integrated into a wider transnational network.

Jama’at Nusrat al-Islam wal-Muslimin (JNIM), an AQ affiliate formed in 2017 through the consolidation of several militant factions operating across the Sahel, illustrates how this model co-opts disparate groups with multiple revenue streams under a parallel financial system. JNIM operates a patchwork of revenue-generating activities tied to illicit timber extraction, artisanal gold smuggling, cattle rustling, taxation of local populations, and narcotics trafficking.

These revenue streams are largely decentralised and embedded in local economies. However, the broader al-Qaeda narrative ecosystem provides legitimacy and cohesion across geographically dispersed factions, allowing multiple militant groups and revenue systems to operate under a shared organisational framework that enables its expansion as a single entity. This combination of propaganda-based legitimacy and locally embedded revenue streams has contributed to JNIM’s rapid expansion across the Sahel.

Open-source evidence demonstrates decentralised revenue generation under a shared JNIM/al-Qaeda framework. Rather than relying on a centralised treasury, these networks operate through a distributed network anchored by the broader al-Qaeda propaganda ecosystem. Through shared narratives, ideological legitimacy, and reputational signalling, this propaganda infrastructure allows geographically dispersed factions to generate and deploy revenue locally while remaining integrated within a wider militant network under the direction of key trust nodes.

JNIM’s decentralised structure resembles the model employed by the Italian ’Ndrangheta criminal network, in which semi-autonomous local groups generate large-scale revenue independently while remaining connected through shared structures rather than centralised financial control – allowing them to largely evade global enforcement for decades. While the scale of JNIM’s finances is far smaller, the comparison highlights how decentralised networks built on trusted intermediaries can sustain resilient financial ecosystems without centralised treasury structures.

A more centralised version of this model can be observed in Somalia through al-Shabaab (AS), which joined AQ in 2012 and generates approximately US $100 million in annual revenue, making it the wealthiest affiliate in the AQ network. AS has developed a structured financial system built around taxation, illicit charcoal trading, diaspora remittances, and intermediaries operating in Gulf financial corridors, East Africa, and Iran.

Despite stronger internal governance than many AQ affiliates, AS’s financial resilience still depends on trust networks reinforced through propaganda and reputational legitimacy. These networks facilitate revenue generation – particularly through diaspora remittances – while evidence also indicates AS reinvests a portion of proceeds into propaganda dissemination. In effect, propaganda functions not only as a communication tool but as a financial infrastructure, sustaining trust, reinforcing legitimacy, and enabling continued resource mobilisation across the broader AQ ecosystem.

Figure 3: AQ-aligned JNIM (red) has expanded rapidly since its 2017 formation, controlling more territory in the Sahel than all other militant groups in the region combined.

The Role of Propaganda-Based Trust in Parallel Financial Systems

Across these cases, propaganda ecosystems function as reputational infrastructures that allow decentralised financial systems to operate beyond formal institutions. While windfall events such as ransom payments or major criminal operations can produce large short-term inflows, these funds likely disperse rapidly due to corruption, competition, and operational fragmentation. By contrast, trust-based financial systems built around propaganda-generated legitimacy rely on repeated small transactions and trusted intermediaries. Although these flows may be lower in individual transaction volume, they often produce greater long-term financial resilience by sustaining continuous revenue streams across distributed networks. In these systems, propaganda does not merely support recruitment or ideological messaging; it also provides the reputational infrastructure that enables financial coordination across decentralised trust nodes.

That these groups’ propaganda frequently emulates the visual and stylistic conventions of mainstream media – videos with news-style watermarks and tickers, press releases, and glossy magazines – is not coincidental. Just as news organisations and commercial brands use such formats to signal legitimacy, extremist organisations deploy them to generate reputational trust among dispersed audiences. These audiences, in turn, form trust nodes that link media channels, influencers, and intermediaries, validating financial flows and enabling coordination across decentralised networks.

Figure 4: Proposed typology breakdown of trust node categories across IS and AQ propaganda ecosystems/financial networks.

Implications for Counter-Terrorist Financing: Targeting Trust Nodes

Current counter-terrorist financing strategies focus primarily on transaction-level disruption, including sanctions, asset freezes, blockchain tracing, and financial surveillance. While these approaches remain essential, they largely target late-stage financial activity after financial coordination has already occurred. The deeper structural vulnerability in many extremist financial systems may lie earlier in the lifecycle of these networks—within the trust relationships that enable decentralised actors to coordinate financial activity across dispersed environments.

Viewed through this lens, propaganda ecosystems function not only as ideological or recruitment platforms but also as trust infrastructures that authenticate intermediaries and enable financial coordination. Within these ecosystems, certain actors, channels, or accounts serve as trust nodes—points within the network that signal legitimacy, validate intermediaries, and facilitate coordination among otherwise disconnected participants. Recent assessments by the Financial Action Task Force (FATF) reinforce this dynamic, noting that groups such as ISKP increasingly embed crowdfunding appeals directly within propaganda ecosystems, including encrypted messaging channels targeting diaspora communities.

Recent research also highlights how emerging financial technologies are reshaping the landscape of terrorist financing. Digital assets, encrypted messaging platforms, and decentralised payment rails have created parallel financial infrastructures operating largely outside traditional regulatory oversight. Artificial intelligence tools are increasingly capable of clustering cryptocurrency wallets, identifying laundering typologies, and mapping financial networks that span multiple platforms and jurisdictions. Rather than simply tracing individual transactions, these technologies allow investigators to analyse financial ecosystems as interconnected systems of intermediaries and facilitators.

Amid the emergence of vast illicit financial service ecosystems—as highlighted in a February 2026 FATF report—the longer-term risk may lie in the convergence of decentralised extremist financial networks with these larger criminal service economies, underscoring the need to disrupt the trust infrastructures that sustain them earlier.

When combined with analysis of extremist propaganda ecosystems, AI-enhanced tracing and mapping capabilities may help investigators identify the trust nodes that anchor decentralised financial networks. Wallet addresses, donation links, and financial intermediaries that circulate repeatedly within propaganda communities can serve as indicators of trusted actors within these ecosystems. By linking online behavioural signals with blockchain analytics and financial intelligence, investigators may be able to map the financial networks that emerge from these trust nodes.

This perspective suggests an opportunity for greater collaboration between platforms and national financial intelligence units (FIUs), and financial intelligence tools like blockchain analytics. Social media platforms and messaging services are often the earliest environments where trust nodes emerge, as accounts that repeatedly disseminate propaganda, authenticate intermediaries, or promote fundraising campaigns gain reputational legitimacy within extremist ecosystems. Rather than focusing solely on content removal, platforms could prioritise identifying accounts and channels that function as trust nodes and sharing associated financial indicators—such as wallet addresses, donation links, or payment identifiers—with relevant investigative bodies.

Investigators and researchers may therefore benefit from prioritising several analytical questions:

• Where are the trust nodes within extremist propaganda ecosystems?

• Which actors authenticate financial intermediaries within these networks?

• And how do trusted propaganda channels enable decentralised financial coordination across geographically dispersed actors?

Integrating insights from propaganda analysis, platform data, and financial intelligence may allow investigators to map financial networks emerging from these trust nodes and identify earlier intervention points within decentralised extremist financing systems.

This article was published in conjunction with the New Lines Institute. You can find the original link here.

Chinese money-laundering networks (CMLNs) have quietly become the financial engine of Latin America’s drug cartels. What once appeared as isolated headlines – Chinese gambling junkets washing millions through U.S. casinos, luxury real-estate loops, suspicious bulk cash deposits at West Coast banks – now forms a single system linking Chinese capital flight to cartel profit cycles.

Regulators continue to grapple with the scale. In late 2024, the U.S. Treasury’s Financial Crimes Enforcement Network (FinCEN) issued a record $3 billion penalty against TD Bank for failures tied to cartel-linked laundering. Less than a year later, in August 2025, FinCEN followed with a national advisory flagging $312 billion in suspected CMLN-related transactions tied to Mexican cartels between 2020 and 2024 – a figure that suggests the headlines are only the surface of a much deeper architecture.

Cartel money laundering through Chinese networks is not an isolated phenomenon. While public attention often centers on downstream effects of cartel operations such as violence and addiction, these impacts are structurally enabled by China’s internal demand to move capital offshore – a demand amplified by digital technologies that now move value faster than any regulatory system can track. The same financial and political dynamics driving Chinese elites to expatriate wealth have also produced the infrastructure powering Southeast Asia’s scam compounds, regional insurgencies, and a shadow digital economy that increasingly behaves like a self-reinforcing network. Taken together, China’s internal financial pressures have produced a shadow liquidity architecture that connects its domestic financial instability to the expansion of criminal and insurgent activity worldwide.

In the Americas, that architecture has taken on a new shape, giving Mexican cartels access to Chinese capital-outflow mechanisms perfectly adapted to their needs. These mechanisms provide criminal groups the means to expand their operations and legitimize illicit gains by tapping into the financial reach of the world’s second-largest economy. From fentanyl precursors and pill presses to consumer goods sold through semilegitimate front companies, China’s industrial machine empowers the criminal-paramilitary networks driving insecurity and mass violence across much of the Americas. Meanwhile, CMLNs legitimize the profits of a multibillion-dollar addiction problem in a way that contributes to inflated prices in an increasingly unaffordable housing market.

The result is a shared financial ecosystem linking capital flight from China to fentanyl profits on either side of the U.S.-Mexican border. It is a convergence that transforms a domestic Chinese financial problem into a global security threat with the potential to upend the traditional power structure behind the North American drug trade, putting globalized CMLNs at its center. Traditional enforcement models were not designed to address this level of complexity, forcing the emergence of a new generation artificial intelligence and machine learning-enabled tools to combat global illicit finance. With criminal actors evolving in parallel, the world is entering a technological contest between shadow capital and the institutions charged with constraining it.

The Liquidity Cascade

CMLNs transform bulk U.S. dollars from narcotics sales into both onshore renminbi purchasing power in China and offshore dollar liquidity for Chinese clients seeking capital flight. Through shadow banking, mirror swaps, crypto-settlement, and cash laundering businesses, these networks have created a financial architecture that allows cartel proceeds to fuse seamlessly into China’s capital-flight mechanisms. What appears from the outside as cartel money laundering is, in reality, the downstream face of a much larger imbalance: the accelerating pressure among Chinese elites to move wealth beyond the reach of domestic controls.

Advances in digital technology underpin this new paradigm: a parallel architecture that operates independently of the SWIFT financial payments system, formal banks, or Western oversight. Mirror transfers (对敲 duìqiāo), over-the-counter cryptocurrency brokers, and gray-market crypto exchangers link Chinese elites, intermediaries, and transnational criminal syndicates into a single global liquidity ecosystem. Cartels have tapped into this infrastructure because it gives them what traditional laundering cannot: frictionless conversion, instant settlement, and access to the world’s largest industrial economy.

Mirror transfers are the primary way Chinese capital outflows are operationalized into cartel laundering infrastructure. The process works thusly:

• Cartels deposit bulk drug cash with Chinese brokers in the Americas, who launder the physical notes locally through cash-intensive businesses such as casinos and massage parlors. These funds pass between shell companies and nominee entities through multiple transactions that obscure their origin.

• U.S.-based brokers then pay Chinese clients in dollars and dollar-denominated assets using laundered funds, thus satisfying their need for offshore funds.

• Simultaneously, China-side brokers settle the other half of the swap by using renminbi pools – paid in by Chinese clients seeking capital flight – to generate export credits or payments for cartel-linked importers in Mexico.

In this arrangement, value moves, but no formal cross-border transfer ever occurs. Because the literature tends to isolate individual pieces, the full architecture is best understood through a three-tiered framework that traces how elite wealth in China becomes operational fuel for fentanyl networks in Mexico and the United States.

Tier 1: Capital Flight Reservoirs in China

The CMLN–cartel relationship begins inside China. For decades, the rise of the world’s largest property bubble created a demand for credit that state-owned banks could not satisfy, fueling the expansion of a vast, unregulated financial sector. At the same time, strict capital controls and political pressure drove elite Chinese households to move money offshore – a dynamic that intensified dramatically after the property bubble’s 2020 deflation. The convergence of these forces produced enormous capital flight pressure, creating vast renminbi pools among China’s underground financiers, waiting to be converted into offshore dollars – a domestic imbalance upon which the entire CMLN system rests.

In this way, Beijing’s failure to regulate its property market not only inflated the bubble but also facilitated the rise of a pervasive parallel financial system.

Tier 2 – CMLNs as Liquidity Infrastructure

Tier 2 is where China’s internal capital-flight pressures are transformed into a global facilitation system. CMLNs sit at the operational middle of mirror-transfer swaps, which allow value to move offshore without ever crossing a border. Operating out of hubs such as Los Angeles; Vancouver, British Columbia; and Mexico City, brokers rely on loosely connected networks of cash-intensive front businesses to launder cartel bulk currency and convert it into clean dollars. Their China-side counterparts in Tier 1 settle the mirrored leg of the transfer using renminbi accumulated from elites seeking to offshore wealth, bypassing both China’s formal banking system and SWIFT entirely. Brokers use laundered cash ATM deposits, and increasingly stablecoins and shell company real estate purchases, to make Chinese clients whole in offshore dollars – often with the help of Chinese students enrolled in Western universities working on behalf of family members and associates back home.

For cartels, the same mechanism delivers renminbi-denominated purchasing power inside China. Early iterations relied partly on gray-market daigou arbitrage – purchasing luxury goods in the United States and reselling them inside China through informal retail channels – but this vector has been constrained by slowing demand and Beijing’s crackdowns to protect domestic consumption and control capital flows. Fortuitously for cartels, rising pressure among Chinese elites to move wealth offshore has created large renminbi reservoirs within the underground banking system, more than meeting the China-side obligations of the mirror-transfer process.

By servicing both Tier 1 Chinese clients and Tier 3 cartels, Tier 2 CMLNs collect enormous fees and have become the structural hinge of the entire system – the brokers who connect global criminal economies to the industrial and financial power of China.

Tier 3 – Cartels as End Users

Tier 3 is where cartels receive value from the system, not in renminbi itself but in the purchasing power it represents. By depositing bulk cash with Tier 2 brokers, cartels gain access to renminbi-denominated value inside China’s commercial ecosystem, allowing them to buy the inputs that scale their operations – fentanyl precursors and pill presses to resell in North America for dirty cash and electronics and other goods for clean liquidity. Trade-based money-laundering (TBML) pipelines and front companies provide the commercial cover that turns mirrored value into export credits and legitimate invoices. In effect, CMLNs give cartels a backdoor into China’s industrial economy, enabling them to convert drug proceeds into operational power, hard assets, and legitimacy that would otherwise be inaccessible.

Cartels are not the architects of this system, but they are destructive end users, empowered by a financial architecture built thousands of miles away and far beyond the reach of traditional enforcement.

Upstream Architecture vs. Downstream Effects

The choke point in this system is the CMLN operators at Tier 2 – brokers who convert, settle, and transport value across gray-market channels that long predate cartel involvement. North American banks and payment platforms are not willing participants; they are intrusion targets exploited through shell companies, falsified invoices, identity-laundering tactics, and mule accounts used to obfuscate the origin of illicit funds moving through them. Laundering occurs before funds interact with the formal financial system, which is why Tier 2 remains the operational center of gravity.

This is not the only global threat vector stemming from Chinese capital flight. Although the immediate focus here is the Americas, underground renminbi reservoirs in China anchor an entirely separate but structurally similar ecosystem across Southeast Asia’s scam compounds, gray-market gaming hubs, and illicit digital-finance corridors. There, too, a three-tiered cascade links onshore Chinese RMB pools to offshore facilitators and downstream criminal end users – a parallel architecture that mirrors the CMLN-cartel system. This broader pattern underscores the core point: China’s shadow-finance engine generates global liquidity structures whose downstream expressions differ by region but whose underlying mechanics remain consistent. These dynamics set the conditions for global threats to manifest.

Despite rising public attention on cartel violence and fentanyl overdoses, enforcement agencies and much of the media continue to misdiagnose the architecture behind cartel liquidity. Tier 2 CMLNs are still described as if they were auxiliary cartel partners or offshore laundering boutiques. In reality, they are the globalized expression of China’s internal financial disorder, and the cartels are simply the most dangerous beneficiaries of a system that predates them.

This misdiagnosis has consequences. Policy responses remain locked on downstream symptoms – bulk cash seizures, courier networks, transactions structured to evade reporting thresholds, front companies – while the upstream liquidity cascade stemming from inside China regenerates unabated. Each high-profile enforcement win removes a node, but not the system. The architecture adapts, reroutes, and strengthens, precisely because the underlying demand signal does not come from cartels at all.

Four factors become impossible to ignore:

• Chinese elites are the primary liquidity source, driving the demand for offshore dollars that fuels CMLN operations. Cartel cash is a convenient supply, not the engine of the system.

• Cartel integration is opportunistic, not foundational. Cartels inserted themselves into a pre-existing outflow network designed for capital flight, not criminal finance, because it is more efficient than legacy laundering methods.

• Cartels are downstream clients. CMLN infrastructure does more than launder cartel cash – it supplies the purchasing power that underpins their business model, giving them access to industrial-scale chemical precursors and equipment inside China. With these synthetic drugs now far more profitable than cocaine or cannabis produced in the Americas, this dynamic risks shifting the operational center of gravity toward CMLNs themselves, much as it once shifted from Colombian cartels as exporters to Mexican cartels as global distributors.

• Enforcement wins remain tactically impressive but strategically insufficient. Seizing accounts or shutting down front companies rarely touches the structural incentives that bind Chinese capital flight to cartel proceeds. The architecture is left intact, and the system improves through adaptation.

The strategic blind spot is not a lack of enforcement capacity. It is the persistent belief that cartel laundering is a cartel-led enterprise, when in fact the cartels are downstream actors plugged into an ecosystem shaped by a much larger set of financial pressures. Until policymakers treat CMLNs as part of a global capital-flight infrastructure – not a narco-adjacent novelty – the enduring three-tiered cascade will continue to reproduce itself faster than it can be disrupted.

Strategic Implications

What emerges from this architecture is not a cartel-finance anomaly but another iteration of an emerging global liquidity order. An interconnected and globalized ecosystem of tech-enabled shadow banks, cryptocurrency intermediaries, and laundering networks – operating across mainland China, Hong Kong, and the Americas – now functions as an informal central bank for illicit and gray-market capital. Their balance sheets are vast, opaque, and fed by the constant demand for offshore dollars among wealthy elites under tight capital controls.

China’s domestic weakness is the system’s strength. As long as elite capital-flight pressures persist, CMLNs will remain stable, adaptive, and indispensable. Because renminbi pools inside China feed multiple downstream economies – militant-backed scam compounds in Southeast Asia and militarized drug cartels in the Americas – the threat becomes increasingly globalized.

For Beijing, CMLN mirror transfers represent a deeply problematic, structurally persistent, and critically under examined vector of capital flight. Although renminbi never formally leaves the country, the value of that money exits China through offshore dollar pools controlled by brokers. Exporters are paid in renminbi with no dollars entering the Chinese banking system, depriving the state of foreign-currency inflows and undermining capital-control integrity. The result is a silent erosion of China’s foreign exchange management architecture – a slow hollowing-out effect similar to other forms of elite capital exfiltration, but with even higher opacity and fewer policy levers available for Beijing to control.

