Combating the Islamic State Finance: Somalia and the Pan-African Nexus

According to the United Nations, the Islamic State’s most successful regional financial offices include al-Karrar, al-Furqan, and al-Siddiq. This series breaks down each office’s operations.

This is an article I recently wrote for the Global Network of Extremism and Technology (GNET). You can find the original link here.

Atop Cal Miskaad, an arid 2,000 meter-high mountain range in northeast Somalia’s Puntland region, an international cohort of Islamic State (IS) operatives oversee one of the organisation’s most important financial hubs. In recent years, IS fighters in Somalia have been central to the financial integration of much of the organisation’s African operations, including in the Democratic Republic of Congo, Mozambique, Uganda, and South Africa, into an increasingly cohesive network that funds the group’s growing global presence. These groups have already sent money to fund Afghan-based IS operations, and given the enormous revenue-generating potential of their respective regions, there is a high risk that they will continue funding further global attacks. This Insight examines the financial evolution of the Islamic State’s African operations, its sources of revenue, and how the tech industry can address this growing threat.

Islamic State Somalia (ISS) fighters in the Cal Miskaad region of Somalia’s Puntland. Image source

Building Sophisticated Financial Structures Inside a Power Vacuum

The Islamic State Somalia (ISS) serves as the IS’s financial hub for branches across much of Africa. Overseeing these operations is Abdiweli Mohamed Yusuf, a Somali man in his early forties who regularly meets with and reports to other leaders in the country, facilitates the international transfers of fighters and supplies, and manages the group’s local revenue streams. In July 2023, the United States Treasury’s Office of Foreign Assets Control (OFAC) imposed sanctions on Yusuf, naming him a Specially Designated Global Terrorist (SDGT). Yusuf reportedly works closely with Abdiqadir Mumin, another OFAC-designated terrorist who was the target of a US airstrike last May and whose death remains unconfirmed. If alive, Mumin remains the emir of the ISS-based al-Karrar Office, which runs financial programs, militant operations and logistics, and support for IS groups across eastern, central and southern Africa. In this way, the ISS and al-Karrar work closely in Somalia to facilitate regional and global terrorist activities.

Al-Karrar transfers hundreds of thousands of dollars in funds generated by ISS to IS operatives in South Africa, who transfer cash to other operatives in Kenya, Uganda, and Tanzania. The South African operatives then send the cash to IS branches in the DRC and Mozambique and other IS financial offices such as al-Siddiq and al-Furqan, which oversee financial operations in Central Asia and West Africa, respectively. The South African operatives frequently use Hawala networks (informal international transfer systems) to transfer funds internationally, usually in small amounts, to avoid suspicion by authorities.

Hawala systems rely on local brokers (Hawaladar) to make informal international transfers in exchange for a percentage-based commission. Under such a system, a sender gives cash to a Hawaladar who informs another Hawaladar of the intended location of the transfer. The second Hawaladar pays the agreed-upon sum to the recipient, later recouping it via another transfer or by balancing their accounts with other transactions, sometimes through legitimate banks. These systems are largely unregulated and highly opaque, making them challenging for authorities to monitor. Moreover, Hawala systems account for an estimated $325 billion in global transfers annually, making it difficult for authorities to differentiate innocent transfers from those used to fund terrorist activity.

Cryptocurrency transfers also comprise many international transfers between IS operatives. In early 2023, a United Nations report found that al-Karrar was sending $25,000 per month in cryptocurrency to the Afghan-based Islamic State Khorasan Province (ISKP), with a July 2024 report finding that al-Karrar was the ISKP’s top revenue source overall. The ISKP is one of the IS’s deadliest branches, responsible for some of the organisation’s most prominent international attacks in recent years, such as those that occurred in Kerman, Iran and Moscow, Russia in 2024. Although authorities generally find it easier to track cryptocurrency transfers than cash, IS and other terror groups have been innovative in evading authorities using currencies such as Bitcoin, Tether, and Monero. According to US authorities, Türkiye is a key transit hub for many global IS transfers, with IS operatives using local cryptocurrency exchanges as well as cash transfer apps such as PayPal and Western Union to move money into the country before transferring it to other affiliated groups worldwide.

