Countering Terrorism Financing in East Africa

Defeating al Shabaab and other terrorist groups in East Africa will require degrading their increasingly sophisticated revenue generation capabilities through strengthened national and regional coordination.

Terrorist groups in East Africa have become increasingly proficient in revenue generation including through extortion, money laundering, mobile money platforms, hawala networks, cryptocurrency, and gold smuggling. (Photos: AFP/Eric Lafforgue/Hans Lucas and AFP/Stringer)

Terrorist groups like al Shabaab and the Islamic State in Somalia (IS-S) pose a persistent and evolving threat to security in East Africa and internationally.

Al Shabaab’s growing engagements with the Houthi paramilitary group in Yemen are illustrative. Through increasingly sophisticated and transnational facilitation networks, these exchanges across the Gulf of Aden have raised the land-based threat posed by both groups, as well as their capacity to disrupt the vital maritime trade route through the Red Sea.

Al Shabaab’s ties to al Qaeda and IS-S’s links to the Islamic State further underscore the risk that parts of East Africa could serve as safe havens for global terrorist operations.

Al Shabaab has established a sophisticated revenue-generation capacity that stretches well beyond areas under its territorial control in Somalia. This includes a host of organized criminal activities, such as direct extortion and illicit taxation, illicit trade, smuggling and trafficking, and money laundering, among other criminal enterprises to move people, arms, and money across East Africa and beyond. Al Shabaab is now estimated to control annual revenues of up to $200 million.

While its early revenue generation was opportunistic, al Shabaab has evolved into a hybrid entity that blurs the lines between terrorism and transnational organized crime. This expanding revenue generation capacity has been further enabled by the region’s porous borders, persistent state fragility, armed conflict, and corruption.

The Federal Government of Somalia (FGS) has made meaningful progress through reforms to its Anti-Money Laundering and Countering the Financing of Terrorism (AML/CFT) framework and the adoption of strategies to disrupt terrorism financing. These efforts have contributed to the freezing of terrorist-linked bank accounts, the suspension of mobile money accounts, and the prosecution of individuals charged with financing terrorism. Despite this progress, al Shabaab has continued to adapt and maintain its revenue flows, while gaps in technical compliance and operational effectiveness undermine efforts to curtail these funding sources.

Al Shabaab’s increasingly transnational financial strategy, moreover, complicates national efforts to disrupt its finances, underscoring the growing importance of cross-border coordination to counter these illicit revenue flows. Interregional coordination, however, remains limited, while capacity gaps undermine effective investigation, interdiction, and asset forfeiture efforts.

The Growing Complexity and Evolution of Terrorism Financing

Al Shabaab’s revenue comes primarily from extortion and racketeering activities in the form of duties, fees, and “taxes” that span almost all sectors of Somalia’s economy. This includes levies at ports of entry, on roadways, and across the trade of goods and services, with Mogadishu and southern Somalia remaining the group’s largest tax base. Within the booming urban real estate sector, al Shabaab not only taxes nearly all private property transactions but also generates revenue by investing in real estate through intermediaries and proxies. The group also enforces a mandatory 2.5 percent wealth tax (zakat) in areas it controls under the guise of religious obligation.

A stateless dhow during a maritime security operation in the Gulf of Aden. Such vessels are often used for smuggling weapons and contraband across the region’s coastal routes. (Photo: USN)

Al Shabaab has also historically generated revenue by taxing illicit commodities transported through areas under its control or influence. One prominent example was the taxation of sugar smuggling into Kenya, from which the group derived substantial revenue by levying fees on the illicit cross-border trade. Although the financial importance of illicit smuggling of commodities such as charcoal has declined relative to al Shabaab’s other taxation efforts, maritime smuggling and trafficking networks continue to facilitate the illicit procurement of weapons and other materiel that enable the group’s operations.

Al Shabaab conceals and moves its revenues through a mix of legitimate and informal channels. These include mobile money platforms, hawala networks, remittance services, front businesses, investments, and registered charities or NGOs operating both within and across Somalia’s borders. Reports indicate the group maintains an expansive transnational network spanning Eastern Africa and the Arabian Peninsula with additional financial and corporate links extending beyond these territories, where entities and individuals have been used to facilitate the movement and laundering of funds.

