Charitable and Non-Profit Organizations

Criminals launder illicit funds by abusing charitable or non-profit entities (including philanthropic or educational organizations) under the guise of legitimate donations or grants, exploiting the credibility and limited oversight these entities often enjoy. Investigations reveal that illicit actors may deliberately establish new non-profits or infiltrate existing ones, embedding associates among staff or management to directly siphon donations and misappropriate resources. In certain cases, up to eight freshly created non-profits were discovered to be operated by terrorist groups, with additional legitimately registered entities later exploited. Criminals frequently integrate cross-border transfers, cryptocurrency donations, and complex documentation to disguise the true fund origin, particularly in jurisdictions lacking robust AML controls or governance. They also capitalize on tax-exempt status or charitable incentives, enabling enhanced anonymity and further complicating detection by authorities. Through layering tactics, such as dispersing funds across multiple projects, criminals effectively obscure beneficial ownership and disrupt traditional KYC processes, making early intervention and investigation more challenging.

[
Code
T0019
]
[
Name
Charitable and Non-Profit Organizations
]
[
Version
1.0
]
[
Parent Technique
]
[]
[
Risk
Customer Risk, Jurisdictional Risk
]
[
Created
2025-02-06
]
[
Modified
2025-04-02
]

Charitable and Non-Profit Organizations

Tactics

ML.TA0009
|
|

Criminals use charitable or non-profit fronts to blend illicit funds with legitimate donations, effectively presenting the proceeds as authorized philanthropic contributions and fully assimilating them into the legitimate financial system.

Risks

RS0001
|
Customer Risk
|

Criminals establish or infiltrate non-profit entities, leveraging their charity status and relaxed AML scrutiny to hide behind philanthropic gestures. By embedding complicit individuals in staff or management, they bypass typical KYC controls, obscure beneficial ownership, and make it more difficult for financial institutions to detect illicit activity.

RS0004
|
Jurisdictional Risk
|

Criminals exploit cross-border donations and grants in regions with weaker AML regulations or tax exemptions for non-profits, transferring funds internationally under charitable pretenses. This regulatory arbitrage tactic reduces scrutiny and complicates efforts to trace the illicit origins or final beneficiaries.

Indicators

IND00364
|

Crypto donation transactions that are far above the typical historical donation amounts or normal range for the beneficiary organization.

IND01324
|

Accompanying donor communications that lack clarity about the donor’s identity or the intended use of donated funds.

IND01374
|

Multiple small crypto donations aggregated from disparate, one-off wallet addresses that quickly converge to a single charitable platform.

IND01375
|

Crypto donations from addresses with minimal or no prior transactional activity, or from addresses flagged for using mixing or tumbling services.

IND01376
|

Crypto donations that occur immediately after large digital asset conversions or inbound transfers, indicating layering attempts to conceal the original fund source.

IND01377
|

Donors who refuse or fail to provide required source-of-funds documentation or do not complete KYC procedures for crypto donations.

IND01378
|

A sudden surge in crypto donations to charities or crowdfunding platforms that have no prior record of receiving digital assets.

IND01379
|

Charitable organizations accepting crypto donations without implementing robust AML/CFT checks or verifying donor identities.

IND01380
|

Crypto donations originating from high-risk jurisdictions or from digital asset platforms offering minimal or no KYC obligations.

IND01382
|

Frequent or suspicious changes in a charitable organization’s board or management coinciding with large or unexplained donation inflows.

IND01383
|

Significant mismatch between incoming donations and the charitable organization’s recorded expenditures on actual programmatic or philanthropic activities, with funds diverted to private accounts or unrelated purposes.

Data Sources

  • Compiles negative news articles, legal actions, or court documents indicating potential wrongdoing by donors, staff members, or charitable entities.
  • Flags key individuals associated with fraud, money laundering, or terrorist financing allegations.
  • Alerts investigators to reputational and legal risks tied to a charity’s management or major funding sources.
  • Classifies countries and regions by AML/CFT risk profiles, highlighting jurisdictions with weak governance and lax oversight.
  • Identifies cross-border donation flows originating from or transiting through high-risk areas.
  • Helps investigators prioritize scrutiny of charities receiving funds from regions known for higher terrorism or money laundering risks.
  • Contains official filings such as audited financial statements, operating expenditures, tax returns, and related documentation.
  • Reveals discrepancies between reported charitable expenditures and actual donation inflows, indicating potential misappropriation.
  • Aids investigators in matching the declared financial activity of non-profits against the real usage of funds.
  • Comprises official lists of individuals, entities, and jurisdictions subject to economic or financial restrictions.
  • Enables the screening of donors, beneficiaries, or affiliated parties who may be designated or tied to terrorist organizations.
  • Helps detect and block funds linked to sanctioned or prohibited entities attempting to exploit charitable structures.
  • Captures granular transaction details, including timestamps, amounts, currencies, account identifiers, and metadata for each donation or payment flow.
  • Enables the identification of suspicious spikes in donation activity, rapid layering attempts, and cross-referencing of multiple high-risk donor sources or incomplete donor information.
  • Assists investigators in detecting anomalies such as unusually large or frequent donations that are inconsistent with typical funding patterns.

