Abuse of Non-Profit Organisations and Charities

Introduction: Why This Topic Matters

Non-profit organisations (NPOs) and charities are among the most trusted institutions in society. They collect billions in donations every year, operate in the world's most dangerous and under-governed regions, and enjoy public goodwill and favourable regulatory treatment. Those same qualities make them attractive to criminals and, above all, to terrorist financiers. A charity can move money across borders into a conflict zone under a humanitarian banner, blend illicit funds with legitimate donations, and rely on the reluctance of banks, regulators and the public to question organisations doing 'good works'.

For the CAMS exam, this topic sits inside the Financial Crime Risks by Sector domain and is tested heavily in connection with terrorist financing (TF). It links directly to FATF Recommendation 8, to the risk-based approach, to customer due diligence on legal entities, and to the recurring exam theme of distinguishing genuinely high-risk activity from activity that merely looks unusual. Candidates who understand both the typologies of abuse and the regulatory insistence that not all NPOs are high risk will handle these questions well.

Part 1: What Is an NPO and Why Is It Vulnerable?

FATF definition. FATF defines an NPO as a legal person, legal arrangement or organisation that primarily engages in raising or disbursing funds for charitable, religious, cultural, educational, social or fraternal purposes, or for the carrying out of other types of good works. This covers registered charities, religious institutions, foundations, relief agencies, educational trusts, community associations and informal collection groups.

Characteristics that create vulnerability:
• Public trust - donors, banks and regulators are less inclined to challenge a charity.
• Access to considerable funds - large and often cash-intensive donation flows, including from anonymous or small donors.
• Global reach - many operate in or send money to high-risk jurisdictions and conflict zones, often where terrorist groups are active and formal banking is weak.
• Reliance on intermediaries - local partners, field offices, implementing agencies and money service businesses or hawala in areas with no banks.
• Light regulation - in many countries NPOs face less supervision than financial institutions; registration may be voluntary; beneficial ownership and control may be opaque.
• Tax advantages and favourable treatment - tax-exempt status can be exploited for fraud and evasion as well as laundering.
• Cash handling - collection boxes, fundraising events and in-kind donations create loose audit trails.

Important nuance for the exam: FATF revised Recommendation 8 and its Interpretive Note in 2016 specifically to stress that the NPO sector as a whole is not inherently high risk. Countries must identify which subset of NPOs falls within the FATF definition and which of those are actually exposed to TF risk, then apply focused, proportionate and risk-based measures. Blanket treatment of all charities as high risk, or wholesale de-risking by banks, is explicitly discouraged because it harms legitimate humanitarian activity and pushes funds into informal, less transparent channels.

Part 2: How NPOs Are Abused - The Typologies

FATF's 2014 report Risk of Terrorist Abuse in Non-Profit Organisations identified five principal methods. These are prime examination material.

1. Diversion of funds. Money raised for a legitimate purpose is siphoned off by insiders (directors, trustees, employees) or by external actors (local partners, field staff) and redirected to terrorist groups or personal enrichment. Diversion can happen at the collection stage, in transit, or at the point of disbursement in the field.

2. Affiliation with a terrorist entity. The NPO maintains operational or ideological links to a terrorist organisation. Key individuals may be members or supporters; the NPO's premises, networks or legitimacy may be used by the group; or the NPO may knowingly funnel support to the group's social or welfare arm.

3. Abuse of programming. Legitimate programmes are manipulated so that the aid itself supports terrorism - for example, humanitarian supplies, schools or clinics delivered through a terrorist-controlled area in a way that strengthens the group's control, or recruitment and indoctrination hidden within educational or youth programmes.

4. Support for recruitment. The NPO serves as a venue or platform for radicalisation, networking and the recruitment of fighters or financiers, even where funds are not directly diverted.

5. False representation (sham NPOs). An organisation is created purely as a front. It claims charitable purposes but exists to raise and move funds for terrorism or to launder criminal proceeds. Sham charities may mimic the names and branding of well-known legitimate organisations.

Money laundering abuse. Although the exam emphasises TF, NPOs are also used to launder criminal proceeds: criminals donate illicit cash to a controlled charity, which then pays the criminal (or associates) as 'consultants', 'suppliers' or 'grant recipients'; charities are used to transfer value across borders under the guise of aid; and fraudulent charities simply steal donations. Tax-exempt status can be used to disguise income or facilitate tax evasion.

Part 3: Red Flags and Indicators

Examiners frequently present a scenario and ask which indicator is most concerning or whether the activity warrants further action. Know these indicators well.

