2024-10-23 | FIN-2024-Alert003Added
FinCEN requests that financial institutions reference alert FIN-2024-Alert003 by including the key term IRANTF-2024-A001 in Suspicious Activity Report (SAR) field 2 and field 33(a), and include the term Hizballah in SAR field 33(z) if a link to the organization is known or suspected. The alert supplements information on Hizballah’s financing and urges institutions to remain vigilant in identifying suspicious activity related to the group's terrorist activities. It provides red flag indicators to help detect potential suspicious activity associated with Hizballah’s global revenue generation and money laundering schemes.
1
This alert supplements the information related to Hizballah’s financing outlined in FinCEN’s 2024 Advisory on Iran-Backed Terrorist Organizations.2
Hizballah is a component of Iran’s “axis of resistance,” a network of Iran-backed terrorist organizations that seeks to erode U.S. influence in the Middle East and encircle Israel with hostile forces.3 Immediately following Hamas’s attacks on Israel on October 7, 2023,4 Hizballah opened a second front in the conflict by launching rocket attacks from southern Lebanon into Israel. Since then, Hizballah and Israel have engaged in persistent cross-border attacks against one another,5 which have forced thousands of civilians to evacuate from their homes in northern Israel and southern Lebanon,6 killed innocent civilians including children,7 and contributed to rising regional tensions and the threat of war.8 Suspicious Activity Report (SAR) Filing Request: FinCEN requests that financial institutions reference this alert by including the existing key term “IRANTF-2024-A001” in SAR field 2 (Filing Institution Note to FinCEN) and the narrative and select SAR field 33(a) (Terrorist Financing-Known or suspected terrorist/terrorist organization). In addition, FinCEN requests that financial institutions include the term “Hizballah” in SAR field 33(z) if a link to Hizballah is known or suspected.
FINCEN ALERT 2 Hizballah has also increased the risks of regional conflict by providing training to the Iran-backed Houthis in Yemen to support their strikes on Israeli territory and their attacks on U.S. military and other vessels in the Red Sea, which has diverted maritime traffic, threatened freedom of navigation, and increased shipping costs.9
As part of the U.S. Department of the Treasury’s (Treasury) campaign against Hizballah’s financing over the past two decades,10 and in light of Hizballah’s ongoing and significant terrorist activities, FinCEN urges financial institutions to remain vigilant in identifying suspicious activity relating to the financing of Hizballah, and to report such activity to FinCEN. This alert aligns with FinCEN’s AntiMoney Laundering/Countering the Financing of Terrorism (AML/CFT) National Priorities of terrorist financing and transnational criminal organization activity, as well as the Treasury 2024 National Terrorist Financing Risk Assessment.11 The information contained in this alert is derived from FinCEN’s analysis of Bank Secrecy Act (BSA) data, open-source reporting, and information provided by law enforcement partners. 9. See May 2024 CRS Report, supra note 6, at p. 2. See also CRS Insight, “Houthi Attacks in the Red Sea: Issues for Congress” (updated Sept. 6, 2024), at p. 1; see also The White House, “Statement from President Joe Biden on Coalition Strikes in Houthi-Controlled Areas in Yemen” (Jan. 11, 2024). For additional information about Houthi financing, see May 2024 FinCEN Advisory, supra note 2, at pp. 8-9. 10. In June 2004, Treasury designated a prominent South America-based member of Hizballah and his two companies under Executive Order 13224. See Treasury, “Treasury Designates Islamic Extremist, Two Companies Supporting Hizballah in Tri-Border Area” (June 10, 2004). 11. See FinCEN, “Anti-Money Laundering and Countering the Financing of Terrorism National Priorities” (June 30, 2021); Treasury, “2024 National Terrorist Financing Risk Assessment” (“Feb. 2024 NTFRA”) (Feb. 2024). 12. ODNI NCTC, “Counterterrorism Guide: Hizballah” (accessed Sept. 26, 2024). 13. See May 2024 CRS Report, supra note 6, at p. 1. 