Provides logs of donors, donation amounts, timestamps, and any recorded details from crowdfunding or charitable donation platforms. This data enables investigators to:

  • Track unusual spikes or patterns in donations.
  • Identify recurring donors, cross-reference incomplete donor details, or detect multiple donations originating from high-risk sources.
  • Correlate donation flow with other indicators (e.g., lack of disclosed fund sources, inadequate KYC) to uncover potential laundering activity within charitable organizations.
  • Validates the authenticity of identification documents or corporate paperwork submitted by donors or representatives.
  • Detects discrepancies, forgeries, or tampering in official IDs, passports, or charity registration documents.
  • Assists in preventing the misuse of falsified documentation to mask true identities or beneficial ownership within non-profits.
  • Provides records of a charity’s stated projects, operational scope, and activities.
  • Enables cross-checking of reported philanthropic activities against actual resources allocated.
  • Helps detect whether incoming donations are consistent with legitimate programming or suggest that funds are being diverted.
DS0033
|
|
  • Aggregates known or suspected fraudulent wallet addresses, flagged entities, and scam patterns.
  • Correlates donor or organizational information with existing fraud databases to identify potential illicit involvement or repeated risk signals.
  • Helps detect addresses using mixing or tumbling services previously associated with suspicious activity.
  • Contains verified identities, risk ratings, and supporting documentation for donors, board members, and key stakeholders.
  • Enables verification of legitimate donor profiles and detection of incomplete or fraudulent KYC submissions.
  • Facilitates screening for infiltration by criminals or parties with unknown or suspicious backgrounds attempting to misuse charitable entities.
  • Captures metadata and, where permissible, the content of donor or management communications (emails, calls, messaging apps).
  • Discloses unclear or evasive donor instructions, false statements of purpose, or contradictory claims about fund usage.
  • Supports investigations by correlating suspect messages with suspicious donation timing or unusual board changes.
  • Provides on-chain transaction records, including wallet addresses, timestamps, and transaction amounts.
  • Detects the use of mixing, tumbling, or obfuscation services associated with high-risk crypto laundering tactics.
  • Enables investigators to trace digital asset flows tied to charitable donations and identify addresses operating from high-risk jurisdictions or flagged for prior illicit activity.
  • Details official registration records, directors, shareholders, and beneficial owners of organizations, including non-profits.
  • Enables investigators to detect frequent or suspicious board changes, hidden ownership structures, or infiltration by criminal associates.
  • Helps confirm or refute claims regarding a charity’s legitimate governance and oversight.

Mitigations

Implement deeper background checks and verification for charitable or non-profit customers by:

  • Verifying board members and key management.
  • Confirming the organization’s legitimate mission.
  • Analyzing donation flows.
  • Demanding clear documentation for large cross-border donations.

This mitigation directly addresses infiltration risk by revealing hidden beneficial owners or extremist affiliations, ensuring transparency in leadership and funding sources.

Implement specialized donation-monitoring rules for charities, flagging large, repetitive, or irregular cross-border transfers that deviate from historical patterns. Investigate abrupt spikes in donation volume, particularly from high-risk jurisdictions, to detect layering and infiltration attempts disguised as charitable giving.

Screen charitable organizations, their management, and major donors against terrorism watchlists, global sanctions databases, and adverse media. This measure directly addresses infiltration risk by identifying potential extremist or sanctioned individuals early, preventing fund diversion to unauthorized entities.

Utilize blockchain analytics to trace and analyze inbound crypto donations to charitable organizations. Flag addresses associated with mixers, newly established wallets lacking transaction history, or large inbound transfers from uncertain sources. This specifically addresses infiltration tactics leveraging the anonymity of digital assets to evade detection.

Cross-verify the legitimacy of charitable organizations and their leadership using publicly available data, registries, and media sources. Identify potential infiltration by extremist or criminal groups, detect inconsistencies in stated missions, and corroborate the organization’s philanthropic activities to ensure donated funds are used as intended.

Restrict or deny services to charitable organizations that fail to provide clear governance structures or adequate documentation for large or cross-border donations. If infiltration or suspicious activity is suspected, freeze accounts or impose transaction limits to curtail ongoing illicit behavior. This measure specifically addresses infiltration by deterring the misuse of nonprofit status.

