The Financial Action Task Force released the results of its Mutual Evaluation of the United States on Dec. 1, 2016, assessing compliance with its 40 anti-terrorist financing and anti-money laundering standards, including Recommendation 8 (R8) on nonprofit organizations (NPOs). While the evaluation found the U.S. to be “largely compliant” with R8, it noted that R8 was revised in June 2016. The evaluation is based on the prior version. Key elements of the new R8, including the proportionality of rules to risk, were not addressed. However, FATF said, “The revised version will be taken into account during the follow-up process.”  Problems NPOs experience with banking services were also discussed. The last evaluation was in 2006. This summary and analysis identifies the major issues relevant to NPOs.

Executive Summary

FATF’s summary of the main terrorist financing threats does not include the nonprofit sector. Instead it notes that threats include “raising funds through criminal activity, individuals raising funds under the auspices of charitable giving but outside of any charitable organization…” and threats related to financial transactions. [p. 5 paragraph 4]  It also notes that the ‘U.S. achieves high results … for preventing abuse of the NPO sector..” [p. 6 paragraph 6] FATF also says that “The U.S. has established a targeted RBA (risk-based approach) to NPO outreach, oversight, investigation and enforcement actions which are largely based on regular engagement with NPOs and intelligence.” [p. 9 paragraph 18]

Comment: NPOs should be encouraged that FATF has updated its analysis of NPO risk to reflect what research and experience over  the last decade demonstrates: that NPOs are not a significant source of terrorist financing. The growing threat from fraudulent fundraising is of concern to all stakeholders. This must be addressed in a manner that does not restrict or disrupt the work of legitimate NPOsNPOs can share credit for FATF’s high rating on prevention of terrorist abuse the NPO sector.

In the follow up to this evaluation, FATF should address the issue of how the risk-based approach in the updated R8 is (or is not) reflected in laws and rules that impact NPO’s ability to carry out their work. This aspect of the risk-based approach was not mentioned in the evaluation, but is essential to avoid over-regulation that disrupts the work of legitimate NPOs.

Chapter 4. Terrorist Financing (TF) – Key Findings, Recommended Action, Trends

A Key Finding make the general statement that measure applies to NPOs “are risk-based, and focused on targeted outreach and engagement with NPOs most at risk for abuse by terrorists and the 2015 NTFRA (National Terrorist Financing Risk Assessment) found that concerted action has improved the resilience of the charitable sector to abuse by TF facilitators.” [pate 87] It goes on to recognize that because terrorist financing and sanctions violations “are strict liability offenses, the authorities should continue to engage stakeholders on banking challenges that some NPOs face when working on conflict zones. The U.S. could further improve the quality of NPO supervision.” [p 88]

FATF reports that “The authorities report that targeted actions and outreach in the NPO sector have significantly reduced the misuse of NPOs… Targeted awareness-raising and outreach has also seen a decline of misuse of FIs (financial institutions), while other means of moving funds have been on the increase.” [p. 91]

Comment: FATF’s recognition that the U.S. anti-terrorist financing rules are “strict liability” is helpful, but there is no discussion of how such “zero tolerance” rules measure up to a risk-based approach. This may reflect the fact that the evaluation was conducted under the old R8, which did not include the risk-based approach.

FATF’s suggestion about improved supervision of NPOs is too vague to be useful. NPOs should carefully monitor what, if any, steps the U.S. takes to regulate NPOs as a result of this statement.

Once again, NPOs can share credit for the reduction in terrorist abuse, through adaptation of robust due diligence to prevent abuse by terrorists.  

Chapter 4. Targeted approach, outreach and oversight of at-risk NPOs

Pages 103-105 provide details on FATF’s the “effectiveness” component of evaluating R8 compliance. FATF uses “Immediate Outcome 10” from its Methodology handbook for this component. IO 10 was revised in October 2016 to reflect the June revision of R8. As a result, this analysis does not reflect the new standard.

Paragraphs 224 -225 provide basic statistics on the size and scope of the U.S. NPO sector and repeats the finding that the U.S. has a risk-based approach to outreach, oversight, investigations and enforcement, stating that it is “broadly effective” in responding to risks. The on-site team “confirmed these conclusions” in discussions with stakeholders, including NPOs.