14. Department of State, “Country Reports on Terrorism 2021” (“2021 State Country Reports”) (2021), at p. 291. Overview of Hizballah Based primarily in Lebanon, Hizballah was founded with support from Iran in the wake of the Israeli invasion of Lebanon in 1982. The group casts itself as the defender of Lebanon against Israeli aggression.12 Hizballah has engaged in ongoing violence against Israel since its inception and has also been involved in the Syrian Civil war, siding with the Assad regime since 2011. It also functions as a political party and has participated in Lebanese elections since 1992.13 Hizballah is responsible for multiple large-scale terrorist attacks against U.S. interests and persons, including: the 1983 suicide truck bombings of the U.S. Embassy and U.S. Marine barracks in Beirut; the 1984 attack on the U.S. Embassy Beirut annex; and the 1985 hijacking of TWA Flight 847. Hizballah was also implicated, along with Iran, in the 1992 attacks on the Israeli Embassy in Argentina and the 1994 bombing of the Argentine Israelite Mutual Association in Buenos Aires.14 In addition, a Hizballah operative associated with the terrorist organization’s Islamic Jihad Organization
FINCEN ALERT 3 (IJO) component15 detonated explosives on a bus transporting Israeli tourists in the vicinity of an airport in Burgas, Bulgaria in July 2012, killing six people and injuring 32 others.16 Iran has trained thousands of Hizballah fighters to wage war and conduct terrorist operations globally. In turn, Hizballah has helped train and equip other Iran-aligned terrorist organizations, including Hamas and the Houthis.17 Hizballah leaders also reportedly armed and trained Shia militias that carried out attacks on U.S. forces during their 2003-2011 deployment to Iraq.18 15. A Hizballah component known as the Islamic Jihad Organization (IJO) is responsible for the planning and coordination of intelligence, counterintelligence, and terrorist activities outside of Lebanon. The IJO consists of two parts: the Foreign Relations Department (FRD), which maintains Hizballah’s public presence around the world and conducts recruiting, fundraising and intelligence gathering on behalf of the organization, and the External Security Organization (ESO), which is responsible for planning and carrying out Hizballah attacks outside of Lebanon. Law enforcement authorities have disrupted several IJO attack-planning operations around the world. The IJO is also known as the External Security Organization and “Unit 910.” See Department of Justice, “U.S. Attorney Announces Terrorism Charges Against High-Ranking Hizballah Member Who Helped Plan 1994 Bombing In Buenos Aires, Argentina” (“Dec. 2023 DOJ Press Release”) (Dec. 20, 2023); Department of State, “State Department Amendments to the Terrorist Designations of Hizballah and al-Qa’ida in the Arabian Peninsula” (June 21, 2017). 16. See Dec. 2023 DOJ Press Release, supra note 15. 17. See May 2024 CRS Report, supra note 6, at pp. 1-2. For more information about the financing of Iran’s terrorist partners and proxies, see May 2024 FinCEN Advisory, supra note 2. 18. See May 2024 CRS Report, supra note 6, at p. 2. 19. ODNI, “Annual Threat Assessment of the U.S. Intelligence Community” (Feb. 16, 2023), at pp. 32-33. 20. See May 2024 FinCEN Advisory, supra note 2, at p. 9. 21. See Feb. 2024 NTFRA, supra note 11, at p. 12; see also 2021 State Country Reports, supra note 14, at p. 191, 291. 22. See, e.g., Department of Justice “Sanctions Evasion and Money Laundering Charges Unsealed Against Specially Designated Global Terrorist Mohammad Bazzi and Talal Chahine” (Feb. 24, 2023); Treasury, “Treasury Sanctions International Financial Networks Supporting Terrorism” (“Sept. 2023 Treasury Press Release”) (Sept. 17, 2021); Treasury, “Treasury Disrupts International Money Laundering and Sanctions Evasion Network Supporting Hizballah Financier” (“Apr. 2023 Treasury Press Release”) (Apr. 18, 2023). 23. See, e.g., Dec. 2023 DOJ Press Release, supra note 15. 24. Drug Enforcement Administration, “DEA And European Authorities Uncover Massive Hizballah Drug And Money Laundering Scheme” (“Feb. 2016 DEA Press Release”) (Feb. 1, 2016). 25. See May 2024 FinCEN Advisory, supra note 2, at p. 9. Hizballah’s Financing Around the World Hizballah’s revenue generation, procurement, and recruitment activities are global in scale, extending to Africa, Asia, Europe, and the Western Hemisphere.19 As noted in the May 2024 FinCEN Advisory, Iran has provided hundreds of millions of dollars in support to Hizballah, with historical estimates approximating $700 million per year. Hizballah also acts as a conduit for funds flowing from Iran to other Iran-aligned groups.20 Additionally, Hizballah has operated in the tri-border area of Argentina, Brazil, and Paraguay, as well as in free trade zones in Panama, to generate revenue for the organization through both licit and illicit activities.21 The organization draws revenue and launders funds through networks of businesses in West Africa, Europe, and South America,22 and has pursued recruitment and weapons and explosives precursor procurement efforts in Asia and the Western Hemisphere.23 Hizballah generates revenue through a broad range of illicit activities, including oil smuggling, money laundering, black market money exchange,24 counterfeiting, and illegal weapons procurement.25