To achieve such levels of financial success and sophistication, the ISS and al-Karrar Office have made their Puntland home a hub for international operatives, with foreigners comprising around half of the current IS operatives in Somalia. Authorities continue to struggle to contain such internationalised threats as IS branches across much of Africa operate well outside their respective spheres of control. For example, Somalia has been in a varied state of civil war since 1991, and its semi-autonomous state of Puntland, where the ISS operates, recently announced plans to govern itself wholly independently of the federal government. Although local authorities arrested six Moroccan nationals working with the ISS and sentenced them to death in early 2024, the group continues to operate in the Cal Miskaad mountains and elsewhere, largely with impunity.

Similarly, IS branches in the DRC and Mozambique mostly operate outside the territorial control of their respective governments. Meanwhile, operatives in South Africa take advantage of established economic structures, local corruption, and complacency to finance and provide support for international operations. Combating IS branches’ increasingly integrated financial operations in Africa requires much more than local police or militaries can provide.

Lucrative Revenue Streams Pose a Global Threat

As Somalia-based IS financiers become increasingly sophisticated in their operations, their ability to access lucrative potential revenue streams through other IS-affiliated groups represents a global threat. Moreover, recent evidence suggests that much of the IS General Directorate of Provinces (GDP), an organisation that manages the group’s global operations financially and logistically, is now centred in Somalia, adding greater seriousness to the threat emanating from there. Given the enormous revenue-generating potential of IS groups in eastern, central, and southern Africa, the global threat posed by their financial integration remains high.

In Somalia, the ISS raises at least $100,000 USD monthly through extortion and illicit taxation, according to an early 2023 UN report, transferring some of this cash to other IS groups via al-Karrar office. Another recent estimate claimed that the group raised US $2 million in the first half of 2022. The ISS also reportedly raises revenue locally through other means, such as arms smuggling and kidnapping for ransom. However, money raised by ISS represents a small portion of the potential revenue of other IS branches working under the purview of al-Karrar.

In Mozambique, the Islamic State bases its operations in the northern province of Cabo Delgado, a region described as a ‘smuggler’s paradise‘ due to its lack of government control, abundance of natural resources, and lengthy coastline with over 30 coastal islands. Here, the local IS branch engages in illicit rosewood smuggling, with a 2024 Environmental Investigation Agency (EIA) report finding that 30% of the timber logged in Cabo Delgado is at a high risk of coming from insurgent-occupied forests. Chinese traders purchase the vast majority of Mozambique’s illicit timber exports, playing important roles in each step of the smuggling process. IS Mozambique operatives also reportedly raise cash via weapons and drug smuggling as well as kidnapping for ransom. The group raises an estimated $1.9 million in revenue each month, making it one of the largest potential contributors to IS coffers on the continent.

In the eastern DRC, the IS-aligned Allied Democratic Forces (ADF) have received funding to expand their operations in the province of Ituri despite joint operations by the DRC and Ugandan militaries. The investment could pay off significantly for the IS as Ituri province is rich in mineral and agricultural resources that the ADF can exploit. In South Africa, IS operatives not only transfer money between other IS cells across the continent but also raise cash locally via kidnappings, illicit mineral and narcotics trafficking, and scams targeting South African citizens using fake dating profiles on apps such as Tinder. In this way, the growing financial interconnectedness of the Somali-based al-Karrar office and local IS branches with significant fundraising potential could help fund future IS operations on the world stage, representing a significant regional and global threat.

Recommendations

A coordinated international response is required to address the growing financial integration and revenue generation potential of IS branches in eastern, central, and southern Africa.

