Circular on Terrorism Financing Trends, Typologies, Red Flags and Recommended Actions for DNFBPs

# ECONOMIC AND FINANCIAL CRIMES COMMISSION
**SPECIAL CONTROL UNIT AGAINST MONEY LAUNDERING**

Head Office: No.5 Fomella Street, off Adetokunbo Ademola Crescent Wuse II, Abuja.
Tel: 0809 6492 000   Email: info@scuml.org

---

## CIRCULAR TO ALL DESIGNATED NON-FINANCIAL BUSINESSES AND PROFESSIONS (DNFBPs) AND SELF-REGULATORY BODIES (SRBs)

REF: EFCC/SCUML/HQ/04/VOL.2/035
DATE: 21st September, 2026

### SUBJECT: TERRORISM FINANCING TRENDS, TYPOLOGIES, RED FLAGS AND RECOMMENDED ACTIONS

The Special Control Unit against Money Laundering (SCUML) has received an advisory from the Joint Investigation Standing Committee (JISC) on Terrorism Financing, through the National Counter Terrorism Centre (NCTC), Office of the National Security Adviser, highlighting emerging **Terrorism Financing (TF) trends, patterns, red flags and indicators** identified from relevant intelligence.

The advisory is intended to strengthen the capacity of reporting entities, including Designated Non-Financial Businesses and Professions (DNFBPs), to identify potential terrorism financing activities and to enhance the effectiveness of their customer due diligence, transaction monitoring and suspicious transaction reporting frameworks.

Accordingly, all DNFBPs and their relevant Self-Regulatory Bodies (SRBs) are hereby directed to take note of the following typologies and indicators and incorporate them, as appropriate, into their AML/CFT preventive and monitoring measures.

## 1. IDENTIFIED TERRORISM FINANCING TRENDS AND PATTERNS

### 1.1 Nominee Account Structures and Shell Relationships for TF Value/Transfer

Terrorism financiers may use networks of nominee account holders, including unemployed or low-income individuals, to distribute funds laterally across terrorist cell networks. Individual transactions may appear ordinary when considered in

www.scuml.org

isolation, while the terrorism financing pattern becomes apparent only when transactions across linked accounts and relationships are analysed.

DNFBPs should therefore pay particular attention to:

• transactions involving apparent nominees or proxies;
• customers whose transactions are inconsistent with their known economic circumstances;
• interconnected customers or businesses with unexplained financial relationships; and
• transactions involving multiple parties where the ultimate source, beneficiary or purpose of funds cannot be satisfactorily established.

1.2 Exploitation of Registered Commercial Entities as TF Conduits

Registered commercial entities in the services and goods supply sectors may be exploited as conduits for terrorism financing. DNFBPs should therefore assess whether the nature, volume and timing of transactions involving a business are consistent with its stated business activities, ownership and beneficial ownership structure.

Particular attention should be given to transactions involving entities or individuals linked through credible intelligence to terrorism-related activities.

1.3 Procurement of Technology Through Legitimate Businesses

The advisory identifies the use of legitimate businesses to procure advanced communications technology, including satellite communications and satellite internet infrastructure, for deployment in terrorist operational theatres.

DNFBPs operating in, or providing services to, technology, telecommunications, equipment supply and related sectors should therefore consider the terrorism financing risks associated with customers and transactions involving the procurement or supply of advanced communications equipment.

1.4 Multi-Layered Fund Aggregation

Terrorism-linked individuals may aggregate funds from different sources and channel them through an intermediate account, including a registered commercial entity, before the funds are applied for a terrorism financing purpose.

A key indicator is the rapid sequential movement of funds, particularly where significant inflows are followed within a short period by corresponding outflows, with little or no retention of funds.

---

1.5 Financial Couriers and Human-Based Value Transfer

Individuals may act as financial couriers moving value between members of terrorist cells and external financiers through formal banking channels, Point-of-Sale (POS) services and mobile banking platforms.

Relevant indicators include:

• individuals with no discernible independent source of income undertaking regular financial transactions;
• transaction activity inconsistent with the customer's declared occupation or income;
• repeated transactions involving persons known or reasonably suspected to be associated with terrorism; and
• unexplained financial relationships among apparently unrelated individuals.

1.6 Exploitation of High-Volume Legitimate Trade Accounts

High-volume legitimate commercial activity, particularly in the FMCG (Fast Moving Consumer Goods) and commodity wholesale sectors, may create a significant analytical challenge by providing a substantial volume of transactions within which potential TF flows may be concealed.

