Anti-money laundering: A risk-based approach to regulating non-profit organisations
Last week, Azerbaijan enacted a new law which imposes a raft of new ‘AML/CFT’ obligations on civil society. Under this law, every single bank transaction of an NGO must be reported by the bank to the Financial Monitoring Service. Every NGO, regardless of activity or size, must complete and submit to authorities a formal written assessment of their exposure to AML/CFT risks each year, and demonstrate that it has internal rules or procedures for mitigating those risks. Non-compliant NGOs can be dissolved or suspended, and the minimum fine for non-compliance exceeds the annual budget of 87% of NGOs.
‘AML/CFT’ means ‘anti-money laundering and countering the financing of terrorism’. Civil society has become used to the development of ‘CFT’ rules, and more adept with the tools available for protecting their space against CFT-inspired restrictions. But when AML is yoked to CFT, as it is in the new Azerbaijani law, the strategy is less clear. The threat from AML measures is more nebulous, and there are fewer clear tools for defence.
So – what’s going on with AML and NGOs?
Unknowingly, civil society was drawn into the orbit of AML/CFT in a meeting held in Washington D.C. on the 29th and 30th October 2001. This was an ‘Extraordinary Meeting’ of the Financial Action Task Force (FATF) – the intergovernmental organisation founded on the initiative of the G7 to develop policies to combat money laundering – held just seven weeks after 9/11, in which senior officials from the sixteen FATF member countries at the time extended their own remit to include countering the financing of terrorism (‘CFT’). For the first time, “NPOs,” as FATF refers to the NGO sector, came in for special attention. ‘Special Recommendation VIII’ was published, stating that ‘NPOs are particularly vulnerable to terrorist financing’. Governments around the world would respond.
No civil society representatives were in the room that day in 2001. There followed a ‘lost decade’ as civil society slowly recognised the significance of what had happened. Since 2014, however, the situation has improved significantly. Through the Global NPO Coalition on FATF and others, civil society now has a voice at FATF. The renamed ‘Recommendation 8’ includes some real protections for civil society space, even if they remain inconsistently applied. Activists around the world have developed and shared strategies on responding to CFT measures which impact civil society at the national level which have had real results.
But for civil society, the other half of the FATF agenda is not covered. There is no international ‘AML’ standard for NPOs. Regardless, AML-specific regulations for NPOs are emerging.
In The Hague in 2018, the first meeting was held of a grouping of civil society activists called the ‘Expert Hub’. The hub had been convened to discuss and share best practices on mitigating the impact of terrorist financing policies on civil society. However, colleagues from Latin America said that they saw the money laundering risk as more pertinent to them than the terrorist financing risk.
As the resource person in the room, I offered the standard FATF line on money laundering and NPOs. NPOs could be abused for terrorist financing – it was rare, but it happened. But FATF saw no particular issue with money laundering in the NPO sector, and no special consideration need be given to it.
The room was not entirely convinced by this response, however, and colleagues from Nigeria, Jordan, India, Bulgaria, Mexico and Pakistan told us of AML-specific measures for civil society in their countries.
This was a surprise. So, I set to work with Vanja Skoric of the European Center for Not-for-Profit Law to learn more. The result is a report on money laundering in the NPO sector* published last year, based on open-source data from seventeen countries worldwide.
Our first finding was that there is no evidence of systemic or widespread abuse of NGOs for money laundering. The number of cases found was very small, in both absolute and relative terms, even allowing for the fact that most money laundering cases go undetected. For example, we identified more cases in the United Kingdom than any other country, but even there only 1 in every 750 money laundering convictions in 2016 involved an NGO.
However, very little regional or national research had been done – before our report, no global study had been published on the topic since 2008, and just one of the countries surveyed had undertaken an actual assessment to identify if there is a risk of money laundering in the sector to justify its measures.
And yet, AML laws for NGOs are adopted. The report found specific money laundering regulations for NGOs in eleven of seventeen surveyed countries, including Spain, Bulgaria, Tunisia and Nigeria. Furthermore, the report found:
“There is no obvious correlation between the strictness of a jurisdiction’s ML regulations for NPOs, and the level of observed risk. The four most restrictive regimes have one observed case between them. The country with the highest number of observed cases (the United Kingdom) has one of the most permissive regimes. There is no evident connection between the type of regulation and the observed number and nature of cases… It remains unclear what was the basis of AML regulation for the NPO sector.”
