The Islamic State In AFG

The fall of the Islamic Republic of Afghanistan at the hands of the Taliban in August 2021 marked a turning point for the operational activities of transnational terrorist organisations that have found refuge in the country. For Islamic State – Khorasan Province (ISKP, the Islamic State’s franchise in Afghanistan), the withdrawal of foreign armed forces provided an opportunity for it to reassert itself as a rival to the Taliban in its new role as the de facto government. Yet, as an important node in a global network, ISKP has grander ambitions than merely upsetting the new Taliban regime. In March 2023, US Army General Michael Kurilla, who oversees US operations in Afghanistan, warned that ISKP could conduct an external operation against a European target in less than six months, speaking to an upward trajectory in ISKP’s capabilities. Kurilla’s estimation concurs with leaked US intelligence that ended up on the Discord messaging platform a month later, which determined that the Islamic State “has been developing a cost-effective model for external operations that relies on resources from outside Afghanistan, operatives in target countries, and extensive facilitation networks”.

The US’s threat assessment is reflected in the Islamic State’s own financial situation. By all accounts, ISKP is a net beneficiary of its global financial network, although the ongoing gradual collapse of its central command in Syria means ISKP will be unable to rely on these handouts going forward. Nonetheless, this shows confidence held in the affiliate’s potential to deliver on the movement’s core objectives, which makes understanding and targeting financial flows bound for ISKP’s war chest a top priority, particularly given the risk of an external jihadist threat capability emerging from within Afghanistan once again.

What’s Mine is Ours

Following a trend seen across the Islamic State’s other franchises, particularly since the peak of the group’s territorial holdings in Iraq and Syria, ISKP is encouraged to reduce its financial dependency on central Islamic State leadership (IS-Core). A regional hub-and-spoke system shares revenue-generation and other responsibilities with regional offices in the Islamic State network, towards a strategy of “regionally pooled funding”.

As an important node in a global network, Islamic State – Khorasan Province has grander ambitions than merely upsetting the new Taliban regime

For example, the UN Sanctions Monitoring Team highlights the role of the Al-Karrar office based in Puntland, northern Somalia, as not only a coordinating base for Islamic State activity in Africa, but as being involved in transferring funds outside its jurisdiction, to ISKP (via Kenya and Yemen, but possibly via a cell in the UK as well). Indeed, a US special operation in Somalia to kill Bilal Al-Sudani, a prominent Islamic State financial facilitator, revealed the relevance of the Al-Karrar office for ISKP financing, including a direct link between the office and the facets of ISKP responsible for the August 2021 bombing of Kabul airport. Further, UN-provided intelligence states that the Al-Karrar office was sending $25,000 to ISKP every month through cryptocurrency transfers.

From late 2021, it is likely that tens of thousands of dollars had been moved to the Al-Siddiq office based in Afghanistan, which has jurisdiction over all Islamic State franchises in Asia, including ISKP. Different estimates put the number closer to $500,000 being made available to ISKP in the same period, with the US Defense Intelligence Agency assessing that in the last quarter of 2022, ISKP “almost certainly” received financial support from IS-Core, some of it earmarked for external operations in Europe and Russia. Indeed, funds do not come without strings attached. IS-Core will have a degree of control over ISKP through such financial support as well as through leadership appointments, although ISKP remains autonomous in planning and orchestrating attacks in Afghanistan and the region. Even though the members of the Islamic State family are requested to develop a more self-reliant financing regime, the architecture of this global financial network endures, with ISKP deemed the worthiest recipient of diminished reserves so long as it remains “one of [Islamic State’s] highest performing branches”.

A blow to the Al-Karrar office’s functioning brought on by the removal of Al-Sudani, alongside dwindling reserves held by IS-Core, suggests financial facilitation networks may become less lucrative for ISKP in the future, or at the very least, a less reliable source of funds. To maintain its tempo of operations, recruitment and propaganda production, ISKP will need to diversity its portfolio of revenue streams, and already has fingers in several pies.

Do-It-Yourself Financing

To look after its own financial needs, ISKP very likely has dedicated financial facilitators based in Gulf countries, with the mission of soliciting and transmitting donations back to Afghanistan, as has occurred in the past. In mid-2016, ISKP facilitators utilised a non-profit organisation, Nejaat Social Welfare Organization, to collect funds from individual donors in Qatar, the UAE, Iraq and other Middle Eastern countries, and to distribute these to ISKP commanders through its offices in Kabul and Jalalabad. The Taliban’s heavy-handed counterterrorism response in eastern Afghanistan has very likely prompted private donors in the Gulf to financially support ISKP as a means of countering threats to their own interests. Chief among these are Taliban operations against Salafi mosques and madrasas in eastern Afghanistan, which also financially support ISKP and receive some funding from Gulf donors as well. Extracting financial support from these communities (mostly in inaccessible valleys in Nangarhar province) is crucial for the group’s self-financing efforts, whether they are called “donations” or, more accurately, “extortion”. For instance, after losing most of its territorial holdings in Kunar province in 2020, tribal elders, journalists, civil society activists and government officials reported how all farmers and businesspeople were obliged to pay taxes on their income during ISKP’s occupation. The group is known to extort trade and transportation companies as well, occasionally acting under the Taliban “brand” as a means of discrediting their enemy.