One of the best ways to counter illicit finance through hawala systems is to offer better, legitimate financial services to Africa’s more than 350 million people without access to bank services. With South Africa playing an essential role as an IS financial transit hub and nearly a quarter of the population lacking access to legitimate financial services, offering a legitimate and transparent means for them to transfer money internationally could help authorities better target illicit Hawala transfers.

Hawala transfers used to finance terror activity rely on many more semi-legitimate transfers between innocent customers that mask their true intent – a process referred to as ‘layering‘ in illicit finance. By reducing the number of innocent transactions within Hawala systems, local authorities would be more able to pinpoint Hawala transfers used for nefarious purposes while gaining the means to track suspicious transfers made via legitimate financial institutions and fintech products. South African fintech products such as Tymebank, BankZero, and DiscoveryBank offer the unbanked a means to store and transfer money online with minimal fees. South African authorities should consider programmes that encourage the use of such products and initiatives to ensure citizens have access to the identification documents needed to access these services via their smartphones. Similarly, service providers such as PayPal and Western Union should continue to work with authorities while monitoring and reporting any suspicious use of their products.

Turkish authorities recently announced new regulations for cryptocurrency exchanges aimed at curbing terrorist financing and other illicit activities, which they will introduce in February 2025. These regulations include identification requirements for transactions exceeding $425 USD and require service providers to gather user information for previously unregistered wallet addresses. Türkiye is currently the world’s fourth largest crypto exchange market, with the Turkish Capital Markets Board (CMB) reporting 47 applications to firms seeking licenses to trade crypto since July 2024. These regulations represent a positive step in stemming illicit financial activity in the country, and crypto service providers in Türkiye and elsewhere should work closely with the CMB as well as the U.S. Treasury and other international authorities to better regulate the market and identify potential IS operatives seeking to finance their global activities. Similarly, cryptocurrencies such as Monero, Bitcoin, and Tether should continue to take steps to block or discourage IS and other terrorist groups from exploiting their networks by working with international authorities, as well as adopt strategies to better monitor their ledgers and identify potentially nefarious users.

Dating apps such as Tinder have strict terms of use, including prohibitions on extremist content and criminal usage. These terms also require the company to assist local law enforcement, should the need arise. South Africa has seen a wave of dating app-related criminal activity in recent years, and law enforcement there should work closely with Tinder and similar platforms to identify extremist profiles and request any information leading to the arrest of illicit users.

With resource smuggling representing a significant portion of the IS’s revenue-generating potential in Africa, authorities and tech companies should do more to combat the global marketing and sale of illegal goods. Chinese criminals play an important role in the smuggling and sale of illegal rosewood and other resources, and although Chinese authorities have worked with authorities in Mozambique and elsewhere to curb resource smuggling among Chinese criminal syndicates, these groups continue to operate largely with impunity. Moreover, Chinese tech companies such as Baidu and Taobao continue to market smuggled rosewood in the domestic market. In recent years, IS groups have increasingly called for attacks on China, giving Chinese authorities every incentive to deprive the organisation of funding by cracking down on their citizen’s illegal activities in Africa and better regulating what goods may be sold on their domestic e-commerce platforms.

Finally, many IS groups in Africa operate in remote regions with limited Internet access, which is essential for running sophisticated illicit global financial networks. Starlink continues to expand its presence in Africa, including providing service in Mozambique, with plans to expand into the DRC in 2025. The company is also considering providing service in Somalia. Indian authorities recently captured Starlink terminals from terrorists operating in the state of Manipur, highlighting the risk that other such organisations could access the Starlink network in the future. Although no evidence suggests IS groups operating in these places currently use Starlink, the company should be vigilant in limiting access to these groups. Starlink is currently working with the US military to limit Russia’s access to the network inside Ukraine. The company should work closely with local authorities as well as the Pentagon and OFAC to deny access to any potential IS operatives in Africa moving forward.