South African National Terrorism Financing Risk Assessment

SOUTH AFRICA SOUTH AFRICAN NATIONAL TERRORISM FINANCING RISK ASSESSMENT 31 MARCH 2022

Page 2 of 15 CONTENTS

1. Introduction..................................................................................... 3
2. Terrorism overview ......................................................................... 4
3. What is terrorism financing? ........................................................... 6
4. A note on methodology................................................................... 7
5. What makes South Africa vulnerable to terrorism financing?......... 9
6. South Africa’s counter-terrorist financing framework.................... 14
7. The way forward ........................................................................... 14
8. Conclusion.................................................................................... 15

Page 3 of 15

1. Introduction The 2022 National Terrorism Financing Risk Assessment identifies the terrorism financing risks and vulnerabilities currently facing South Africa. It aims to assist government, private sector and the general public to understand the associated risks and vulnerabilities and to assist in the implementation of appropriate preventive measures. This assessment is limited to the identification of inherent terrorism financing risks in South Africa and will not address the mitigating measures being implemented by the relevant role players to counter the financing of terrorism. It will also not include country specific case studies and typologies due to the sensitive nature of ongoing investigations and court proceedings. Terrorism financing poses a direct threat to South Africa’s national security as well as the integrity and reputation of its financial system. Terrorism financing has the potential to finance and enable terrorist activities locally and abroad. Over and above posing a security threat, it also impacts the integrity of non-financial institutions such as charities and non-profit organisations which could be exploited, often unwittingly, for the financing of terrorism. Terrorist groups make use of multiple methods to raise, move, store and/or use funds and exploit the inherent vulnerabilities of countries’ regulatory, financial, law enforcement and security frameworks. Their techniques vary and depend on the sophistication and objectives of terrorists, terrorist organisations and their sympathisers. Terrorism financing investigations are usually extremely complex, particularly with regard to the identification of financiers and ultimate end-users of the generated funds. This is due to the myriad financial transaction mediums such as cash and crypto assets, the international nature of transfers between financial jurisdictions, the informal financial sector (e.g. Hawala), as well as the capacity and capability challenges faced by financial institutions, regulators, supervisory bodies and law enforcement agencies. Funds intended for terrorism related activities may be derived from legitimate as well as from illicit sources, making terrorism financing particularly difficult to detect, disrupt and prevent. The constant evolution of terrorism financing methods in response to new and increasingly sophisticated countermeasures remains a continual challenge locally and for international financial oversight bodies such as the Financial Action Task Force (FATF) and its regional-style bodies. Taking note of the findings in this assessment, and putting in place workable measures to prevent, detect, investigate and prosecute the financing of terrorism, is imperative to effectively combat terrorism financing.

Page 4 of 15 2. Terrorism overview South Africa considers terrorism, and the financing thereof, a national security priority. Although the country has not been affected by terrorism as drastically as other regions in the world, South Africa is not immune to international, regional and domestic terrorism. Terrorism knows no borders and the South African authorities therefore cannot be complacent. Thousands of violent religious extremists from across the world travelled to Syria and Iraq during 2014 and 2015, heeding a call by the Islamic State (IS) and other extremist groups, including Al-Qaeda aligned groups to settle in the Caliphate and join their cause. Subsequent territorial losses and military defeat of the Islamic State of Iraq and Syria (ISIS) at the end of 2016, however, has led to attempts by these foreign terrorist fighters (FTFs) to flee the Middle East and to return to their countries of origin or to relocate to other targeted areas or regions where security is considered to be less stringent. This includes the African continent. IS has since urged FTFs and sympathisers, some of whom did not manage to travel to the Middle East at the height of the Caliphate, to conduct attacks in their home countries and areas to which they relocated . They have urged supporters to conduct rudimentary, yet impactful attacks directed at soft targets whose beliefs conflict with IS. Terrorist and violent extremist groups continue to exploit the Internet and online media platforms to spread their radical views and propaganda for the recruitment, financing, training and incitement to commit acts of terrorism. In this context, the threat posed by lone actors, who are self-radicalised, poses a particular security challenge. These lone actors have the ability to conduct largely unsophisticated, but lethal attacks against targets. These attackers often have few or no formal ties or direct exposure to terrorist groups. On the African continent, terrorist groups continue to spread and influence terrorist activities across borders, entrenching themselves into existing conflicts, exploiting security vulnerabilities and enabling factors, and then causing cross-border spill overs. In southern Africa, the attacks carried out by Al Sunnah Wa Jama’ah (ASWJ) in northern Mozambique, many of which having been claimed by the Islamic State Central Africa Province (ISCAP), is of growing security concern. ASWJ, through its links to regional terrorist groups, such as ISCAP, serves as an attractive option for FTFs to conduct “violent” jihad when seeking to demonstrate their support of the ideology. South African authorities are increasingly concerned about the impact that this is having on Mozambique’s neighbouring countries, as supporters may consider the conflict zone a viable operational theatre or safe haven from where to direct operations in the region. The possibility of retaliatory attacks in response to military deployment by Southern African Development Community (SADC) countries’ to assist in the stabilisation in northern Mozambique remains a concern. In July 2020, IS warned that it would retaliate with attacks if South Africa became involved in the conflict in Mozambique. South Africa needs to consider the possibility that its territory may be used as a logistical hub, transit country (channelling terrorists, resources and funds) and recruitment base by terrorist