For North America, the implications are severe. CMLNs form the financial spine of a system that channels cartel drug proceeds into the offshore renminbi pools used by Chinese elites seeking dollar access. This fusion of cartel cash and capital-flight demand pushes billions of dollars into Western real estate, luxury assets, and private-market vehicles – particularly in Canada and key U.S. cities – at a time of record unaffordability. The same liquidity architecture that fuels fentanyl-linked deaths in the United States and Canada, and enables escalating cartel violence in Mexico, also accelerates opaque trans-Pacific capital inflows that distort markets and weaken financial governance.

For enforcement agencies, the asymmetry is structural. Downstream interventions, no matter how aggressive, cannot meaningfully disrupt a system whose incentives are upstream and whose architecture is distributed. The persistent enforcement gap is not a failure of policing but a failure of framing: the problem is liquidity infrastructure, not individual criminal actors.

Moving Beyond Human Enforcement Capacity

Technology has rewritten the physics of money. What once required suitcases, offshore accounts, and months of coordination can now move through encrypted chats, offshore OTC desks, and digital payment platforms in minutes. Liquidity has slipped out of state control and into networks never meant to wield it, producing a technologically accelerated destabilization that can only be countered with tools operating on the same scale.

Criminal actors grasped this new paradigm before policymakers could react. Bulk cash, once a liability, can now be converted into purchasing power inside China through networks that merge capital flight with cartel liquidity needs. What appears to be a laundering service is, in fact, shared financial infrastructure.

Chinese money-laundering networks sit at the center of that infrastructure. They are not peripheral fixers but the architecture linking China’s internal financial pressures to the expansion of cartel power. They endure because the incentives that produced them remain intact, and because enforcement continues to target the edges rather than the structure itself.

At the structure’s core is liquidity. The ability to move value faster than states can detect has become a force of sovereignty – determining who can project power, absorb shocks, outlast pressure, and operate within the blind spots of the global system. Cartels did not defeat states through ideology or insurgency, but by mastering liquidity, building a financial nervous system more adaptive than the one meant to contain them.

Until CMLNs are recognized not as peripheral laundering boutiques but as the infrastructure of a new liquidity order, the gap between state capacity and illicit capability will only widen. At this point, the limits of human enforcement become unavoidable. Task forces can seize cash, shutter front companies, and arrest intermediaries – but humans can only see snapshots of a system that evolves in real time. A liquidity network built on mirror swaps, diaspora brokers, synthetic trade chains, and offshore renminbi reservoirs cannot be mapped manually. Its architecture is too distributed, too adaptive, too fast.

The shift on the enforcement side has already begun. As recent analysis shows, blockchain-analytics firms and financial-intelligence units are quietly layering machine-learning models into their detection systems – clustering wallets, mapping laundering networks, and identifying anomalies across stablecoin flows, escrow logs, and commercial-invoice patterns. These are prototype architecture-level tools, the first enforcement systems designed not to chase criminals but to map the infrastructure that makes crime possible. The most advanced of these models already operates across jurisdictions and asset classes, revealing relationships that traditional investigative methods could never uncover.

Artificial intelligence is not an adjunct to enforcement; it is the first form of enforcement capable of operating upstream. Only systems that learn as quickly as the networks they track can identify the structure beneath the transactions – the neural architecture of shadow liquidity itself. In a world where liquidity behaves like a distributed neural network, enforcement will require its own neural network in response, guided by humans who can see the system at a structural level.

This is not futurism. It is the logical extension of the world we already inhabit. The liquidity order described above will not be disrupted by more seizures, more arrests, or more border checks. It will only be countered by humans wielding tools capable of recognizing the system for what it is: distributed, multilayered, resilient, and evolving faster than traditional governance can respond.

This is an article I recently wrote for The Diplomat with the help of Brett Erickson - who aided immensely in reaching out to and interviewing the AUSTRAC CEO Brendan Thomas. You can find the original link here.

Australia’s top financial-crime official has sounded the alarm on the worrying transformation of his country’s economy. Behind the rhetoric of fintech innovation lies an expanding shadow liquidity network linking Canberra’s financial sector to the grey market capital circuits of Asia and Latin America – a system now testing the limits of regulatory sovereignty itself.

What began as a permissive environment for digital experimentation has quietly evolved into a regional clearinghouse for unregulated money.

“Digital-currency transactions are major financial-crime risks in Australia,” said Brendan Thomas, chief executive of the Australian Transaction Reports and Analysis Centre (AUSTRAC). “We currently have around 450 digital-currency exchanges and a sector characterized by rapid growth and very poor AML [Anti-Money Laundering] compliance.”

Today, Australia has hundreds of registered digital-currency exchanges and crypto-related operators, many of which, regulators say, are at increasing risk of exploitation for money laundering, scams and fraud, offering the potential for large value flows between criminal syndicates, grey market actors, and legitimate institutions. Stablecoins and over-the-counter (OTC) desks offer frictionless dollar exposure to actors evading capital controls and sanctions, while trade-based laundering networks now tie Sydney and Melbourne directly to illicit and semi-licit actors across Latin America, Hong Kong, and Southeast Asia.

This architecture hides in plain sight. Crypto exchanges double as proxy banks for offshore wealth; illicit proceeds from online fraud and cartel operations mingle with speculative inflows; and regulators struggle to distinguish legitimate liquidity from laundered funds. What appears to be fragmented compliance failure is, in fact, the emergence of a parallel financial infrastructure – one eroding the boundary between licit and illicit capital and exposing Australia to systemic risk on a global scale.

The evidence of that erosion is already visible. The same digital corridors that once promised innovation now facilitate narcotics finance, illicit tobacco syndicates, and Southeast Asian scam networks. In the space of a decade, the promise of frictionless money has matured into something far more consequential: a liquidity system powerful enough to reorder economies, and elusive enough to escape the laws meant to govern it.

Drugs, Cigarettes, and Digital Liquidity

Australia is more flush with illicit substances than ever before. A recent study by the Australian Criminal Intelligence Commission (ACIC) found that Australians consumed over 22 tonnes of methamphetamine, cocaine, and MDMA between August 2023 and August 2024, up 34 percent compared to the previous year’s findings. These drugs had an estimated combined street value of US$7.5 billion – making Australia a high-value market for global drug cartels. Meanwhile, Australia’s record high tobacco excise has created an unprecedented surge in demand for underground alternatives, with industry data finding that illegal tobacco sales account for 64 percent of total consumption and 82 percent of total nicotine use.

Mexico’s Sinaloa and Jalisco New Generation (CJNG) cartels have become central suppliers in this ecosystem, embedding themselves through high-volume methamphetamine and cocaine routes that link Latin American production hubs to Australia’s premium end-market.

“Australians pay quite high prices globally for drugs… there is an increasing cocaine problem, especially in Sydney. This indicates significant supply links with cartels in South America, possibly linked through Asian-based money-laundering organizations,” said Thomas.

Indeed, significant overlap exists between cartel operations and entrenched Chinese and Southeast Asian syndicates that dominate the region’s chemical precursors, laundering networks, and scam-derived liquidity – suggesting that cartel drug profits blend with these systems before being injected into Australia’s capital markets at “clean” investments. AUSTRAC has previously noted how laundered funds often intersect with Australia’s high value property market, contributing to unaffordable prices for citizens across the country.

These growing illicit trades have facilitated the rise of an illegitimate financial ecosystem to service them.

“The narcotics and underground tobacco trades trade are the largest drivers of illicit finance in this country,” said Thomas. He also noted that important role digital currencies play in this financial system. “We have a (digital currency) market that isn’t regulated prudentially and therefore exposed to significant risk,” he added.

Thomas also noted that these illicit trades are not distinct criminal issues, but symptomatic of a maturing underground financial system.

“We believe the illicit tobacco and narcotics markets are controlled by the same entities,” he said.

Recent cases already show how digital currencies underpin the same financial circuits that move narcotics and illicit tobacco profits in Australia. In August 2021, Victoria Police seized AU$8.5 million in cryptocurrency from an online drug syndicate — the largest crypto-asset seizure in Australian history at the time — while AUSTRAC later documented a 2022 conviction in which an offender used cryptocurrency to purchase, import, and resell illicit drugs via dark-web markets.

What emerges is a hybrid criminal order: a system in which Latin American supply chains, Asian liquidity networks, and Australian demand converge into a single adaptive organism that mirrors the complexity of the licit economy while feeding off its infrastructure. Illicit proceeds move through offshore businesses and digital corridors before re-entering legitimate markets as investment capital. These convergent flows inflate asset prices — from property to logistics – and distort trade data once seen as reliable economic indicators.

The boundary between organized crime and legitimate enterprise is dissolving. What appears to be foreign investment may conceal criminal liquidity seeking legitimacy – embedding transnational finance and organized crime within the same bloodstream of the Australian economy.

This financial metabolism doesn’t end with narcotics. The same infrastructure now powers the region’s fastest-growing criminal enterprise: Southeast Asian scam centers.

On Australia’s Doorstep: Scam Centers and Massive Capital Outflows

Australia stands at the geographic doorstep of one of the world’s most pressing financial and humanitarian disasters: the vast Southeast Asian scam-industrial complex. As detailed in Rousselle’s recent article for The New Lines Institute, these compounds form part of a broader ecosystem primarily driven by Chinese organized crime – often state-linked – and built on capital outflows from China and neighboring economies. In countries such as Cambodia, Laos, Myanmar, and others, illicit and semi-licit funds are recycled through offshore financial hubs, cryptocurrencies, and digital payment infrastructure.

What began as a fringe phenomenon tied to telecom fraud and online gambling has evolved into a region-wide industry generating tens of billions of dollars annually, intertwined with human trafficking, narcotics proceeds, state-aligned shell corporations, and even armed militants and designated terror groups such as the Houthis.

Australia’s exposure to this ecosystem is twofold: as a lucrative victim market and as a destination for laundered funds. In 2024 alone, Australians reported nearly 495,000 scam incidents and losses exceeding AU$2 billion, according to the Australian National Anti-Scam Centre (NASC). These are not isolated acts of cybercrime but components of a regional financial system that drains consumer capital from high-income economies and reintroduces it into legitimate sectors via offshore layering and crypto-enabled laundering.

“We see crypto used as a source of major narcotic transaction and the source of much scam activity. The scam centers operating in South East Asia are also a major laundering risk for the Australian economy,” Thomas observed.

Australia’s role in this shadow network extends beyond consumer losses. The same digital corridors that move narcotics profits and scam proceeds now intersect with domestic financial infrastructure. As Thomas warned, “These illicit funds are entering the legitimate economy in a number of places and we need coordinated effort to shut that out. We also need coordination to stop the flow of recruitment of people into these centers and block their labor supply – targeting those human trafficking networks would be of great benefit.”

The nexus between financial exploitation and forced labor underscores the human cost of this liquidity system: victims in Australia are connected, through layers of deception and capital transfer, to victims across Southeast Asia whose exploitation sustains the machinery of fraud.

From Cambodia’s scam compounds to Australia’s financial sector, the circuit is closed by liquidity – money stripped of origin, nationality, and moral judgement. What appears as digital crime at the consumer level is, in practice, an extension of the same transnational financial order that Rousselle described: a shadow ecosystem born of unchecked capital outflows, institutional capture, and the global failure to distinguish dirty liquidity from economic vitality.

Coordination, Capacity, and the Enforcement Gap

Australia’s current regulatory architecture was built for an earlier generation of financial crime. The country’s first AML/CTF framework – Tranche 1, enacted under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 and implemented in 2007 – was revolutionary at the time. It brought banks, remitters, casinos, and bullion dealers under AUSTRAC’s supervision, embedding risk-based compliance into the financial sector.

Yet nearly two decades later, that framework has atrophied. Successive governments have failed to deliver the long-promised Tranche 2 reforms that would extend AML/CTF obligations to lawyers, accountants, real-estate agents, and company service providers. These extensions are essential: although digital assets such as cryptocurrencies have been regulated since 2018, the professional intermediaries who help conceal these flows remain largely outside enforcement. Tranche 2 is designed to close that gap, but years of delay have allowed those channels to become the principal on-ramps for illicit digital capital.

The rollout of Tranche 2 — which would bring these professional facilitators under the AML/CTF compliance regime — has been repeatedly delayed amid prolonged consultation and industry resistance, creating structural blind spots that now serve as conduits for illicit liquidity. The result is a bifurcated system: highly regulated financial institutions on one side, and semi-formal professional networks on the other, precisely the spaces through which scam proceeds, narcotics profits, and offshore capital outflows can be re-routed into legitimate assets.

The current regulatory gap will not close until July 2026, when Tranche 2 entities are scheduled to come under full compliance. Until then, most are only beginning to familiarize themselves with their new AML/CTF obligations.

As Thomas noted, “They are understanding the law and their legal obligations but still don’t properly understand money laundering – how people actually do it through law firms and accounting practices in particular.”

AUSTRAC and partner agencies are now preparing extensive case studies to build that operational literacy, but the knowledge gap remains profound.

Australia’s enforcement landscape compounds the challenge. AUSTRAC, Australian Securities and Investment Commission (ASIC), the Australian Federal Police (AFP), and state police each bring essential capabilities to the country’s financial-crime architecture, yet their mandates often intersect across complex and rapidly evolving typologies. Coordination has improved through initiatives such as the Fintel Alliance, but information sharing remains largely case-driven rather than systemic. The protracted rollout of Tranche 2 represents a strategic vulnerability, leaving key professional channels open to exploitation in the meantime.

When the reforms finally take effect in mid-2026, they will bring long-excluded gatekeepers into the AML/CTF regime and expand the country’s capacity to trace illicit flows through professional channels that have so far escaped scrutiny. But timing is everything. Every month of delay allows shadow liquidity to entrench itself further within Australia’s legitimate economy, laundered through legal practices, escrow accounts, property holdings, and offshore intermediaries. The effectiveness of Tranche 2 will depend not only on its legislation, but on whether the institutions charged with enforcing it can move from static compliance to dynamic intelligence, matching the speed and adaptability of the networks they seek to contain.

Conclusion

Blockchain analytics and AI-assisted transaction mapping have stripped away much of the mystery that once surrounded digitized illicit finance. The problem is no longer invisibility but inertia. Regulators and enforcement agencies now possess unprecedented data on cross-border fund movements, stable-coin settlements, and the interlocking wallets and shell entities that sustain shadow liquidity. The question is whether they can move fast enough to act on it.

Other jurisdictions already are. Europe’s MiCA framework, Hong Kong’s virtual-asset licensing regime, and the proposed U.S. GENIUS Act each signal a shift from reactive compliance to proactive financial-infrastructure defense. By contrast, Australia’s reforms remain stalled between consultation papers and industry pushback. Every month of delay leaves the country more deeply embedded in the regional circuits of criminal capital that its own analytics can now trace in real time.

Australia’s challenge is therefore strategic, not technical. The data exist; the patterns are visible. What remains undecided is whether the nation will use its visibility to close the enforcement gap – or continue to serve as the Indo-Pacific’s liquidity sink and laundering hub for offshore criminal finance.

Image source

This is an article I recently published with the Jamestown Foundation China Brief Notes. It comes as a follow up to an article I wrote for China Brief last year, which was cited in a 2025 report by the U.S. Senate Foreign Relations Committee. You can find the link to the latest article here.

Executive Summary:

• Judicial cases in the Democratic Republic of the Congo and in Nigeria confirm that citizens from the People’s Republic of China (PRC) are active in both resource extraction and digital offshore laundering networks, connecting illicit resource economies and stablecoin settlement into value chains that sustain conflict.

• Gold, timber, and crypto flows move through the same corridors that carry PRC-manufactured weapons into embargoed zones. This integration creates a shadow liquidity system in which capital and material reinforce one another, allowing African militant economies to become self-financing and resilient to external pressure.

• Existing regimes treat arms diversion and money laundering as separate issues. They are not. Addressing this challenge requires collapsing the divide between arms embargo enforcement and financial crime intelligence into a single operational continuum.

The circulation of weapons manufactured in the People’s Republic of China (PRC) has become an increasingly visible feature of African conflicts. Earlier research by this author traced how Chinese small arms and light weapons appear in the hands of militant groups across the continent, often in ways that reveal the fragility of existing control mechanisms (China Brief, November 1, 2024; U.S. Senate, July 2025). That research underscored the scale of material leakage from licit trade into irregular markets. Since then, more evidence has come to light to suggest that the story does not end with the physical movement of arms.

Alongside weapons, Chinese illicit finance networks are spreading across Africa’s conflict zones and beyond. These networks have the capacity to enable militant actors to not only acquire weapons but also to sustain self-financing economies of violence and extraction. They tie the diversion of arms to capital flows that are deliberately routed through opaque offshore structures, informal value transfer systems, and state-aligned facilitators.

Illicit finance is not a peripheral concern. It is a structural enabler of militant economies and arms transfers. Understanding the fusion of financial and material supply chains is therefore essential for grasping how African conflicts are evolving, and how external actors shape them.

Chinese Criminals Embedded in Conflict Economies

In January, a court in Bukavu, a war-torn community in the eastern Democratic Republic of the Congo, handed down a rare and decisive judgment against three PRC nationals involved in illicit extractive activity. The defendants were convicted for operating illegal mining concessions and laundering proceeds through both cash and precious metals (South China Morning Post [SCMP], January 15). Authorities seized more than $400,000 in hard currency alongside a quantity of gold bars, establishing a direct evidentiary trail from resource extraction to illicit financial flows (Central News, January 16). Because this conviction was adjudicated in court, it created a judicially verified record of PRC actors engaging in illicit commerce within a conflict zone. The absence of PRC media coverage of this case is telling.

The defendants did not operate in a vacuum. The PRC maintains a visible commercial footprint across eastern Congo’s extractives economy, including Chinese-owned buying houses, traders, and small-scale gold operations in war-torn South Kivu (ECOFIN, December 30, 2024). PRC state media has even warned PRC nationals of the legal and security risks of doing such business in the war-torn region, explicitly mentioning mining activities (Xinhua; Consular Express WeChat Official Account, July 28). Congolese officials and local communities have repeatedly objected to illicit practices attributed to Chinese operators (ACP, November 15; Radio Okapi, August 8).

The Bukavu convictions confirm that Chinese illicit financiers are present inside eastern Congo’s conflict zones. A panel of UN experts reported to the press that minerals extracted from areas in eastern Congo controlled by the Congolese Rwandan-backed rebel paramilitary group M23 are being smuggled through Rwanda and Uganda before entering global markets (AfricaNews, January 10; Al-Jazeera, July 18). At the same time, M23 rebels have been documented with significant stocks of PRC-manufactured weapons and equipment, consistent with supply via their Rwandan and Ugandan backers (China Brief, November 1, 2024). The PRC is the world’s dominant processor of the ore coltan, gold, and other Congolese exports, and both Rwanda and Uganda ship far more of these minerals than they produce (Enact, May 3, 2022; Haitong, April 23, 2023; CASS West Asia and Africa Research Institute, March 2024; AllAfrica, December 18, 2024). Taken together, these facts make PRC end-use not speculative but structurally inevitable: illicit finance on the ground, smuggling through neighbors, and end-user demand in the PRC form a single chain that helps sustain this conflict economy.

