Protecting Purpose: How Jersey Is Strengthening NPO Defences Against Terrorist Financing

Non-profit organisations perform some of society’s most important work. They provide humanitarian assistance, support vulnerable communities, respond to disasters, fund medical treatment and deliver services in places where governments and commercial organisations may be unable to operate.

Those same capabilities can create exposure to terrorist financing.

Non-profit organisations may raise funds rapidly, operate across borders, work through local partners and provide assistance in conflict zones or areas with limited financial infrastructure. Terrorist organisations can attempt to exploit those characteristics by diverting donations, infiltrating local partners, misusing charitable programmes or presenting themselves as legitimate beneficiaries.

In January 2023, Jersey launched an engagement campaign intended to protect its non-profit sector from such exploitation. Led by the Jersey Financial Services Commission, the programme included online guidance, direct communication, drop-in sessions and targeted engagement with organisations considered more vulnerable to terrorist-financing abuse.

The campaign accompanied new legal obligations that created a supervised category of “Prescribed NPOs”. These organisations were required to introduce additional financial records, risk assessments, donor controls and measures governing overseas partners and beneficiaries.

The initiative was not based on evidence that Jersey’s charity sector was systematically financing terrorism. Jersey’s national assessment concluded that the sector presented medium-to-low overall risk, while identifying approximately 11% of organisations as having characteristics that could make them more vulnerable.

The policy objective was therefore preventive and risk-based: protect legitimate charitable activity without imposing unnecessary restrictions on the wider sector.

Key Takeaways

• Non-Profit Organisations Can Be Exploited for Terrorist Financing
• Charitable Structures Can Conceal the Movement of Illicit Funds
• Cross-Border Fundraising Creates Elevated Terrorist Financing Risk
• NPO Vulnerability Depends on Activities, Geography and Funding Channels
• Legitimate Charities Can Be Misused Without Their Knowledge
• Strong Governance Is Critical to Protecting the NPO Sector
• Registration Requirements Improve Transparency and Accountability
• Donor Confidence Depends on Effective Financial Crime Controls
• Terrorist Financing Prevention Requires Proportionate, Risk-Based Measures
• Regulatory Outreach Can Improve NPO Compliance
• Smaller Organisations May Require Additional Guidance and Support
• International Fund Transfers Require Greater Scrutiny
• Effective NPO Controls Must Avoid Unnecessarily Restricting Legitimate Charitable Activity
• Collaboration Between Regulators and NPOs Strengthens Sector Resilience

Listen the podcast

Watch the video

Why Jersey’s campaign matters now

Jersey is a small jurisdiction with a disproportionately international financial profile.

Its non-profit sector includes local clubs, community associations, religious organisations, registered charities and internationally focused structures administered by professional service providers.

Most present limited terrorist-financing exposure. Their activities, beneficiaries and financial relationships remain largely domestic and transparent.

A smaller group raises or distributes funds internationally, including in jurisdictions affected by conflict, instability, sanctions or weak governance. These organisations may depend on foreign partners, cash, remittance businesses, mobile-money services or other payment mechanisms where conventional banking is unavailable.

Those activities are often essential to humanitarian delivery. They also make it more difficult to confirm who ultimately received the assistance and whether every part of the payment chain operated as intended.

Jersey’s response is therefore relevant beyond the Island. It illustrates how an international finance centre can apply targeted controls to a higher-risk subset of organisations rather than treating the entire charitable sector as equally exposed.

How non-profit organisations can be exploited

Terrorist financing involving an NPO does not always mean that the organisation itself supports terrorism.

An organisation may be entirely legitimate while a foreign partner, employee, volunteer or beneficiary diverts part of its resources. A local armed group may demand payment for access to a community, or an intermediary may inflate expenses and redirect the difference.

Terrorists can also create sham charities whose stated humanitarian purpose conceals fundraising, recruitment or logistical support. In other cases, an established organisation may be infiltrated by individuals who obtain influence over projects, payments or beneficiary selection.

Abuse can involve more than money. Vehicles, buildings, communications equipment, documents, training and personnel can provide value to a terrorist organisation even where no direct financial transfer occurs.