Page 5 of 15 groups, including the ASWJ. This may be due to the country being an economic hub in the region and on the continent, as well as the existing security risks and vulnerabilities in the region. These vulnerabilities include long and porous borders, challenges in addressing largely informal and cash-based economies as well as the use of often inadequately regulated alternative remittance systems and mobile payment systems. The presence of organised crime networks, trafficking and illicit smuggling routes, displacement and movement of people as well as the proliferation of small arms and weapons are further vulnerabilities in the region that need to be considered in strengthening countermeasures. SADC has recently updated its Regional Counter-Terrorism Strategy and Plan of Action and is in the process of establishing a Regional Counter-Terrorism Centre. In response to a changing terrorism landscape necessitating a critical review of its countermeasures, South Africa is finalising changes to its counter-terrorism legislation and has made progress with the establishment of dedicated and specialised financial investigative and intelligence units. Additionally, South Africa has several domestic terrorism and terrorism financing risk factors to consider. Support for Foreign Terrorist Organisations (FTOs) in the form of South African nationals who have travelled to and returned from conflict zones as well as foreign suspected terrorists transiting through or staying in South Africa is acknowledged. South Africa has a history of isolated incidents of domestic extremism, particularly violent right-wing extremism, that is continuously monitored but is not currently deemed to be as high a risk as international terrorism trends and terrorist groups. The terrorism financing risk presents a security risk as well as a reputational risk due to obligations in accordance with the United Nations and international oversight bodies including FATF. South Africa is a member of both bodies, which require the country to take the necessary measures to effectively prevent exploitation for terrorism financing purposes.

Page 6 of 15 3. What is terrorism financing? Terrorism financing is the financial and logistical support, in any form, of terrorism or of individuals, entities or groups that encourage, plan or engage in acts of terrorism and includes plans or intended plans to support or commit an act of terrorism. It generally falls into two broad categories: • Funding the direct costs associated with undertaking a terrorism act, for example expenses for recruitment, travel, explosive materials, weapons, vehicles and training, etc. • Funding required to sustain a terrorist, a terrorist group, network or cell, either inside the country, transiting the country, or emanating from abroad. The terrorism financing process typically involves four stages: raising, moving, storing or using funds and other assets, the stages are not necessarily sequential or linked to a specific terrorism related activity. • Raising funds via numerous methods including legitimate means, donations, self￾funding and criminal activity. • Moving funds to an individual terrorist or a terrorist group, network or cell through a series of witting or unwitting facilitators and/or intermediaries by means of banking and remittance sectors, informal value transfer systems, bulk cash smuggling and crypto assets, and smuggling high value commodities such as oil, art, antiquities, agricultural products, precious metals and gems, as well as used vehicles. • Storing funds intended for an individual terrorist or a terrorist group, network or cell by similar means used in moving funds while planning for their use. • Using funds for payment when needed to further the terrorist organisation, group, network or cell’s goals, including living expenses, to purchase weapons or bomb￾making equipment and/or to finance terrorism operations.