These dynamics are not confined to eastern Congo. Across Africa, PRC nationals are embedded in commodity corridors that move value and provide logistics. In 2022, roughly 435 tonnes of gold were smuggled out of Africa, 93 percent of it bound for the United Arab Emirates (UAE), with PRC buyers active at both ends of the chain (SCMP, November 16, 2023; Swissaid, May 30, 2024; Africa Report, October 24, 2024). PRC-linked syndicates also dominate timber and rosewood exports from the Sahel, Central, and East Africa, often sourcing directly from insurgent-affected areas (African Development Bank, 2021). These gold and timber corridors easily provide the financial and logistical backbone for broader illicit trade, establishing flows of capital and transport capacity that could be redirected toward arms procurement or militant financing.

Chinese Criminals Laundering Crypto

In July, a federal court in Lagos, Nigeria ordered the forfeiture of approximately 223,000 Tether ($223,000)—the U.S. dollar-pegged stablecoin—from two PRC nationals convicted of fraud and money laundering (EFCC, July 21). The case was notable not only for the scale of the seizure but also for its judicial confirmation that PRC nationals were operating through crypto networks in Nigeria. It followed an earlier wave of enforcement in December 2024, when Nigeria’s Economic and Financial Crimes Commission (EFCC) carried out mass raids that led to the arrest of 792 suspects. Among those implicated were 148 PRC nationals accused of participating in coordinated crypto fraud and laundering schemes (Toutiao, April 27; African Mirror, December 19, 2024). Together, these cases establish a pattern of sustained involvement by PRC nationals in illicit digital finance across West Africa.

The pattern is clear: PRC illicit finance networks have embedded themselves into West African stablecoin rails. These rails enable frictionless cross-border settlement that can be directed toward extractive rents, arms procurement, or conventional fraud. Stablecoin rails in West Africa now provide the same frictionless settlement capacity increasingly favored by PRC-linked financiers in Southeast Asia (Sina Finance, May 26). In effect, stablecoins have become a structural enabler of transnational illicit finance tied to PRC nationals, providing cross-border transfer capacities beyond the reach of current regulatory controls.

Weapons Trafficking Completes the Supply Chain

In May, Amnesty International verified the presence of PRC-manufactured weapons in both Khartoum and Darfur, despite a standing United Nations arms embargo on Sudan. The investigation traced the weapons’ path through the UAE, confirming that PRC-manufactured weapons had been re-exported into an active conflict zone (Amnesty International, May 8; SCMP, May 9). The UAE—already identified as a primary destination for smuggled African gold and a key entrepôt for trafficked resources such as timber and wildlife—is now linked to weapons leakage into embargoed territories. A 2023 report by the PRC’s Ministry of Commerce (MOFCOM) highlights the country’s central role as a commodity logistics hub, while international investigations document its function as a distribution point for illicit flows ultimately bound for the PRC (The Sentry, February 2021; GITOC, December 2022; MOFCOM, 2023).

Extractive commodities and arms flows are not separate streams but parts of a single transnational infrastructural system. Gold and timber exports provide the financial base, often routed through opaque networks tied to PRC buyers. Stablecoin rails in West Africa supply frictionless cross-border digital settlement, as increasingly favored by PRC-linked illicit financiers in Southeast Asia (Sina Finance, May 26). The re-export of weapons through commodity hubs completes the circuit, bringing material support back into conflict zones. The convergence is the critical risk: financial, logistical, and military flows run along the same corridors, reinforcing each other and expanding the resilience of militant economies.

This configuration functions as a shadow liquidity system. Value extracted from African resources is continuously re-expressed as kinetic capability, ensuring that liquidity itself becomes a weaponized asset class. Each transaction in this system, whether a gold shipment, stablecoin transfer, or weapons re-export, amplifies the others, producing a feedback loop that stabilizes illicit power structures where governance fails.

Conclusion

The evidence now available establishes that the illicit involvement of PRC nationals in African conflict economies is neither incidental nor peripheral. Judicial convictions in Bukavu and Lagos confirm the presence of criminal actors from the PRC engaged in both extractive laundering and stablecoin-based fraud, while reporting from Sudan illustrates how weapons manufactured in the PRC reappear in embargoed theaters.

These cases reveal a common pattern. Illicit finance and logistics linked to PRC nationals run through the same corridors that sustain militant supply chains. Gold, timber, digital assets, and arms move along overlapping routes, creating a resilient system in which capital and material flows reinforce one another.

Recognizing this convergence is essential. The challenge is not simply weapons leakage or financial opacity in isolation but the way disparate supply chains combine to strengthen insurgent and criminal economies. PRC end-user demand and facilitation give the system scale and durability, tying local extraction and digital laundering directly to global markets. Addressing this challenge requires collapsing the divide between arms embargo enforcement and financial crime intelligence; and treating both as elements of one integrated system.

This is an article I recently wrote for the Global Network of Extremism and Technology (GNET). You can find the original link here.

Terrorist groups are increasingly using digital assets to move money outside traditional financial oversight. These same channels – blockchain networks, stablecoins, and encrypted apps – now underpin a wider illicit economy that spans cybercrime, sanctions evasion, and elite capital movement. Together, they form a shadow financial infrastructure that operates at a scale and velocity traditional enforcement cannot match.

As regulators struggle to keep pace, artificial intelligence (AI) is emerging as a force multiplier. From clustering wallets and detecting laundering networks to automating early detection, AI is transforming how investigators detect, map, and disrupt illicit flows. Yet technology alone cannot solve the problem. Effective countermeasures require human analysis and strategic framing – linking the rise of digital liquidity systems to the broader financial ecosystems that sustain both criminal and terrorist actors. This Insight will explore emerging regulatory and technological trends aimed at closing the global enforcement gap – showing how AI-enabled enforcement, systemic liquidity mapping, and multi-domain synthesis can shift counter-terrorist financing from reactive disruption toward proactive resilience.

Figure 1: The three-tiered liquidity framework.

Understanding the Problem: A Three-Tiered Approach

The challenge today is not simply that terrorists seek money beyond regulatory and enforcement oversight, but that the methods they use to mobilise funds converge with a broader set of illicit and semi-licit flows. The rise of blockchain and digital currency ecosystems has provided bad actors with faster, cheaper, and less traceable means of moving value globally. These value transfer mechanisms, combined with encrypted messaging apps, offer the ability to move vast sums outside the global banking system, thus representing a structural alternative to it.

Terrorists are not alone. A much larger global criminal ecosystem – spanning cyber fraud, state-linked sanctions evasion, and elite capital flight – exploits the same digital corridors. On 14 October, U.S. authorities seized over $14 billion USD worth of Bitcoin tied to Cambodia-based and Hong Kong-registered Prince Group, which provided laundering services to Southeast Asia’s vast cybercrime industrial complex. It was the largest Bitcoin seizure in history, underscoring the scope of these illicit systems. These systems represent a financial substrate where actors with varied goals and ideological motives can rely on the same facilitators, which become more pervasive with each transaction.

The three-tiered liquidity framework explains this new paradigm. At the top, Tier 1 captures elite flows – shadow banks, high-net-worth individuals, and state-adjacent funds that seed the system – generally manifesting as capital outflows, although at times taking the form of strategic inflows in specific contexts. Tier 2 is the facilitation layer, comprising over-the-counter (OTC) brokers, underregulated exchanges, and laundering platforms that have grown from Tier 1 flows. These entities now rent their services to anyone with the means to access them. Tier 3 is where threats surface, as extremists and criminal groups exploit the same intermediaries to move money through unregulated corridors. By mapping this cascade, we see how funds that leave states at the top can ultimately end up financing terrorism and criminality at the bottom – with Tier 2 serving as the connective tissue with none of the accountability of regulated financial systems.

Tier 2 intermediaries take many forms, but Huione Guarantee in Cambodia, Garantex in Russia/Dubai, and Iran’s Derakhshan/ Alivand shadow banking network all show how digital asset facilitators operate at the intersection of offshore capital and terrorist finance. Huione’s illicit marketplace evolved into a laundering channel for ethnic Chinese criminal networks across Southeast Asia, with clear evidence of participation by Hong Kong facilitators – strongly suggesting its use by Chinese elites to evade domestic capital controls. U.S. authorities also flagged Huione for laundering $39 million USD tied to the Houthis, a clear example of terrorist financial usage. Evidence also suggests that Myanmar-based militant groups have accessed Huione and comparable networks, further illustrating how such financial ecosystems enable militant and terrorist funding structures.

Meanwhile, U.S. and European regulators sanctioned the Moscow-based crypto exchange Garantex for enabling Russian sanctions evasion and elite capital flows, as well as for processing transactions linked to Palestinian Islamic Jihad. Further analysis has also revealed that funds from Garantex flowed into wallets controlled by the Islamic State Khorasan Province (ISKP). Finally, in Iran, the Derakhshan/ Alivand shadow banking network operated as a crypto-enabled extension of the regime’s sanctions evasion architecture, moving billions through front companies and exchange houses. U.S. Treasury designations also show the network provided financial services to Hezbollah funding corridors, again demonstrating a clear cascade between Tier 1, 2, and 3 flows.

While the three-tiered framework currently captures only some terrorist organisations, groups such as those associated with the Islamic State and al-Qaeda also rely on intermediaries to move and launder funds on the blockchain. As these networks become more digitally sophisticated and financially liquid through their exploitation of high-value trades – including commodities such as gold and timber as well as narcotics trafficking – it is likely that they too will engage Tier 2 facilitators, further expanding their global financial reach and resilience.

Disrupting only the Tier 3 terrorist groups is insufficient, as these actors are symptomatic of broader systems. The real leverage lies in targeting the Tier 2 facilitators who profit from servicing everyone – oligarchs, sanctioned states, and militant/ terrorist groups alike. A strategy of networked disruption must therefore neutralise the brokers, platforms, and exchanges that systematically connect these flows. By constraining Tier 2, regulators and investigators can structurally disrupt the cascade before funds reach Tier 3, cutting off not just individual plots, but the infrastructure that makes global illicit liquidity possible. Although this challenge remains enormous in scope, new regulatory and technology-based solutions have begun to tip the scales in favour of global enforcement.

Regulatory Reforms and AI Advances

Emerging regulatory frameworks are bringing digital assets under formal oversight. In the U.S., the GENIUS Act would pull the issuers of and intermediaries behind stablecoins – the current lifeblood of large-scale illicit financial flows – into the existing anti-money laundering and combating the financing of terrorism (AML/CFT) system. In the European Union, the Markets in Crypto-Assets regulation (MiCA) sets harmonised standards for licensing and disclosure across the bloc. Financial hubs such as Hong Kong and Singapore, as well as Southeast Asian jurisdictions such as the Philippines, are also moving to regulate exchanges, OTC brokers, and other intermediaries. Together, these measures mark a decisive shift: digital assets are no longer a lawless frontier, with governments actively working to close the gaps that criminals, sanctioned states, and violent extremists exploit.

However, tens of billions of dollars move each year through the informal systems described above, and human analysts alone cannot keep pace with flows of this magnitude and velocity. Without advanced tools and coordinated enforcement, new regulatory frameworks risk becoming outmanoeuvred by the actors they seek to constrain. Recent AI advances increasingly address this enforcement gap – not by replacing human analysis, but by amplifying it through pattern recognition at scale. Leading blockchain analytics firms have already begun layering AI into their products in ways that concretely boost detection, attribution, and investigation speed.

Blockchain analytics platforms currently use machine learning to cluster addresses that belong to the same actor, trace funds that are deliberately split and rerouted to hide their origin, and flag unusual transaction patterns that suggest illicit flows. Some systems go further, automating the first level of triage, presenting investigators with likely leads rather than raw data. Others use advanced models to sift through vast webs of wallet interactions and highlight networks that resemble known money-laundering structures. While private analytics firms rarely disclose which AI modules are employed in specific investigations, recent rollouts of AI-enabled triage, clustering, and typology-detection tools suggest that such technologies are increasingly embedded in live enforcement workflows.

The effect on investigations is simple: machines take on the role of scanning and sorting, allowing human investigators to focus on context, judgment, and strategy. The combination makes it increasingly possible to confront illicit flows at volumes that have long exceeded the limits of manual enforcement. But the technology is still developing, coverage remains uneven, and determined actors continue to find ways to exploit the gaps. What AI offers today is not a finished solution, but an evolving opportunity to narrow the enforcement gap at the scale currently required.

Advances in AI disruption do not end with the private sector. The U.S. Military’s Defense Advanced Research Projects Agency (DARPA) has been developing a new programme called Anticipatory and Adaptive Anti-Money Laundering (A3ML). According to DARPA, the programme seeks to transform anti-money laundering from “manual, reactive, and expensive analytic practices” into a system that can proactively identify illicit financial activity by analysing transaction data at machine speed. The initiative aims to build adaptive models capable of detecting complex laundering behaviours and evolving with new threat patterns across global financial networks. In a recent interview, A3ML programme manager David Dewhurst claimed the goal of the project is to “raise the cost of money laundering so high that it becomes unsustainable.”

If realised, A3ML would represent a significant step toward closing the enforcement gap that today’s regulators and investigators struggle to manage in the realm of terrorist and illicit finance. Given DARPA’s 60-year track record of pioneering AI technology, as well as the core technologies behind the Internet itself, the fact that the agency is promoting A3ML publicly signals its potential as an emerging game-changer in countering terrorist finance and illicit liquidity networks as a whole.

Recommendations: Building Human–Machine Fusion Across the Enforcement Chain

Artificial intelligence will not replace human financial investigators; it will demand a new generation of them. As enforcement agencies integrate AI tools into financial investigations, the limiting factor will not be processing power but strategic judgment – the ability to interpret machine-generated signals in context. AI excels at pattern recognition, but it cannot discern intent, geopolitical linkage, or systemic consequence. These require human synthesis based on deep contextual understanding.

Three priorities follow from this reality:

1. Invest in human-machine fusion: Regulators, tech firms, and research institutions should prioritise training analysts who can interpret algorithmic outputs, question model assumptions, and integrate AI findings into broader geopolitical and financial-systems analysis.

2. Expand interdisciplinary research: The convergence of digital assets, sanctions evasion, and terrorist finance demands a research agenda that unites data science, economics, finance, criminology, strategic studies, and more. Understanding illicit liquidity networks at scale requires systems-level mapping and cross-domain synthesis, not siloed expertise.

3. Institutionalise feedback loops: AI detection models improve only when informed by real investigative experience and extensive research. Private firms and research institutions should create channels for case-based learning and publication, ensuring that enforcement outcomes continuously refine analytical models.

Additional priorities for technology platforms to consider:

4. Integrate financial signal detection into trust and safety operations: Social media, messaging, and other platforms are uniquely positioned to identify the early stages of extremist financing. Embedding financial intelligence cues such as patterns of wallet sharing, donation link reuse, or coordinated in-app transfers into existing moderation systems would enable early intervention without compromising privacy.

5. Create secure interoperability between financial and content-moderation ecosystems: Platforms can pilot controlled data-exchange frameworks that allow vetted enforcement partners and blockchain analytics firms to cross-reference on-chain data with online behavioural indicators. This would help surface the connective tissue between propaganda distribution, recruitment, and funding pipelines that rely on digital payment rails.

6. Promote collaboration on typology discovery: Major platforms can co-fund shared typology libraries that describe emerging laundering and fundraising behaviours across digital ecosystems. Building upon the precedent set by GIFCT’s hash-sharing database and other collaborative frameworks, as well as existing typology reporting by FATF and the Egmont Group, a complementary repository for financial signals could integrate structured input from public and private stakeholders, including blockchain analytics firms at the forefront of these trends. This would create a unified typology framework – linking regulatory, platform, and investigative perspectives – and provide a common analytical language for identifying new threats while ensuring that emerging AI models across companies learn from consistent signal categories.

AI is reshaping financial intelligence, but its success will depend on the people who wield it – analysts capable of seeing the system, not just individual outcomes. For the technology companies that host, route, and monetise digital interactions, this means examining how digital economies can be co-opted by illicit liquidity systems and disrupting them when possible. The next frontier in counter-terrorist finance will belong to those who can bridge the gap between computation and comprehension – between safeguarding platforms and preserving the integrity of the digital economy.

Author’s Note: This article was originally written for the New Lines Institute (link).

The analysis was cited by Coinbase in an October 2025 Request for Comment submitted to the U.S. Treasury Department (link).

A soldier stands guard as workers cover their faces while authorities raid the offices of Central One, an alleged scam hub masquerading as a call center company, on Oct. 31, 2024, in Bagac, Philippines. (Photo by Ezra Acayan/Getty Images)

The explosive rise of Southeast Asia-based scam networks targeting victims globally is no accident; it is the byproduct of China’s vast offshore shadow liquidity systems. Scammers from the region have increasingly targeted victims in the United States, who lost at least $5 billion to such scams in 2024 alone. Scam hubs, some of which comprise entire cities built using offshored Chinese wealth, threaten stability across Asia by draining middle-class savings into a self-perpetuating parasitic ecosystem. These criminal enterprises are now actively expanding their operations in Africa and Latin America, positioning themselves closer to Western societies where aging populations are especially vulnerable to sophisticated cybercrimes. These systems also threaten regional stability, with recent military clashes between Thailand and Cambodia underpinned by rising scam activity and capital flows to the Cambodian side of their disputed border.

Over the past decade, China built a secret offshore capital reservoir to shield itself from an increasingly hostile outside world. That reservoir, combined with massive capital outflows, has spawned a vast criminal ecosystem that threatens social and economic interests the world over. Moreover, the networks constituting this ecosystem now serve their own ends, not merely those of Beijing. In the absence of safeguards, this pooled liquidity has fueled criminality that now threatens China despite Beijing’s ongoing efforts to reassert control over it. This offshored criminal ecosystem demonstrates a fundamental truth by its very existence: liquidity systems, once externalized beyond state oversight, become self-reinforcing, corrosive infrastructures.

In Southeast Asia, sprawling scam hubs now siphon an estimated tens of billions of dollars or more annually, turning a defensive buffer into a parasitic financial ecosystem threatening regional and global stability. This criminal ecosystem exposes a significant contradiction at the heart of China’s model: a regime built on centralized control increasingly entangled with systems it can neither regulate nor contain. These networks – once designed to strengthen China’s financial sovereignty – now threaten it, eroding domestic stability and undermining the very narrative of control the ruling Communist Party depends on to maintain legitimacy.

What Is Shadow Liquidity?

Shadow liquidity is a mobile layer of capital that exists outside standard regulatory frameworks. Unlike traditional illicit finance, which is explicitly criminal, it occupies a gray zone – part statecraft tool, part private escape valve, part opportunistic exploitation. Its core function is not to hide individual transactions but to maintain a resilient flow of value that can shift jurisdictions, instruments, or ownership structures as conditions demand.

China’s offshore liquidity systems emerged as a response to external pressures, including tariffs and sanctions. Initially structured as discreet channels to support trade and investment, these reserves evolved into conduits for elite capital flight and informal influence operations. A clear example is the $900 billion in offshore foreign currency assets held by China’s state commercial banks, funded by deposits made by state-owned enterprises and outside the official People’s Bank of China (PBoC) balance sheet. Designed as a buffer against external shocks, these pools of liquidity coincide with the rise of informal networks beyond Beijing’s direct control.

DeepSeek, an artificial intelligence product developed in close proximity to China’s state-owned military and defense sector, provided a striking example of how offshore liquidity pools serve Chinese state interests. In June 2025, U.S. officials accused DeepSeek’s parent company of using shell corporations in Southeast Asia to acquire banned Nvidia H100 chips – critical for training advanced AI models – thereby bypassing sanctions aimed at curbing Beijing’s military AI ambitions. Recent cases also show that Chinese firms leverage offshore entities to evade recently escalated U.S. tariffs. In this way, these networks created a parallel reservoir of liquidity designed to move outside Beijing’s formal financial architecture while remaining at least partly aligned with state objectives.