FINCEN ALERT 4 In some cases, individual Hizballah donors who are affiliated with transnational organized criminal groups and drug trafficking organizations may donate some of their illicit proceeds to Hizballah.26 Oil Smuggling Hizballah generates a large portion of its revenue through the smuggling and sale of Iranian oil and liquified petroleum gas (LPG) to buyers in Asia and the Middle East, often in collaboration with Islamic Revolutionary Guard Corps-Qods Force (IRGC-QF) and Houthi networks.27 The majority of this oil is sold to the People’s Republic of China (PRC); however the Syrian regime is also a major buyer.28 The oil is smuggled by a complex network of facilitators and shipping networks supporting IRGC-QF and Hizballah and using vessels that are typically owned by front companies in thirdcountry jurisdictions that sail under flags of convenience from unrelated third countries.29 In some cases, these networks blend Iranian oil with oil from other countries to further obfuscate its origins.30 Hizballah oil smuggling networks often utilize deceptive shipping practices, such as falsifying cargo and vessel documents, ship-to-ship transfers, disabling shipboard automatic identification systems, and changing the names of sanctioned vessels, to disguise their oil and LPG shipments.31 Middle East Within the Middle East, Hizballah profits from smuggling goods such as gold and electronics as well as foreign currency from Iran into neighboring countries for sale. The goods and currency are either smuggled across borders or sold through front companies, and the proceeds are either returned to Iran directly, usually via bulk cash smuggling, or laundered through the use of front companies.32 Hizballah also profits from numerous business ventures in Lebanon and elsewhere in the Middle East, which are owned or controlled by Hizballah sympathizers and financiers.33 These financiers leverage networks extending beyond the Middle East into Europe, Asia, and Latin America to provide illicit financial services like money laundering, bulk cash shipping, and black market currency exchange to Hizballah and other organizations.34 26. See Treasury, “Treasury Sanctions Lebanese Money Launderer Kassem Chams Who Moves Money on Behalf of Narcotics Trafficking Organizations and Hizballah” (Apr. 11, 2019). 27. See Treasury, “Treasury Targets Qods Force, Houthi, and Hizballah Finance and Trade Facilitators” (“Mar. 2024 Treasury Press Release”) (Mar. 26, 2024); Treasury, “Treasury Adds Further Sanctions Targeting Houthi and Hizballah Trade Networks” (Aug. 15, 2024). 28. See Treasury, “Treasury Sanctions Key Actors in Iran’s Oil Sector for Supporting Islamic Revolutionary Guard CorpsQods Force” (Oct. 26, 2020); Treasury, “Treasury Designates Vast Iranian Petroleum Shipping Network That Supports IRGC-QF and Terror Proxies” (Sept. 4, 2019); Treasury, “Treasury Targets Oil and LPG Smuggling Network That Generates Millions in Revenue for Hizballah” (Sept. 11, 2024). 29. See Treasury, “Treasury Sanctions Networks Enabling Illicit Trade that Benefits IRGC-QF and Hizballah” (Sept. 25, 2024). 30. See Treasury, “Treasury Sanctions Oil Shipping Network Supporting IRGC-QF and Hizballah” (Nov. 3, 2022). 31. For more information about deceptive shipping practices used to evade sanctions on Iran and its proxies, see OFAC, “OFAC Advisory to the Maritime Petroleum Shipping Community” (Sept. 4, 2019). 32. See Sept. 2023 Treasury Press Release, supra note 21. 33. See Treasury, “Treasury Targets Sanctions Evasion Conduits for Major Hizballah Financiers” (Apr. 24, 2019); Treasury, “Treasury Sanctions International Hizballah Network” (Jan. 21, 2022); Treasury, “Treasury Sanctions Hizballah Front Companies and Facilitators in Lebanon And Iraq” (June 10, 2015). 34. See Treasury, “Treasury Sanctions Key Hizballah Money Laundering Network” (“Jan. 2016 Treasury Press Release”) (Jan. 28, 2016); see also Feb. 2016 DEA Press Release, supra note 25.
