Associations and protection against terrorist financing

• Clear internal rules are necessary for the safe financial management of a non-profit organization to ensure both transparency and measures to prevent terrorist financing. These rules should include regular and effective internal monitoring and auditing.
• It is advisable to create a "mission statement" that clearly distances itself from any support for terrorism, money laundering or other criminal acts. This can be anchored in the statutes, for example.
• Financial management should be transparent, with comprehensible accounting and reporting, transparent bank accounts, use of regulated financial channels and control over the distribution and withdrawal of funds.
• Potential risks within an NPO should be identified and regularly reviewed (as part of a risk assessment).
• Projects, especially those with risk aspects, should be subject to regular reviews and final audits.
• It is advisable to provide checklists for each step in the implementation process of a project to ensure financially transparent monitoring.

• In order to identify and manage the risks of terrorist financing, a risk assessment by the organisations concerned is advisable.
• A risk assessment should be carried out when operating in proximity to active terrorist threats (as explained above). It can be prepared per project or country.
• You can follow the example structure below:

1. Evaluate the threat scenarios listed above and any other identified threats. You can use the values ​​low (1), medium (2), high (3) or very high (4).
2. Evaluate how vulnerable your organization is to each identified threat scenario. You can use the values ​​low (1), medium (2), high (3) or very high (4).
3. State which risk-reducing measures (e.g. checking project partners, documenting payment flows, dual control when approving payments) you will use and evaluate how these measures affect your risk.
4. Calculate the overall risk using the formula: 40% threat + 60% vulnerability - risk-reducing measures = overall risk.
5. The overall value determined reflects the risk of terrorist financing. Individual areas identified with higher risk should be given special consideration in project implementation. Possible measures include more stringent monitoring of business partners and/or transactions. If the risk limit defined within the organization is exceeded, certain projects should not be carried out or should only be carried out under modified conditions.

• You can use this template (Word, 36 KB) for this purpose.
• The country reports of the Financial Action Task Force can provide information on the risks of terrorist financing. Jurisdictions with a high risk of money laundering and terrorist financing can be found on the relevant country lists of the Financial Action Task Force and the European Commission. You can also use information from the authorities and articles from reputable newspapers or research institutes. If you or trustworthy informants already have a local presence, you can also use this information.
• The key figure determined by the risk aseesment reflects an assessment of your own risk and should be reviewed regularly. It should be adjusted if essential parameters change, e.g. if new projects are added in new countries.
• The risk assessment is used to derive preventive measures and to coordinate them with the organization's internal risk strategy, risk preferences, risk tolerances and risk limits.
• For further information on preparing a risk assessment and practical examples, please refer to the National Risk Assessment 2021 (PDF, 1 MB) and the FMA circular on this topic.

• Make sure that the management and staff involved in the project are trustworthy. You can do this by, among other things, obtaining references, criminal records or checking EU sanctions lists.
• Make sure you know your beneficiaries. Depending on the identified risk of the project, you should have at least basic information about your group of beneficiaries.
• Make sure you know your project and business partners. You can do this by, among other things, obtaining information from authorities, articles from reputable newspapers or research institutes, checking EU sanctions lists, obtaining information on beneficial owners and trustworthy local informants.
• Regularly check that the beneficiaries or project and business partners are not persons or entities covered by applicable EU sanctions or belonging to other terrorist organisations.
• Determine in advance who can access how much money, when and under what conditions.
• Management and project staff should be aware of the risk and take appropriate risk-reducing measures. They should also be trained and informed accordingly.
• Adapt your measures to the identified risk. For example, if you have identified a high risk of diversion on site, you can increase the monitoring of local project partners.
• Document every transaction step from receipt of the money to its use in the target project and archive this documentation for an appropriate period of time (for example, five years).
• If possible, carry out follow-up checks to ensure that the aid was provided as intended. The "three lines of defence" model can play an important role in risk management. Each of the three lines of defence takes on a specific role in an organisation's broader governance framework. For example, local staff can act as the first line of defence to carry out preventive measures. As a second line of defense, Compliance staff conduct spot checks and verify implementation. The third line of defense is the organization's internal audit team, which ensures the effectiveness of internal control procedures through regular audits. It is necessary that all three lines of defense know their roles and are appropriately trained.