However, by unleashing vast sums of liquidity into loosely regulated financial systems, Beijing seeded a landscape where state-linked capital, private wealth, and criminal enterprise converge. According to a July 2025 report from the U.S.–China Economic and Security Review Commission (USCC), Chinese criminal networks in Southeast Asia “have built ties – some overt, some deniable – to the Chinese government by embracing patriotic rhetoric and supporting China’s Belt and Road Initiative (BRI).” The report further notes that “Chinese crime syndicates have expanded across the region with, at a minimum, implicit financial and political backing from elements of the Chinese government.” Murky state-linked investments in now-notorious scam hubs like the Golden Triangle Special Economic Zone (SEZ) in Laos and Myanmar’s Shwe Kokko SEZ are just some examples. What was meant to be a controlled instrument of resilience has instead become a porous, adaptive ecosystem – one increasingly beyond Beijing’s ability to discipline without destabilizing the very flows it relies on.

In China’s case, offshored “shadow reserves” have become a critical funding source for BRI projects, with state commercial banks channeling offshore foreign currency assets – often absent from official PBoC reporting – into overseas infrastructure. BRI has become the most visible expression of how shadow liquidity can be weaponized as both an economic and geopolitical instrument.

Because liquidity is inherently dynamic, these networks behave less like pipelines and more like living infrastructure. They adapt under enforcement pressure, migrate during crises, and often move faster than formal financial reforms can catch them. For China, this networked capital is both a pillar of external influence and a source of internal fragility: a system built to shield the state from outside constraint that has instead created an informal architecture of power – one Beijing now depends on but cannot fully control. Simultaneously, this informal architecture has proved resilient against Chinese and other global crackdowns, likely at least in part due to its entrenchment in Chinese elite power structures.

The Southeast Asia Inflection Point

In Southeast Asia, China’s shadow liquidity strategy has mutated into something far more volatile. Scam compounds in Cambodia, Laos, and Myanmar, sprawling online gambling hubs in the Philippines, and a dense web of informal crypto-asset brokers now act as powerful magnets for Chinese capital outflows. Funds slip past Beijing’s formal controls through domestic underground banking networks, gray-market over-the-counter (OTC) brokers based in Hong Kong, and payment platforms such as Huione and other similar underground systems. These actors often facilitate capital flight disguised as trade settlement or investment outflows, converging powerfully with state-led outflows.

Investigations have tracked billions of dollars flowing through OTC desks in Bangkok and Ho Chi Minh City into scam operations and laundering networks. What began as pass-throughs for capital flight is now self-reinforcing. Reports indicate that Chinese middle-class investors have lost tens of billions of dollars to newer forms of crypto fraud – particularly pig-butchering scams – often facilitated by border OTC networks in Southeast Asia. According to Wired, global losses due to scam operations exceeded $75 billion in 2023, with China-origin capital feeding scam compounds and high-risk gambling zones in Cambodia, Laos, Myanmar, and beyond. These systems no longer route funds back into China; they feed their own expansion, siphoning ever-larger volumes of Chinese wealth to sustain illicit economies.

This dynamic has created a parasitic financial architecture. Chinese liquidity designed to circumvent external constraints is now trapped in feedback loops, comingling with and empowering nonstate actors and criminal organizations. For example, the Yemen-based al-Houthi rebel group has used Huione to transfer $39 million in illicit proceeds. Militant groups in Myanmar have been linked to similar funding schemes. These networks have proven resilient in the face of global pressure, such as recent revelations that Huione remains operational despite its formal shutdown in the wake of U.S. sanctions.

Scam centers now threaten regional stability in Southeast Asia, draining middle-class savings while embedding themselves into the broader gray-zone economy. For example, ethnic Chinese-run scam centers in Cambodia routinely target middle-class victims in neighboring Thailand. Thai authorities report that since 2022, these operations have defrauded domestic investors of roughly 80 billion baht (about $2.5 billion), while regional estimates variably suggest the industry now generates nearly tens of billions of dollars annually. These scam centers became an important point of tension between Thailand and Cambodia in the months leading up to the July border clashes between the two countries that killed at least 35 people and displaced more than 260,000.

The result of China’s shadow liquidity outflows is a network that serves state, private, and criminal interests simultaneously – but answers fully to none. In this Southeast Asian crucible, China’s shadow liquidity has crossed an inflection point: from strategic tool to autonomous ecosystem, eroding the very stability it was meant to secure.

How It Backfires on China

The explosion of scam-driven liquidity drains in Southeast Asia produces visible social and economic consequences inside China. Hundreds of thousands – possibly millions – of Chinese citizens have lost savings to cross-border fraud schemes linked to scam compounds and gray-market payment platforms. While reliable data on those losses is scarce, early documented cases point to hundreds of millions of dollars stolen through pigbutchering scams – long con frauds where perpetrators groom victims online before convincing them to hand over large sums of money. Today, estimates claim scam compounds generate tens of billions of dollars annually, most extracted from Chinese households – an ongoing bleed of domestic savings that represents a vastly underestimated long-term erosion of national capital.

This state-facilitated ecosystem has bred distrust within China’s middle class – the demographic Beijing relies on most for social stability. Recent unemployment and failed investments have fueled unrest and rising violence – potential harbingers of things to come as scam losses mount. The scale of loss from cross-border scams is not merely individual but systemic. As illicit networks siphon billions annually, they erode China’s internal capital coherence – the ability of the state to direct domestic savings into strategic investment. Instead of reinforcing national resilience, these shadow channels are diverting household wealth into offshore criminal ecosystems that recycle capital outside Beijing’s control.

Although Chinese authorities have made efforts at cross-border crackdowns, Southeast Asia’s scam economy continues to flourish. It is likely that Beijing cannot fully disavow these operations due to how embedded they have become within elite circles. For example, organized crime figures such as the 14K Triad’s Wan Kuok Koi (aka “Broken Tooth”) reportedly hold close political ties to the Chinese Communist Party (CCP), with Wan allegedly stating that although he used to fight for the cartels, he now fights for the CCP. In 2018, Wan launched the World Hongmen History and Cultural Association, an entity U.S. authorities sanctioned two years later for its alleged criminal activity, including close ties to Southeast Asian scam operations. Washington also claims that Wan is a senior member of the Chinese government, holding a position on the Chinese People’s Political Consultative Conference – an assertion Beijing denies.

Another Chinese gangster, Zhao Wei, has benefited from extensive BRI investment in his Laos-based Golden Triangle SEZ, where he owns and operates the infamous Kings Romans Casino, which allegedly maintains extensive ties to scam operations in the SEZ. Such cases indicate that the Chinese regime maintains deep ties to the very scam operations that consistently undermine its public image despite attempts to rein them in. As ensuring capital outflows likely plays a key role in maintaining loyalty within the CCP’s opaque patronage networks, these scam operations may benefit from protection by the very officials meant to regulate them.

This dynamic sharply inverts the original aim of China’s offshore liquidity systems. What began as an effort to secure financial sovereignty and shield the economy from external shocks has instead produced an internal liquidity leak. It undermines the narrative of centralized control – the cornerstone of party legitimacy – as the population sees their own savings flow into unregulated, foreign-run criminal networks backed by state-led investments. In this way, the social cost of shadow liquidity is not just economic dislocation but also the corrosion of the trust Beijing needs to sustain its model of governance.

Policy and Security Implications

Current anti-money laundering and counter-terrorist financing frameworks focus on shadow liquidity as a criminal threat on a case-by-case basis rather than a systemic one. Compliance systems emphasize wallet-level monitoring and red-flag thresholds, but as the Financial Action Task Force (FATF) warns, the decentralization of financial operations “may further complicate efforts to disrupt larger financial networks.”

There is a clear imperative for disrupting and dismantling these shadow liquidity systems. The human cost is already visible – from human trafficking rings sustaining scam operations to the growing number of victims in the United States and globally whose wealth is funneled into opaque offshore corridors. With Western populations aging, Chinese illicit financial infrastructure already embedded within Western societies, and scam centers expanding into geographically, linguistically, and culturally proximate regions such as Africa and Latin America, the risk of a structurally entrenched global scam economy is rising. Evidence that these same corridors are exploited by terrorist and militant groups such as the Houthis to launder and transfer funds beyond the reach of traditional enforcement only underscores the urgency for decisive action.

At the state level, China’s BRI has become a dual-use platform – advancing Beijing’s geopolitical objectives while quietly facilitating elite capital flight and enabling shadow liquidity systems under the cover of infrastructure investment. In this way, BRI simultaneously spreads and undermines Beijing’s influence globally but doubly harms U.S. and other global interests by simultaneously furthering Chinese military expansionism while enabling parasitic organized criminal infrastructure. Until Beijing demonstrates a genuine commitment to dismantling these offshore shadow liquidity networks, global regulators and enforcement agencies should treat its financial initiatives with maximum caution.

Scam compounds, OTC desks, and gray-market payment networks are no longer discrete criminal enterprises; they are embedded in shadow capital infrastructure originally tied to Chinese state objectives. Treating them as isolated criminal enterprises misses their role as autonomous reservoirs of capital capable of sustaining proxy influence and destabilizing economies.

Addressing this requires ecosystem-level targeting. FATF’s 2025 report highlight “Operation Grafos,” where real-time intelligence sharing, blockchain analysis, and cross-jurisdictional coordination was employed to disrupt a virtual asset-based terrorism finance network. Those methods must become standard practice, not isolated cases.

Hybrid threat frameworks must integrate liquidity analysis alongside kinetic and cyber domains. The Basel Framework’s network-based supervision and the Organization for Economic Cooperation and Development’s beneficial ownership models offer practical templates for this. Pressure on Southeast Asian jurisdictions hosting scam enclaves must also escalate. Cambodia, Laos, Myanmar, and the Philippines are now structural nodes; carrot-and-stick approaches could force structural change.

Stablecoin and OTC-specific controls are essential. Hong Kong’s virtual asset service provider OTC regime and International Monetary Fund guidance on stablecoin flows provide blueprints for containing these pipelines. The recent announcement that stablecoin issuer Tether will fully comply with Washington’s Guiding and Establishing National Innovation for U.S. Stablecoins (GENIUS) Act over a period of 36 months is a positive step in this direction. Without systemic measures to regulate and contain these flows, shadow liquidity will continue to metastasize beyond state control, embedding itself as a structural layer of global capital flows. Given the primacy of U.S. regulatory and enforcement bodies in the global financial system, Washington will have to anchor any serious effort to contain these high-risk and unregulated flows.

By mapping these flows as an ecosystem rather than isolated incidents, enforcement bodies can identify structural chokepoints where targeted interventions may have disproportionate disruptive impact.

Conclusion

Shadow liquidity is more than a byproduct of illicit finance; it is a strategic architecture. China’s experience shows how systems built to project resilience can evolve into autonomous networks draining wealth and feeding actors beyond state control.

This is the central warning: once liquidity is externalized into unregulated systems, it no longer necessarily serves the state or actor that created it. Financial sovereignty is not just reserves; it depends on controlling the conduits of trust – the pathways through which value moves. Without discipline over these flows, even the most carefully engineered financial architecture can become a vector of decay, eroding the very stability it was built to secure. The real question is whether these systems can be contained in time – before they permanently erode the foundations of the global financial order.

A screenshot from the movie Hotel Rwanda, in which a Hutu warlord shows off his PRC-made machete. (Source: Douban)

This article was published on November 1, 2024 in the Jamestown Foundation China Brief. It has since been cited in a July 2025 report by the U.S. Senate Committee on Foreign Relations. You can find the original article here.

Executive Summary:

• Weapons manufactured in the People’s Republic of China (PRC) are increasingly falling into the hands of militant groups across Africa, with key contributors being state-owned defense contractors like Norinco. However, it is unclear how the weapons reach these groups.

• Militant groups such as Mali-based JNIM and the Democratic Republic of Congo’s M23 are employing PRC-manufactured arms in their operations, with evidence suggesting the potential involvement of Chinese criminal syndicates and corruption within PRC defense firms and African militaries.

• Extensive access to PRC-manufactured weapons by countries like Rwanda and Uganda, both of which support rebel groups, underscores the growing influence of PRC defense contractors in Africa, potentially contributing to regional conflicts.

• Beijing’s experience in Myanmar, where it supports both the government and rebel groups, may offer insights into its role in African conflicts, raising concerns about how escalating conflicts could strain Beijing’s partnerships and jeopardize its regional investments.

Weapons manufactured in the People’s Republic of China (PRC) are increasingly falling into the hands of militant groups across Africa as PRC defense contractors expand their influence in the region. Many African governments have signed arms deals with Beijing, with the PRC becoming the continent’s leading supplier of weapons this year. It is unclear how weapons are falling into the hands of militants, though corruption is likely playing a part in the influx of PRC-manufactured arms on the continent. Corruption has been rampant in recent years within the PRC’s military-industrial complex, reaching right to the top of the system. At the same time, the likelihood of corrupt activities by PRC arms companies in Africa—that operate far from regulatory oversight by Beijing—is high, as is the involvement of Chinese criminal groups that are also active in the region.

In late September, the Mali-based, al-Qaeda-affiliated Jama’at Nasr al-Islam wal Muslimin (JNIM) continued to escalate its presence in Africa’s Sahel region, executing attacks that claimed over 70 lives in Bamako (Xinhua, September 18; September 20). JNIM has access to large numbers of PRC-manufactured weapons. This is one of several instances of non-state actors having access to substantial quantities of PRC military equipment—Myanmar constitutes another prominent case.

Mali-based Terrorist Group Maintains Extensive Arsenal of PRC Weapons

Propaganda videos and footage released by the Malian military reveal substantial stockpiles of weapons produced by PRC state-owned defense contractor Norinco (中国兵器工业集团; 北方工业), including a Type 80 machine gun, a Type 81-1 assault rifle, and at least two Type 69 rocket-propelled grenade (RPG) launchers equipped with high-explosive anti-tank projectiles (Militant Wire, September 22). While the images also display weapons from other countries such as Russia, Romania, and older Soviet Union models, most of the arms pictured are of PRC origin.

Norinco has increasingly expanded its role in supplying militaries throughout the Sahel, particularly in Mali. A video released last summer shows Malian special forces outfitted with a broad array of PRC-manufactured weapons and equipment, including Norinco-produced CS/VP11 Lynx all-terrain vehicles equipped with W85 anti-aircraft machine guns, as well as JS 9mm submachine guns produced by Jianshe Industries (云南建设工业集团) (BiliBili, August 27, 2023). Last month, during the Forum on China–Africa Cooperation (FOCAC) in Beijing, Mali secured another contract with Norinco to provide additional weapons to its military (Embassy of the PRC in India, September 2; Military Africa, September 3).

In recent years, JNIM has funded much of its expansion by running a protection racket associated with the illicit harvesting and trade of southern Malian rosewood, a highly valued tropical hardwood prized for its distinctive color and durability (ISS Africa, June 19). In 2018, Malian whistleblower Amadou Traoré exposed the extensive deforestation and criminal activities tied to Mali’s rosewood trade, prompting several international investigations (Corruption Anonymous, September 13, 2023). Reports suggest that most of Mali’s exported rosewood ends up in the PRC, with PRC criminal syndicates operating in Mali and Senegal playing essential roles in the trade (South China Morning Post, May 22, 2022; PPLAAF, September 11, 2023). In the PRC, the trade of illegally exported Malian wood is so widespread that several online retailers sell it on Aicaigu (爱采购), a business-to-business platform operated by PRC tech giant Baidu (Aicaigou, October 10). However, the origin of JNIM’s vast cache of PRC-manufactured weapons and the group’s relationship with PRC criminal syndicates remains unclear. Although villagers in southern Mali have reported that local PRC crime syndicates pay protection money to JNIM, these reports remain unsubstantiated (ECOWAS, November 2023). Such factors call for further investigation.

PRC Defense Contractors Benefit From Worsening Conflict in the Eastern DRC

In the eastern Democratic Republic of Congo (DRC), the March 23 Movement (M23), predominantly composed of Tutsi rebel forces, continues to devastate the region using PRC-manufactured weapons, including an assault on the provincial capital of Goma and the plundering of vast quantities of minerals (United Nations, February 20; Africa Defense Forum, March 5). Photos of seized M23 weapons and equipment released by the Congolese military underscore the PRC origin of these extensive supplies, particularly from Norinco and Xinxing (中国新兴进出口有限责任公司), a firm specializing in military uniforms and tactical gear. In an interview with a local news outlet, Congolese-Belgian defense analyst Jean-Jacques Wondo Omanyundu noted, “the M23 weapons seized by the FARDC [the Congolese military] are almost all Chinese-made” (China Global South Project, July 12, 2022).

A recent UN Security Council report concludes that M23 receives substantial financial and material support from neighboring Rwanda and Uganda, both of which have acquired significant quantities of PRC-manufactured weapons (United Nations; ReliefWeb, June 4). In recent years, Rwanda has made large purchases of artillery systems and other arms produced by Norinco and other firms. A Shanghai-based firm called Deekon Group even uses images of the Rwandan military uniforms it produces for promotional purposes on its website (Deekon Group, October 8). The PRC and Rwanda also maintain close military and defense ties, with Beijing deploying an official defense attaché to Rwanda earlier this year (Embassy of the PRC in Rwanda, February 21). Uganda’s military, meanwhile, has purchased arms from Norinco and another Chinese firm, Poly Technologies (保利科技有限公司; 保利科技), according to a 2021 investigation by a Ugandan journalist (The Independent [Uganda], December 19, 2021). In November last year, Norinco partnered with the Ugandan military to establish a research center focused on unmanned aerial vehicles (UAVs) in the country (MODVA, November 29, 2023). The extensive access of Rwanda and Uganda to PRC-manufactured weapons, along with their support for the M23 movement, highlight the likely source of the rebel group’s large PRC-made arsenal.

To counter the escalating threat from M23, the DRC military has also turned to the PRC defense industry, purchasing its first batch of three CH-4 attack drone systems from China Aerospace and Technology Corporation (CASC; 中国航天) last year (Africa Intelligence, May 22, 2023). Later that year, Norinco became embroiled in controversy in the DRC when its subsidiary, Norin Mining, attempted to acquire cobalt and copper mines outside Lubumbashi, in the Katanga province, south of the M23-led insurgency in North Kivu province. The DRC state-owned mining conglomerate, Gécamines, moved to block the sale, claiming it had not been properly informed of the decision (Africa Confidential, October 11). Although Lubumbashi is approximately 900 miles south of M23-controlled territory in North Kivu, the group conducted extensive attacks in the city during its 2014 offensive (BBC, January 7, 2014).

Corruption at Defense Contractors and the Myanmar Example Raise Further Questions

The PRC’s defense contractors are increasingly flocking to African markets, with the PRC surpassing Russia as the continent’s largest weapons supplier this year (ADF, July 23). Norinco, which manufactures a wide range of weapons from handguns to tanks, has been at the forefront of this expansion, operating offices in over 70 countries. Its latest expansion into Dakar, Senegal, signals growth intentions in the West African market (Norinco, October 8; SCMP, August 21, 2023). According to its website, Norinco controls mining sites across Africa (including gold, cobalt, and palladium mines), is deeply involved in the regional copper trade, and plans further expansion (Norinco, October 8). Although there is insufficient evidence directly linking these companies to the militant groups who are using their weapons, recent developments within the PRC shed more light on these companies’ practices.