FINCEN ALERT 5 West Africa In West Africa, Hizballah is sponsored by a network of financiers who use their businesses in the diamonds and precious stones, import/export, and high-value art sectors to raise and launder funds on behalf of the organization.35 These financiers have also formed front companies to disguise the movement of funds associated with Hizballah or to receive shipments of goods as part of tradebased money laundering (TBML) schemes.36 In some cases, these financiers have leveraged political connections or bribed law enforcement officials to facilitate the movement of funds, including through bulk-cash smuggling.37 Several of these financiers have been sanctioned by the U.S. government but have continued their illicit activities on behalf of the group through the use of front companies and intermediaries.38 Latin America Historically, Hizballah operatives have been active in Central and South America, particularly the tri-border region of Argentina, Brazil, and Paraguay, where they have carried out illicit activities ranging from smuggling to TBML to illegal weapons procurement.39 Hizballah’s External Security Organization Business Affairs (BAC) has developed close ties with South American drug trafficking organizations and has benefited from laundering the proceeds of drug trafficking through elaborate schemes involving the Black Market Peso Exchange, the Hawala system, and intercontinental bulkcash smuggling networks that span Europe, Latin America, and the Middle East.40 Numerous Hizballah financiers and supporters have been arrested in South America for providing financial services to the organization and plotting attacks.41 35. See Treasury, “Treasury Designates Prominent Lebanon and DRC-Based Hizballah Money Launderers” (“Dec. 2019 Treasury Press Release”) (Dec. 13, 2019); Treasury, “Treasury Targets Hizballah Financial Network in Africa and the Middle East” (Feb. 2, 2018); Treasury, “Treasury Targets Hizballah Network in Africa” (May 27, 2009). 36. See Department of Justice, “Manhattan U.S. Attorney Files Civil Money Laundering and Forfeiture Suit Seeking More than $480 Million Dollars from Entities Including Lebanese Financial Institutions that Facilitated a Hizballah-Related Money Laundering Scheme” (Dec. 15, 2011). 37. See Treasury, “Treasury Sanctions Hizballah Financiers in Guinea” (Mar. 4, 2022). 38. See Department of Justice, “OFAC-Designated Hezbollah Financier and Eight Associates Charged with Multiple Crimes Arising Out of Scheme to Evade Terrorism-Related Sanctions” (“Apr. 2023 DOJ Press Release”) (Apr. 18, 2023); Drug Enforcement Authority, “Top Hizballah Terror Financier Arrested” (Mar. 24, 2017). 39. See, e.g., Treasury, “Treasury Designates Hizballah Operatives and Financial Facilitators in South America and Lebanon” (Sept. 12, 2023). 40. See Feb. 2016 DEA Press Release, supra note 25; Jan. 2016 Treasury Press Release, supra note 35. 41. See Department of State, “Commemoration of the 25th Anniversary of the Terrorist Bombing of the AMIA in Buenos Aires” (July 12, 2019).
