Non-profit organisation abuse

What non-profit organisation abuse actually looks like

Abuse of a non-profit organisation isn’t usually a fake charity invented purely to move terrorist money, though that happens too. More often, it’s a real, functioning charity that gets exploited: a branch office diverting funds, a local partner with undisclosed links to a proscribed group, or donations collected for one purpose and redirected to another.

FATF’s definition covers organisations engaged in raising or disbursing funds for charitable, religious, cultural, educational, social or fraternal purposes, or other types of good works. It’s deliberately broad, because the risk shows up across the whole range of the sector, not just in obvious cases.

The three ways FATF says it happens

FATF’s guidance identifies three distinct mechanisms. First, terrorist organisations posing as legitimate charities from the outset, using the appearance of good works as cover. Second, legitimate NPOs being exploited as conduits, sometimes to move money, sometimes specifically to dodge asset-freezing measures aimed at named individuals or groups. Third, and often the hardest to detect, funds collected for a genuine purpose being clandestinely diverted to a terrorist cause partway through.

Each mechanism calls for a different control. Vetting at registration catches the first. Ongoing monitoring of fund flows catches the second and third.

Why this risk gets treated differently from other AML risk

This is one of the few corners of AML/CFT where FATF has explicitly warned regulators against overreach. Recommendation 8’s own revision history exists largely because countries applied it too bluntly: freezing bank accounts, imposing due diligence smaller charities couldn’t meet, or effectively pushing NPOs out of the banking system altogether.

The result, documented repeatedly by FATF and civil society groups, was legitimate charities losing access to banking and donors losing confidence, without a matching gain in actually stopping terrorist financing. A revised Recommendation 8, adopted in November 2023, exists to correct that.

FATF Recommendation 8 and its 2023 revision

FATF released amendments to Recommendation 8 and its Interpretive Note on 16 November 2023, specifically to address what it called misapplication and misinterpretation of the original standard. The core instruction is explicit: countries must identify which NPOs actually fall within scope, assess their real risk of abuse, and apply focused, proportionate, risk-based measures, not a blanket approach across the whole sector.

The updated Best Practices Paper that came with the revision, for the first time, includes examples of bad practice alongside good practice, spelling out specifically how not to implement the standard.

What a risk-based approach means for charities in practice

In practice, a risk-based approach means most NPOs face light-touch treatment. A local community group running a food bank doesn’t need the scrutiny an international NPO moving funds into a conflict zone with weak governance and active armed groups requires.

Countries are expected to review their entire NPO sector first, then narrow in on the genuinely higher-risk subset, based on factors like where funds are sent, how much cash moves through the organisation, and whether it operates in or near areas with active terrorist activity.

Warning signs firms and donors actually look for

Firms and donors doing due diligence on an NPO tend to look for a specific set of signals: unclear or shifting statements of charitable purpose, fund flows to jurisdictions with weak governance or active conflict, related parties or trustees with undisclosed links to proscribed organisations, and a mismatch between an NPO’s stated size and the volume of money moving through its accounts.

None of these signals confirm abuse on their own. They’re reasons to ask more questions, not reasons to automatically refuse service.

The humanitarian exemption problem

One genuine tension the sector has raised for years is the risk that strict controls block legitimate humanitarian aid to the places that need it most, often the same conflict zones where sanctioned groups also operate. UN Security Council Resolution 2664, adopted in 2022, introduced a standing humanitarian exemption to asset-freeze provisions across UN sanctions regimes, specifically to stop counter-terrorism measures from accidentally blocking aid delivery.

That exemption doesn’t remove the underlying AML/CFT risk. It recognises that a blanket freeze can cause its own kind of harm.

Where NPO abuse risk shows up in due diligence

For a bank or payment provider, NPO abuse risk usually surfaces during onboarding and ongoing monitoring of any customer registered as a charity or similar not-for-profit entity. Enhanced checks tend to focus on where the organisation actually operates, who controls it, and where its money ultimately goes, rather than treating charitable status itself as a risk factor.

Cash-intensive fundraising adds a layer of difficulty on top of this. Street collections, cash donation boxes, and informal fundraising events are harder to trace than a bank transfer, which is why FATF’s guidance pushes firms toward assessing the whole relationship, governance, transparency, and financial controls, rather than relying on transaction data alone to spot a problem.

Frequently asked questions

Read more: our ultimate guides, whitepapers and templates

Related guides and resources to help you act on what you just read.