High transaction volume should not, in itself, be treated as evidence of terrorism financing. However, where high-volume activity is accompanied by other risk indicators, DNFBPs should undertake appropriate contextual analysis, including verification of counterparties, the purpose of payments and the underlying economic rationale for transactions.

2. KEY RED FLAGS AND INDICATORS

DNFBPs are required to take appropriate account of the following indicators when conducting customer due diligence, ongoing monitoring and transaction analysis:

a. Transaction splitting/structuring: Repeated transactions just below reporting thresholds or the splitting of a large transfer into several smaller transactions, particularly where the transactions involve unemployed or low-income customers.

b. Occupation-to-transaction mismatch: A customer declares unemployment or a low-income occupation but regularly sends or receives funds that are inconsistent with the customer’s stated economic capacity.

c. Funds immediately forwarded after receipt: An account receives funds and transfers most or all of the funds to another account within a short period, with

minimal or no retention, suggesting a possible pass-through or layering arrangement.

d. Technology procurement by terrorism-linked entities: Payments from accounts linked to terrorism suspects or networks to technology vendors supplying advanced communications equipment, particularly satellite internet services.

e. Same-institution cluster of terrorism-linked accounts: Multiple accounts within the same financial ecosystem exhibit interconnected transaction patterns consistent with cell-based financing, with funds circulating within a closed group before being applied towards a common purpose.

3. REQUIRED ACTIONS BY DNFBPs

In light of the foregoing, all DNFBPs are required to:

1. Review their existing AML/CFT/CPF transaction monitoring controls and procedures to determine whether they adequately capture the identified TF typologies, trends, patterns and indicators.

2. Enhance transaction monitoring rules, where necessary, to identify, among other things:

   • nominee or proxy account structures;
   • rapid pass-through transactions;
   • occupation-to-transaction mismatches;
   • unexplained interconnected accounts or business relationships;
   • transactions involving technology vendors where there are terrorism-related concerns; and
   • other transactions exhibiting characteristics consistent with the identified TF typologies.

3. Apply enhanced and risk-based customer due diligence where heightened TF risks are identified, including obtaining and verifying relevant information concerning the customer's identity, beneficial ownership, source of funds, source of wealth, business activities, counterparties and purpose of transactions, as appropriate.

4. Apply heightened due diligence to high-volume trade, commodity and goods-supply transactions where the identity of counterparties, the underlying transaction or the purpose of payment cannot be readily verified.

5. Conduct appropriate ongoing monitoring and contextual analysis rather than assessing transactions solely on the basis of individual transaction values or apparent commercial legitimacy.

6. Promptly file Suspicious Transaction Reports (STRs) with the Nigerian Financial Intelligence Unit (NFIU) where transactions or customer relationships give rise to suspicion of terrorism financing or other financial activity associated with terrorism.

7. Maintain adequate records and supporting documentation relating to customer due diligence, transaction monitoring, enhanced due diligence and decisions taken in relation to identified red flags, in accordance with applicable AML/CFT/CPF requirements.

8. Ensure that relevant compliance, risk management, internal audit and operational personnel are adequately sensitised on the identified TF typologies and indicators.

9. ROLE OF SELF-REGULATORY BODIES

All relevant SRBs are requested to:

• disseminate this Circular and the underlying TF indicators to their regulated members;
• reinforce awareness of TF risks within their respective sectors;
• encourage their members to review and strengthen their AML/CFT controls in line with the identified typologies;
• incorporate relevant TF indicators into sector-specific compliance guidance, where appropriate; and
• support SCUML in promoting effective implementation of risk-based AML/CFT/CPF measures across the DNFBP sectors.

5. SUPERVISORY EXPECTATION

SCUML expects all DNFBPs to take these indicators into account as part of their risk-based AML/CFT/CPF framework and to ensure that their internal controls remain responsive to emerging terrorism financing typologies.

DNFBPs should note that the presence of a single red flag does not necessarily establish that a transaction or customer is involved in terrorism financing. Rather, the indicators should be considered collectively and in the context of the customer’s profile, business activities, transaction history, counterparties and other available intelligence. Where reasonable grounds for suspicion exist, the matter should be escalated in accordance with the DNFBP’s internal procedures and an STR filed promptly with the NFIU.

All DNFBPs and SRBs are therefore required to give this Circular immediate attention and ensure appropriate dissemination and implementation.

Harry Erin, fsi
DIRECTOR, SPECIAL CONTROL UNIT AGAINST MONEY LAUNDERING (SCUML) ECONOMIC AND FINANCIAL CRIMES COMMISSION (EFCC)