FINCEN ALERT 6 Laundering Illicit Proceeds 42. See Treasury, “Treasury Targets Hizballah Financial Network’s Abuse of the Business Sector” (May 19, 2022); Dec. 2019 Treasury Press Release, supra note 36; and Apr. 2023 Treasury Press Release, supra note 21. 43. See Feb. 2024 NTFRA, supra note 11, at p. 13. 44. Id., at pp. 2, 13. 45. See Department of Justice, “Specially Designated Global Terrorist Mohammad Bazzi Pleads Guilty to Sanctions Evasion” (Sept. 20, 2024); Department of Justice, “Lebanese Businessman Tied by Treasury Department to Hezbollah is Sentenced to Prison for Money Laundering Scheme Involving the Evasion of U.S. Sanctions” (Aug. 8, 2019); Apr. 2023 DOJ Press Release, supra note 39. 46. See Department of Justice, “Manhattan U.S. Attorney Announces Seizure Of $150 Million In Connection With A Hizballah-Related Money Laundering Scheme” (Aug. 20, 2012). 47. Historically, Hizballah has controlled banks both in Lebanon and abroad, like Bayt al-Mal in Lebanon which was sanctioned by OFAC in 2006 or Lebanese Canadian Bank SAL, which was identified as a primary money laundering concern under section 311 of the USA PATRIOT Act in 2011. See Treasury, “Treasury Targets Facilitators Moving Millions to HAMAS in Gaza” (Aug. 29, 2019); see also Treasury, “Treasury Identifies Lebanese Canadian Bank Sal as a “Primary Money Laundering Concern” (Feb. 10, 2011). 48. See Treasury, “Treasury Targets Hizballah Finance Official and Shadow Bankers in Lebanon” (May 11, 2021); Treasury, “Treasury Labels Bank Providing Financial Services to Hizballah as Specially Designated Global Terrorist” (Aug. 29, 2019). 49. See Treasury, “Treasury Sanctions Key Hizballah Money Exchanger” (Jan. 24, 2023); Department of Justice, “Framingham Man Sentenced to Prison for Operating an Unlicensed Money Transmitting Business” (Apr. 5, 2024). 50. See Mar. 2024 Treasury Press Release, supra note 28. 51. See, e.g., Apr. 2023 Treasury Press Release, supra note 21. 52. See Feb. 2024 NTFRA, supra note 11, at p. 12. Hizballah and its supporters leverage an elaborate global network of front companies and legitimate businesses in the real estate, import/export, construction, diamonds and precious stones, and high-value art sectors to move and launder funds.42 Treasury’s 2024 National Terrorist Financing Risk Assessment found that Hizballah continues to utilize the U.S. financial system in its money laundering, smuggling, and trafficking schemes.43 Hizballah and its supporters have transferred funds through the U.S. financial system and attempted to purchase military or export-controlled equipment through front companies.44 Furthermore, some U.S.-designated Hizballah financiers may seek to evade sanctions through the use of front companies and intermediaries; may open and use accounts held in the names of family members; or may use the services of other unrelated nominees that benefit financially in exchange for holding accounts in their names.45 Hizballah also engages in TBML, with electronics and used cars serving as a common means of value transfer.46 Hizballah has also regularly sought access to the international banking sector and started money transfer businesses to take advantage of the dependence of ordinary Lebanese citizens on non-bank financial institutions.47 The terrorist group has used organizations like trusts and non-governmental organizations in Lebanon to provide financial services and facilitate banking activities, corrupting legitimate structures for its illicit use.48 Hizballah also makes use of unlicensed money services businesses (MSBs) in Lebanon and elsewhere—some of which it controls—and the informal financial sector to move and launder funds.49 In recent years, Hizballah and its facilitators have used convertible virtual currencies in support of money laundering activities.50 However, the group continues to rely extensively on more traditional methods like bulk cash smuggling.51 For these activities, Hizballah relies primarily on jurisdictions with weak government institutions, porous borders, or corrupt state officials.52
FINCEN ALERT 7 Red Flag Indicators for Hizballah Financing 53. See May 2024 FinCEN Advisory, supra note 2, at pp. 12-13. 