FATF’s position on AML risk in the NPO sector is not clearly defined. In theory, civil society organisations should be treated like any other legal entity, with countries taking a risk-based approach that ensures proportionate measures are taken to address identified risks. At face value, this doesn’t impose much – but neither does it protect much.
Contrast this with Recommendation 8, which requires that governments demonstrate that they understand the terrorist financing risks to their NPO sector, and in particular the types of NPOs that may be most exposed to those risks. For those NPOs, and those NPOs only, countries must demonstrate that there is effective outreach, risk-based targeted supervision and monitoring, and the capacity to obtain information on and investigate potential crimes. Crucially, these measures must be risk-based, targeted and proportionate, and must not inhibit legitimate NPO activity. Countries including Serbia and Turkey have been publicly criticised by FATF for misusing TF regulations against civil society, and in countries such as Nigeria and Tunisia, activists have used FATF’s own rules to overturn restrictive policies.
Nevertheless, FATF’s AML measures are being felt. In particular, the definition of Beneficial Ownership has prompted a new wave of public registers encompassing civil society organisations. Europe has been at the vanguard, thanks to the EU Anti-Money Laundering Directives 4 and 5 (although the recent decision of the European Court of Justice rendering a key provision invalid has thrown those policies into uncertainty).
Nevertheless, the observation remains. AML restrictions on civil society can emerge without the catalyst of FATF Recommendations or, indeed, any actual evidence that there is a significant or systemic problem of abuse of NGOs for money laundering purposes.
Which raises a dilemma. Until now, the main policy battles have been fought over terrorist financing and FATF Recommendation 8. Questions are being asked about whether Recommendation 8 is fit for purpose, or should even exist at all. Critics point to situations like Nicaragua, where 3,108 NPOs were closed in 2022 using laws referencing terrorist financing. FATF’s response? A statement that it is “strongly concerned by the potential misapplication of the FATF Standards resulting in the suppression of Nicaragua’s non-profit sector” and that “Nicaragua should continue to work with GAFILAT” [the regional FATF body in Latin America].
But R8 does at least establish clear rules which countries will be assessed on, and activists can point to some real successes in using those rules to protect freedoms.
Hence, the dilemma. Whilst FATF says AML rules must be ‘risk-based’, the specific protections in Recommendation 8 do not necessarily apply. New measures are being developed by governments in an information and policy vacuum. Should civil society play regulatory lottery and hope that, on balance, the measures will be tolerable? Or should they actively advocate for global policy guidance on the issue, recognising that this may stimulate more regulation, albeit with the hope that in most cases this will be based on and targeted at identified risk?
My judgement is that more regulations are inevitable. We cannot hope to stop them, but we can hope to influence the shape that they take. Entities like the Global NPO Coalition on FATF have an excellent working relationship with FATF. European civil society works closely with European governments that make up the majority of FATF’s membership. And European networks such as Civil Society Europe, ECNL, Human Security Collective , European Fundraising Association and Philea are engaging around the new EU AML package to get to a more appropriate and risk based application of the beneficial ownership policy. Despite the risks, I believe our best hope is to use that influence to advocate now for global policy clarity on countering money laundering in the sector. That policy should enshrine a risk-based approached predicated on protection of civil societies’ freedom. We cannot afford another lost decade.
* Specificity, Complexity, Complicity And Harm: Typologies of Illicit Financial Abuse of the NPO Sector (EU Global facility on AML/CFT, August 2021)
 Law “on the fight against the legalization of property obtained through crime and the financing of terrorism.”
 An estimated 0.1% of funds laundered globally are recovered: Ronald F. Pol (2020) Anti-money laundering: The world’s least effective policy experiment? Together, we can fix it, Policy Design and Practice, 3:1, 73-94, DOI: 10.1080/25741292.2020.1725366
 This excludes cases where the NPO was the victim.
 FATF Recommendation 8 and Immediate Outcome 10.
 ‘Beneficial Ownership’ registers are transparency tools requiring legal entities and certain unincorporated entities to declare who their ‘ultimate beneficiary owners’ are: n other words, for whose benefit do they exist. The EU’s Anti-Money Laundering Directives 4 and 5 required member states to have such registers and to make the identify of the beneficial owner public. It is this last requirement that has been overturned by the European Court of Justice, thereby undermining AMLD 5 and also, potentially, FATF R24 and R25.
 European states comprise 20 of the 37 FATF member states. The European Commission is one of two institutional members.