Structural and governance indicators:
• NPO is unregistered or registered in a jurisdiction with weak oversight, or its stated purpose is vague or shifts over time.
• Directors, trustees or signatories appear on sanctions or terrorist lists, or are associated with designated persons or entities.
• Same individuals control several NPOs, or an NPO shares addresses, phone numbers or officers with for-profit entities or other NPOs with no clear relationship.
• Name closely resembles that of a well-known charity (potential sham).
• Refusal or inability to provide information on beneficiaries, partners, use of funds or audited accounts.

Transactional indicators:
• Funds flow to or from conflict zones or high-risk jurisdictions, particularly where the NPO has no demonstrable programme presence.
• Transfers to individuals rather than organisations, or to a single intermediary in a high-risk area, or to money service businesses or hawaladars.
• Transaction patterns inconsistent with the NPO's stated size, mission or geographic footprint (e.g., a local community charity wiring funds abroad).
• Sudden, unexplained surges in donations, or donations from unexpected sources, locations or high-risk jurisdictions.
• Large or frequent cash deposits, structured deposits below reporting thresholds, or round-sum transfers.
• Funds pass through the account quickly with little retained for operating expenses (pass-through behaviour).
• Payments to vendors with no apparent connection to the charitable activity, or to the personal accounts of directors or staff.
• Minimal spending on administration or programme delivery relative to amounts raised, or the reverse - high fundraising costs with little going to stated beneficiaries.
• Use of personal accounts of officers to receive donations or make disbursements.
• Transactions with entities or individuals that appear in adverse media connected to extremism.

Part 4: How the Regulatory Framework Works

FATF Recommendation 8. Countries should review the adequacy of laws and regulations relating to NPOs identified as vulnerable to TF abuse and apply focused, proportionate measures in line with the risk-based approach. The Interpretive Note sets out four objectives: (a) sustained outreach to the sector; (b) proportionate, risk-based supervision or monitoring; (c) effective investigation and information gathering; and (d) effective mechanisms for international cooperation. FATF's Best Practices Paper on Combating the Abuse of NPOs (updated 2015) supports this. Recommendation 8 is one of the core TF recommendations alongside Recommendations 5 (criminalising TF), 6 (targeted financial sanctions) and 7 (proliferation financing).

National measures. Examples include the UK Charity Commission's registration, reporting and inquiry powers; the US Treasury Anti-Terrorist Financing Guidelines: Voluntary Best Practices for US-Based Charities; and designation and asset-freezing powers (such as OFAC designations of charities found to be fronts). Many jurisdictions require charities to file annual accounts, disclose trustees and maintain records of donors and disbursements.

Controls expected of the NPO itself ('Know Your Donor, Know Your Partner, Know Your Beneficiary'):
• Strong governance: independent board, documented decision-making, conflict-of-interest policies.
• Financial controls: dual signatures, budget approval, reconciliation, segregation of duties, use of regulated banking channels rather than cash or informal transfer systems where possible.
• Due diligence on donors (especially large or unusual ones), on implementing partners and field offices, and on end beneficiaries, including sanctions screening.
• Transparency: published audited accounts, clear programme reporting, monitoring and field verification of how money is spent.
• Staff training and whistleblowing channels.

Controls expected of financial institutions:
• Customer due diligence tailored to NPOs: understand the purpose and mission, legal form, registration status, controlling persons and beneficial owners (trustees and senior officers), sources of funding, donor base, countries of operation, intended beneficiaries and expected transaction profile.
• Risk assessment of each NPO on its own facts - geography, cash intensity, use of intermediaries, transparency - rather than treating all NPOs identically. Apply enhanced due diligence where risk is elevated (e.g., operations in conflict zones), simplified measures where risk is low.
• Sanctions screening of the entity, its officers, partners and payees.
• Ongoing monitoring against the expected profile, with alerts for the red flags above.
• Investigation and reporting: escalate unusual activity, request supporting documentation, file a suspicious activity report where suspicion remains, and consider exit only after a reasoned, documented decision. Regulators warn against reflexive de-risking that denies legitimate charities access to banking.

Part 5: Illustrative Scenario

A regional bank onboards a small religious charity whose stated purpose is to run a community centre in its home city. Over six months its account receives a growing volume of cash deposits from many individuals and several large wires from an overseas foundation. Nearly all incoming funds are wired within days to a single individual in a country bordering an active conflict, described in payment references as 'relief supplies'. The charity's website shows no overseas programmes, and when the bank requests information on the recipient, the treasurer says it is a trusted contact and declines to provide documentation.