Al Shabaab’s evolving relationship with the Houthis is accelerating both groups’ regional reach. Houthi delegations have traveled to Somalia and delivered training to al Shabaab (as well as IS-S) in explosives, maritime interdiction, and drone use. The Houthis have also facilitated the transfer of arms, ammunition, explosives, and both weaponized and surveillance drones into Somalia. These transfers rely heavily on illicit maritime networks using small vessels (dhows) operating in a triangular Yemen-Somalia-Iran trade to move arms, fuel and personnel. Relationships forged through these shared illicit economies have enhanced the operational capabilities and revenue streams of these groups, embedding Horn-based actors within broader transnational criminal and militant networks.

While smaller in size and territorial control compared to al Shabaab, IS-S emerged as a key player in Islamic State’s broader global network, overseeing the financing of other Islamic State affiliates around the world through the al-Karrar office. It is estimated that IS-S generated between $100,000 and $360,000 per month through extortion and illicit taxation in 2023 and 2024. At the group’s height, IS-S maintained entrenched criminal networks that operated across Iran, Yemen, and Somalia, facilitating the smuggling of arms, ammunition, migrants, black market fuel, and other illicit goods. The group also oversaw financial networks and cells operating in Kenya, Uganda, Tanzania, and South Africa.

Cryptocurrency emerged as an increasingly important mechanism for IS-S to move funds and fund activities, while individuals associated with the group have been linked to investigations of terror-related financial activity on online gaming platforms. Gold smuggling and trafficking also emerged as a revenue source for IS-S.

Puntland regional security forces with U.S. counterparts on a counterterrorism operation in the mountainous areas of the Bari Region. (Photo: horseedmedia)

IS-S’s local revenue generating and other operational capabilities have been significantly degraded by Operation Hilaac (Lightning)—the joint operation between Puntland State, other local allies, and international partners such as the United States launched in December 2024. The operation has also resulted in the capture of key IS-S figures responsible for its extortion and financial operations. Nonetheless, IS-S has demonstrated signs of a modest resurgence and retains some capacity for revenue generation that warrants close monitoring.

Expanding Regional Capabilities to Counter Terrorism Financing

Given the increasingly transnational nature of al Shabaab and IS-S’s financial networks, effective counterterrorism efforts will depend on enhanced regional cooperation to identify, disrupt, and dismantle terrorist financing networks.

Financial Intelligence Units

Countries worldwide are responsible for establishing a financial intelligence unit (FIU) for receiving, analyzing, and disseminating financial intelligence consistent with the Financial Action Task Force (FATF), the international standard-setting body for the AML/CFT framework. All East African governments have made meaningful strides in operationalizing FIUs and integrating them into broader counterterrorism and AML efforts following FATF Recommendation 29 and Article 14 of the United Nations Convention against Corruption (UNCAC).

While FIUs are national-level institutions, they cooperate extensively with regional and international networks. This includes the Eastern and Southern Africa Anti-Money Laundering Group (ESAAMLG), a FATF-style regional body that promotes implementation of international AML/CFT standards through mutual evaluations, technical assistance, training, and regional cooperation. Efforts have also been made to improve cooperation and intelligence-sharing between national FIUs in line with best practices established by the Egmont Group, a global network of more than 170 FIUs. FIUs in the region also coordinate with the United Nations Office on Drugs and Crime (UNODC) to strengthen regional and international CFT collaboration.

However, challenges persist. Reporting suspicious transaction reports (STRs) to FIUs by banks, money service providers, and other regulated entities, depending on the country’s laws, remains inconsistent and insufficient. STRs submitted to FIUs often lack actionable details or arrive too late to support timely assessment and dissemination of intelligence to support investigations.

Reporting compliance among a wide range of money service businesses remains loose, particularly among businesses and professionals outside the traditional financial sector that are legally required to submit STRs. Contributing factors include limited training on what constitutes a suspicious transaction, fear of regulatory scrutiny or liability leading to “defensive reporting,” and weak supervisory oversight in environments where financial transparency and regulatory oversight remain underdeveloped. In many cases, institutions file reports solely to meet legal requirements or fail to report at all.

