Dr. Nicholas Ryder Professor in Financial Crime Bristol Law School

1. Counter-terrorist financing, cryptoassets, social media platforms, and suspicious activity reports: a step into the regulatory unknown Dr. Nicholas Ryder Professor in Financial Crime Bristol Law School University of the West of England, Bristol

2. Abstract • This paper is divided into three parts: • The paper presents evidence of how terrorism financiers are able to appeal for and obtain funding via cryptoassets and social media platforms. • The paper enhances the understanding of the ineffectiveness of DATF SARs to terrorism financing via both cryptoassets and social media platforms. • The paper critically appraises the potential extension of DATF SARs to payments made via cryptoassets and social media platforms.

3. Findings • The paper concludes: • advocating the extension of the DATF SARs regime to include cryptoassets • and that the voluntary exchange of information model, as developed by the Joint Intelligence Money Laundering Task Force (JMLIT) must be extended to include social media platforms.

4. Context • What is terrorism financing? • Terrorist financing has been referred to as ‘reverse money laundering’, which is a practice whereby ‘clean’ or ‘legitimate’ money is acquired and thenfunnelled to support terrorism

5. Context • State Sponsors of terrorism: • Sudan, Iran, Syria and North Korea • Iran rejected new counter terrorist financing law (November 2018) • Private terrorist moneys may be classified into two categories : • legitimate, • and unlawful funds.

6. Context • Sources of terrorism financing: • Corporate donations, • Drug trafficking, • Extortion, • Organised retail theft, • Kidnappings for ransom, • Oil refining, • Misapplied charitable donations, • Islamic non-remittance systems, • Bank robberies, • sale of ivory, • Fraud, • Cryptoassets and • Social media platforms.

7. Part I - Cryptoassets and Social media Platforms • How was 9/11 financed? • Terrorists were funded by al-Qaeda: • either through wire transfers or • cash provided by Khalid Sheikh Mohammed (KSM) • Wire transfers ranging between $5,000 to $70,000

8. Part I - Cryptoassets and Social media Platforms • There is no universally agreed definition of a cryptoassets, • they have been referred as virtual currencies and cryptocurrencies, • A virtual currency is more commonly referred to as digital money which is utilized and accepted within the virtual community. • As such, they are not issued by a central bank, or deposit taking institution, they are generally unregulated.

9. Part I - Cryptoassets and Social media Platforms • There are generally three types of cryptoassets: • exchange tokens, • security tokens and • utility tokens. • Well known cryptoassets include Bitcoin, the first of which was used to purchase a Pizza in 2010. • The evolution of cryptoassets is illustrated by its market capitalisation: • peaked at $830 billion. • The figure only accounted for one per cent of global GDP.

10. Part I - Cryptoassets and Social media Platforms • The transition from traditional sources of terrorism financing towards online sources has been facilitated by the ease at which would-be terrorism financiers are able to access the internet: • UN estimated that 47% of the global population were able to gain access to the internet via a variety of mechanisms, • 90% of the UK population have internet access and • By 2019, over two thirds of the global population will have access to a mobile device. • Therefore, any person who has access to the internet could be a terrorism financier.

11. Part I - Cryptoassets and Social media Platforms • Association between cryptoassets and financial crime: • Silk Road, • Liberty Reserve, • Western Express International and • Danske Bank.

12. Part I - Cryptoassets and Social media Platforms • Al-Nusra Front • actively seeking to attract funding via social media platforms • subject to US Department of Treasury Sanctions • Mohamed Elshinawy • provided $8,700 of funding to ISIL • Convicted 2015 • Gregory Lepsky • 16 years imprisonment • Pleading guilty to attempting to provide material support to a designated foreign terrorist organisation. • Lepskyhad used several social media platforms to plan his terrorist attack

13. Part I - Cryptoassets and Social media Platforms • Ardit Ferizi • computer hacker demanded a ransom of two Bitcoins from a retailer in exchange for removing bugs from their computer system, • Ferizi extracted data from the server to create a ‘kill list’ of over 1,300 names US government and military personnel, • Ferizi, was convicted and sentenced to 20 years imprisonment • Ali Shukri Amin • Convicted and sentenced to 11 years and four months imprisonment, • “Used the nternetto provide material support and resources” to ISIL. • Amin pleaded guilty and admitted to using his Twitter handle ‘@Amreekiwitness’ • Zoobia Shahnaz • Attempted to transfer $62,000 of Bitcoin to ISIL • Convicted and sentenced to 20 year imprisonment.