Page 7 of 15 4. A note on methodology South Africa’s first terrorist financing risk assessment is a Cabinet-approved Inter￾Departmental, multi-agency, government-led process, involving the private sector. It is the product of a multi-disciplinary process based on a working methodology, agreed to by all parties involved, that attempts to identify, analyse and understand terrorist financing vulnerabilities, threats and risks and serves as a first step in addressing them. The national risk assessment process involved a range of stakeholders as part of an Inter￾Departmental Working Group (IWG) and a multitude of key authorities across operational, policy and supervisory functions. The IWG consists of the following government departments, law enforcement agencies, intelligence agencies, financial and non-financial supervisors and regulators: • National Treasury • Financial Intelligence Centre • South African Police Service • National Prosecuting Authority • South African Revenue Service • State Security Agency • National Intelligence Co-ordinating Committee • Department of Home Affairs • Department of Justice and Constitutional Development • Department of International Relations and Cooperation • Department of Trade and Industry and Competition • Department of Social Development • Companies and Intellectual Property Commission • South African Reserve Bank (and Prudential Authority) • Financial Sector Conduct Authority. In developing the methodology for this assessment, the IWG considered the latest international good practice and research. This included guidance developed by FATF, the United Nations Office on Drugs and Crime, the World Bank and the International Monetary Fund, international training approaches followed by other countries as well as the experience and expert opinions of key stakeholders in South Africa's counter-terrorism financing regime.

Page 8 of 15 The following key terms are used throughout the assessment: Terrorist activities and related activities: 'Terrorist activities' and 'terrorist related activities' as defined in the Protection of Constitutional Democracy against Terrorist and Related Activities Act, 2004 (Act 33 of 2004) (POCDATARA Act). Threat A terrorism financing threat is a person or group of people with the potential to cause harm by raising, moving, storing or using funds and other assets (whether from legitimate or illegitimate sources) for terrorism purposes. Terrorism financing threats may include domestic or international terrorist organisations and their facilitators, their funds, as well as past, present and future terrorism financing activities and individuals and populations sympathetic to terrorist organisations. Vulnerability Terrorism financing vulnerability comprises those aspects that can be exploited by the threat or that may support or facilitate its activities. Vulnerabilities may include features of a particular sector, a financial product or type of service that makes them attractive for terrorism financing. Vulnerabilities may also include weaknesses in measures designed specifically for the countering of terrorism financing, or more broadly in anti-money laundering or the countering of terrorism financing systems or controls, or contextual features of a jurisdiction that may impact opportunities for terrorism financiers to raise or move funds or other assets. There may be some overlap in the vulnerabilities exploited for both money laundering and terrorism financing. Consequence In the context of terrorism financing, consequence refers to the impact or harm that terrorism financing may cause. This includes the effect of the underlying terrorism activity on domestic or institutional financial systems and institutions, as well as the economy, political stability and society more generally. Risk A terrorism financing risk can be seen as a function of three factors: threat, vulnerability and consequence. It involves the risk that funds or other assets intended for use by a terrorist or terrorist organisation are being raised, moved, stored, or used in, or through a jurisdiction, in the form of legitimate or illegitimate funds. An assessment of terrorism financing risk will typically involve a consideration of terrorism financing threats and vulnerabilities and consequences.