Beijing has taken punitive actions against at least two senior Norinco executives since 2021 in response to corruption charges. In October 2021, PRC authorities charged former Norinco Chairman Yin Jiaxu (尹家绪) with bribery and seeking illegal profits for relatives and friends (People’s Daily, October 25, 2021). According to an official readout, Yin received “huge sums” of money and gifts, and held top positions at the company from 2002 until his 2018 retirement (Global Times, April 4, 2021; CCDI, September 30, 2021). Last December, authorities removed then-Norinco Chairman Liu Shiquan (刘石泉) from the 14th National Committee of the Chinese People’s Political Consultative Conference amid an anti-corruption investigation into the defense and aerospace sector (China Brief, February 2; Global Times, March 3). Liu had previously held senior roles at the state-owned China Aerospace Science and Industry Corporation (CASIC; 中国航天科工).

These high-level disciplinary actions highlight the prominence of corruption within some of the PRC’s top defense contracting firms. Given the distance between operations in African countries and oversight by Beijing authorities, corrupt backchannels may be funneling the transfer of PRC-manufactured weapons to African militant groups for personal gain. Coupled with the involvement of Chinese criminal elements in Africa and the potential for internal corruption within the militaries of affected nations, this situation merits further investigation as a possible source of these weapons (OCCRP, May 25, 2022; Africa Report, August 12; May 14).

The PRC’s experience in Myanmar may offer insights into this involvement in internal African conflicts, such as those in Mali and the DRC. For decades, Beijing has supported Myanmar’s ruling government while simultaneously providing material and financial backing to various armed resistance groups (China Brief, March 17, 2023; MLM, July 31; South China Morning Post, August 25). Both JNIM in Mali and M23 in the DRC hold significant value for the PRC due to their access to rare and high-value resources. It is plausible that Beijing may unofficially support one or both groups to secure its continued resource access. However, if such claims are substantiated, they could damage the PRC’s reputation in Africa. Moreover, as seen in Myanmar, further conflict escalation could endanger Chinese investments and those of other nations. Moreover, JNIM’s prolonged conflict with Wagner mercenaries fighting for the Malian junta—coupled with the group’s use of PRC-manufactured weaponry—may strain the PRC’s “no limits” partnership with Moscow, particularly regarding African matters (Xinhua, January 2, 2021).

Conclusion

The expanding presence of PRC defense contractors in Africa and the increasing use of PRC-manufactured weapons by militant groups warrant deeper investigation. However, such inquiries will likely prove challenging due to the frequently opaque nature of business dealings in these regions. What remains clear is that the growing prevalence of PRC-manufactured weapons among powerful militant groups in Africa has considerable implications as Beijing moves to dominate the African arms market. These implications include regional security, as non-state actors gain further access to advanced PRC weaponry and equipment, and geo-strategic concerns, as resource-based conflicts can potentially disrupt global supply chains. Given current trends, these threats will likely intensify as PRC defense contractors seek greater access to the continent’s arms markets.

This article was originally published in Small Wars Journal. You can find the original here.

Executive Summary

Illicit liquidity has emerged as the hidden scaffolding of modern conflict – a decentralized architecture enabling covert influence, conflict financing, and strategic evasion on a global scale. This report examines the continued operation of Huione, a Chinese-language criminal marketplace that facilitates large-scale financial laundering across Southeast Asia, despite public claims of shutdown. It further explores digital laundering tools more broadly, building toward a working typology. Leveraging encrypted messaging apps and informal financial networks, Huione enables the movement of billions of dollars in illicit funds through fiat-to-stablecoin conversions, card transfers, and in-person cash exchanges–critical infrastructure for state-aligned criminal actors, proxy networks, and scam-industrial complexes.

While often treated as a cybercrime or compliance issue, Huione and networks like it reflect a new reality: decentralized financial platforms now function as logistics and influence infrastructure in irregular conflict.

This article argues that the U.S. and its allies should view this laundering ecosystem not just as a criminal threat, but as a strategic enabler of adversarial statecraft. Without a shift in how threat finance is integrated into operational planning, on-chain laundering infrastructure like Huione will continue to outpace enforcement, undermine deterrence, and fuel irregular conflict below the threshold of war.

Subscribe now

Introduction

Starting in early 2024, blockchain analysts began tracing a set of suspicious transactions flowing out of Shwe Kokko–a lawless border town in Myanmar known for its Chinese-backed casinos and scam compounds. The money trail wound through obscure stablecoin swaps, informal brokers, and encrypted Telegram channels before disappearing into the digital void. According to open-source intelligence, the proceeds, originating from online fraud and forced labor, are ultimately linked to the financial wing of the Karen National Army (KNA), a militia currently engaged in armed resistance against Myanmar’s military regime.

This case is not an isolated one. Across the globe, armed groups exploit digital finance to fund their operations, evade sanctions, and project influence across borders. From Yemen’s Houthi rebels trading sanctioned Iranian oil with Chinese refineries, to Southeast Asian insurgents laundering vast sums in proceeds from brutally exploitative scam centers, evidence suggests militant groups increasingly launder their illicit gains through informal online networks. One such network is Huione, which has laundered billions of dollars through its highly resilient, decentralized digital infrastructure.

Huione Guarantee, a subsidiary of Huione Group, is a loosely organized network of Chinese‑language Telegram channels and informal money brokers, operating out of Cambodia. It facilitates high-volume laundering through stablecoins, escrow-like “guarantee” services, gift-card conversions, and direct fiat exchanges. Among its top executives is Hun To, a cousin of Cambodian President Hun Manet–one of Beijing’s most reliable allies in the region. Despite public claims of a shutdown in May, Huione continues to function as a critical backend for scam compounds, sanctioned actors, and gray market networks.

Illicit finance is no longer a secondary enabler of conflict–it has become strategic terrain. Until military and intelligence planning fully integrates the financial dimension, adversaries will continue to weaponize liquidity with little resistance.

Legacy vs. Reality: Why Conventional CTF Tools Are Failing

For decades, counter-threat finance (CTF) operations have relied on a core set of tools: Suspicious Activity Reports (SARs), wire transfer tracing, and international cooperation through systems like SWIFT. These models assume that most illicit finance flows through formal institutions—banks, remittance services, and regulated money transmitters. But this assumption is increasingly outdated.

Today, insurgent groups, proxy forces, and transnational criminal networks operate in a parallel financial ecosystem—one designed to avoid the very systems traditional CTF tools are built to monitor.

Instead of wire transfers, these actors use stablecoins–digital tokens pegged to fiat currencies and moved easily across borders without banks. Instead of formal remittance services, they rely on informal brokers, often functioning as over-the-counter intermediaries, embedded in ethnic, linguistic, or diaspora networks. And instead of SWIFT messages, they communicate through encrypted apps like Telegram and WeChat, where entire money-laundering marketplaces function out of public view.

Virtual economies–such as those embedded in scam centers, in-game asset markets, and social media monetization—have become viable sources of revenue and platforms for money movement. These systems allow for peer-to-peer value transfer, rapid obfuscation, and low enforcement visibility, especially when shielded by weak regulatory regimes or state complicity.

Most CTF frameworks are not designed[SS2] to detect or disrupt financial flows that evade the banking system. And even when red flags are triggered, enforcement often stops at jurisdictional boundaries. By contrast, platforms like Huione Guarantee operate within a legal gray zone–unlicensed in most of the jurisdictions they touch but are tolerated or even protected within their host countries.

The result is a growing enforcement gap. State and non-state actors alike are learning to operate in spaces where sanctions carry less relevance, banking oversight is minimal, and enforcement agencies lack both visibility and jurisdiction. Without a shift in how CTF is conceptualized and deployed, these alternative systems will continue to grow–fueling insurgency, proxy warfare– in addition to advanced criminality–far beyond their points of origin.

Case Study Cluster: Illicit Liquidity in Action

Illicit finance is now a primary enabler of armed groups operating in strategic gray zones. Whether through Huione or possibly through equivalent broker-mediated platforms, these actors rely on decentralized laundering infrastructure that overlaps with Chinese regulatory and economic ecosystems–providing both operational funding and resilience. Here are a few examples where the Huione case provides direct evidence of use, and where further research is needed to determine the nature of laundering pathways.

Ansar Allah (AKA: The Houthis), Yemen

• A May 2025 Elliptic investigation linked $39 million in illicit flows to Houthi-controlled wallets via Huione-affiliated OTC brokers operating in Yemen and Southeast Asia.

• In parallel, the Houthis have sold Iranian oil to Chinese “teapot” refineries in Shandong—allowing for off-the-books revenue outside U.S. Treasury control.

• The Houthis’ may have laundered these illicit oil proceeds through Huione-style stablecoin conversions, anonymized brokers, and encrypted cash channels.

• The Houthis channel their illicit proceeds into ballistic missile development, drone programs, and influence operations, making illicit liquidity a critical pillar of Houthi capability.

Karen National Army (KNA), Myanmar

• 2025 U.S. Treasury sanctions confirm that the KNA facilitated and profited from scam compounds in Shwe Kokko tied to forced labor, trafficking, and cybercrime.

• Sanctioned shortly after Huione, the KNA is a likely–but not publicly confirmed—user of these or similar laundering channels.

• The KNA operates in territory influenced by China-tied real estate and criminal enterprises, making it structurally embedded in a transnational gray zone economy.

• As with other conflict-linked criminal profit streams, illicit funds flowing through KNA-controlled scam operations are likely channeled into weapons, militia pay, and territorial control–similar to broader patterns documented in United National Office on Drugs and Crime (UNODC)/Global Initiative against Transnational Organized Crime (GI-TOC) analysis.

Myanmar National Democratic Alliance (MNDAA, AKA: Kokang Army), Myanmar

• The Myanmar National Democratic Alliance Army, composed of Mandarin-speaking ethnic Han Chinese, operates along the China-Myanmar border and maintains long-standing ties to Yunnan’s informal trade and finance ecosystems.

• The MNDAA has operated and protected scam compounds in Kokang, including in Laukkai, where cyber fraud targeting overseas victims has been widespread. These operations positioned the group within a broader ecosystem of illicit finance, logistics, and trafficking networks along the China-Myanmar border—though the mechanisms used to launder proceeds remain opaque.

• The MNDAA has participated in Chinese-brokered ceasefires, benefited from border gate openings and infrastructure access, and aligned rhetorically with Beijing’s regional narrative.

• While no confirmed link to Huione has been documented, MNDAA’s involvement in the scam compound ecosystem and operational alignment with Yunnan’s gray finance routes make it a plausible participant in this emerging gray finance ecosystem.

Shared Strategic Profile

• Each group operates near or within China’s shadow financial sphere

• Each has benefited–directly or indirectly–from China’s regulatory fragmentation or tolerance of illicit flows

• All use illicit finance not just for survival, but for the projection of asymmetric power

The Illicit Liquidity Complex: A Working Typology

Over the past five years, digital laundering tools have coalesced into a loosely connected ecosystem. Armed groups, sanctioned regimes, and criminal syndicates now operate within a shared financial domain. This domain is best described as an Illicit Liquidity Complex.

The Illicit Liquidity Complex does not operate as a single platform or network. It functions as an ecosystem of loosely affiliated brokers, laundering channels, and pseudo-legitimate financial services. These components collectively enable high-speed, low-visibility liquidity transfer across borders. The system’s effectiveness stems not from technical sophistication. It derives from structural fragmentation, operational adaptability, and regulatory absence.

Core Components

• Informal Stablecoin Brokers: Middlemen who convert crypto to fiat and back—usually by communicating on Telegram or WeChat—without know-your-customer (KYC) protocols, often tied to language or diaspora trust networks.

• Shadow Financial Rails: Infrastructure that moves value without touching the banking system: OTC desks, Telegram-based escrow services–often automated or managed anonymously, in-person swaps, gift card laundering, and multiple wallet hops.

• Pseudo-Legitimate Platforms: Exchanges, fintech front ends, or “payment services” that provide a compliant façade while facilitating high-volume laundering behind the scenes (Ex: Huione).

• Social Monetization Layers: Streaming apps, fake shops, and in-game tipping tools that convert scam earnings into surface-level income—popular among scam syndicates and hybrid operators.

The convergence of state-backed threats and informal financial systems makes this multifaceted ecosystem especially dangerous. State-aligned militias, cybercriminals, and sanctioned entities now use the same rails – or closely related ones. The same Huione-linked broker might move funds for a scam ring one day and a sanctioned militant group the next. This ecosystem is no longer merely a criminal concern; it is a form of financial infrastructure – built for plausible deniability, speed, and resilience. Its growth is outpacing what traditional enforcement can track.

Subscribe now

Toward a Strategic Response

Confronting the Illicit Liquidity Complex will require more than conventional financial enforcement. Traditional counter-threat finance methods—built around SARs and bank-led compliance–fail to engage the architecture of decentralized, broker-mediated laundering networks. A coherent response must address both tactical intervention and strategic adaptation across military, regulatory, and intelligence domains.

Tactical Responses

• Map financial enablers in active and emerging conflict zones

  Conventional tools do not capture the movement of funds that never enter formal institutions. Field-level analysts and signal intelligence (SIGINT) operators must track informal stablecoin brokers, peer-to-peer transactions, and escrow services that exist entirely outside the banking system. Mapping should prioritize network structures and chokepoints–not just endpoints.

• Target and disrupt laundering infrastructure

  Focused action against digital escrow providers, laundering-as-a-service platforms like Huione and OTC brokers can have disproportionate impact. These entities perform functional roles similar to tunnels, supply caches, or encrypted communications. Their removal degrades adversarial force projection and financial resilience.

Strategic Shifts

• Embed financial mapping in counterinsurgency (COIN) and hybrid warfare doctrine

  Financial networks must be treated as terrain. This includes embedding forensic financial analysis into campaign planning, target development, and stability operations. Doctrinal integration should treat laundering infrastructure as both a logistics system and a narrative engine.

• Partner with blockchain analytics firms and adjacent platforms

  Blockchain firms possess tools to trace stablecoin movement, cross-chain swaps, and laundering loops. Partnerships with these firms–along with digital platforms vulnerable to abuse (e.g., gaming economies, social streaming networks)–will expand visibility into high-velocity, low-signature financial flows.

• Build multi-jurisdictional regulatory frameworks

  Financial fragmentation remains one of the greatest enablers of illicit liquidity. Ireland and the EU have moved toward tighter regulation of stablecoin flows and informal brokers through Markets in Crypto Assets Regulation (MiCAR). Such frameworks should be expanded and adapted to other high-risk environments, including Southeast Asia, the Gulf, and Central Asia.

Conclusion: Mapping the Unseen Battlespace

Illicit liquidity now constitutes core terrain in modern conflict. Armed groups, proxy actors, and sanctioned states no longer rely on traditional banking or formal remittance channels. They exploit decentralized laundering infrastructure—composed of stablecoin brokers, escrow bots, and regionally protected financial corridors—to finance operations, sustain logistics, and wage narrative warfare.

Platforms like Huione are not peripheral or purely criminal. They function as tactical assets–digital equivalents of tunnels, weapons caches, or encrypted communications. These systems enable recruitment through economic incentives, fund weapons acquisition, and sustain political influence across borders. Their continued operation erodes deterrence and complicates battlefield intelligence.

Failure to identify, map, and degrade these systems will cede initiative in conflicts that remain below the threshold of war. The architecture behind illicit liquidity functions as enemy infrastructure and must be treated as such, with its operators prioritized as strategic targets. Without this shift, irregular actors will continue to weaponize liquidity–transforming stablecoins and informal brokers into engines of asymmetric power.

This is an article I recently wrote for the Global Network of Extremism and Technology (GNET). You can find the original link here.

Image source

Subscribe now

Mali has been in a climate crisis for over half a century, experiencing at least 40 climate-related shocks between 1970 and 2020. Last summer, the country withstood droughts and flooding, affecting some 400,000 people and costing some $9.5 million USD in annual crop revenues in one of the world’s poorest countries. These climate shocks have contributed to and exacerbated the country’s brutal and multifaceted civil war, which started in 2012, by driving recruitment and opening revenue-generating opportunities for militant groups. Although ethnic tensions in Mali’s arid and sparsely populated north gave rise to the conflict, it has since spread to the more salubrious south, with radical Islamist groups emerging as powerful contenders to unite the country’s disparate groups.

Jihadist militant groups have thrived amid Mali’s ongoing climate crisis. Malian people comprise roughly a dozen ethnic groups speaking 79 languages, and with 95% of the population adhering to Sunni Islam, Islamist ideologies are among any faction’s best chances to unite the various peoples of this complex and diverse land. The al-Qaeda-linked Jama’at Nusrat al-Islam wal-Muslimin (JNIM) is the most powerful of these factions and is responsible for 64% of all violent events linked to Islamist groups in the Sahel since 2017. Its steady expansion and threat to the lives and livelihoods of Mali’s increasingly desperate population are an indirect consequence of the region’s worsening climate crisis.

Based in Mali’s extreme north and formed from a merger between four terror groups under the nominal leadership of longtime Tuareg warlord Iyad Ag Ghaly, JNIM has spread rapidly across Mali and into Burkina Faso, Niger, Togo, and Benin. Much of this expansion results from the organisation’s ability to incorporate and co-opt other militant groups under its broad umbrella while capitalising on the Sahel’s worsening climate crisis. This Insight explores how JNIM takes advantage of the Sahel’s climate crisis regarding recruitment and revenue generation while gaining access to increasingly sophisticated weaponry and posing an ever-expanding regional threat.

Climate-Induced Desperation Drives JNIM Recruitment

Mali’s role in world history is inestimable. Its lands were once the cradle of great civilisations such as the Malian Empire, the world’s leading supplier of gold in the 14th Century, the influx of which to Europe was so great that it gave rise to the gold-backed currencies that defined modern states until the mid-20th Century. However, modern Mali has become increasingly inhospitable to human life, with the country’s average annual temperature rising by 0.7 degrees Celsius since 1960, its annual rainfall decreasing steadily, and its vast arid regions expanding rapidly. These trends have made much of the country’s north untenably dry, driving cattle herders such as the nomadic Fulani south into the traditional territory of the predominantly agricultural and sedentary Dogon, leading to intense competition over land and resources between two of the country’s largest ethnic groups. This conflict and others across Mali drive recruitment into armed militia groups, many of which JNIM has incorporated into its organisation.

Climate change drives jihadist recruitment in myriad ways. First, it and subsequent factional conflicts diminish people’s ability to produce income via stable means. For example, increased aridity and flooding result in reduced crop yields for farmers, while jihadist groups such as JNIM frequently prevent farmers from harvesting, using hunger and unemployment as means to drive recruitment and occupy new lands. The climate crisis also affects fishing as the increasing aridity of the Niger River’s flood plains, combined with overfishing, has left local fishers with fewer available stocks. This trend greatly limits the availability of dietary protein in the region, worsening the hunger crisis that continues to draw recruits to jihadist organisations. Moreover, al-Qaeda-linked jihadists, now organised under JNIM’s banner, frequently target local fishermen traversing the waterways, making their trade increasingly unsustainable.