14. Part II - DATF SARs • Terrorism Act 2000 (s.19) • DATF SARs seek to provide financial intelligence (FININT) • Regime littered with problems: • Interpretation of suspicion, • Quality of SARs, • Compliance costs, • Quality of information provided and • Defensive reporting.

15. Part II - DATF SARs • Problems recognised by Home Office, Law Commission and Financial Action Task Force, • Hopelessness of DATF SARs is illustrated by their inability to provide FININT that could be used to prevent acts of terrorism, • “retrospective SARs are less helpful in terrorism financing cases” (Law Commission, 2018, 57).

16. Part II - DATF SARs • Terrorism financing is associated with very small amounts of funding which are impossible to detect via a DATF SAR: • Finsbury Park Mosque (2017), • Westminster Bridge (2017), • the Parsons Green tube bombing (2017), • London Bridge and Borough Market attacks (2017) and • Manchester (2017).

17. Part II - DATF SARs • There are three fundamental weaknesses: • cryptoassets do not fall within the regulatory remit of the FCA, • cryptoassets providers do not fall within the scope of the DATF SARs regimeand • the system of the supervision and regulation of cryptoassets is inadequate and it has been hindered by HMG’s piecemeal policy.

18. Part III Social Media Platforms and Information Sharing • Is Joint Money Laundering Intelligence Taskforce the way forward? • Public/private partnership with the financial sector, • Created in February 2015, • Seeks to improve the sharing of information between reporting entities and LEAs, • The increased appreciation is partly achieved because JMLIT has access to 89% UK personal current accounts.

19. Part III Social Media Platforms and Information Sharing • JIMLT results: • 63 arrests of individuals suspected of money laundering, • over 1,000 investigations into bank customers suspected of money laundering, • the recognition of over 2,000 accounts that were unknown to LEAs, • enhanced monitoring by banks of over 400 accounts, • the closure of a further 450 bank accounts suspected of being used for the purposes of money laundering, • the restraint of £7m of suspected criminal funds and • the ordering of approximately 40 Proceeds of Crime Act 2002 orders.

20. Part III Social Media Platforms and Information Sharing • JIMLT results: • London Bridge terrorist attack, • NTFIU and the NCA liaised with JMLIT, • Within 12 hours of the attack they were able to identify the payments for van hire and establish spending patterns, allowing further investigative strategies to be identified and • investigators concluded that the attack involved only three attackers with no broader network.

21. Part III Social Media Platforms and Information Sharing • The UK has become a global forerunner in its efforts to improve the exchange of information between reporting entities and LEAs, • The UK model has been adopted in: • Australia, • Singapore and • Hong Kong.

22. Part III Social Media Platforms and Information Sharing • JIMLT is that it does not apply to reporting entities which are particularly vulnerable from abuse by terrorism financiers, • JIMLT has focused on working with the financial services sector yet there is no evidence of it engaging with other professions such as: • accountants, • lawyers and • estate agents. • Social media monitoring could assist with the voluntary exchange of information and would represent a far more cost effective mechanism than extending DATF SARs regime.

23. Findings • DATF SARs do not work and there is little evidence to suggest that any acts of terrorism could have been prevented by their submission • Terrorism financing has moved away from its traditional funding mechanisms towards exploiting the speed, convenience and anonymity provided by the Internet and Dark Web. • The paper has identified several examples of terrorism financiers using cryptoassets, such as Bitcoin, and a wide range of social media platforms such as YouTube, Facebook and Twitter.

24. Findings • HMG hastily brings forward legislative measures to include this funding mechanism within the scope of the DATF SARs regime. • There is no doubt that terrorism financing via social media platforms, the ‘Dark Web’ and heavily encrypted mobile devices is an unprecedented problem for both LEAs, supervisory agencies and the security services, • The ability of any Facebook user to transfer money to a ‘friend’ is almost impossible to police,

25. Findings • This research advocates the extension of the information sharing platform, JIMLT, to include social media providers. • The inclusion of social media platforms within this exchange of information model would represent a bold and innovative step into the regulatory unknown and it would go some way to redressing the current loopholes and uncertainty in the scope of the DATF SARs regime.