Two Customers, One Word
A community charity, Al-Birr Relief, banks with you. Annual income is $210,000. Each month it sends nine to fourteen transfers of $300 to $1,200 to three recipients in a conflict-affected region through a money transfer business. Stated purpose is orphan sponsorship and food parcels. Screening returns no matches. The website lists projects, but the bank holds no beneficiary-level documentation. Separately, a 22-year-old student account receives 60 to 90 inbound payments a month averaging $140, from more than forty individuals across four countries, and withdraws cash in similar amounts. The student says the money is from family and friends. Nothing is sent abroad from that account.
1. Which of the two shows genuine terrorist financing indicators, and on what reasoning?
Read the worked answer
The instinct is to flag the charity because of the word 'conflict' and the geography. That instinct is partly right but badly calibrated, and the calibration is the exam point.
Charity indicators that are real: sector risk is elevated because charitable funds are fungible and diversion can occur at the last mile; use of a money transfer business in a conflict-affected region reduces transparency; the bank cannot see beneficiary level. Indicators that are not indicators: the amounts are small - small sums are a feature of TF financing, not a defence, so neither size nor its opposite exonerates; and a clean screening result only proves no name match, not that no risk exists.
The student account is the stronger structural signal. Sixty to ninety inbound credits from forty-plus unrelated senders, pooled and then cashed out, is a collection-and-dispersal pattern. The absence of any outbound transfer matters: the value leaves as cash, which is where the trail ends. That structure is more characteristic of value transfer for a network - whether the proceeds are fraud, ML, or TF is a separate question requiring evidence, but the structure is what warrants action.
Conclusion: file on the student on structure; enhance on the charity on sector and transparency, without equating sector with suspicion.
2. How do you apply enhanced measures to the charity without de-risking a legitimate organisation?
Read the worked answer
Proportionality is not leniency; it is matching the control to the actual risk driver. Here the risk driver is last-mile visibility, not the charity's identity.
Measures that address the driver:
- Obtain the partnership agreement or MOU with each of the three implementing recipients, and evidence of how they were vetted.
- Request beneficiary-level or project-level documentation on a sample basis - for example, distribution records or sponsorship lists - rather than demanding full lists, which may be unsafe for beneficiaries.
- Verify the money transfer business's licensing and confirm the charity's account with it is in the charity's name.
- Confirm governance: trustees, signatories, and whether the transfer destinations changed recently.
- Set a review date and monitoring thresholds tied to the charity's own baseline (a sudden tenfold increase to a new recipient is a signal; steady small flows to the same three are not).
What to avoid: exiting a registered charity because its work is in a conflict zone. Blanket de-risking of a sector is a recognised supervisory concern, it displaces risk into less supervised channels, and it is a decision you will have to defend. If you ever do exit, the file should show that the charity failed to provide documentation after a reasonable request - not that it operated in a difficult region.
3. You decide to file on the student and to close that account. What are the sequencing and confidentiality risks?
Read the worked answer
Two obligations pull in opposite directions: report promptly, and do not tip off.
Sequencing: file first, and in the report state the intention to exit and the proposed timing. Many reporting regimes allow the reporting unit to direct whether an account should remain open; closing before you know the answer can destroy evidence a later investigation would want. If your regime permits a deferral request, use it.
Tipping off: closing an account 'for compliance reasons' and answering the student's questions honestly can amount to tipping off. Prepare a neutral exit script and an escalation route for staff, and make sure the closure reason recorded internally is not repeated to the customer.
Confidentiality: the SAR itself, its existence, and its contents must not be disclosed - including to the relationship manager who is curious, and including in any internal chat channel. Keep the distribution list minimal and documented.
Fairness: the student may be a mule, a victim, or an ordinary recipient of remittances from a diaspora family. The report should say which, and why the structure - not the person - drove the decision. If the account is closed, preserve records, since an innocent customer wrongly exited has a legitimate complaint route and you will need the file.