According to the United Nations, the Islamic State’s most successful regional financial offices include al-Karrar, al-Furqan, and al-Siddiq. This series breaks down each office’s operations, with part three investigating al-Siddiq. Click here to read part one and part two.
Introduction
The Afghan-based Islamic State Khorasan Province (ISKP) has become the Islamic State’s (IS) primary arm for inflicting brutal attacks on the world stage. On 3 January 2024, two ISKP suicide bombers detonated themselves within 10–20 minutes of each other at a memorial ceremony for General Kassem Suleimani in Kerman, Iran, killing 95 and injuring 284 others. Less than three months later, ISKP gunmen opened fire at a crowd attending a concert at Moscow’s Crocus City Hall before setting the venue ablaze, killing 145 people and injuring at least 551. ISKP propaganda regularly calls for attacks in South Asia, China, and the West, increasing the threat of another similar or perhaps more deadly attack in the future.
The primary financial facilitator behind these and other vicious attacks is Maktab al-Siddiq (the al-Siddiq office), which oversees a vast illicit financial network that raises money through donations and receives money from other regional counterparts, transferring vast sums through a vast global network of financiers. Although the office has faced many setbacks amid crackdowns by international law enforcement, it remains resilient, broadening its global network in a likely effort to evade further detection. This Insight explores Maktab al-Siddiq’s sources of revenue and the global financial infrastructure it uses to finance some of the world’s deadliest terrorist attacks.
Maktab al-Siddiq
As part of the IS’s General Directorate of Provinces (GDP), Maktab al-Siddiq oversees IS finances across much of Asia. According to the US State Department, the office employs unregistered money services businesses, established hawala networks, cash couriers, and virtual assets to finance subordinates in Afghanistan, Pakistan, India, Bangladesh, Maldives, and the Philippines. Through these financial tools, Maktab al-Siddiq allocates funds to various IS operations worldwide, such as for last year’s attacks in Iran and Russia. A man known as Tamim al-Kurdi has reportedly run the office from somewhere in Afghanistan since 2020; however, he is barely mentioned in the existing literature on the organisation.
Because Maktab al-Siddiq is the primary financial facilitator of the ISKP, which has become the IS’s most notorious constituent group, it has attracted considerable attention and pressure from global authorities, forcing it to adapt. Although the office previously generated revenue from illicit activities such as extortion, kidnapping for ransom, and robbery, it has since outsourced these criminal activities to its subordinate groups, who transfer money back to the regional office when funds run low. Even with the arrests and deaths of key operatives and facilitators from Afghanistan, Pakistan, Somalia, Syria, and Türkiye in 2023 and early 2024, the office has reportedly recovered. This resilience is likely the product of the organisation’s ability to spread its influence globally, soliciting donations from a broadening global base of donors and relying on operatives to complete transfers from many locations.
Limited Local Revenue Generation Potential
Maktab al-Siddiq is unlike its African counterparts in terms of local revenue generation, as its subordinate groups do not control significant territories. The ISKP once controlled mines in eastern Afghanistan’s Nangarhar province, generating millions of dollars in profits by smuggling resources such as talc, marble and lapis lazuli through channels in Pakistan and onto global markets. However, a 2018 US-backed operation to clear militants from key mining sites in Nangarhar and the subsequent 2021 Taliban takeover of the province significantly reduced the ISKP’s ability to generate revenue there. Although the Taliban have been largely successful in gaining control over Afghanistan’s vast mineral wealth, the ISKP routinely targets Chinese mine workers in the country, demonstrating that the battle for these resources is far from over. Nevertheless, the IS likely generates little, if any, revenue from Afghan-based resources today.
Rather than generating revenue through controlled lands, the ISKP and other groups under the purview of al-Siddiq generate funds through more covert means such as extortion, robbery and kidnapping for ransom. In 2020, IS operatives reportedly commanded a ‘growing share’ of Pakistan and Afghanistan’s illicit tobacco markets, although it is unknown whether these groups still generate revenue in this way at present. Because of this limited potential for local revenue generation, al-Siddiq and its subordinates have become increasingly dependent on external funding sources, relying on a complex web of regional and global partners to deliver funds to their intended destinations.
