Communiqué concerning non-profit organisations and the fight against terrorism financing

In Luxembourg, vertical risk assessments (on legal persons and legal arrangements¹, on the one hand, and especially on terrorist financing² (“TF”), on the other hand), published by the Ministry of Justice in 2022, measure the level of TF risk exposure of certain non-profit organisations (“NPOs”) as high, based on the characteristics and activities of these NPOs. As regards the Luxembourg NPOs which may be at risk (non-profit associations and foundations, as referred to in the new Law of 7 August 2023 on non-profit associations and foundations), reference is made especially to NPOs carrying out development and humanitarian projects abroad.

As a reminder, the aforementioned TF vertical risk assessment identified a twofold TF risk exposure of these NPOs:

“(…) through the donations they receive and the destination of their funds.

• Regarding donations, organisations linked to terrorists or terrorist groups have been known to create false appeals to raise money. In most cases, donations are made by the public in the belief that the money will be used to fund genuine charitable activities. However, occasionally the donors are aware of the true destination of the funds and use the humanitarian cover to avoid raising suspicion. No such cases have yet been identified in Luxembourg, but the vulnerability exists;
• Regarding the destination of the funds, money may be paid by NPOs active in projects abroad (with or without DNGO [development non-governmental organisation] status) to individual terrorists or terrorist groups, deliberately or inadvertently. As above, no such cases have yet been identified in Luxembourg, but the vulnerability exists.

Although the globally observed typologies have not been detected in relation to Luxembourg NPOs developing projects abroad, this sub-sector remains highly vulnerable in view of the geography of their activities”³, notably in the vicinity of or in conflict zones.

Given the current international geopolitical context (cf. e.g. the CSSF communiqué AML/CTF of 25 October 2023⁴, the risk that illegal financing networks exploit the weaknesses of certain NPOs has been increasing, in particular as NPOs are not directly subject to the obligations provided for by the legislation relating to the fight against money laundering and terrorist financing (“AML/CTF”).

As a result, the implementation of an adequate risk-based approach should lead the financial institutions to target these riskier NPOs and to apply appropriate mitigation measures, taking care not to stigmatise all NPOs.

At international level, it should be stressed that the Financial Action Task Force (“FATF”) has also been reporting for many years that terrorist groups may succeed in abusing and misusing the money of certain NPOs to finance their activities or their promotion, even that NPOs actively support terrorist organisations or activities.

However, the FATF also recalls and emphasises that NPOs do not all pose the same risk of abuse for TF purposes⁵. Consequently, in order to prevent financial institutions from applying disproportionate measures, NPOs must be subject to a factual and risk-based analysis. The FATF highlights the practices to be avoided in order to preserve the integrity of the non-profit sector and also stresses the unintended and harmful consequences of the implementation of inappropriate mitigation measures towards NPOs (e.g. considering all NGOs as posing a high TF risk). “De-risking”, as defined by the FATF, means, in this case, the phenomenon of financial institutions terminating or restricting business relationships with NPOs to avoid, rather than manage, risk in line with the FATF’s risk-based approach⁶. The application of risk mitigation measures must not jeopardise the financial inclusion of NPOs, which consequently might move to unregulated and unsupervised financial services, further increasing the risk of abuse for TF purposes.

The FATF thus adopted, during the plenary meeting of October 2023, amendments to Recommendation 8 regarding NPOs in order to provide an effective framework to protect the financial system from potential abuses for TF purposes⁷. In order to take account of these amendments, the FATF also updated its Best practices paper on combating the terrorist financing abuse of NPOs (which also includes examples of bad practices)⁸. In parallel, the FATF’s assessment methodology has also been adapted, as decided during the plenary meeting of February 2024, in order to mirror these recent changes for the next FATF’s assessments under the 5^th round of evaluations.

Hence, the FATF provides a set of good practices aimed at reconciling the fight against TF and the access of NPOs to financial services. We would like to raise attention to the fact that the FATF requests financial institutions, where they identified a TF risk specific to an NPO and its activities, to determine if there are appropriate guarantees and measures that enable them to manage it. The FATF also recommends financial institutions to collaborate more closely with the non-profit sector to open discussions on the expectations and issues of each of them. Such exchanges offer the possibility to financial institutions to clearly express their requirements towards NPOs.

In this sense, it should also be pointed out that, at European level, the European Banking Authority (EBA) updated its guidelines in order to reflect the factors which financial institutions must take into account when assessing the risks of money laundering and TF related to business relationships with NPOs. Reference is made to Circular CSSF 23/842⁹ on the adoption of these guidelines (EBA/GL/2023/03).

Finally, the combination of these factors and of the aforementioned guidelines allows drawing up a non-exhaustive list of indicators that financial institutions may take into consideration in order to determine whether they face a TF risk situation through the abusive exploitation of an NPO:

• difficulties in tracing the origin or destination of the funds;
• mostly cash-based donations;
• unexplained increase of deposits and transactions;
• significant and unusual withdrawals (in particular following a refusal to carry out a cross-border transfer);
• transactions including terms/symbols associated with violent, racist and/or terrorist ideologies.

• transferring funds to several entities in (a) high-risk country(ies);
• appointment of a third party as representative to transfer funds to high-risk countries (notably upon a fund collection campaign);
• no domestic donors, donors located in high-risk countries;
• resources transferred or activities conducted in an area where terrorist entities are known to have a substantial presence;
• links with conflict zones or nearby regions (e.g. transfers to a local association that is supposed to pursue the NPO’s missions);
• fund transfers from/to entities operating in areas with known terrorist activities.

• existence of reliable information indicating that the NPO is linked to third parties that support or are engaged in terrorist activities;
• receipt of funds from entities suspected of supporting terrorist activities;
• receipt of funds from suspected terrorists [or “listed persons”, i.e. persons included in the TF financial sanctions lists]¹⁰.

• lack of information on the objective, and, where applicable, on the ultimate beneficiaries of the activities of the NPO;
• inability to account for the final use of all of the resources; absence of legal status (under national law or a different jurisdiction).

• disappearance of the NPO’s online and/or social media presence (notably following a crowdfunding request for donations);
• use of falsified or conflicting documentation;
• sharing premises with an organisation suspected of supporting terrorist activities, etc.

The geographic indicators allow evidencing potential situations through which NPOs might be abused for TF purposes in ex post situations (embezzlement of funds), whereas the other indicators mostly refer to situations in which NPOs potentially engage in TF and have been established ex ante for this specific purpose.

As a conclusion, based on their risk-based approach, financial institutions should apply mitigation measures that are appropriate and proportionate to the NPOs that they identified as being exposed to TF risk, whilst ensuring that all the actors of that sector are not stigmatised, and refrain from “de-risking” which would be detrimental to the financial inclusion of NPOs and to transparency.