A 2021 report by the Stockholm International Peace Research Institute (SIPRI) demonstrates a likely correlation between climate change and jihadist recruitment in Mali. Farah Hegazi, one of the report’s authors, claimed in a 2021 interview that data she and others collected suggests a relationship between rainfall in central Mali and child soldier recruitment, with families tending to send more children to armed groups as a form of income in drier periods and fewer during periods of higher precipitation. Since 2016, JNIM and other jihadist groups have increasingly relied on child soldiers to fill their ranks as the conflict over the Sahel intensifies.

Increased scarcity has exacerbated the disparity between local elites and lower-caste young men, fissures that jihadist groups such as JNIM exploit to drive recruitment. JNIM frequently uses Telegram and chat rooms such as Rocket Chat and Element to reach potential recruits, publicise its attacks, and distribute other propaganda to perpetuate narratives. These narratives tend to capitalise on local grievances related to the climate crisis, such as class and unemployment, as well as others, such as the junta government’s reliance on Russian Wagner mercenaries, which are broadly unpopular due to their penchant for excessive and often extreme force, widespread resource theft, and general failure to uphold their security mandate.

Climate Crisis Opens Revenue Streams for JNIM

Because Mali has fewer opportunities in agriculture, the sector that traditionally provides employment for the vast majority of the country, many young men have turned to illegal timber harvesting to earn a living. This trend has further exacerbated Mali’s climate crisis by contributing to widespread deforestation: over the past three decades, the country has lost over 20,000 square kilometres of forest due to illegal harvesting and increased desertification. This deforestation contributes to Mali’s flood vulnerability due to the land’s reduced ability to absorb rainwater, further devastating agrarian output. However, with a lack of fuel alternatives, the population has little choice but to cut down their dwindling forests for basic necessities such as cooking, with poachers even cutting down trees planted by activists for firewood.

JNIM has also capitalised on this trend by involving itself in the illegal trade of rare timbers. Mali’s illicit sales of precious hardwood species such as ebony and rosewood have spiked in recent years as demand from Chinese criminal syndicates, heavily involved in local harvesting and trafficking, has spiked. JNIM has extended its racketeering operations, already heavily involved in regional narcotics trafficking, to timber smuggling, providing protection services to illegal loggers in exchange for payment. Unverified local sources claim that some Chinese timber traffickers pay protection fees to JNIM in exchange for their services, and evidence suggests that Chinese domestic e-commerce platforms such as Baidu and Taobao market illegal Malian rosewood. JNIM’s widespread use of Chinese-made small arms and light weapons (SALW) also warrants further investigation.

Gold is another lucrative revenue stream for JNIM and is also an indirect consequence of the group’s capitalising on the climate crisis in Mali’s fertile and gold-rich southwest. JNIM has expanded its revenue from artisanal mines, acquiring new lands by driving away increasingly desperate farmers using hunger and other means. Although Mali has laws that apply to gold exports, illegal miners there and in several other countries across Africa export vast sums of gold each year, with major destinations including the United Arab Emirates (UAE), Türkiye and others. Both countries are important hubs for international gold transactions, including online sellers, whom regulators have struggled to rein in regarding gold from illicit sources.

Subscribe now

Advanced Weapons

JNIM’s expanding arsenal of advanced weaponry indirectly results from its ability to capitalise on the Sahel’s ongoing climate crisis. On one hand, JNIM’s ability to exploit the crisis and gain access to new revenue sources gives it the ability to purchase better weapons. On the other hand, JNIM’s improved ability to launch attacks with these increasingly advanced weapons gives it the ability to capture more advanced weapons from enemy forces. In this way, JNIM’s expanding militarisation is a self-perpetuating cycle firmly rooted in Mali’s climate crisis.

Chinese small arms and light weapons feature prominently in JNIM’s arsenal, allowing the group to inflict widespread attacks on government and civilian targets while expanding and maintaining its territorial holdings. The group also increasingly harnesses more advanced weapons such as mortars, rockets, improvised explosive devices (IEDs), and drones. JNIM tends to use modified commercial drones for offensive operations, outfitting these with explosives to drop on enemy targets or explode on impact in a kamikaze attack. Experts claim that drone usage by JNIM and other groups has increasingly levelled the playing field between conventional militaries and non-state actors in the region. Although little information exists as to how JNIM and other jihadist groups in the Sahel acquire commercial drones, the market for these items is extensive, with both local and international manufacturers fulfilling the region’s burgeoning demand. It is possible that JNIM sources some of these devices from intermediaries in neighbouring countries using e-commerce platforms; this also warrants further investigation.

Recommendations

There are no easy answers to Mali’s worsening and concurrent ecological and security crises. Since its 2021 coup, the Malian government has become increasingly isolated from much of the world, instead turning to Russia and China to fulfil its dire security needs. These partnerships have done little to advance security in the country. Russia’s Wagner Group, engaged in widespread atrocities and resource theft, generates little more than disdain from the local population and remains generally feckless in its counterinsurgency mandate. Meanwhile, a massive influx of Chinese weapons into the country has not given the military the tools it needs to engage in meaningful counterterrorism operations, with many of these items now wielded by militant groups such as JNIM.

Last September, Mali’s government announced a partnership with Chinese tech giant Huawei to aid in the country’s ‘digital transformation’, with the goal of enhancing security through digital surveillance and other means. The following month, the junta regime announced it was lifting its operational ban on US-based satellite internet company Starlink for six months to develop a comprehensive regulatory framework during this period. Clearly, the regime seeks partners from the global tech industry to help fulfil its security needs. Although Starlink’s operations in Mali remain controversial, this timeframe gives it and potentially other Western tech companies the opportunity to meaningfully engage the Malian regime in ways that could advance goals related to counterterrorism moving forward.

Cooperation between technology companies and Mali could help improve the country’s security through enhanced digital surveillance while facilitating dialogue between the regime and foreign governments that could provide invaluable solutions in counterinsurgency operations. Given the regime’s abysmal human rights record, companies should approach this prospect cautiously. However, anything that advances security in Mali could help ameliorate one of the world’s most dire ecological and humanitarian crises.

For example, under improved security conditions in Mali, legitimate mining companies could reinvest in the country’s vast and largely untapped mineral reserves. Moreover, an improved security situation in the countryside would likely provide a boon to the agricultural sector. Gold and cotton are Mali’s top exports, upon which it relies heavily to purchase fuel from the global market, with fuel representing 42% of its total imports by value. By improving the security situation to bolster these exports, Mali may import greater quantities of necessities such as fuel, taking pressure off its dwindling forests that are continually decimated for firewood. Moreover, reduced illegal logging for fuel would likely provide less cover to groups such as JNIM, who currently profit from the sale of rare timbers with impunity. This theoretical example is just one possible benefit that improved dialogue between Mali and the outside world could bring, and companies such as Starlink can help facilitate this through cautious first steps with a less-than-savoury regime.

There are also things tech companies can do to stem the flow of funds to JNIM, Mali’s most dangerous terrorist group, as a result of its profiteering from the country’s climate crisis. First, platform providers, including Apple and Google, can continue to pressure apps that fail to conform to their standards by permitting the dissemination of terrorist propaganda, such as Telegram and RocketChat. Second, social media platforms should work with global governments to strengthen the global regulatory framework for combating illegal gold transfers. Although the UAE and others have attempted to regulate the flow of illicit gold bullion into their countries, the problem persists, requiring enhanced global regulatory oversight. Until such enhanced oversight occurs, social media companies should carefully evaluate any company seeking to advertise online gold trading services on their platforms. Third, Chinese e-commerce companies should work to limit the sale of illicit rare timbers on their domestic platforms, for no other reason than the terrorist activity they help facilitate threatens Chinese interests and citizens working in Africa. Finally, e-commerce companies should work closely with regional and local law enforcement to map the sale of commercial drones to militant groups. This mapping likely requires extensive intelligence and data gathering, which are currently sorely lacking in the region.

This is an article I recently wrote for the Global Network of Extremism and Technology (GNET). You can find the original link here.

This article was cited in the Financial Action Task Force (FATF) Report on Terrorist Financing, the most authoritative global assessment of terrorist financing risks in 2025, which you can find here.

Subscribe now

The Afghan-based Islamic State Khorasan Province (ISKP) has become the Islamic State’s (IS) primary arm for inflicting brutal attacks on the world stage. On 3 January 2024, two ISKP suicide bombers detonated themselves within 10–20 minutes of each other at a memorial ceremony for General Kassem Suleimani in Kerman, Iran, killing 95 and injuring 284 others. Less than three months later, ISKP gunmen opened fire at a crowd attending a concert at Moscow’s Crocus City Hall before setting the venue ablaze, killing 145 people and injuring at least 551. ISKP propaganda regularly calls for attacks in South Asia, China, and the West, increasing the threat of another similar or perhaps more deadly attack in the future.

The primary financial facilitator behind these and other vicious attacks is Maktab al-Siddiq (the al-Siddiq office), which oversees a vast illicit financial network that raises money through donations and receives money from other regional counterparts, transferring vast sums through a vast global network of financiers. Although the office has faced many setbacks amid crackdowns by international law enforcement, it remains resilient, broadening its global network in a likely effort to evade further detection. This Insight explores Maktab al-Siddiq’s sources of revenue and the global financial infrastructure it uses to finance some of the world’s deadliest terrorist attacks.

Maktab al-Siddiq

As part of the IS’s General Directorate of Provinces (GDP), Maktab al-Siddiq oversees IS finances across much of Asia. According to the US State Department, the office employs unregistered money services businesses, established hawala networks, cash couriers, and virtual assets to finance subordinates in Afghanistan, Pakistan, India, Bangladesh, Maldives, and the Philippines. Through these financial tools, Maktab al-Siddiq allocates funds to various IS operations worldwide, such as for last year’s attacks in Iran and Russia. A man known as Tamim al-Kurdi has reportedly run the office from somewhere in Afghanistan since 2020; however, he is barely mentioned in the existing literature on the organisation.

Because Maktab al-Siddiq is the primary financial facilitator of the ISKP, which has become the IS’s most notorious constituent group, it has attracted considerable attention and pressure from global authorities, forcing it to adapt. Although the office previously generated revenue from illicit activities such as extortion, kidnapping for ransom, and robbery, it has since outsourced these criminal activities to its subordinate groups, who transfer money back to the regional office when funds run low. Even with the arrests and deaths of key operatives and facilitators from Afghanistan, Pakistan, Somalia, Syria, and Türkiye in 2023 and early 2024, the office has reportedly recovered. This resilience is likely the product of the organisation’s ability to spread its influence globally, soliciting donations from a broadening global base of donors and relying on operatives to complete transfers from many locations.

Limited Local Revenue Generation Potential

Maktab al-Siddiq is unlike its African counterparts in terms of local revenue generation, as its subordinate groups do not control significant territories. The ISKP once controlled mines in eastern Afghanistan’s Nangarhar province, generating millions of dollars in profits by smuggling resources such as talc, marble and lapis lazuli through channels in Pakistan and onto global markets. However, a 2018 US-backed operation to clear militants from key mining sites in Nangarhar and the subsequent 2021 Taliban takeover of the province significantly reduced the ISKP’s ability to generate revenue there. Although the Taliban have been largely successful in gaining control over Afghanistan’s vast mineral wealth, the ISKP routinely targets Chinese mine workers in the country, demonstrating that the battle for these resources is far from over. Nevertheless, the IS likely generates little, if any, revenue from Afghan-based resources today.

Rather than generating revenue through controlled lands, the ISKP and other groups under the purview of al-Siddiq generate funds through more covert means such as extortion, robbery and kidnapping for ransom. In 2020, IS operatives reportedly commanded a ‘growing share’ of Pakistan and Afghanistan’s illicit tobacco markets, although it is unknown whether these groups still generate revenue in this way at present. Because of this limited potential for local revenue generation, al-Siddiq and its subordinates have become increasingly dependent on external funding sources, relying on a complex web of regional and global partners to deliver funds to their intended destinations.

Subscribe now

Global Funding Sources and Reliance on Intermediaries

Given the high level of scrutiny al-Siddiq faces from international authorities, it is likely that the office functions as a clearing house between various IS branches, directing transfers when needed. In this way, the office serves as a steward for much of the IS’s global financial infrastructure, overseeing a diverse and international group of operators who carry out complex transfers using hawala networks and crypto exchanges. Recent crackdowns and geopolitical shifts have caused these funding networks to become increasingly global and diffuse, with this trend likely to continue as global authorities move against the organisation.

Al-Siddiq raises money by soliciting donations through its propaganda channels, including the Voice of Khorasan magazine, which its subordinate, al-Azaim Media Foundation, publishes in multiple languages on a monthly basis. Each issue of the magazine includes an advertisement soliciting donations from readers in Monero, the IS’s preferred cryptocurrency due to its enhanced privacy protections (Fig 1). It includes obscured transaction details that make it especially difficult for international authorities to detect.

Figure 1: The donation solicitation page at the end of most Voice of Khurasan issues. Obtained via Jihadology.

The donor base that funds al-Siddiq-linked groups, such as the ISKP, is increasingly geographically diverse. Although these groups previously solicited donations closer to home, such as from ethnic Tajiks and other Central Asians living in Russia via Telegram groups and QIWI, a Russian payments app, it is unclear whether Russian crackdowns since the Crocus City Hall attacks have stymied these revenue streams. Moreover, sanctions imposed on Russia following its invasion of Ukraine most likely prohibit any significant international transactions in roubles using Russian financial institutions. Recent arrests demonstrate how al-Siddiq-linked groups have broadened their donor base, such as the June 2024 arrest of a German man for transferring over US $1,700 worth of cryptocurrency to an ISKP-linked account. In another example from last December, UK authorities arrested a 24-year-old Luton man who allegedly transferred over £16,000 worth of Monero to the ISKP. These are just some of the many arrests associated with ISKP-linked donors over the past two years, with the growing reach of IS propaganda on platforms such as Telegram, Theema, RocketChat, and others likely playing an essential role in this trend.

Local Crackdowns Give Rise to an Increasingly Global Funding Network

Maktab al-Siddiq and its subordinates rely heavily on external revenue sources and the intermediaries who facilitate the flow of funds. This reliance on external actors has required the organisation to foster a vast global network of financial facilitators in multiple countries. For example, the ISKP transferred at least $2,000 in virtual assets to the group in Moscow responsible for carrying out the Crocus City Hall attack, likely using established al-Siddiq channels. As authorities continue to crack down on IS financial operations, these channels have become increasingly geographically broad.

Maktab al-Siddiq receives considerable funding from the Somalia-based Maktab al-Karrar, which oversees a vast illicit financial network spanning much of eastern, central, and southern Africa. A United Nations report from early 2023 found that al-Karrar was sending US $25,000 per month in cryptocurrency to the ISKP, a subordinate of Maktab al-Siddiq, with a July 2024 UN report finding that al-Karrar was the ISKP’s top revenue source.

According to USUS authorities, Türkiye has been a key transit hub for many global IS transfers, with IS operatives using local cryptocurrency exchanges, Hawala networks, and cash transfer apps such as PayPal and Western Union to move money into the country before transferring it to other affiliated groups worldwide. In Türkiye, the interests of al-Karrar and al-Siddiq likely merged in the past, with the former taking advantage of local crypto exchanges to transfer funds to the ladder. However, recent moves by Turkish authorities will likely cause operatives from both regional offices to seek new ways to transfer funds between them.

Turkish authorities have made sweeping moves to crack down on IS operatives in the country, arresting more than 3,600 suspected operatives since June 2023, according to official figures. In 2021, the international crime watchdog Financial Action Task Force (FATF) placed Türkiye on its ‘grey list’ due in part to the country’s role as a hub for terrorist financing, limiting international credit to the country and exacerbating its economic crisis. Türkiye is a major hub for cryptocurrency trading, and regulators there have recently introduced measures to combat criminal and terrorist financial networks through enhanced oversight and identification systems. The country has also cracked down on hawala networks, with many jewellers there acting as hawaladars due to the relatively stable value of their goods amid the country’s ongoing inflationary crisis. Turkish authorities also collaborated with their counterparts in Tajikistan – also a hub for IS financing – leading to the arrest of IS financiers in both countries in 2022 and 2023. Further, authorities identified US $2 million in suspicious transactions on the TRON blockchain in conjunction with TRM Labs and Binance. Binance also announced it collaborated with Tajikistan’s National Bank and other government agencies to disrupt terrorist financing there.

These crackdowns contributed to the FATF’s removal of Türkiye from its grey list in June 2024, and Ankara will likely continue to take harsh measures against terrorist financiers moving forward. For this reason, Türkiye is likely no longer a prime destination for IS financial transactions, as authorities continue to crack down on illicit activity, limiting the intersection between illicit hawala and crypto exchange activity. Similarly, enhanced scrutiny in Tajikistan and other Central Asian states, such as Uzbekistan, will also likely cause IS to look elsewhere for cryptocurrency transit hubs. As with al-Siddiq’s donor base, these sustained crackdowns will likely necessitate a further diffusion of the IS’s global financial network.

Recent events demonstrate the broad geographic reach of IS financial facilitators. In 2023, the US Treasury designated key individuals and companies based in the Maldives under their Office of Foreign Assets Control (OFAC) in relation to IS fundraising activity. The Maldives is a growing market for cryptocurrency adoption, noted for its lack of a clear regulatory regime, making it a potentially important node in terrorist financing. On a per capita basis, the Maldives sent more recruits to fight for the IS than any other between 2013 and 2018, and many of these veterans likely reside in the country at present.

In Spain, police arrested a Jordanian national in February 2024 on charges related to transferring €200,000 worth of Tether (USDT) on the TRON blockchain to various IS funding campaigns. The amount suggests that the suspect acted as an intermediary, receiving the funds from multiple sources before transferring them to IS-linked accounts. Last July, German police arrested two suspected IS operatives in Hamburg in connection with participating in a financing network, collecting cash donations and transferring them to IS sources. In December 2024, police in the US arrested a 35-year-old man in connection with providing material support to the IS.

Although it is unclear whether these individuals are specifically related to official al-Siddiq channels, they nonetheless demonstrate the broad global reach of IS financial networks, of which al-Siddiq is a beneficiary. As global crackdowns on IS activity continue, the organisation will have to continue to adapt as it has done before.

Subscribe now

Recommendations

Disrupting al-Siddiq’s increasingly broad and diffuse network of global financiers is essential to thwarting further attacks by groups such as the ISKP. Adopting more robust regulatory measures in countries such as Türkiye is a positive development. Still, the lack of formal regulations in other countries, such as the Maldives, represents a significant problem. For this reason, international law enforcement agencies and blockchain intelligence platforms such as TRM Labs should work to identify suspicious transactions, especially in countries lacking coherent regulations, and advocate for reform in countries with underdeveloped regulatory bodies. This approach is likely more effective than targeting individual donors and propaganda, which this series covered in Part 1.

Last October, Japanese authorities arrested 18 suspects on suspicion of money laundering using Monero. Monero uses advanced privacy technologies such as ring signatures and stealth addresses that make it difficult to track to follow transactions. Nonetheless, Japanese authorities identified US $670,000 worth of Monero transactions over several months by linking suspicious transactions to stolen credit card purchases on an e-commerce platform. Although other countries’ crypto markets may differ from Japan’s, this example could serve as a template for tracking illicit finance using Monero moving forward. Fintech firms, cryptocurrencies, and financial institutions should be forthcoming and aid wherever they can in such investigations.

Cryptocurrency trading platforms can play an essential role in identifying suspicious users and their transactions. Because companies such as Binance operate across global markets, they can serve as an essential mediator between international and local law enforcement, providing important recommendations and insights into suspicious local activities. Local and international open-source analysts can also play an essential role in this regard.