The NPO’s name and reputation can also be misused. Fraudulent websites, social-media appeals and impersonated fundraising campaigns may collect donations without the genuine organisation receiving any funds.

The relevant control question is therefore not simply whether the NPO transferred money to a listed terrorist. It is whether the organisation understands who controls each stage of its programmes and can demonstrate that resources reached their legitimate destination.

Jersey’s national assessment

Jersey’s dedicated NPO risk assessment examined the structure, activities, geographical connections and payment practices of the sector.

The assessment concluded that approximately 90% of relevant organisations fell within low or standard risk categories. Around 11% displayed characteristics associated with heightened vulnerability.

Risk factors included operating in conflict zones, failed states and disaster areas; working through overseas partners; using cash or alternative remittance methods; and maintaining inadequate systems for tracing funds.

The assessment did not suggest that organisations displaying these characteristics were involved in terrorism. A humanitarian charity may operate in a conflict zone precisely because legitimate assistance is urgently required.

The purpose of the classification was to identify where additional safeguards would be appropriate.

The assessment found that some organisations lacked written risk assessments, anti-diversion procedures or contractual controls governing partners. In some cases, an NPO knew which intermediary received its funds but held limited evidence explaining how those resources reached the intended beneficiaries.

This gap between the immediate recipient and the ultimate destination became a central focus of Jersey’s later supervisory work.

What makes an organisation a Prescribed NPO

From 1 January 2023, NPOs falling within the relevant legal definition were required to register with the JFSC.

Registration alone does not make an organisation a Prescribed NPO.

The additional category applies where, during the preceding 12 months, the organisation raised more than £1,000 from outside Jersey, Guernsey, the Isle of Man, England and Wales or Scotland—or distributed more than £1,000 outside those jurisdictions.

The threshold is intended to identify organisations with international financial exposure. It does not mean that every overseas payment above £1,000 is considered suspicious.

MONEYVAL later noted that the relatively low threshold could create proportionality concerns for smaller organisations. Jersey was encouraged to continue assessing whether the obligations remained aligned with actual terrorist-financing exposure.

This is an important distinction. A risk-based framework should increase scrutiny where exposure is higher without imposing bank-level compliance structures on every small community organisation.

The additional obligations

Prescribed NPOs must prepare annual financial statements and maintain accounting systems capable of showing how funds were received and spent.

They must keep sufficient information to identify the people who own, direct or exercise significant influence over the organisation. These records help authorities and governing bodies understand who controls decisions and financial activity.

The regime also requires records of significant donors.

A significant donor generally includes a person who provides at least £10,000 during a 12-month period or whose contribution represents more than half of the organisation’s total donations during that period. Records must be retained for at least five years.

These requirements do not imply that major donors are inherently suspicious. They allow the organisation to understand whether concentrated funding creates influence, conflicts or exposure to an undisclosed source.

Prescribed NPOs must also take reasonable steps to identify their associate organisations and beneficiaries, understand the activities and purpose of those relationships, and confirm—so far as possible—that they are not assisting terrorism or being used for terrorist financing.

Diversion is the central operational risk

Diversion occurs when funds or other resources intended for a legitimate purpose are redirected so that a terrorist or terrorist organisation benefits directly or indirectly.

The diversion may occur before the resources leave Jersey, during international transfer, after receipt by a partner or at the point of distribution.

A partner organisation may deliberately redirect assistance. Employees may create false beneficiaries or inflate project costs. Local actors may impose unofficial taxes, checkpoint payments or access fees.

The risk can also arise through procurement. A humanitarian project may purchase goods from a supplier controlled by an armed organisation or pay rent to a sanctioned individual.

Not every unavoidable payment in a conflict environment establishes terrorist financing. The facts, applicable law, knowledge and available mitigation measures remain central.

The NPO must nevertheless understand where control over its resources changes hands and what evidence can demonstrate appropriate end use.

Transferring money to a reputable partner does not end the originating organisation’s responsibility. It changes the form of the control required.

What Jersey’s first examination found

During 2023, the JFSC examined eight Prescribed NPOs, focusing initially on significant-donor records and related controls.

The results showed substantial early compliance. Most organisations maintained adequate donor records, risk assessments and documented risk-appetite statements.