Global Funding Sources and Reliance on Intermediaries
Given the high level of scrutiny al-Siddiq faces from international authorities, it is likely that the office functions as a clearing house between various IS branches, directing transfers when needed. In this way, the office serves as a steward for much of the IS’s global financial infrastructure, overseeing a diverse and international group of operators who carry out complex transfers using hawala networks and crypto exchanges. Recent crackdowns and geopolitical shifts have caused these funding networks to become increasingly global and diffuse, with this trend likely to continue as global authorities move against the organisation.
Al-Siddiq raises money by soliciting donations through its propaganda channels, including the Voice of Khorasan magazine, which its subordinate, al-Azaim Media Foundation, publishes in multiple languages on a monthly basis. Each issue of the magazine includes an advertisement soliciting donations from readers in Monero, the IS’s preferred cryptocurrency due to its enhanced privacy protections (Fig 1). It includes obscured transaction details that make it especially difficult for international authorities to detect.
Figure 1: The donation solicitation page at the end of most Voice of Khurasan issues. Obtained via Jihadology.
The donor base that funds al-Siddiq-linked groups, such as the ISKP, is increasingly geographically diverse. Although these groups previously solicited donations closer to home, such as from ethnic Tajiks and other Central Asians living in Russia via Telegram groups and QIWI, a Russian payments app, it is unclear whether Russian crackdowns since the Crocus City Hall attacks have stymied these revenue streams. Moreover, sanctions imposed on Russia following its invasion of Ukraine most likely prohibit any significant international transactions in roubles using Russian financial institutions. Recent arrests demonstrate how al-Siddiq-linked groups have broadened their donor base, such as the June 2024 arrest of a German man for transferring over US $1,700 worth of cryptocurrency to an ISKP-linked account. In another example from last December, UK authorities arrested a 24-year-old Luton man who allegedly transferred over £16,000 worth of Monero to the ISKP. These are just some of the many arrests associated with ISKP-linked donors over the past two years, with the growing reach of IS propaganda on platforms such as Telegram, Theema, RocketChat, and others likely playing an essential role in this trend.
Local Crackdowns Give Rise to an Increasingly Global Funding Network
Maktab al-Siddiq and its subordinates rely heavily on external revenue sources and the intermediaries who facilitate the flow of funds. This reliance on external actors has required the organisation to foster a vast global network of financial facilitators in multiple countries. For example, the ISKP transferred at least $2,000 in virtual assets to the group in Moscow responsible for carrying out the Crocus City Hall attack, likely using established al-Siddiq channels. As authorities continue to crack down on IS financial operations, these channels have become increasingly geographically broad.
Maktab al-Siddiq receives considerable funding from the Somalia-based Maktab al-Karrar, which oversees a vast illicit financial network spanning much of eastern, central, and southern Africa. A United Nations report from early 2023 found that al-Karrar was sending US $25,000 per month in cryptocurrency to the ISKP, a subordinate of Maktab al-Siddiq, with a July 2024 UN report finding that al-Karrar was the ISKP’s top revenue source.
According to USUS authorities, Türkiye has been a key transit hub for many global IS transfers, with IS operatives using local cryptocurrency exchanges, Hawala networks, and cash transfer apps such as PayPal and Western Union to move money into the country before transferring it to other affiliated groups worldwide. In Türkiye, the interests of al-Karrar and al-Siddiq likely merged in the past, with the former taking advantage of local crypto exchanges to transfer funds to the ladder. However, recent moves by Turkish authorities will likely cause operatives from both regional offices to seek new ways to transfer funds between them.
Turkish authorities have made sweeping moves to crack down on IS operatives in the country, arresting more than 3,600 suspected operatives since June 2023, according to official figures. In 2021, the international crime watchdog Financial Action Task Force (FATF) placed Türkiye on its ‘grey list’ due in part to the country’s role as a hub for terrorist financing, limiting international credit to the country and exacerbating its economic crisis. Türkiye is a major hub for cryptocurrency trading, and regulators there have recently introduced measures to combat criminal and terrorist financial networks through enhanced oversight and identification systems. The country has also cracked down on hawala networks, with many jewellers there acting as hawaladars due to the relatively stable value of their goods amid the country’s ongoing inflationary crisis. Turkish authorities also collaborated with their counterparts in Tajikistan – also a hub for IS financing – leading to the arrest of IS financiers in both countries in 2022 and 2023. Further, authorities identified US $2 million in suspicious transactions on the TRON blockchain in conjunction with TRM Labs and Binance. Binance also announced it collaborated with Tajikistan’s National Bank and other government agencies to disrupt terrorist financing there.