Page 9 of 15 5. What makes South Africa vulnerable to terrorism financing? Cash and alternative remittance services Cash remains a high risk for use in terrorism financing due to it being easily accessible, largely untraceable and anonymous. In addition to cash moving domestically outside the country’s formal banking sector, there is a significant risk that the cross-border movement of cash may be used by South Africans and/or foreigners in transit as a channel to fund terrorist groups and their activities in a foreign jurisdiction. This risk increases when South Africans travel to high￾risk areas such as Syria and areas in the region where terrorism activity is pronounced, this may be to participate in the activities or to be used as money mules or cash couriers to these areas. South Africa has large émigré communities from countries associated with terrorism such as Somalia, Kenya, Nigeria and Mozambique. The predominant use of cash in these communities coupled with a large informal economy in South Africa and neighbouring countries increases the risk for terrorism financing. The use of unregulated and alternative remittance services, such as hawala, and mobile money payments by low-income groups and émigré communities, is prevalent in South Africa. It is estimated that a large proportion (up to 70 percent) of cross￾border remittances between South Africa and the SADC remittance market are informal, referring to the movement of money outside the formal banking sector. Cash transmitted in this manner may be carried directly to a particular conflict country, or more likely, to neighbouring countries where it can be carried overland across further borders. It is difficult to detect and confiscate cash moved across borders, and outside the formal banking sector. A significant challenge is to distinguish the alternate remittance systems used for channelling funds by the vast émigré community in South Africa, as these systems are unregistered, unregulated and operate outside the formal banking sector. It is equally challenging to distinguish between legitimate diaspora remittances for the maintenance and financial support of families in countries of origin and money syphoned off to fund terrorism related activities. Border integrity South Africa’s unique geographical position and its status as regional economic hub with its sophisticated financial system makes it attractive for terrorists and their supporters, and vulnerable to terrorism financing. It is a concern that South Africa’s border integrity remains under pressure as international terrorists have managed to travel in and out of the country abusing South African travel and identity documents. Long, porous borders in the SADC region with relatively poor controls at numerous land and sea entry points as well as many areas along the borderline being remote and not easily accessible for border patrol could allow terrorist suspects to illegally enter South Africa and extend their stay to avoid detection in other jurisdictions. Some of these terrorist suspects could

Page 10 of 15 likely link up with local terrorist suspects and become a conduit through which funds are collected or transmitted to terrorist groups in the region and further afield. Current terrorist activities in northern Mozambique have brought the terrorism threat closer, with the movement of a small number of terrorist suspects between South Africa and Mozambique having been recorded. These terrorist suspects are likely to travel with cash to be used for personal consumption or to fund the activities of the insurgents in Mozambique. Claims of funding for attacks in Mozambique and Kenya emanating from South Africa is of serious concern and investigations to confirm or refute claims and quantify the possible movement of funds across borders are ongoing. International crime syndicates and refugees travelling through the region may also abuse South Africa, potentially facilitating the movement of cash or other assets to terrorist groups in the region. Charities and non-profit organisations Charities and non-profit organisations (NPOs) play a critical role in providing educational, religious and humanitarian services. While crucial in many ways to daily life in the developing world, charities and NPOs can be exploited and used as vehicles to raise, store and divert funds towards terrorism. The NPO sector in South Africa is well established and comprises various voluntary charities and associations. South African-based NPOs and charities are vulnerable to potential abuse by terrorist groups despite the fact that it is not currently assessed as posing a significant terrorism financing risk. Although there have been no terrorism financing convictions related to the South African NPO sector, the prevalence of cash and specifically charities operating near or in conflict zones associated with terrorism pose a higher terrorism financing risk. These charities and NPOs, or individuals within the charities and NPOs are at risk of being exploited by terrorist groups in these areas. Funds collected in South African communities, ostensibly for benevolent causes, through crowd funding or donations, and channelled abroad for humanitarian aid could potentially be intercepted and siphoned off by terrorist groups. Some donors may willingly provide donations to support these groups as a means to support a particular call for aid and assistance, while other donors, and the charities and NPOs themselves, may be coerced, extorted or misled about the purpose of funding. The possibility that funds channelled by local charities and NPOs to international NPOs and aid organisations can also be used to disguise funding to foreign conflict zones and terrorist groups. The risk of potential terrorism financing abuse could increase if funds collected are channelled through less formal, unregulated and start-up entities. It is likely that funds collected could be sent via conduit countries to conflict zones making it more difficult for financial institutions to link international money transfers directly to terrorism. Conduit entities may also be used to channel terrorism financing to evade resolutions of the United Nations Security Council.