The evaluation finds that “the large size and diversity of the U.S. charitable sector and its global reach means the sector remains vulnerable to abuse. Agencies consistently shared the view that U.S. efforts in this area had significantly reduced, but not eliminated, the risks of TF through NPOs.” [p. 103 paragraph 226] Higher risk was found for NPOs involved in international funds transfers, noting that the U.S. collects information on international activities through IRS Form 990 Schedule F and has “considerably enhanced due diligence on international funds transfers.” [p. 103 paragraph 227]

Regarding the trend of fraudulent fundraising “outside of any charitable organization recognized as tax-exempt by the U.S. government,” FATF noted that this has been dealt with through criminal prosecutions, which is considers the “most effective tool to stop this kind of abuse, especially in the U.S.…” It noted that “Designations of NPOs by OFAC may be more effective against overseas entities, where the ability of U.S. law enforcement to arrest and prosecute terrorist facilitators is more limited.” [p 103 paragraph 228]

Paragraphs 229-232 describe how the U.S. gathers data on NPOs to use for enforcement purposes, including information from the IRS, state regulators and Suspicious Activity Reports (SARS) filed by banks. It also refers to “extensive guidance” provided for charitable giving, humanitarian assistance and advice of NPO risks.

The results of the evaluation team’s February 2016 on-site visit states that “NPOs supported the view that controls are strictly applied by both government entities and FIs through which NPO funds are moving…In terms of access to financial services NPOs commented on the impact that strict liability for breaching TFS (terrorism financing sanctions) may have on banks’ risk appetites, particularly when humanitarian aid is provided in conflict areas with TF risk.” [p. 104 paragraph 233]

The section concludes with this statement, taken from paragraph 234:

“Measures applied to NPOs are risk-based, and focused on targeted outreach and engagement with NPOs most at risk for abuse by terrorists. Striking the right balance and avoiding the disruption of legitimate NPO activities can be challenging, particularly in higher-risk conflict zones. As violations of TF- related TFS are strict liability offenses, the authorities should continue to work with the NPO community to understand and mitigate the real TF risks that exist, while engaging stakeholders on banking challenges that some NPOs may face when working in conflict zones. The U.S. authorities are aware of the continuing challenges in this difficult area and are encouraged to continue their efforts, including work with the private sector.”

Comments: Because this section reflects evaluation under the old R8, it does not address key issues raised by NPOs during the evaluation process. See comments of the Council on Foundations and Charity & Security Network and C&SN’s Analysis of the National Terrorist Financing Risk Assessment.which were sent to FATF during the evaluation process. During the site visit evaluators did not meet with major NPO umbrella organizations, so the team’s ability to get views representing a broad spectrum of service organizations  was limited.

Technical Compliance Review for Recommendation 8

The primary finding is Criterion 8.1, on page 194, which states:

“The U.S. has conducted several internal reviews of its domestic charitable sector to  assess its risk of misuse for TF: one in June 2010 as part of TFS information published by Treasury, and another in 2012/13 to support the 2015 National Terrorist Financing Risk Assessment. While there has been no separate, comprehensive review of the adequacy of laws and regulations relating to NPOs  since 2003, the authorities indicated that the laws are subject to ongoing review (e.g. by the civil components of IRS) and any deficiencies are brought to the notice of policy-makers. One important example of this process was the enhancements made to the Form 990 (the annual returns required from tax-exempt NPOs) in 2008.”

Comment: The new R8 requires a risk-based approach. In its Best Practices Paper for R8 implementation, FATF spells out the steps this entails. The review of existing laws and measures in light of the risk assessment is a crucial step. As FATF notes, the U.S. has not undergone this process since 2003. Things have changed substantially since then.  Although U.S. authorities claim to have “ongoing review” of these laws, it has failed to address concerns NPOs have raised about the disruptive effect of U.S. laws and measures on legitimate NPOs. FATF should look into the need for a review that includes outreach to and input from the NPO sector as part of the follow up to this evaluation. Otherwise, the new R8 may not be effectively implemented in the U.S. for a long time, as the next evaluation will be years from now.

The remaining technical compliance findings describe the relevant U.S. regulatory and law enforcement systems. [pages 195-196]

On page 196 FATF rates the U.S. as “largely compliant” with the old R8.