In other cases, FIUs’ capacity is constrained by institutional fragmentation, overlapping mandates, and low trust between agencies. These have implications on the extent to which FIUs coordinate with relevant intelligence and law enforcement bodies, especially when other agencies possess their own dedicated financial investigation units and maintain principal responsibility over all counterterrorism matters. Gaps in technological tools and analytical capacity further hinder the ability of FIUs to process STRs effectively, reducing their utility to other investigative agencies, such as law enforcement bodies.

Even where FIUs are coordinating well with other agencies and are producing and disseminating actionable intelligence, such as in Kenya, action to seize assets and initiate enforcement measures can remain uneven, thereby limiting the operational impact of financial intelligence. These challenges underscore the difficulty of translating financial intelligence into sustained enforcement action.

The pace at which financial transactions have evolved from traditional cash systems to decentralized digital financial ecosystems has also outpaced existing regulatory frameworks and traditional investigative methods. These digital platforms and assets include mobile money platforms and digital wallets, cryptocurrency exchanges and blockchain transactions, and online gambling platforms, all of which groups like al Shabaab and IS-S have exploited.

Meanwhile, AML/CFT tools and laws designed for more formal economies are often ill-suited to conflict-affected environments. This is particularly the case in contexts that rely heavily on informal financial systems, where financial literacy concerning illicit finance is low, and coercion by armed groups undermines compliance, such as Somalia. Identifying and freezing assets of sanctioned individuals is also challenging where civil registries are weak, inconsistent, or easily manipulated.

Leveraging Open-Source Intelligence and Artificial Intelligence for Financial Intelligence

As groups such as al Shabaab and IS-S increasingly adopt digital mechanisms to raise, conceal, and move funds, financial intelligence and investigative teams are beginning to incorporate open-source intelligence (OSINT), blockchain analytics, machine learning, and artificial intelligence (AI) into financial intelligence (FININT) and counterterrorism financing investigations. The growing use of digital platforms and financial services generates extensive digital trails, while the broader digital ecosystem exploited by terrorist groups for recruitment, propaganda, operations, and communications produces large volumes of publicly available information. By systematically collecting and analyzing these data, OSINT enables analysts and investigators across FIUs, law enforcement agencies, and intelligence services to identify, corroborate, and contextualize suspicious financial activity.

AI and machine learning tools further enhance these capabilities. These tools can enable analysts to rapidly collect, process, and synthesize large volumes of data, particularly in resource-constrained settings with small analytic teams. However, their greatest value lies in their integration with other intelligence disciplines to produce a more comprehensive picture of terrorism financing networks, underscoring the importance of multiagency coordination and intelligence fusion. These efforts can be facilitated through fusion centers—interagency mechanisms that bring together information, intelligence, expertise, and capabilities from multiple government entities to develop a shared understanding of threats, support early warning, inform decision-making, and enable coordinated operational responses.

Although adoption across East Africa remains uneven, regional institutions and international bodies, including the East African Police Chiefs Cooperation Organization’s (EAPCCO) Counter-Terrorism Centre of Excellence, INTERPOL’s Regional Bureau for Eastern Africa, and national-level bodies in Ethiopia, Kenya, Tanzania, and Uganda, have also made efforts to incorporate OSINT capabilities into their capacity-building initiatives. Some are also actively building partnerships with the private sector to strengthen analytic capabilities and improve real-time financial intelligence in support of counterterrorism objectives. Despite the significant potential of OSINT, AI, and machine learning, efforts to leverage them continue to be constrained by the lack of required technologies, inconsistent investment in human expertise, and other significant capacity gaps.

Underutilized Military Intelligence

Military intelligence has played a decisive role in identifying and disrupting terrorism financing networks, particularly in conflict-affected regions. This is evidenced by the July 2025 capture of Abdiweli Mohamed Aw-Yusuf (Walalac), head of IS-S’s Finance Department.

Military forces operating in conflict zones and border areas, however, often lack the training protocols for evidence collection, chain of custody, and interagency transfer. This results in gaps in identifying individuals involved in terrorism financing, as well as preserving and transferring evidence to the relevant civilian authorities for terrorism financing investigations, asset forfeitures, and ultimately successful terrorism prosecutions.