• Designate informed contact persons for your bank and respond promptly to inquiries from your bank. If possible, any anticipated delays should be communicated and explained to the bank in good time.
• Answer all questions and, if necessary, explain the circumstances of the transaction or business relationship (remember that your bank is not a specialized humanitarian organization). The answers should be meaningful to reduce the need for follow-up inquiries.
• Only use credit and financial institutions that are authorized and supervised. If you do business with unlicensed providers, you risk losing the donations through fraud. The FMA's company database provides an overview of all providers authorized in Austria.
• Contact your bank early. Provide a summary of the program you are proposing, listing the intended beneficiaries, the selection of beneficiaries, the program to be implemented, the schedule, the project partners and the award procedures.
• Be prepared to help your bank understand your processes – they are not a specialised humanitarian organisation and may not be familiar with the controls you have in place. To comply with their legal obligations, banks need to understand how you work, what your purposes are and the volume and frequency of payments you plan to make.
• Be transparent and as detailed as possible and build trust with your bank. In complex scenarios, explain how you carried out your project planning, which sanctions lists you checked, the criteria you use to select your project partners and how you will deal with potential risk scenarios.

• File a suspicious transaction report with the Financial Intelligence Unit and follow all further instructions. Information on how to identify anomalies can be found on the FIU's website and in a circular from the FMA.
• In this regard, it is also advisable to inform and sensitize employees accordingly so that they are also able to recognize possible indications or anomalies in connection with terrorist financing. This could take place, for example, as part of (internal or external) training courses or information events.
• If necessary, update your risk assessment and the preventive measures you have taken.

Certain countries are more vulnerable to money laundering, terrorist financing or other financial crimes and are on higher-risk country lists, such as those of the European Commission or the FATF.

Credit and financial institutions take these lists into account and also assess whether the nonprofit is registered or operating from abroad. This includes foreign banking relationships, board members residing abroad and transactions from or to abroad. In addition, credit and financial institutions must comply with applicable sanctions regulations and review potential violations of these sanctions.

» Please note the following points:

• Does your organization's name include a higher-risk or sanctioned country? This may lead to inquiries at the bank or at a correspondent bank required to conduct transactions.
• Do the funds originate from conflict or post-conflict countries, higher-risk countries or sanctioned countries? The European Commission and the FATF classify certain countries as particularly high-risk. Explain what measures your organization takes to ensure that funds do not come from an illegal source in those countries.
• Do you fund activities in conflict or post-conflict areas, high-risk countries or sanctioned countries? Have you taken steps to mitigate the risks involved?
• Are activities conducted outside of conflict or high-risk countries but visited from high-risk countries?
• Do you use third-party services in conflict, high-risk or sanctioned countries/areas?
• Do your beneficiaries, board members or staff come from areas controlled by terrorist groups?

Credit and financial institutions need to know what activities the nonprofit carries out. Some activities are known to be particularly vulnerable to money laundering or terrorist financing, for example when a lot of cash is used or a relatively large proportion of funds are used for printed promotional materials linked to an engagement in a conflict zone.

» Please consider the following points:

• Is there a clear link between your organizational objectives and your actual activities?
• Do you have evidence of your activities, such as an annual report? Quality reports help credit and financial institutions to evaluate. An established track record of the nonprofit, such as benchmarks, references or a reference to previous activities, gives a better idea of ​​the types of activities carried out. Make your track record visible through media links, project summaries, testimonials and short case descriptions.
• Do you have an online presence (social media or website)? We recognize that organizations that work primarily with volunteers have less capacity and resources for websites and press releases and/or do not seek media coverage. Likewise, nonprofits working on human rights issues in authoritarian regimes sometimes operate under the radar and deliberately avoid seeking media attention and/or raising their profile. A public presence can help lending and financial institutions proactively obtain information about the nonprofit, thus avoiding possible misunderstandings.
• How long has your organization been active? What is your (expected) turnover, what are your sources of funding and who are your beneficiaries? Is this information logical and consistent with your activities?
• Has your organization (or any of its partners, beneficiaries or board members) been the subject of critical reporting in the past? If you are aware of such reporting, it is helpful to provide background information and further explanation. Do not hide such reporting, but proactively address it.