Analysis: The combination is textbook - mismatch between stated purpose and activity, pass-through behaviour, payments to an individual rather than an organisation, destination near a conflict zone, growing unexplained inflows, and refusal to cooperate with due diligence. The appropriate response is to escalate, conduct enhanced due diligence, screen all parties, document findings and file a suspicious activity report if the concerns cannot be resolved. The bank should not tip off the customer and should follow its documented exit process if it decides to end the relationship.

Part 6: Exam Tips - Answering Questions on Abuse of Non-Profit Organisations and Charities

Tip 1: Lead with terrorist financing. When an exam question involves a charity, the examiner is most often testing TF rather than classic money laundering. Remember the TF hallmarks: funds may be entirely legitimate in origin, amounts are often small, and the concern is destination and purpose, not source.

Tip 2: 'Charity' is not a red flag by itself. Any answer option implying that all NPOs are high risk, or that an institution should refuse all charity customers, is almost always wrong. FATF's 2016 revision of Recommendation 8 is explicit about proportionate, risk-based treatment and the harm caused by de-risking.

Tip 3: Look for the mismatch. The strongest indicators are inconsistencies between what the NPO says it does and what the money actually does: a local charity sending funds abroad, a relief agency with no programme in the receiving country, funds going to individuals instead of partner organisations, or a pass-through pattern with little spent on operations.

Tip 4: Geography is a multiplier. Conflict zones, jurisdictions with active terrorist groups, and countries with weak AML/CFT controls elevate risk sharply, especially when combined with intermediaries, hawala or payments to individuals. If a question asks which NPO deserves enhanced due diligence, the one operating in or sending funds to such areas is the usual answer.

Tip 5: Know the five FATF typologies. Be able to classify a scenario as diversion, affiliation, abuse of programming, support for recruitment or false representation. Questions may describe a situation and ask what type of abuse it represents.

Tip 6: Know what good due diligence looks like. For 'what should the bank obtain' questions, think: purpose and mission, registration and legal status, trustees and controllers (beneficial ownership), sources of funds and donor base, countries of operation, beneficiaries and partners, expected activity. For the NPO's own controls, remember Know Your Donor, Know Your Partner, Know Your Beneficiary, plus governance, audits and transparency.

Tip 7: Follow the correct escalation sequence. The 'best next step' when suspicious activity appears is typically to investigate and conduct enhanced due diligence, then file a SAR/STR if suspicion persists. Immediate account closure, confronting the customer, or contacting law enforcement informally are usually distractors. Never select an option that would tip off the customer.

Tip 8: Be alert to sanctions overlay. If a trustee, partner or payee matches a designated person or entity, the issue moves from suspicion to a sanctions obligation: freeze or block as required and report to the competent authority. Options that suggest merely monitoring in that situation are wrong.

Tip 9: Recognise the sham charity. Names imitating well-known organisations, recent formation shortly before large fundraising, no verifiable programme activity and officers linked to other shell entities point to false representation.

Tip 10: Read from the perspective asked. Some questions are from the viewpoint of the compliance officer at a bank, others from a regulator, others from the charity's own board. The correct control differs: banks conduct CDD and monitoring; regulators conduct outreach and risk-based supervision; charity boards implement governance and partner due diligence. Match the answer to the role.

Tip 11: Eliminate absolute language. Options containing 'always', 'never', 'all charities' or 'automatically' are usually incorrect in this topic because FATF and national regulators insist on a risk-based, proportionate approach.

Summary Checklist
• NPOs are vulnerable because of public trust, access to funds, global reach, cash and intermediary use, and lighter regulation.
• FATF Recommendation 8 requires focused, proportionate, risk-based measures; the sector is not uniformly high risk.
• Five abuse typologies: diversion, affiliation, abuse of programming, recruitment support, false representation.
• Key red flags: purpose-activity mismatch, conflict-zone flows, payments to individuals or single intermediaries, pass-through patterns, cash intensity, opaque governance, links to designated persons, refusal to provide information.
• Bank controls: tailored CDD, risk assessment, sanctions screening, monitoring, EDD where warranted, SAR filing, reasoned rather than reflexive exit.
• NPO controls: governance, financial controls, Know Your Donor / Partner / Beneficiary, transparency and audits.
• Exam approach: think TF first, find the mismatch, weigh geography, follow the escalation sequence, reject absolutes and blanket de-risking.