The review also identified material development areas.

Only three-quarters of the organisations examined fully demonstrated that diversion risk had been considered, mitigated and documented. Some could show that funds were transferred to an associate NPO but could not adequately evidence where or how the money was ultimately used.

Training presented another weakness. Most organisations examined could not fully demonstrate that appropriate terrorist-financing training had been delivered to relevant employees or volunteers.

Independent NPOs generally recorded more findings than organisations administered by regulated trust companies. The JFSC cautioned that this did not mean independent organisations were conducting riskier activities. They often had less access to established compliance procedures and specialist resources.

The findings demonstrate why implementation matters more than the presence of a policy. An organisation may have a risk assessment while remaining unable to prove that resources reached their intended destination.

The 2024 focus on diversion

The JFSC’s 2024 thematic programme moved more directly towards the effectiveness of diversion controls.

Prescribed NPOs were expected to assess the risk that their programmes could assist terrorism, document their tolerance for diversion risk and maintain appropriate systems and controls.

Effective mitigation may include partner due diligence, written agreements, payment verification, project reports, receipts, photographs, independent audits and visits to programme locations.

No single method is conclusive.

Receipts can be fabricated, photographs can be staged and reports can repeat information supplied by the partner. Stronger assurance comes from combining several forms of evidence and comparing them with the nature and value of the programme.

A small grant to a long-established partner may justify different controls from a major cash-funded project operating through several intermediaries in a conflict zone.

Partner due diligence must remain practical

Overseas partners are often essential because they understand local language, geography, culture and beneficiary needs.

Requiring the Jersey NPO to replace every local organisation with direct delivery would frequently be unrealistic and counterproductive.

The objective is to understand the partner sufficiently to assess the relationship.

Relevant information includes legal status, controllers, experience, reputation, financial capacity, sanctions exposure and links to public officials or armed groups. The NPO should also understand whether the partner uses subcontractors or distributes funds through additional organisations.

Written agreements should define programme objectives, permitted expenditure, reporting obligations and the organisation’s right to inspect records.

Due diligence must continue after onboarding. Changes in leadership, banking arrangements, geographical activity or political conditions can alter the risk substantially.

Sanctions screening is necessary but insufficient

Prescribed NPOs should understand whether donors, controllers, partners and relevant recipients are subject to applicable financial sanctions.

Screening can identify a listed person or organisation, but terrorist-financing exposure extends beyond exact-name matches.

A partner may be controlled indirectly by a designated individual, or funds may be made available through an intermediary acting on that person’s behalf.

Names may also appear in different scripts or transliterations. Common names can create false positives, requiring comparison of dates of birth, locations, nationalities and other identifiers.

Screening ultimate beneficiaries may be impractical where assistance is distributed to large communities. In such cases, controls should focus on the process used to identify eligible beneficiaries, the role of local partners and the safeguards surrounding distribution.

A clean sanctions result should not replace an assessment of ownership, control and programme purpose.

Financial institutions must avoid indiscriminate de-risking

Banks play an important role in protecting NPOs and the financial system. They also control access to the payment channels through which humanitarian assistance is delivered.

An overly cautious response can create unintended consequences.

Closing accounts or refusing payments solely because an organisation operates in a higher-risk jurisdiction may disrupt legitimate aid and push transactions towards cash or informal transfer mechanisms. That can reduce transparency rather than improve it.

FATF revised Recommendation 8 in 2023 to reinforce that controls should apply to the subset of organisations exposed to terrorist-financing abuse and should remain focused, proportionate and risk-based.

Banks should understand the NPO’s mission, countries of operation, donors, partners, expected payment methods and control environment.

Transaction monitoring should compare actual activity with that profile. Sudden payments to a new jurisdiction, unexplained cash withdrawals or transfers to unrelated individuals may justify investigation, but international humanitarian activity should not be treated as suspicious merely because it is complex.

Reporting suspicion and protecting the organisation

NPO representatives may encounter circumstances that create suspicion: a partner refuses to provide records, beneficiaries cannot be verified, a donor demands control over expenditure or funds move to an unexplained third party.

The organisation should have a clear internal escalation process.