Finally, hawala networks represent a significant challenge for international authorities. Although combatting them is mostly a matter for local police, banks and international payment processors such as Western Union, PayPal and Wise should monitor closely for suspicious transactions as hawala networks rely on these in some instances to make up for cash from other transfers.

This is an article I recently wrote for the Global Network of Extremism and Technology (GNET). You can find the original link here.

This article was cited in the Financial Action Task Force (FATF) Report on Terrorist Financing, the most authoritative global assessment of terrorist financing risks in 2025, which you can find here.

The Islamic State West Africa Province (ISWAP) occupies much of the Lake Chad basin. Image source

Subscribe now

The Islamic State (IS) and its affiliate groups in West Africa and the Sahel remain resilient to the counterterrorism efforts of local and international authorities. Overseeing these groups is Maktab al-Furqan (the Furqan office), an elusive organisation likely based in Nigeria that provides local IS branches with operational guidance and international funding under the purview of the General Directorate of Provinces (GDP). According to UN reports, Al-Furqan is one of the three most successful financial branches of the Islamic State’s General Directorate of Provinces (GDP), along with the Somalia-based al-Karrar and the Afghan-based al-Siddiq. This Insight will examine what we know about al-Furqan, the organisations it oversees, its financial role in broader IS operations, and the potential threat this confluence of interests could pose moving forward.

What We Know About Maktab al-Furqan

Maktab al-Furqan derives its name from Abu Mohammed al-Furqan, the former IS minister of information who died in a US airstrike in Raqqa, Syria, on 7 September 2016. The organisation also shares its name with al-Furqan Media Foundation, a propaganda arm of the IS. Abu Bakr ibn Muhammad ibn ‘Ali al-Mainuki, a Nigerian national born in 1982, currently leads Maktab al-Furqan on behalf of the GDP, having served in senior roles since around 2018.

Personal differences between al-Mainuki and Boko Haram leader Mamman Nur reportedly contributed to a public and acrimonious split between the two organisations in 2016 that weakened the IS’s regional presence. However, al-Furqan remains one of the Islamic State’s “most vigorous and best-established regional networks.” In 2023, US Secretary of State Antony Blinken imposed sanctions on al-Mainuki and three others concerning their senior roles in the IS organisation, freezing any assets and blocking all asset transfers associated with him in the global financial system.

According to a May 2024 report by the US Department of Treasury:

“The ISIS branch in West Africa engages with the formal financial sector by using bank accounts to transfer money. Al-Furqan Office, which has a strong base in Nigeria and oversees ISIS-West Africa and other ISIS branches in the Sahel, Tunisia, Algeria, Libya, Cameroon, Niger and Chad.”

The Department of Treasury also assessed that unlike its more successful counterpart, Maktab al-Karrar, al-Furqan is likely seeking additional income due to a lack of stable revenue. Nevertheless, al-Furqan has protocols in place that maintain the regional financial structure of IS operations. For example, it reportedly collects 50 per cent of funds generated by the larger Islamic State West Africa Province (ISWAP) in Nigeria and redistributes them to smaller branches in Mali, Burkina Faso, Niger, and Chad, which fall under the purview of the newly restructured Islamic State–Sahel Province (ISSP). Moreover, with Nigeria now the world’s second-largest cryptocurrency trading market, al-Furqan likely plays a pivotal role in regional and global IS finance.

According to experts, with Nigeria’s nearly US $60 million in cryptocurrency transfers in 2023 and an estimated 33% of Nigerians investing in cryptocurrencies, the IS and other terrorist groups can easily hide their transactions within this growing centre of trading activity. The US Treasury also claims that the IS has been expanding its use of virtual assets in Africa since January 2024, with Nigeria-based Maktab al-Furqan likely playing a role in this process. With the IS reportedly moving away from cryptocurrencies such as Bitcoin and Tether to Monero, which offers enhanced privacy, al-Furqan can likely further disguise its activities within the Nigerian crypto market. Moreover, IS groups increasingly solicit donations in Monero through propaganda outlets such as its Voice of Khorasan publication, and it is possible that the organisation routes some of these solicited donations through entities associated with Maktab al-Furqan, given the scope of Nigeria’s crypto market.

Branches Under al-Furqan Remain Resilient Despite Operational Setbacks

Maktab Al-Furqan oversees two provinces of the IS, the ISWAP and the newly restructured Islamic State–Sahel Province (ISSP). ISWAP bases its operations along the shores of Lake Chad in northern Nigeria, where it generates revenue from local taxation on farmers and fishermen, as well as robbing civilians and kidnapping for ransom. The group’s 2016 split from Boko Haram has diminished its local revenue sources, and the two groups continue to vie for territorial control; on 13 January, ISWAP fighters murdered at least 40 local farmers for reportedly straying into their lands. In December 2021, an action group founded by the Economic Community of West African States (ECOWAS) found that ISWAP was moving around US $36 million in funds generated in its territories through Nigeria’s legitimate financial system annually, likely with the involvement of Maktab al-Furqan.

The ISSP is primarily centred in northern Mali and is one of the most violent and active terrorist organisations in the Sahel region, with a track record of targeting Malian, Wagner, and US military personnel as well as local civilians. It also receives funding from ISWAP via Maktab al-Furqan. The current literature provides little insight into how Maktab al-Furqan sends funds to the ISSP; however, it likely heavily relies on hawala, informal and largely unregulated financial systems used to send money internationally. Although the ISSP regularly contends with opposing forces such as the al-Qaeda-linked Jama’at Nusrat al Islam wa al Muslimin (JNIM) and Russia’s Wagner Group, since January 2023, the group has focused on expanding its territories, particularly in northeast Mali’s Gao and Menako regions.

Northern Mali is a lucrative route for the global narcotics trade, with local traffickers working with powerful cartels in Latin America to traffic drugs through the country’s north into Algeria and onto the European markets. If the ISSP can successfully seize these lucrative trafficking routes, it could become a significant revenue generator for the IS organisation and, with the help of Maktab al-Furqan, could funnel some of this revenue to finance global attacks by other branches, such as the Islamic State Khorasan Province (ISKP).

Regulatory Environment and Recommendations

Combating the ongoing expansion of IS in West Africa and the Sahel requires a systematic approach to the group’s local finances. Although military and police responses have had a limited impact to date, Nigerian authorities have initiated regulatory responses to the country’s growing cryptocurrency market in part due to concerns over terrorist financing. These responses include restricting banks and other financial institutions from trading in cryptocurrencies and limiting such transactions to regulated peer-to-peer platforms. These regulations aim to curtail cryptocurrency use in illicit activities like terrorist financing by requiring platforms to conduct transactions through approved channels and disclose key information about those involved in trading. In April 2024, Nigerian authorities secured a court order to freeze the assets of 1,146 suspicious accounts related to unauthorised forex trading, money laundering and terrorist financing.

The limited amount of information available on IS and Maktab al-Furqan’s financial activity in West Africa requires further research by international law enforcement, financial institutions, and fintech companies. Because IS networks rely heavily on Monero, a cryptocurrency that offers enhanced privacy compared to Bitcoin or Tether, industry professionals and international law enforcement should work closely with Nigerian authorities to trace suspicious transactions that may be associated with al-Furqan or the groups it oversees.

Hawala networks likely play an important role in IS’s growing influence in West Africa, especially regarding transfers between groups facilitated by Maktab al-Furqan. Limiting the use of such networks could play an essential role in limiting IS expansion in West Africa, particularly as ISSP relies on transfers facilitated by Maktab al-Furqan that, if left unchecked, could facilitate its seizure of highly lucrative narco-trafficking routes. Recently, the Central Bank of Nigeria (CBN) adopted new licensing guidelines with the aim of combating hawala by offering competitive rates and more reliable services. As Nigeria’s legitimate fintech sector continues to grow, global fintech firms should work to foster its development by sharing best practices related to cybercrime and counter-terrorism.

This is an article I recently wrote for the Global Network of Extremism and Technology (GNET). You can find the original link here.

This article was cited in the Financial Action Task Force (FATF) Report on Terrorist Financing, the most authoritative global assessment of terrorist financing risks in 2025, which you can find here.

It was also cited in a July 2025 report from the Africa Center for Strategic Studies, a U.S. Department of Defense Institution.

Subscribe now

Atop Cal Miskaad, an arid 2,000 meter-high mountain range in northeast Somalia’s Puntland region, an international cohort of Islamic State (IS) operatives oversee one of the organisation’s most important financial hubs. In recent years, IS fighters in Somalia have been central to the financial integration of much of the organisation’s African operations, including in the Democratic Republic of Congo, Mozambique, Uganda, and South Africa, into an increasingly cohesive network that funds the group’s growing global presence. These groups have already sent money to fund Afghan-based IS operations, and given the enormous revenue-generating potential of their respective regions, there is a high risk that they will continue funding further global attacks. This Insight examines the financial evolution of the Islamic State’s African operations, its sources of revenue, and how the tech industry can address this growing threat.

Islamic State Somalia (ISS) fighters in the Cal Miskaad region of Somalia’s Puntland. Image source

Building Sophisticated Financial Structures Inside a Power Vacuum

The Islamic State Somalia (ISS) serves as the IS’s financial hub for branches across much of Africa. Overseeing these operations is Abdiweli Mohamed Yusuf, a Somali man in his early forties who regularly meets with and reports to other leaders in the country, facilitates the international transfers of fighters and supplies, and manages the group’s local revenue streams. In July 2023, the United States Treasury’s Office of Foreign Assets Control (OFAC) imposed sanctions on Yusuf, naming him a Specially Designated Global Terrorist (SDGT). Yusuf reportedly works closely with Abdiqadir Mumin, another OFAC-designated terrorist who was the target of a US airstrike last May and whose death remains unconfirmed. If alive, Mumin remains the emir of the ISS-based al-Karrar Office, which runs financial programs, militant operations and logistics, and support for IS groups across eastern, central and southern Africa. In this way, the ISS and al-Karrar work closely in Somalia to facilitate regional and global terrorist activities.

Al-Karrar transfers hundreds of thousands of dollars in funds generated by ISS to IS operatives in South Africa, who transfer cash to other operatives in Kenya, Uganda, and Tanzania. The South African operatives then send the cash to IS branches in the DRC and Mozambique and other IS financial offices such as al-Siddiq and al-Furqan, which oversee financial operations in Central Asia and West Africa, respectively. The South African operatives frequently use Hawala networks (informal international transfer systems) to transfer funds internationally, usually in small amounts, to avoid suspicion by authorities.

Hawala systems rely on local brokers (Hawaladar) to make informal international transfers in exchange for a percentage-based commission. Under such a system, a sender gives cash to a Hawaladar who informs another Hawaladar of the intended location of the transfer. The second Hawaladar pays the agreed-upon sum to the recipient, later recouping it via another transfer or by balancing their accounts with other transactions, sometimes through legitimate banks. These systems are largely unregulated and highly opaque, making them challenging for authorities to monitor. Moreover, Hawala systems account for an estimated $325 billion in global transfers annually, making it difficult for authorities to differentiate innocent transfers from those used to fund terrorist activity.

Cryptocurrency transfers also comprise many international transfers between IS operatives. In early 2023, a United Nations report found that al-Karrar was sending $25,000 per month in cryptocurrency to the Afghan-based Islamic State Khorasan Province (ISKP), with a July 2024 report finding that al-Karrar was the ISKP’s top revenue source overall. The ISKP is one of the IS’s deadliest branches, responsible for some of the organisation’s most prominent international attacks in recent years, such as those that occurred in Kerman, Iran and Moscow, Russia in 2024. Although authorities generally find it easier to track cryptocurrency transfers than cash, IS and other terror groups have been innovative in evading authorities using currencies such as Bitcoin, Tether, and Monero. According to US authorities, Türkiye is a key transit hub for many global IS transfers, with IS operatives using local cryptocurrency exchanges as well as cash transfer apps such as PayPal and Western Union to move money into the country before transferring it to other affiliated groups worldwide.

To achieve such levels of financial success and sophistication, the ISS and al-Karrar Office have made their Puntland home a hub for international operatives, with foreigners comprising around half of the current IS operatives in Somalia. Authorities continue to struggle to contain such internationalised threats as IS branches across much of Africa operate well outside their respective spheres of control. For example, Somalia has been in a varied state of civil war since 1991, and its semi-autonomous state of Puntland, where the ISS operates, recently announced plans to govern itself wholly independently of the federal government. Although local authorities arrested six Moroccan nationals working with the ISS and sentenced them to death in early 2024, the group continues to operate in the Cal Miskaad mountains and elsewhere, largely with impunity.

Similarly, IS branches in the DRC and Mozambique mostly operate outside the territorial control of their respective governments. Meanwhile, operatives in South Africa take advantage of established economic structures, local corruption, and complacency to finance and provide support for international operations. Combating IS branches’ increasingly integrated financial operations in Africa requires much more than local police or militaries can provide.

Subscribe now

Lucrative Revenue Streams Pose a Global Threat

As Somalia-based IS financiers become increasingly sophisticated in their operations, their ability to access lucrative potential revenue streams through other IS-affiliated groups represents a global threat. Moreover, recent evidence suggests that much of the IS General Directorate of Provinces (GDP), an organisation that manages the group’s global operations financially and logistically, is now centred in Somalia, adding greater seriousness to the threat emanating from there. Given the enormous revenue-generating potential of IS groups in eastern, central, and southern Africa, the global threat posed by their financial integration remains high.

In Somalia, the ISS raises at least $100,000 USD monthly through extortion and illicit taxation, according to an early 2023 UN report, transferring some of this cash to other IS groups via al-Karrar office. Another recent estimate claimed that the group raised US $2 million in the first half of 2022. The ISS also reportedly raises revenue locally through other means, such as arms smuggling and kidnapping for ransom. However, money raised by ISS represents a small portion of the potential revenue of other IS branches working under the purview of al-Karrar.

In Mozambique, the Islamic State bases its operations in the northern province of Cabo Delgado, a region described as a ‘smuggler’s paradise‘ due to its lack of government control, abundance of natural resources, and lengthy coastline with over 30 coastal islands. Here, the local IS branch engages in illicit rosewood smuggling, with a 2024 Environmental Investigation Agency (EIA) report finding that 30% of the timber logged in Cabo Delgado is at a high risk of coming from insurgent-occupied forests. Chinese traders purchase the vast majority of Mozambique’s illicit timber exports, playing important roles in each step of the smuggling process. IS Mozambique operatives also reportedly raise cash via weapons and drug smuggling as well as kidnapping for ransom. The group raises an estimated $1.9 million in revenue each month, making it one of the largest potential contributors to IS coffers on the continent.

In the eastern DRC, the IS-aligned Allied Democratic Forces (ADF) have received funding to expand their operations in the province of Ituri despite joint operations by the DRC and Ugandan militaries. The investment could pay off significantly for the IS as Ituri province is rich in mineral and agricultural resources that the ADF can exploit. In South Africa, IS operatives not only transfer money between other IS cells across the continent but also raise cash locally via kidnappings, illicit mineral and narcotics trafficking, and scams targeting South African citizens using fake dating profiles on apps such as Tinder. In this way, the growing financial interconnectedness of the Somali-based al-Karrar office and local IS branches with significant fundraising potential could help fund future IS operations on the world stage, representing a significant regional and global threat.

Recommendations

A coordinated international response is required to address the growing financial integration and revenue generation potential of IS branches in eastern, central, and southern Africa.

One of the best ways to counter illicit finance through hawala systems is to offer better, legitimate financial services to Africa’s more than 350 million people without access to bank services. With South Africa playing an essential role as an IS financial transit hub and nearly a quarter of the population lacking access to legitimate financial services, offering a legitimate and transparent means for them to transfer money internationally could help authorities better target illicit Hawala transfers.

Hawala transfers used to finance terror activity rely on many more semi-legitimate transfers between innocent customers that mask their true intent – a process referred to as ‘layering‘ in illicit finance. By reducing the number of innocent transactions within Hawala systems, local authorities would be more able to pinpoint Hawala transfers used for nefarious purposes while gaining the means to track suspicious transfers made via legitimate financial institutions and fintech products. South African fintech products such as Tymebank, BankZero, and DiscoveryBank offer the unbanked a means to store and transfer money online with minimal fees. South African authorities should consider programmes that encourage the use of such products and initiatives to ensure citizens have access to the identification documents needed to access these services via their smartphones. Similarly, service providers such as PayPal and Western Union should continue to work with authorities while monitoring and reporting any suspicious use of their products.

Turkish authorities recently announced new regulations for cryptocurrency exchanges aimed at curbing terrorist financing and other illicit activities, which they will introduce in February 2025. These regulations include identification requirements for transactions exceeding $425 USD and require service providers to gather user information for previously unregistered wallet addresses. Türkiye is currently the world’s fourth largest crypto exchange market, with the Turkish Capital Markets Board (CMB) reporting 47 applications to firms seeking licenses to trade crypto since July 2024. These regulations represent a positive step in stemming illicit financial activity in the country, and crypto service providers in Türkiye and elsewhere should work closely with the CMB as well as the U.S. Treasury and other international authorities to better regulate the market and identify potential IS operatives seeking to finance their global activities. Similarly, cryptocurrencies such as Monero, Bitcoin, and Tether should continue to take steps to block or discourage IS and other terrorist groups from exploiting their networks by working with international authorities, as well as adopt strategies to better monitor their ledgers and identify potentially nefarious users.

Dating apps such as Tinder have strict terms of use, including prohibitions on extremist content and criminal usage. These terms also require the company to assist local law enforcement, should the need arise. South Africa has seen a wave of dating app-related criminal activity in recent years, and law enforcement there should work closely with Tinder and similar platforms to identify extremist profiles and request any information leading to the arrest of illicit users.

With resource smuggling representing a significant portion of the IS’s revenue-generating potential in Africa, authorities and tech companies should do more to combat the global marketing and sale of illegal goods. Chinese criminals play an important role in the smuggling and sale of illegal rosewood and other resources, and although Chinese authorities have worked with authorities in Mozambique and elsewhere to curb resource smuggling among Chinese criminal syndicates, these groups continue to operate largely with impunity. Moreover, Chinese tech companies such as Baidu and Taobao continue to market smuggled rosewood in the domestic market. In recent years, IS groups have increasingly called for attacks on China, giving Chinese authorities every incentive to deprive the organisation of funding by cracking down on their citizen’s illegal activities in Africa and better regulating what goods may be sold on their domestic e-commerce platforms.

Finally, many IS groups in Africa operate in remote regions with limited Internet access, which is essential for running sophisticated illicit global financial networks. Starlink continues to expand its presence in Africa, including providing service in Mozambique, with plans to expand into the DRC in 2025. The company is also considering providing service in Somalia. Indian authorities recently captured Starlink terminals from terrorists operating in the state of Manipur, highlighting the risk that other such organisations could access the Starlink network in the future. Although no evidence suggests IS groups operating in these places currently use Starlink, the company should be vigilant in limiting access to these groups. Starlink is currently working with the US military to limit Russia’s access to the network inside Ukraine. The company should work closely with local authorities as well as the Pentagon and OFAC to deny access to any potential IS operatives in Africa moving forward.

Subscribe now

This is an article I recently wrote for the Global Network of Extremism and Technology (GNET). You can find the original link here.