These crackdowns contributed to the FATF’s removal of Türkiye from its grey list in June 2024, and Ankara will likely continue to take harsh measures against terrorist financiers moving forward. For this reason, Türkiye is likely no longer a prime destination for IS financial transactions, as authorities continue to crack down on illicit activity, limiting the intersection between illicit hawala and crypto exchange activity. Similarly, enhanced scrutiny in Tajikistan and other Central Asian states, such as Uzbekistan, will also likely cause IS to look elsewhere for cryptocurrency transit hubs. As with al-Siddiq’s donor base, these sustained crackdowns will likely necessitate a further diffusion of the IS’s global financial network.
Recent events demonstrate the broad geographic reach of IS financial facilitators. In 2023, the US Treasury designated key individuals and companies based in the Maldives under their Office of Foreign Assets Control (OFAC) in relation to IS fundraising activity. The Maldives is a growing market for cryptocurrency adoption, noted for its lack of a clear regulatory regime, making it a potentially important node in terrorist financing. On a per capita basis, the Maldives sent more recruits to fight for the IS than any other between 2013 and 2018, and many of these veterans likely reside in the country at present.
In Spain, police arrested a Jordanian national in February 2024 on charges related to transferring €200,000 worth of Tether (USDT) on the TRON blockchain to various IS funding campaigns. The amount suggests that the suspect acted as an intermediary, receiving the funds from multiple sources before transferring them to IS-linked accounts. Last July, German police arrested two suspected IS operatives in Hamburg in connection with participating in a financing network, collecting cash donations and transferring them to IS sources. In December 2024, police in the US arrested a 35-year-old man in connection with providing material support to the IS.
Although it is unclear whether these individuals are specifically related to official al-Siddiq channels, they nonetheless demonstrate the broad global reach of IS financial networks, of which al-Siddiq is a beneficiary. As global crackdowns on IS activity continue, the organisation will have to continue to adapt as it has done before.
Recommendations
Disrupting al-Siddiq’s increasingly broad and diffuse network of global financiers is essential to thwarting further attacks by groups such as the ISKP. Adopting more robust regulatory measures in countries such as Türkiye is a positive development. Still, the lack of formal regulations in other countries, such as the Maldives, represents a significant problem. For this reason, international law enforcement agencies and blockchain intelligence platforms such as TRM Labs should work to identify suspicious transactions, especially in countries lacking coherent regulations, and advocate for reform in countries with underdeveloped regulatory bodies. This approach is likely more effective than targeting individual donors and propaganda, which this series covered in Part 1.
Last October, Japanese authorities arrested 18 suspects on suspicion of money laundering using Monero. Monero uses advanced privacy technologies such as ring signatures and stealth addresses that make it difficult to track to follow transactions. Nonetheless, Japanese authorities identified US $670,000 worth of Monero transactions over several months by linking suspicious transactions to stolen credit card purchases on an e-commerce platform. Although other countries’ crypto markets may differ from Japan’s, this example could serve as a template for tracking illicit finance using Monero moving forward. Fintech firms, cryptocurrencies, and financial institutions should be forthcoming and aid wherever they can in such investigations.
Cryptocurrency trading platforms can play an essential role in identifying suspicious users and their transactions. Because companies such as Binance operate across global markets, they can serve as an essential mediator between international and local law enforcement, providing important recommendations and insights into suspicious local activities. Local and international open-source analysts can also play an essential role in this regard.
Finally, hawala networks represent a significant challenge for international authorities. Although combatting them is mostly a matter for local police, banks and international payment processors such as Western Union, PayPal and Wise should monitor closely for suspicious transactions as hawala networks rely on these in some instances to make up for cash from other transfers.
Adam Rousselle is a researcher focused on illicit finance, weapons technology, macroeconomics, geopolitics, and more. He has been featured in The Jamestown Foundation, The Hudson Institute, Nikkei Asia, The Wall Street Journal, and others. He is the co-founder of www.btl-research.com.