Multiagency Coordination and Investigative Capacity

Coordination between FIUs, law enforcement agencies, intelligence actors, prosecutors, and even private sector stakeholders across East Africa is improving. Kenya, for instance, has institutionalized interagency guidelines for cooperation and collaboration in the investigation and prosecution of terrorism financing. These guidelines link the Anti-Terrorism Police Unit (ATPU) with the Financial Reporting Centre (Kenya’s FIU), and the Office of the Director of Public Prosecutions (ODPP). Kenya’s Financial Reporting Centre also leverages its partnerships with the Directorate of Criminal Investigations and the Asset Recovery Agency to deploy multiagency financial crime units to the country’s borders to combat money laundering.

Criminal Investigative Directorate building in Garowe, Somalia. (Photo: Garowe Online)

Somalia has also made notable strides. Federal law enforcement bodies have improved information sharing with key counterparts, such as the Financial Reporting Centre (Somalia’s FIU), the National Intelligence and Security Agency, the Attorney General’s Office, the Central Bank, and the Ministry of Justice. Uganda, likewise, has made efforts to reinforce collaboration between the Financial Intelligence Authority (Uganda’s FIU), law enforcement investigators, and prosecutors in terrorism financing cases.

Regional bodies, with support from external partners, have also launched a range of workshops and training initiatives to strengthen national investigative and multiagency mechanisms as well as regional cooperation. These capacity building initiatives convene investigators, prosecutors, judges, financial intelligence analysts, and other practitioners from across the region to build skills in blockchain analytics, virtual asset investigations, the preservation of electronic evidence, the preparation of mutual legal assistance requests, the conversion of digital intelligence into admissible evidence, and the effective presentation of virtual assets and other digital evidence in court.

Nonetheless, investigations continue to struggle with inefficiencies in collecting, organizing, processing, and sharing evidence. In some instances, this stems from the ongoing reliance on manual, paper-based procedures and the absence of standardized digital case management systems, as can be seen in the case of Somalia. Training gaps also persist, especially in specialized areas such as digital financial crime investigations, advanced forensics, and the handling of cryptocurrency or other forms of digital evidence despite ongoing capacity building initiatives. Furthermore, the investigative and judicial pipeline frequently breaks down due to weak standard operating procedures for recording and transferring evidence.

Prosecution-Led Investigations

Unlike traditional law-enforcement-led approaches that typically involve prosecutors later in the investigative process, prosecution-led investigations engage prosecutors from the outset. Doing so ensures proper collection, preservation, documentation, and transfer of evidence to meet admissibility standards in court. The successful prosecution of the individuals involved in the 2019 DusitD2 attack in Nairobi, Kenya, illustrates the effectiveness of prosecution-led investigations. In that case, the ODPP and the ATPU collaborated closely with regional and international partners to trace the digital evidence and financial transactions that enabled the attack, ultimately leading to the conviction of two suspects on charges of conspiracy to commit a terrorist act and facilitation of a terrorist act.

Despite this progress, cases like the DusitD2 remain the exception. The admissibility of digital evidence, including electronic communications and digital financial transactions, continues to be problematic, largely due to unclear and inconsistent procedures for collecting and handling such evidence. Lengthy prosecution timelines also hinder justice, with mutual legal assistance requests often delayed by diplomatic and bureaucratic hurdles. This forces prosecutors to rely on informal channels for timely information sharing. Additionally, investigators frequently lack adequate training to effectively use financial intelligence provided by FIUs and convert it into prosecutable evidence, limiting the overall effectiveness of terrorism-financing prosecutions.

Regional Cooperation: Opportunities and Fragmentation

Regional and continental bodies—such as the EAPCCO, East African Community (EAC), Intergovernmental Authority on Development (IGAD), ESAAMLG, African Union Mechanism for Police Cooperation (AFRIPOL), The African Union Counter Terrorism Centre (AUCTC), and the Committee of Intelligence and Security Services of Africa (CISSA)—have invested in efforts to enhance national and cross-border capabilities to counter terrorism financing. With support from INTERPOL, UNODC, UNOCT, and other international partners, these organizations are supporting capacity building, training, operational coordination, and joint actions to disrupt terrorist networks and their facilitators.