Page 11 of 15 South African regulators should conduct due diligence upon the registration as well as during the collection and transfer of money, especially by charities and NPOs that pose a potentially higher terrorism financing risk. South African charities and NPOs are advised to verify the status and credibility of foreign entities and recipients of funds to ensure that funds are channelled through registered and credible financial institutions. Support for the Islamic State in South Africa Support for the ideology of the IS in South Africa and the involvement of IS supporters in raising funds for terrorism financing purposes, including the recruitment, training and facilitation of supporters during 2014 and 2015 to join IS in the Middle East has been detected. These IS supporters had access to modest amounts of cash obtained through legal means which included self and crowd funding. An increased terrorism financing risk though, is the subsequent involvement of local IS supporters with links to organised crime and includes criminal activities such as kidnap for ransom, extortion of businesses, protection rackets in foreign-owned tuck shops, theft of cargo containers and dealings in precious metals, notably gold and diamonds. Legitimate businesses, as well as front companies, are used to send or receive funds transiting through mainstream financial channels. This access to cash allows IS supporters, some of whom operate large and diverse businesses with international reach, to operate with impunity. Although indications are that the cash accessed by these IS supporters is used for day-to-day living expenses, the possibility exists that the cash is being used for purchasing weapons and conducting para￾military training, as well as being channelled via alternative remitters to terrorist groups in the region and abroad. Money may also be used to conduct terrorist activities in the country in the future. Foreign terrorist fighters Foreign terrorist fighters (FTFs) are globally used by terrorist groups as combatants and to carry physical cash and other material supplies to and between conflict zones. South African FTFs who left or attempted to leave South Africa during 2014 and 2015 with the intention of joining IS had limited cash supplies and appeared to be predominantly self-funded. These individuals relied on personal loans, selling of assets and maximising access to credit on bank and retail cards to obtain money to fund their travels. South African FTFs relied heavily on stipends provided by ISIS and called on relatives in South Africa to send them money for their sustenance. In the South African context, self or crowd funding by smaller groups or individuals acting alone may seek to fund their terrorism related activities themselves using legitimate sources such as loans, credit extensions and selling of assets, allowing them to raise small to moderate amounts of money relatively unnoticed. In these cases, it can be difficult for financial institutions to distinguish transactions intended to fund terrorism from ordinary and legitimate transactions. For smaller terrorist cells or lone actors, self-funding may provide sufficient resources to carry out an unsophisticated but high impact attack.

Page 12 of 15 Self-funding by FTFs and potential lone actors is difficult to detect, deter and prevent as a relatively small amount of cash is needed to conduct a successful so-called “simple” terrorist attack. Detection is largely dependent on the identification of such supporters for their finances to be investigated as part of intelligence and criminal investigations. A few South African IS supporters who returned to South Africa continue to solicit relatively small amounts of funds under the pretext of support for humanitarian relief or educational purposes. Terrorism financing concerns exist due to the possibility that these funds may be directed to IS supporters in the region, notably in the Democratic Republic of Congo, Kenya, or Mozambique. There is concern regarding IS supporters who have returned from conflict zones in the Middle East. These individuals could possibly share their experiences with local communities, and in doing so may convince local communities and like-minded individuals in South Africa to support the IS ideology and to contribute financially to terrorism. Detecting the collection of cash and the cross-border remittance via alternative remittance systems of cash donations to conflict areas abroad remains a challenge. Closer cooperation is needed between financial institutions, regulators, supervisory bodies and law enforcement agencies to use a risk-based approach and to identify the role players within the domain of terrorism financing. Terrorism financing and organised crime nexus Internationally, security concerns are mounting regarding the nexus between organised crime activity such as trafficking in arms, drug smuggling, the illegal trade in commodities and goods, kidnapping for ransom, extortion and bank robbery, and terrorism. These types of crimes generate large amounts of money making it attractive for terrorist groups and organised criminal networks to collaborate. Although the links and level of interaction between the terrorist groups and organised criminal networks are not always clear, it is undisputed that the symbiotic relationship between them is financially viable. Links between terrorist and organised crime groups and syndicates are wide-ranging and manifest in various forms ranging from tolerant coexistence to collaboration. The collaboration benefits both sets of activities and may include skills training, accessing weapons, explosives, fraudulent documentation, and channels to transfer funds and assets. These different linkages make the nexus complex and dynamic. The evolving relationship between terrorist groups and organised criminal networks as well as the often transnational nature of criminal and terrorism activities pose significant challenges for law enforcement to counter. Although the ultimate goals of terrorist groups and organised criminal networks are often different, their activities are not always distinguishable and often overlap or reinforce each other. For organised criminal networks, the illicit acquisition or sale of goods is the goal. For terrorist groups, however, the illicit acquisition or sale of goods and services may be a means to achieve a specific ideological goal, rather than personal financial gain. In addition, it is noted with concern that criminal activity such as kidnap for ransom and extortion is being used by IS supporters to acquire or test skills sets, training and access to weapons. This calls for a more nuanced approach in countering the nexus between terrorism and organised crime.