Employees and volunteers need to know whom to contact, what evidence to preserve and when external reporting may be required. They should avoid confronting a suspected facilitator where doing so could endanger staff or beneficiaries.

The governing body must also assess whether activity should be suspended, whether funds can be recovered and whether banking or regulatory partners need to be informed.

Reporting should focus on facts: the people involved, the transaction path, the expected purpose, the discrepancy identified and the steps already taken.

An allegation unsupported by evidence can harm legitimate organisations and communities. Silence can allow diversion to continue. Effective reporting requires both vigilance and precision.

What MONEYVAL concluded

MONEYVAL’s 2024 evaluation rated Jersey compliant with the technical requirements of FATF Recommendation 8.

The assessment recognised the dedicated risk analysis, legislative reforms, registration framework, sector engagement and risk-based supervision of Prescribed NPOs.

It also found that the supervisory regime was still relatively new and that its effectiveness had not yet been fully demonstrated.

Evaluators highlighted the need for continued guidance on terrorist-financing indicators and diversion risk. They also observed that the initial thematic review concentrated heavily on donor records and should place greater attention on the point at which funds are distributed to partners and beneficiaries.

The distinction between technical compliance and effectiveness is important. Jersey had constructed the required framework. The continuing challenge was to show that it consistently prevented, identified and responded to misuse.

What a resilient NPO control stack looks like

The first layer is a programme-specific risk assessment covering geography, beneficiaries, partners, payment methods and applicable sanctions.

The second is documented risk appetite, including a clear position that the organisation will not tolerate deliberate diversion or work with parties enabling it.

The third is governance. Trustees, governors or directors should approve higher-risk programmes and receive meaningful information about incidents and control failures.

The fourth is transparent accounting capable of tracing funds from donor to programme and explaining each material expenditure.

The fifth is proportionate due diligence covering significant donors, associate organisations and relevant beneficiaries.

The sixth is end-use verification using several independent forms of evidence rather than relying entirely on partner declarations.

The seventh is role-specific training for trustees, employees and volunteers.

Finally, the organisation needs escalation, reporting and incident-response procedures capable of protecting beneficiaries while preserving evidence and preventing further loss.

What this means for financial crime leaders

Jersey’s campaign should not be interpreted as evidence that charities are inherently high risk.

The national assessment found that most of the sector presented limited exposure. The regulatory response focused on the smaller subset whose international activities and payment methods created greater vulnerability.

The strongest framework is therefore neither minimal oversight nor blanket regulation.

Financial crime leaders should support NPOs in understanding their partners, tracing resources and documenting legitimate activity. They should also ensure that banks, supervisors and government agencies do not confuse humanitarian complexity with terrorist intent.

Non-profit organisations become vulnerable when trust replaces verification, control ends at the first intermediary and limited resources prevent effective oversight.

Protecting the sector requires proportionate safeguards that allow legitimate assistance to continue while making diversion, infiltration and concealed influence more difficult.

Jersey’s continuing challenge is to demonstrate that its campaign and legal reforms improve operational outcomes without discouraging the charitable work they were designed to protect.

What Financial Institutions Should Consider

• Apply Risk-Based Due Diligence to NPO Customers
• Understand the Organisation’s Purpose and Activities
• Identify Trustees, Controllers and Beneficial Relationships
• Assess Geographic Exposure and Overseas Operations
• Understand Expected Fundraising and Payment Patterns
• Monitor Cross-Border Transfers to Higher-Risk Jurisdictions
• Assess Unusual Changes in Beneficiaries or Payment Destinations
• Identify Payments Inconsistent With the Organisation’s Stated Purpose
• Strengthen Terrorist Financing Transaction Monitoring
• Integrate Sanctions Screening With NPO Monitoring
• Review Links to High-Risk Individuals and Organisations
• Monitor Unusual Cash Collection and Disbursement Activity
• Apply Enhanced Due Diligence Where Risk Indicators Are Present
• Maintain Up-to-Date NPO Registration and governance information
• Use Network Analytics to Identify Connected Parties
• Escalate Potential Diversion of Charitable Funds
• Train Financial Crime Teams on NPO Terrorist Financing Typologies
• Avoid Treating NPO Status Alone as an Indicator of Suspicion