An EAPCCO meeting in Kigali, March 2026. (Photo: RIB)

Working closely with one another, INTERPOL, SARPCCO and EAPCCO have provided training on financial investigations, including joint sessions for law enforcement agencies and FIUs. AFRIPOL has coordinated successful joint operations across West, Central, and Eastern Africa, resulting in the arrest of key terrorist operatives and facilitators. ESAAMLG continues to strengthen FIUs, improve their ability to analyze suspicious transactions related to terrorism, and train investigators to convert financial intelligence into prosecutable evidence. ESAAMLG has also partnered with other FATF-style regional bodies (FSRBs), such as the Action Group Against Money Laundering in Central Africa (GABAC) and the Intergovernmental Action Group against Money Laundering in West Africa (GIABA), to foster cross-regional coordination.

Despite this progress, technical assistance remains fragmented with limited interoperability across platforms and institutions. Different international partners provide technologies and training with limited coordination, resulting in parallel or even contradictory investments. Coordination between regional initiatives can also be inconsistent, and duplication of efforts remains a challenge.

Expanding the Agility and Coordination of Counterterrorism Financing Operations

Despite notable advancements in strengthening countering terrorism financing in East Africa, terrorist groups like al Shabaab continue to adapt and exploit institutional gaps. To further disrupt the financial lifelines that sustain terrorist groups, an enhanced multisectoral approach involving FIUs, law enforcement, military, prosecutors, judges, as well as regional and international partners is needed.

• Enhance national and regional capacity to counter terrorism financing through sustained, specialized training on financial crimes. Training should focus on specialized areas such as cryptocurrency forensics, nontraditional value transfer systems (e.g., hawala, mobile money), compliance and implementation of FATF standards, OSINT, and proper submission and analysis of Suspicious Transaction Reports.
• FIU analysts, investigators, and prosecutors from across the region should receive ongoing, practical training to improve their ability to translate financial intelligence into actionable and admissible evidence. Among other topics, these initiatives can focus on digital financial investigations, electronic evidence preservation, preparation of mutual legal assistance requests, and other specialized skills required to investigate and prosecute the increasingly sophisticated methods terrorist groups use to raise, conceal, move, and launder funds. These trainings can be delivered by regional, continental, and international bodies, including EAPCCO, SARPCCO, INTERPOL, AUCTC, AFRIPOL, UNODC, UNOCT, ESAAMLG, and expert institutions like the Institute for Security Studies through coordinated, multisectoral programs.

• Expand OSINT and emerging technologies into investigation capacities. Establishing well-trained OSINT analyst teams should be a strategic priority embedded within national AML/CFT budgets and public-private partnerships. Publicly available tools can be employed to track terrorist organizations’ digital transactions, networks, financial flows, communication links, supply chains, and affiliate relationships. Safeguards for data protection and data sovereignty must simultaneously be established so that these tools are not abused.
• Adopt a prosecution-led approach to terrorism financing investigations. Governments should consider adopting a prosecution-led model for investigating terrorism financing, assigning specialized prosecutors to guide cases from the outset alongside law enforcement. Early prosecutor involvement enables timely asset freezing, ensures legally sound evidence collection, and significantly improves the chances of successful prosecution.
• Enhance military evidence handling to strengthen terrorism financing investigations. Given their frontline role in counterterrorism operations, military land forces must receive targeted training on crime scene management, evidence preservation, and chain-of-custody procedures to ensure battlefield evidence remains admissible in court. Strengthening these skills will bridge operational gaps with law enforcement, enhancing the investigation, interdiction, and prosecution of terrorism financing networks.
• Enhance counterterrorism efforts through embedded FIU representation in national counterterrorism fusion centers. Embedding FIU representation in national counterterrorism fusion centers will ensure financial intelligence is analyzed alongside other intelligence sources, including operational data, enabling faster detection of suspicious transactions and more effective mapping of terrorist financial networks. Over time, this could help promote standardized national intelligence-sharing protocols and build interagency trust.
• Improve coordination between FIUs in the region and strengthen cross-regional coordination among FATF-style regional bodies. FIUs should establish or update bilateral and multilateral memorandums of understanding to enable timely, secure, and reciprocal information sharing aligned with Egmont Group standards. ESAAMLG must deepen formal collaboration with other FSRBs like GABAC and GIABA through joint typology studies, shared secure communication systems, coordinated risk assessments, and cross-regional task forces targeting key threats such as hawala and trade-based money laundering.