Regularly review and update risk assessments for charitable entities, focusing on changes in management structure, unusual donation spikes, and the actual use of funds. This measure identifies suspicious patterns, such as a new board member with extremist ties or unexplained shifts in project objectives, indicating potential infiltration or misappropriation of donations.

Instruments

IN0004
|
|
  • Non-profit organizations frequently accept checks as donations, enabling criminals to funnel illicit proceeds under the guise of legitimate philanthropic contributions.
  • Complicit staff or lax verification processes can prevent proper scrutiny of check donors, allowing criminals to use multiple checks from different sources or accounts to layer funds.
  • Once deposited in the charity’s account, the illicit origins become obscured by the perceived legitimacy of charitable donations.
  • Criminals exploit the dedicated bank accounts of charitable organizations by depositing illicit funds labeled as regular donations.
  • Once these funds enter the non-profit’s main account, they are commingled with legitimate contributions, making it challenging for authorities to identify illicit origins.
  • Complicit management can further disguise withdrawals or transfers as operational expenses, layering illicit proceeds under a charitable veneer.
  • Criminals leverage cryptocurrency donations to non-profits to disguise the origins of illicit funds, taking advantage of pseudonymity and global transferability.
  • By routing funds through multiple wallets or mixing services before donating, they obscure the transaction trail, complicating AML efforts.
  • Charities accustomed to minimal KYC for crypto donors may unknowingly integrate criminal proceeds alongside legitimate contributions.
IN0051
|
|
  • At charitable events or donation drives, criminals can contribute physical currency anonymously, bypassing formal donor documentation.
  • Large cash sums can be broken into smaller increments below reporting thresholds to avoid raising suspicion, effectively placing illicit funds into the non-profit’s revenue streams.
  • The physical nature of cash reduces traceability, offering criminals an initial layer of anonymity before blending with legitimate charitable receipts.

Service & Products

  • Criminals convert illicit funds into cryptocurrency (or vice versa) before channeling them as charitable donations, bypassing traditional financial oversight.
  • Rapid crypto-to-fiat conversions enable layering, making it difficult to track the original source of funds.
  • Illicit funds are deposited into accounts designated for nonprofit activities, commingling dirty money with legitimate contributions.
  • Criminals reroute or slowly siphon funds under philanthropic pretenses, obscuring the ultimate beneficiary and complicating standard KYC measures.
  • Criminals set up front nonprofits using simplified registration processes, quickly establishing entities positioned to receive or move illicit funds.
  • By infiltrating boards or management, criminals can orchestrate suspicious transactions disguised as grants or operational expenses.
  • Criminals can funnel illicit proceeds disguised as donations into fundraising campaigns or events.
  • Limited oversight or lax AML checks on these platforms can enable anonymous or pseudonymous contributions, especially via cryptocurrency, making it difficult to trace the true fund source.
  • Criminals transfer funds internationally under the cover of charitable donations, exploiting weaker AML regulations in certain jurisdictions.
  • By dispersing transactions across multiple regions, they add complexity that hinders investigators from tracing beneficiaries and origins.

Actors

These groups establish or manage charitable entities to funnel funds for extremist activities under a seemingly philanthropic mission. By exploiting the legitimacy of charitable accounts, they transfer money across jurisdictions with limited scrutiny, posing significant challenges to the risk assessment processes of financial institutions.

Criminals establish or infiltrate these entities, presenting illicit funds as legitimate donations or grants. This commingling obscures the true source of funds and complicates transaction monitoring, making it harder for financial institutions to identify and verify beneficial owners.

These criminal actors create or exploit non-profit organizations to mask and redistribute illicit proceeds. By leveraging cross-border transactions, cryptocurrency donations, and complex paperwork, they hinder financial institutions' ability to trace origins and uncover final beneficiaries.

By controlling financial and operational decisions, complicit or unwitting directors may authorize or conceal transactions related to illicit funds. Criminal operatives embedded in these leadership positions can rapidly misdirect donations, undermining financial institutions' attempts to detect suspicious activities.

References

  1. Wardhana, I. M. W. (2023). The analysis of non-profit organisations in terrorism financing in Indonesia (Doctoral dissertation). Charles Sturt University. https://researchoutput.csu.edu.au/en/publications/the-analysis-of-non-profit-organisations-in-terrorism-financing-i

  2. Financial Action Task Force (FATF). (2014, June). Risk of terrorist abuse in non-profit organisations. FATF. https://www.fatf-gafi.org/en/publications/Methodsandtrends/Risk-terrorist-abuse-non-profits.html

  3. MENAFATF (The Middle East and North Africa Financial Action Task Force). (2022). Typologies project report on the abuse of NPOs in TF activities. https://www.menafatf.org/sites/default/files/Newsletter/NPOsTypologies%20Project%201st%20Draft%2030%20OCT%2022%20ENG%20Final.pdf