Combating the Financing of Terrorism
What is combating the financing of terrorism (CFT)?
Combating the financing of terrorism (CFT) is the set of laws, screening controls, and reporting duties that regulated businesses use to detect and block funds moving to terrorist groups or their operations. CFT sits in the same regulatory framework as rules, which is why the two are usually written together as AML/CFT.
The two disciplines run in opposite directions. AML traces money that came from crime and needs to look legitimate; CFT traces money that can be legally earned and clean at source, but is destined for an illegal purpose. That reversal changes what detection looks like. Because the funds can be small in value and drawn from ordinary salaries, donations, or business revenue, CFT controls lean on who is involved and where value is going – counterparty screening, sanctions lists, destination corridors – rather than on transaction size alone.
The standards come from the Financial Action Task Force (FATF), the intergovernmental body that sets the recommendations national regulators translate into local law. Sanctions and designated-person lists are issued separately by the United Nations, the EU, the US Office of Foreign Assets Control (OFAC), and individual national authorities, and regulated firms screen against several of them at once.
Key requirements
Specific obligations differ by jurisdiction and licence type, but supervised firms are consistently expected to operate the following controls:
- Customer identification and verification. checks for individuals, checks for corporate clients, and identification of each behind a legal entity.
- Sanctions and watchlist screening. Customers, beneficial owners, and payment counterparties are screened against terrorism-related designation lists at onboarding and continuously afterwards, since lists are updated between reviews.
- Transaction monitoring. Rules and models flag patterns associated with terrorist financing: structured low-value transfers, sudden corridor changes, payments to or from high-risk jurisdictions, and activity that doesn't match the stated business profile.
- Suspicious activity reporting. Confirmed alerts are escalated to the national financial intelligence unit as a suspicious activity or suspicious transaction report. Most regimes also prohibit tipping off the customer that a report was filed.
- Risk assessment and record keeping. A documented business-wide risk assessment drives control calibration, and records are retained so a supervisor can reconstruct decisions after the fact.
- Governance and training. A named compliance officer owns the programme, and staff in customer-facing and payments roles are trained to recognise escalation triggers.
Who it applies to
CFT obligations attach to licensed and registered financial firms first: banks, electronic money institutions, payment service providers, , money remitters, and crypto-asset service providers. Scope beyond that varies by jurisdiction and commonly extends to lawyers, accountants, company formation agents, real estate agents, and dealers in high-value goods.
Merchants are rarely direct subjects of CFT law, but the obligations reach them through the payments chain. An acquiring bank or PSP that onboards a merchant runs due diligence on the business, identifies its UBOs, and screens directors against sanctions lists before a is approved. A in a sector or geography with elevated exposure typically faces deeper checks, more frequent reviews, and closer monitoring of settlement patterns.
Penalties for non-compliance
Supervisory penalties for AML/CFT failures include monetary fines, formal enforcement undertakings, restrictions on onboarding new customers, and suspension or withdrawal of a licence. Senior managers and named compliance officers can be held personally liable, and in several regimes are subject to individual fines or prohibition from holding regulated roles.
Sanctions breaches carry separate and heavier exposure. Processing a payment for a designated person or entity is a criminal matter in most jurisdictions, and many sanctions regimes apply without requiring proof that the firm intended to breach them.
For a merchant, the operational consequence arrives faster than any regulatory one: the acquiring bank or freezes settlement and terminates the merchant account, and the resulting termination record is visible to other acquiring banks during their own onboarding checks.