Page 13 of 15 Virtual currencies Increased use of electronic and online platforms to raise, store, move and access funds and assets for terrorism purposes, including virtual currencies such as Bitcoin and e-wallets, pose an emerging terrorism financing risk that needs to be mitigated. The popularity and preference of terrorist groups to use these mediums is well documented. These electronic and online platforms present terrorist suspects with the opportunity to raise, store, move and access money for terrorism purposes instantly and anonymously across the globe. Several online payment systems and digital currencies are anonymous by design, making them attractive for terrorism financing, especially when the payment system is located in a country with weak or no regulatory controls. Terrorist groups using online payment systems and digital currencies have become common practice according to online communication for propaganda, recruitment, and facilitation. These groups solicit donations via social media or from an online support base and use digital payment systems to transfer funds to affiliates or other groups abroad. Although the use of virtual currencies by terrorist suspects in South Africa is not currently assessed to be widespread, it is likely that these suspects may increasingly use virtual currencies to conduct their activities anonymously and to evade law enforcement scrutiny. This, combined with the improved accessibility of virtual currencies and the increased ability to conceal the destination of funds, means that the risk of terrorism financing through virtual assets in South Africa will increase.

Page 14 of 15 6. South Africa’s counter-terrorist financing framework Acknowledging the evolving threat as well as international and regional obligations, South Africa has initiated a process to review its National Counter-Terrorism Strategy and Implementation Plan. Terrorism and terrorism financing is a national security priority and formal counter-terrorism coordination mechanisms exist to coordinate strategic intelligence, international and multilateral engagement, and defensive measures to enforce the law and to deal with the consequences of an attack. The POCDATARA Act is South Africa’s primary counter-terrorism law. It is intended to not only address all forms of domestic terrorism, but also to address acts of international terrorism where there is a connection to South Africa. The POCDATARA Act is being reviewed to address evolving counter terrorism challenges and obligations. The POCDATARA Act is supported by an extensive umbrella of domestic legislation relating to securing the integrity of the state and the safety of all citizens under the Constitution. 7. The way forward South Africa has, through its Financial Intelligence Centre, put measures and mechanisms in place to increase vigilance and ensure a coordinated approach between stakeholders within the public and private sector to detect, disrupt and prevent terrorism financing. Training to relevant stakeholders in the financial sector as well as high risk sectors in society has commenced and includes regular sector surveys to measure potential terrorism financing risks. These sector risk assessments in turn inform an array of awareness campaigns and interventions, including training to supervisory officials in prioritised at-risk sectors. Following the inefficiencies to detect, disrupt and prevent terrorism financing as identified during the assessment of South Africa’s anti-money laundering and combating of terrorist financing regime in October 2021 by the FATF Mutual Evaluation, the South African law enforcement agencies, which include relevant and specialised structures in the South African Police Service, intelligence agencies and the Financial Intelligence Centre, have prioritised the combating of terrorism financing. In addition to enhancing supervision and regulatory controls as well as the prioritisation of countering terrorism financing by law enforcement, a process has been embarked upon to raise public awareness. The latter includes online messaging and a media campaign to inform the public about South Africa’s terrorism financing risks to facilitate the reporting of suspicious financial activity.

Page 15 of 15 8. Conclusion South Africa’s terrorism financing risk profile is acknowledged given the threat, vulnerabilities, and existing challenges to effectively counter terrorism financing. The extent to which financiers and facilitators may exploit systems in the country, in the region and internationally is noted with concern. Additional vigilance is required to identify the preferred means, methods, and mechanisms terrorists use to raise, move, store and use funds in support of planned terrorist operations and activities. As is evident in international, regional and domestic terrorism financing trends, consistent monitoring and review is required to prevent the exploitation of the wide range of financial products and services in South Africa. Effective collaboration between the public and private sectors, community commitment and the dedicated scrutiny by financial and supervisory bodies as well as high-risk sectors will enhance South Africa’s effectiveness in countering terrorism financing.