The nonprofit's organizational structure must be transparent. A politically exposed person (PEP) associated with the nonprofit (e.g. a board member) may lead to additional questions being asked during the risk assessment. PEPs are natural persons who hold or have held important public offices. Because of this position, PEPs are considered to be at an abstractly higher risk of money laundering, corruption and embezzlement. They can use the nonprofit to hide funds or assets embezzled through the abuse of their official position or through bribery or corruption.

» Please note the following points:

• Do you have a clear organizational structure? Provide an organizational chart showing the responsibilities of each person involved and the separation between the functions of the board of directors and the finances of the nonprofit.
• Is the majority of the members of your supervisory board independent? Too much distance of these members from the day-to-day operations of the nonprofit can be a risk factor, as members may not be sufficiently able to identify risks and act accordingly when necessary.
• Does your organization have three or more board members? Is there equal “involvement or control,” meaning that one board member cannot dominate decision-making?
• Is one of your employees or board members a PEP? Please note that in some cases, individuals who are family members or business partners of a PEP may also be asked additional questions in the risk assessment.
• Does the PEP involved in the nonprofit have control over the nonprofit’s transactions?
• Have you made provisions for the eventual end of your nonprofit? The nonprofit’s charter or bylaws should specify that any funds remaining after the nonprofit is dissolved should be used for a nonprofit with a similar mission.

The nonprofit's funds and (expected) transactions must be consistent with the nonprofit's mission. Many transactions to and from abroad, critical reporting regarding the nonprofit's funds or inconsistent funding can raise questions in the risk assessment. The key is how the organization knows that the funds, goods or activities provided have reached the intended recipients and what controls ensure proper use.

Transactions can be blocked or delayed if there are similarities with suspicious behavior or indicators. Some reasons that may arise, especially for nonprofits, are incomplete information required for the transaction or additional information requested by the correspondent bank (often a foreign bank that carries out part of the transaction).

» Please note the following points:

• What types of transactions do you expect to conduct? Explain the different types (including estimates of amount and number) of transactions.
• Can you demonstrate that your transactions follow logically from your activities? Do you have evidence of your payments (and donations), e.g. receipts, estimates, invoices? If you are a new organisation, indicate how you will handle transactions.
• Can you demonstrate that you know the origin of your funds and the final destination/beneficiary? Give examples of the aid chain in conflict and high-risk areas and explain the control and transparency measures.
• Can you explain the link between your organisation's funding source, the type of organisation and your activities? Make a clear connection between these three elements. If you anticipate that this might be difficult to understand, consider how you can improve understanding, e.g. by giving examples of established non-profit organisations.
• Do you receive funding from individuals who are considered PEPs? This is especially important for your major donors (your largest donors relative to all donors).
• In particular, smaller and voluntary organisations that work on a project basis have to deal with irregular funding sources. Inform your bank about this and make the purpose and time periods for the funding transparent.
• If donations are received in a conspicuous and atypical manner, it can help your bank if you proactively contact them and explain the background of the donation.
• Try to transfer the donation to the destination as directly as possible. Avoid intermediaries of natural or legal persons as much as possible. It can help your bank if you proactively contact them and explain why you are using intermediaries of natural or legal persons.
• If you change the payment methods you use (transfers, cash withdrawals, crypto assets), proactively communicate the reason for the change.
• If you use cash, document the flow of payments from receipt to use in detail.