Subscribe now

Extremist groups increasingly target ethnic Tajiks for recruitment through sophisticated online propaganda campaigns, resulting in some of the world’s most horrific terrorist attacks over the past year, including those in Kerman, Iran and Moscow, Russia. An ethnic Persian people of central Asia, the largest Tajik populations exist in Afghanistan, where over 11 million comprise more than a quarter of the population, and Tajikistan, where just over 10 million comprise the country’s vast majority. For over a decade, the authoritarian government of Tajikistan and extremist groups in Afghanistan have waged an ideological war for the hearts and minds of Tajik people living on both sides of the border, with terrorist groups, including the Taliban-aligned Jama’at Ansarullah (JA) and the Islamic State Khorasan Province (ISKP), recruiting ethnic Tajiks to carry out massive attacks both regionally and globally. This Insight explores the various ways terror groups in the region seek to recruit and co-opt ethnic Tajiks using online propaganda, and possible measures platforms can take to address this growing challenge.

Image source

The Tajik Taliban and the Al-Qaeda Media Nexus

In 2021, the Afghan Taliban handed control of the Tajikistan border districts of northeast Afghanistan’s Badakhshan province to JA, an al-Qaeda-affiliated group formed in 2006. For years, JA has maintained a hostile relationship with the Emomali Rahmon authoritarian government in neighbouring Tajikistan, where the group came to prominence following a September 2010 suicide attack on a police station that killed two officers, two civilians, and wounded 28 others. Since then, JA has regularly focused on cross-border operations, including attacks, border raids, and online propaganda aimed at recruiting people within Tajikistan. JA publicly aligned itself with the Afghan Taliban following the latter’s takeover of Afghanistan in August 2021, earning the unofficial title of Tehreek-e-Taliban Tajikistan (TTT). JA’s ideology is primarily a mix of the Taliban’s brand of radical Islamism mixed with Tajik ethno-nationalism.

JA maintains an active presence on Telegram. In an October 2021 post on Telegram, Mahdi Arsalan, one of JA’s top leaders, declared his group’s readiness to invade Tajikistan. According to a November report from the Middle East Media Research Institute (MEMRI), JA members ‘continue to speak in Telegram channels about continuing Jihadist activity against the government of Emomali Rahman’. The group also benefits from the Taliban’s broader media nexus, including the reportedly Al-Qaeda-operated al-Mersaad media campaign, which produces Tajik language pro-Taliban content that mirrors news coverage on X and Telegram. Al-Mersaad’s coverage includes regular criticism of Tajikistan’s Rahmon government, referring to the president by his Soviet-era name ‘Rahmonov’ and labelling him a ‘communist’. The campaign also blames the Rahmon regime for the rise of its ideological rival, the ISKP, which also runs an extensive propaganda campaign to radicalise ethnic Tajiks on both sides of the border.

ISKP’s Recruitment of Ethnic Tajiks Produces Global Consequences

The ISKP targets and recruits ethnic Tajiks using an extensive online propaganda campaign, recruiting individuals to carry out notable attacks inside Tajikistan as well as launch attacks on the country from neighbouring Afghanistan. The group has also recruited Tajiks for international attacks, with major attacks in Kerman, Iran and Moscow reportedly perpetrated by ethnic Tajiks from Afghanistan and Tajikistan, respectively. On 8 April, Italian police arrested a Tajikistan national with alleged ties to the Islamic State (IS) at Rome’s Fiumicino International Airport. On 14 June, US authorities arrested eight Tajik nationals with alleged ties to IS who had illegally crossed the southern border. According to former US Deputy Assistant Secretary of Defense for Afghanistan, Pakistan, and Central Asia David Sevney, although the total number of Tajiks in the ISKP is ‘fairly small’, they form a ‘fairly large portion of the more aggressive and successful fighters.’

Ideologically, the ISKP shares JA’s criticisms of the Rahmon government but also extensively criticises the Taliban and their affiliated groups for their lack of aggression and ideological purity. In this way, the group targets disaffected members of JA and other extremist groups, such as the Turkestan Islamic Party (TIP), for recruitment. The ISKP’s al-Azaim Foundation is the largest contributor of propaganda for the group and functions as part of a broader constellation of sixteen other competing but aligned groups that produce translated content in Tajik and several other languages for a global audience. The ISKP even uses AI-generated newscasters to broadcast propaganda via its Khursan TV channel on Teleguard, a Swiss alternative to Telegram.

This extensive media ecosystem produces propaganda in the form of online print magazines and videos with narratives focused on criticising both the government of Tajikistan along with the Afghan Taliban and JA. For example, videos produced by these outlets frequently criticise Rahmon’s dictatorial and nepotistic rule, with many featuring faked images of the president’s humiliation and death. The ISKP also focuses much of its propaganda on the Taliban and its affiliated groups. On 24 November, the ISKP’s Voice of Khorasan publication released an issue on RocketChat extensively devoted to criticising the Taliban’s three years of de-facto control over Afghanistan titled ‘Three Years of the Taliban Apostates’ Filth’.

Figure 1: The cover of the 24 November issue of Voice of Khurasan titled ‘Three Years of the Taliban Apostates’ Filth’.

Subscribe now

Fertile Ground for Radicalism to Take Hold

Tajikistan’s regular crackdowns on religious freedom and other civil liberties, and a desperate economic situation on both sides of the border, have produced fertile ground for radicalism to take hold among ethnic Tajiks. Since 2009, the Rahmon government has adopted increasingly repressive tactics aimed at curbing extremism, including only permitting state-sanctioned religious activities and widespread surveillance of religious organisations. Measures have also included informal bans on hijabs for women and beards for men, leading to reports of police publicly and forcibly shaving men in some instances. Such repressive measures likely play a role in driving radicalisation in the country. Meanwhile, Tajikistan’s economic situation produces little opportunity for the public, with a recent government report noting that most citizens do not earn enough money to afford basic necessities. Moreover, the economic situation on the Afghan side of the border is even worse, with a 7 March United Nations report noting that Afghanistan’s economy has ‘basically collapsed’. In this way, crackdowns on religious freedom in Tajikistan and a spiralling economic situation on both sides of the border create a situation for extremist propaganda to take hold among disaffected Tajiks living in both countries.

Although Tajikistan’s government has sought to limit the public’s exposure to online extremist content using widespread Internet censorship, these measures have been broad in scope and have not stemmed to presence of extremist content in recent years. Instead, these efforts have served to hide the Tajikistani army’s use of deadly force by shutting down opposition media while indiscriminately cutting off Internet access in some 200,000 people living in the troubled Gorno-Badakhshan Autonomous Region (GBAR) for extended periods. Although such measures may limit some exposure to extremist online content at the expense of human rights, the recent involvement of Tajik nationals in terrorist attacks demonstrates extremists’ ability to reach them on both sides of the border effectively.

Figure 2: Al-Mersaad (also spelled Al-Mirsaad, Arabic for The Watchtower) operates openly on X, producing pro-Taliban content in the style of a media outlet. This Dari language account is one of several operated by the campaign, which also operates X accounts in English, Arabic, Uzbek, Russian, and more. The campaign’s slogan is ‘Stronghold for ideological struggle.’

Recommendations

Addressing extremist content aimed at ethnic Tajiks requires a tailored approach, including content moderation in the Tajik and Dari languages, which are mutually intelligible but use different scripts. Recent advances in artificial intelligence (AI) allow for automated content moderation, and these systems should continue to be programmed with advanced Tajik and Dari language capabilities. Although large platforms such as Facebook, X, Instagram, and TikTok have systems to limit extremist content and continue to advance in this area, other platforms such as Telegram and RocketChat are much more limited in their moderation. Apple and Google have successfully pushed Telegram to adopt stricter content moderation policies by threatening to expel it from their app stores. Still, extreme content continues to proliferate on the platform. In this way, further pressure is needed to bring companies like Telegram, Teleguard, RocketChat and others into compliance with best practices regarding content moderation.

The legal basis for limiting the content of the pro-Taliban media channel al-Mersaad, which operates extensively on X and Telegram, is much less clear as the group does not publicly align itself with the Taliban regime or al-Qaeda, which experts believe operates the channel in secret. In this way, further research demonstrating that designated terrorist groups operate al-Mersaad would be invaluable in shutting down the pro-Taliban campaign in the future.

This is an article I recently wrote for the Global Network of Extremism and Technology (GNET). You can find the original link here.

Subscribe now

On 17 September, al-Qaeda-affiliated Malian terror group Jama'at Nasr al-Islam wal Muslimin (JNIM) carried out a series of attacks in the country's capital of Bamako, targeting a military police training camp and the Modibo Keita International Airport. One anonymous security source claimed that 77 people died in these attacks, with 255 more wounded. These attacks comes as part of the group’s broader efforts to supplant established state authority in favor of its extreme interpretation of Islamic Law. JNIM's threat to Mali and the Sahel region at large continues to rise, with a 2023 study by the Africa Center for Strategic Studies concluding that JNIM was responsible for most of the 50% spike in fatalities attributed to Islamist groups in Somalia and the Sahel compared to the previous year.

Much of this threat stems from JNIM's direct and indirect leveraging of digital technologies, including an extensive online propaganda campaign and potential partnering with Chinese criminal groups to indirectly sell smuggled Malian rosewood. This insight will discuss JNIM’s online media presence and the online marketing of illicit rosewood that may help fund its regional operations.

Illegally harvested rosewood logs in Ghana, 2019. Image source

Online Propaganda Campaign

JNIM emerged in March of 2017, the result of a merger between four Malian terror groups: the regional branch of al-Qaeda of the Islamic Maghreb (AQIM), the Macina Liberation Front, al-Mourabitoun, and Ansar Dine. The latter of these groups had already developed an extensive online presence, devoting 44% of its total communications to news management, targeting Muslims abroad and drawing them into the Malian conflict as stakeholders. However, because the U.S. State Department designated Ansar Dine as a foreign terrorist organization in 2013, the group was limited in accessing social media platforms such as YouTube, instead relying heavily on Telegram channels to spread its communications, which became increasingly professionalized and regular. When Ansar Dine merged into JNIM, it gained access to al-Qaeda's assets and narratives, allowing for its messaging to spread further.

JNIM operates multiple telegram channels through its media wing, al-Zallaqa. According to Héni Nsaibia and Rida Lyammouri, al-Zallaqa temporarily creates or maintains closed Telegram accounts to spread propaganda across a designated network, disseminating it to supporters and subscribers. Although periodic crackdowns have caused al-Zallaqa to temporarily migrate to platforms outside Telegram, its strategy remains resilient, with the group releasing an audio address to recruit new members on Telegram and Chirpwire on 15 August. A recent investigation found that JNIM regularly releases content, such as claiming attacks, on its Telegram, sometimes on a daily basis, and that this content includes documentary-style videos that mimic news broadcasts.

Under al-Qaeda's umbrella, JNIM has partnered with Nigeria-based Ansaru to disseminate propaganda, radicalise members, and connect with similar organisations in other regions using Telegram accounts and chat rooms such as Rocket Chat and Element. Moreover, by leveraging its al-Qaeda affiliation, JNIM propaganda reaches broader audiences through the umbrella organiszation's global channels. For example, JNIM content reached Turkish audiences through an al-Qaeda-affiliated Turkish Telegram channel in 2018.

Subscribe now

Rosewood smuggling and the criminal groups that facilitate it

JNIM partly fuels its ongoing expansion by offering protection services to illicit rosewood smugglers in southern Mali. Between 2017 and 2022, China imported an estimated $220 million of rosewood from Mali alone. Rosewood is particularly prized in the Chinese market, where consumer demand for expensive replicas of Ming and Qing dynasty furniture made from the wood has been in high demand for decades. Ecological and other concerns caused Mali to ban rosewood exports in 2020, with other countries in the region following suit, including Senegal and Gambia in 2022. However, these bans have done little to stop JNIM and others from participating in this lucrative revenue source, with JNIM reportedly dislodging bandits who steal from smuggling rings more effectively than hired security agents. According to local reports, JNIM often kills those bandits who do not conform to its dictates.

China's insatiable demand for rosewood resulted in the depletion of Southeast Asian rosewood forests around 2010, causing Chinese traders to turn to Africa increasingly. For this reason, several Chinese criminal syndicates operating in Mali and neighbouring Senegal engage heavily in the illicit rosewood trade in collusion with local authorities and businesses. According to Organized Crime Index, Chinese companies smuggle rosewood out of Mali using authorized wood export companies, with the illicit rosewood trade linked to ivory smuggling operations as well. Although locals in southern Mali allege that Chinese traders pay protection fees to JNIM, the extent of relations between the two remains unclear. However, recent clashes between JNIM and the Malian government reveal that the terror group extensively uses Chinese-made weapons, including rocket-propelled grenades with anti-tank projectiles. For these reasons, the relationship between JNIM's rosewood protection racket and West Africa-based Chinese criminal syndicates requires further investigation.

China's tech sector plays a vital role in selling and marketing illegal West African rosewood, which helps fuel JNIM's rapid expansion there. Moreover, the sector makes little effort to hide its role. A simple search on Baidu, China’s top search engine, of ‘Malian Rosewood’ (红木马里) reveals dozens of related links to online retailers and articles extolling the benefits of Malian rosewood furniture. Although e-commerce sites focused solely on the domestic market, such as Taobao specifically market Malian rosewood and goods made from it, on Alibaba, the country's largest international e-commerce retailer, vendors do not list the national origin of their rosewood items, or claim it comes from markets where rosewood exports remain legal, such as India and South Africa. In this way, it remains unclear if Chinese retailers are marketing illegal Malian rosewood that helps fund JNIM’s ongoing insurgency to the global market.

A Baidu search of ‘Malian Rosewood’ (红木马里) reveals dozens of related links to online retailers and articles extolling the benefits of Malian rosewood furniture

Although Chinese online retailers market illegal Malian rosewood to the domestic market, they do not do so on international ecommerce platforms, such as Alibaba.

Recommendations

Authorities have struggled to contain extremist content from JNIM, the broader al-Qaeda network, and other terror groups on Telegram for some time. Although the Dubai-based company recently hired around 100 contractors to work as content moderators, with just 60 full-time employees, Telegram reportedly ignores most requests for assistance from global law enforcement agencies. However, Apple and Google, which have significant leverage over Telegram due to their ability to expel it from their app stores, have successfully pushed the company to restrict the spread of extremist content on its platform. This leverage, combined with the recent arrest of CEO Pavel Durov, could push Telegram to adopt more robust measures to counter extremist content like those of other platforms such as YouTube and Instagram. Given JNIM's resilience in using the app to spread its messaging to date, these enhanced moderation measures are likely necessary to counter its presence on the platform moving forward. Similarly, authorities should work in conjunction with Apple and Google to demand similar moderation practices at smaller chat services such as Chirpwire, Rocket Chat, and Element.

Governments and industry should do more to counter the global trade of illicit West African rosewood on Chinese e-commerce platforms. Although Western shipping companies Maersk and CMA-CGM have already committed to blocking and investigating their role in the illicit rosewood trade, respectively, this has not yet stopped smuggled rosewood from reaching China’s shores. Although international institutions can do little about the marketing of illicit rosewood inside China, customs agencies and law enforcement should more closely scrutinise the international sale of rosewood products on Chinese e-commerce platforms as these may be indirectly funding JNIM's ongoing expansion. Finally, further investigation is needed into Mali's illicit rosewood trade, including the local supply chains that may link Chinese smuggling syndicates and consumer markets to JNIM's ongoing expansion.

Commandos from the Mozambique Defense Armed Forces participate in a simulated raid during a U.S.-Mozambique Joint Combined Exercise Training, near Moamba, Mozambique, Aug. 19, 2024. U.S. Air Force photo by Tech. Sgt. Christopher Dyer.

Subscribe now

For centuries, cultures around the globe have prized items made from rosewood due to its fine-grained durability and rich coloring. Nowhere has this been more true than in China, where rosewood furniture, with its intense cherry red hues, carries cultural associations of prosperity and life-affirming energy.

Although historically only attainable for wealthy merchants and elite members of the Ming and Qinq-era imperial courts, in recent decades, the rapid expansion of China’s middle class has sparked an unprecedented explosion of demand for all things rosewood. This demand first wreaked havoc on forests across Asia. The decimation caused a wave of logging bans in fragile forest ecosystems, starting with China’s 1998 Natural Forest Protection Program. For this reason, Chinese smuggling rings have increasingly turned to some of sub-Saharan Africa’s most vulnerable forests, brazenly defying a series of bans on rosewood sales there.

From a smuggler’s haven on the Mozambican coast of southeast Africa to a complex network of middlemen in West Africa, Chinese intermediaries have been instrumental in the trade of rosewood, the single most illegally trafficked natural product on earth. Today, growing evidence suggests these vast criminal nexuses provide support to some of Africa’s deadliest terrorist groups, which have increasingly gained access to advanced weapons made by Chinese defense contractors.

This is an excerpt from an piece I recently wrote for the Diplomat. To read the full article, click here.

This article was published as part of the ongoing collaboration between Between the Lines and The Dispatch. Between the Lines listeners can access The Dispatch free for 30 days. Click here for more details.

Subscribe now

Halloween was widely celebrated in Shanghai, perhaps more than in Western cities. Thousands of costumed young people flocked to the city’s art deco core—a remnant of its jazz-age colonial past—joining dozens of parties set to the tune of Michael Jackson’s Thriller and other festive staples. Even the timing was perfect, as late October comes with cool breezes and golden ginkgo leaves beneath azure skies—a reprieve from Shanghai’s notoriously hot summers and damp, frigid winters. But 2024 was different. With little notice, police rounded up costumed partygoers, took them to stations, and forced them to remove their makeup and costumes before registering their names, IDs, and phone numbers. Uniformed officers posted notices stating, “All cosplaying is prohibited, and no Halloween makeup will be permitted.” Even the weather turned, with unseasonal rains soaking the streets. 

Authorities in Shanghai remain on edge following the White Paper protests of November 2022, when thousands of youth took to the streets in response to draconian COVID prevention measures and the economic and social hardships that came with them. Moreover, many tongue-in-cheek costumes mocked pandemic prevention workers and other sensitive topics during last year’s Halloween festivities, something authorities were unwilling to bear this year. Elsewhere in the country, there are signs of growing economic discontent. Workers regularly protest layoffs and unpaid wages at the many struggling factories that dot the southern provinces. There were 719 such incidents in the first half of this year, compared to 696 during the same period last year and just 37 strikes in all of 2022. Many of these labor disputes have provoked violent responses from authorities, most infamously when riot gear-clad police beat workers outside a Foxconn iPhone plant in Zhengzhou in November 2022. 

China’s domestic crackdowns belie a deep and growing sense of fear among its political elites. This insecurity runs counter to the frequent media portrayal of China as a confident and rising superpower and speaks to the growing economic and social crises gripping the country. 

Manufacturing crisis and unemployment.

China’s manufacturing sector, the country’s largest generator of desperately needed foreign cash and investment, has fallen on hard times. Exports have fallen below expectations amid a softening global economy, reduced domestic demand, and increased competition from emerging markets such as India, Mexico, and Vietnam. Although China aims to transition toward “high quality” manufacturing, including items such as electric vehicles (EVs) and batteries, rising protectionism on the world stage threatens its export prospects, especially following the recent election of Donald Trump. Despite significant investment and potential, some 52,000 Chinese EV-related companies shut down last year amid weakening demand and rising raw material costs. Many analysts blame significant government subsidies to the industry for creating overcapacity—a problem that is hardly exclusive to the EV sector. 

Read more