Around the World

The Islamic State’s global hub-and-spoke system depends on reliable methods of moving funds throughout the network. Above all, tried and tested methods of moving terrorist funds are employed, including the use of unregistered money service businesses, cash couriers and established hawala networks (a centuries-old value transfer system). Cash couriers – some intimately affiliated with ISKP and others employed episodically – are likely to be used to move cash across Afghanistan and regionally. The group’s operatives based in Jalalabad and Kabul make use of hawaladars in these cities to receive (and possibly also send) funds throughout the global network, and to help store tens of thousands of dollars for the group. These hawala networks will be linked up with broader IS financial networks such as the so-called Al-Rawi Network, whose money service businesses and money-laundering expertise aided Saddam Hussein in evading sanctions back in the 1990s, and which now supports Islamic State financial facilitation through operations in Iraq, Turkey, Belgium, Kenya, Russia, China and elsewhere. The network relies on established money-laundering techniques including the use of proxies, layering and cash smuggling to hide the origin of the Islamic State’s funds, with the gold trade being a favourite method. As of December 2018, the network’s leader Mushtaq Al-Rawi was living in Belgium and operating money exchange businesses in Syria, Turkey, Sudan and the Gulf countries, alongside front companies and an unidentified charitable organisation based in the West Bank to generate, launder and move funds on behalf of the Islamic State. The diffuse and covert nature of networks such as Al-Rawi makes them a reliable asset for the Islamic State, being resilient to countermeasures and capitalising on gaps within the global counterterrorism financing regime.

The Islamic State’s global hub-and-spoke system depends on reliable methods of moving funds throughout the network

Yet despite the success of such established transfer methods, recent evidence indicates that cryptocurrencies have become a more important element of the Islamic State’s overall financial tradecraft. Blockchain analytics firms have independently reported donations being made to ISKP’s media unit in Bitcoin, Ethereum and TRX (Tron), very likely in response to propaganda and recruitment efforts, and to an ISKP recruitment campaign in Tajikistan to the tune of approximately $2 million in USDT (Tron). Yet, the greater utility for cryptocurrency lies in its use for international funds transfer, though what remains unseen is how cryptocurrencies held by ISKP may be “cashed-out”, or converted to fiat currencies, a necessary step towards eventually spending these funds. A rapid uptick in cryptocurrency adoption by Afghans followed the collapse of the Islamic Republic, with emergency aid being sent in cryptocurrency and cashed-out by local money exchangers or hawaladars, a vital economic lifeline as bank transfers became next to impossible. A nation-wide ban on cryptocurrencies imposed by the Taliban in the summer of 2022 will have increased the risk of cashing-out cryptocurrency in Afghanistan, but is unlikely to have completely eradicated the trade. Further, for ISKP, similar methods could easily be employed across the border in Pakistan, or anywhere else its financial facilitators may be based and where hawaladars or money exchanges accept cryptocurrencies. Once in cash, ISKP can utilise couriers to run the money wherever it needs to go, to pay for goods or services rendered or to cover other costs such as salaries. Otherwise, hawaladars can hold funds in cryptocurrencies in-trust for an intended beneficiary or transfer to someone else.

Going After the Money

ISKP’s favoured position within the global Islamic State network offers the affiliate access to financial resources (and thus, capabilities) it could not be expected to acquire through self-financing alone. Yet, these financial connections also offer access points for mapping and ultimately disrupting the network, having an impact not only on ISKP, but all Islamic State affiliates.

Refocusing domestic and UN-level sanctions tools on the Islamic State’s financial facilitators outside Afghanistan would be a good place to start. Individuals with freedom to manoeuvre in, say, Turkey, Pakistan, the Gulf or even in Europe or North America stand to suffer more from targeted financial sanctions than ISKP leaders in eastern Afghanistan, which almost certainly do not bank with sanctions-implementing financial institutions. Asset freezes and listings for such financial facilitators would at the very least make their lives more onerous and render them less useful for raising and moving of funds for ISKP. Beginning with some of the most understood parts of the structure, arrests or targeted financial sanctions against Al-Rawi members would help in diminishing the Islamic State’s transnational financing networks overall, thus helping to stem the flow of funds towards ISKP specifically, or at least raise the costs of moving funds to the group.

Responses must also keep up with, if not keep ahead of, terrorists’ adoption of new technologies for raising and moving funds. States’ blockchain analysis capabilities should be pooled and marshalled towards identifying and corroborating financial linkages with ISKP seen on the blockchain. Here, financial intelligence officials could collaborate to identify crypto-accepting hawaladars and other money service businesses that, by cashing-out cryptocurrencies, act as peer-to-peer or unlicensed/unregulated cryptocurrency exchanges. Whether these are based in Afghanistan or elsewhere, tracing transactions back to a regulated exchange or hosted wallet could help disruption operations against ISKP’s cryptocurrency use, by limiting opportunities for the group or its financiers to cash-out funds in cryptocurrency sent to them by IS-Core or individual donors. Indeed, notifying a Turkish exchange that was used to cash-out proceeds of the Tajik recruitment campaign mentioned above resulted in the June 2023 arrest of Shamil Hukumatov, an important ISKP financial facilitator based in Turkey.

The evolution of the Islamic State into a relatively loose, transnational jihadist movement has complicated the mission of interrupting its financing, with industrial natural resources exploitation and sophisticated taxation of civilians in Iraq and Syria giving way to a diffuse fundraising structure. With less money to go around, and alleviated of the overhead costs in running a quasi-state, IS-Core is left with more flexibility in allocating remaining reserves among affiliates. Here, value for money is crucial. So while ISKP remains under pressure from Taliban counterterrorism operations, it can count on a formidable support network to ride out the tough times for as long as it can deliver the best return on investment for the Islamic State movement. If the affiliate cannot seize its golden opportunity, we can expect IS-Core to pick a new favourite before too long.

Stephen Reimer is a Senior Research Fellow at RUSI’s Centre for Financial Crime & Security Studies, where he specialises on countering the financing of terrorism and threat finance generally. His recent work has focused on self-activating terrorism finance in Europe, the national security threats posed by illicit finance, and assessing risk of terrorism financing abuse in the not-for-profit sector.