54. Front companies are fully functioning companies, often having a physical location, with the characteristics of a legitimate business, and are used to comingle illicit proceeds with earnings from legitimate business operations. See Treasury, “2024 National Money Laundering Risk Assessment” (Feb. 2024), at p. 53. FinCEN has identified the following red flag indicators to help detect, prevent, and report potential suspicious activity related to Hizballah’s terrorist financing and other illicit activities. These red flags are in addition to the red flags identified in FinCEN’s 2024 Advisory on Iran-Backed Terrorist Organizations,53 all of which remain relevant. As no single red flag is determinative of illicit or suspicious activity, financial institutions should consider the totality of available facts and circumstances, such as a customer’s historical financial activity, whether the transactions are in line with prevailing business practices, and whether the customer exhibits multiple red flags before determining that a behavior or transaction is suspicious. A customer or a customer’s counterparty conducts transactions with entities and individuals that OFAC has designated due to their connection with Hizballah, or conducts transactions that contain a nexus to identifiers listed for OFAC-designated entities and individuals affiliated with Hizballah, to include email addresses, physical addresses, phone numbers, passport numbers, or convertible virtual currency addresses. A customer or a customer’s counterparty utilizes the services of foreign financial institutions that have been identified as being of “primary money laundering concern” under section 311 of the USA PATRIOT Act referencing their association with, or use by, Hizballah. A customer conducts transactions with an MSB or other financial institution, including one that offers services in convertible virtual currency, that operates in jurisdictions known for, or at high risk for, Hizballah terrorist financing activity, such as the tri-border region of South America, the Middle East, or West Africa, and has opaque ownership or whose beneficial owners are known associates of Hizballah. A customer conducts transactions that originate with, are directed to, or otherwise involve entities that are known or suspected front companies or other companies whose beneficial ownership information indicates that they may have a nexus with Hizballah. Indicators of possible front companies include opaque ownership structures or business addresses that are residential or co-located with other companies.54 Invoices—particularly for shipments of electronics leaving the United States for the tri-border region of South America or the PRC, or used cars being shipped from the United States to West Africa—appear to over- or under-charge the recipient, especially if the goods do not appear to correspond with the counterparty’s stated line of business and/or if the payments for those goods are facilitated by a Lebanese or Hizballah-connected financial firm, or a branch of a Lebanese or Hizballah-connected financial firm located abroad.
FINCEN ALERT 8 Transactions and wire transfers refer to underlying commercial activity that involves bills of lading with no consignees or involves vessels that have been previously linked to suspicious financial activities or registered to sanctioned entities connected with Hizballah, the Houthis, the IRGC-QF, or the Syrian regime. Documentation, such as bills of lading and shipping invoices, appears to be falsified or omits key information, or there are inconsistencies between shipping related documents and maritime database entries. A customer, domestic or foreign, with businesses in the real estate, import/export, construction, diamonds and precious stones, or high-value art sectors with numerous international counterparties in high-risk jurisdictions for Hizballah financing, makes an unusually high number of cash deposits in business accounts, transfers funds from business to personal accounts or vice versa, or uses personal accounts or personal credit cards to make business payments. FinCEN requests that financial institutions reference this alert by including the existing key term “IRANTF-2014-A001” in SAR field 2 (Filing Institutions Note to FinCEN) and the narrative and select SAR field 33(a) (Terrorist Financing-Known or suspected terrorist/terrorist organization). In addition, FinCEN requests that financial institutions include the term “Hizballah” in SAR field 33(z) if a link to Hizballah is known or suspected. Financial institutions wanting to expedite their report of suspicious transactions that may relate to the activity noted in this alert should call the Financial Institutions Toll-Free Hotline at (866) 556-3974 (7 days a week, 24 hours a day).55 The mission of the Financial Crimes Enforcement Network is to safeguard the financial system from illicit use, counter money laundering and the financing of terrorism, and promote national security through strategic use of financial authorities and the collection, analysis, and dissemination of financial intelligence. The information contained in this alert is derived from FinCEN’s analysis of Bank Secrecy Act data, open-source reporting, and information provided by law enforcement partners. Questions or comments regarding the contents of this alert should be sent to the FinCEN Regulatory Support Section at frc@fincen.gov. 55. The purpose of the hotline is to expedite the delivery of this information to law enforcement. Financial institutions should immediately report any imminent threat to local-area law enforcement officials.