Countering Terrorism Financing in East Africa

Defeating al Shabaab and other terrorist groups in East Africa will require degrading their increasingly sophisticated revenue generation capabilities through strengthened national and regional coordination.

Terrorist groups in East Africa have become increasingly proficient in revenue generation including through extortion, money laundering, mobile money platforms, hawala networks, cryptocurrency, and gold smuggling. (Photos: AFP/Eric Lafforgue/Hans Lucas and AFP/Stringer)

Terrorist groups like al Shabaab and the Islamic State in Somalia (IS-S) pose a persistent and evolving threat to security in East Africa and internationally.

Al Shabaab’s growing engagements with the Houthi paramilitary group in Yemen are illustrative. Through increasingly sophisticated and transnational facilitation networks, these exchanges across the Gulf of Aden have raised the land-based threat posed by both groups, as well as their capacity todisrupt the vital maritime trade route through the Red Sea.

Al Shabaab has evolved into a hybrid entity that blurs the lines between terrorism and transnational organized crime.

Al Shabaab’s ties to al Qaeda and IS-S’s links to the Islamic State further underscore the risk that parts of East Africa could serve as safe havens for global terrorist operations.

Al Shabaab has established asophisticated revenue-generation capacitythat stretches well beyond areas under its territorial control in Somalia. This includes a host of organized criminal activities, such asdirect extortion and illicit taxation, illicit trade, smuggling and trafficking, and money laundering, among other criminal enterprises to move people, arms, and money across East Africa and beyond. Al Shabaab is now estimated to controlannual revenues of up to $200 million.

While its early revenue generation was opportunistic, al Shabaab has evolved into a hybrid entity thatblurs the lines between terrorism and transnational organized crime. This expanding revenue generation capacity has been further enabled by the region’sporous borders, persistent state fragility, armed conflict, and corruption.

The Federal Government of Somalia (FGS) has made meaningful progress throughreforms to its Anti-Money Laundering and Countering the Financing of Terrorism(AML/CFT) framework and the adoption ofstrategies to disrupt terrorism financing. These efforts have contributed to thefreezing of terrorist-linked bank accounts, the suspension of mobile money accounts, and theprosecution of individuals charged with financing terrorism. Despite this progress, al Shabaab has continued to adapt and maintain its revenue flows, while gaps in technical compliance and operational effectiveness undermine efforts to curtail these funding sources.

Al Shabaab’s increasingly transnational financial strategy, moreover, complicates national efforts to disrupt its finances, underscoring the growing importance of cross-border coordination to counter these illicit revenue flows. Interregional coordination, however, remains limited, while capacity gaps undermine effective investigation, interdiction, and asset forfeiture efforts.

Al Shabaab’s revenue comes primarily fromextortion and racketeering activitiesin the form of duties, fees, and “taxes” that spanalmost all sectors of Somalia’s economy. This includes levies at ports of entry, on roadways, and across the trade of goods and services, withMogadishu and southern Somaliaremaining the group’s largest tax base. Within the booming urban real estate sector, al Shabaab not only taxesnearly all private property transactionsbut also generates revenue by investing in real estate throughintermediaries and proxies. The group also enforces a mandatory 2.5 percent wealth tax (zakat) in areas it controls under the guise of religious obligation.

A stateless dhow during a maritime security operation in the Gulf of Aden. Such vessels are often used for smuggling weapons and contraband across the region’s coastal routes. (Photo: USN)

Al Shabaab has also historically generated revenue by taxing illicit commodities transported through areas under its control or influence. One prominent example was thetaxation of sugar smuggling into Kenya, from which the group derived substantial revenue bylevying fees on the illicit cross-border trade. Although the financial importance of illicit smuggling of commoditiessuch as charcoalhas declined relative to al Shabaab’s other taxation efforts,maritime smuggling and trafficking networkscontinue to facilitate the illicit procurement of weapons and other materiel that enable the group’s operations.

Al Shabaab conceals and moves its revenues through a mix of legitimate and informal channels. These include mobile money platforms, hawala networks, remittance services, front businesses, investments, and registered charities or NGOs operating both within and across Somalia’s borders. Reports indicate the group maintains anexpansive transnational networkspanning Eastern Africa and the Arabian Peninsula with additional financial and corporate links extending beyond these territories, where entities and individuals have been used to facilitate the movement and laundering of funds.

Al Shabaab’s evolving relationship with the Houthis is accelerating both groups’ regional reach. Houthi delegations have traveled to Somalia and delivered training to al Shabaab (as well as IS-S) inexplosives, maritime interdiction, and droneuse. The Houthis have also facilitated the transfer of arms, ammunition, explosives, and both weaponized and surveillance drones into Somalia. These transfers rely heavily on illicit maritime networks using small vessels (dhows) operating in atriangular Yemen-Somalia-Iran tradeto move arms, fuel and personnel. Relationships forged through theseshared illicit economieshave enhanced the operational capabilities and revenue streams of these groups, embedding Horn-based actors within broader transnational criminal and militant networks.

Reports indicate that al Shabaab maintains an expansive transnational network spanning Eastern Africa and the Arabian Peninsula.

While smaller in size and territorial control compared to al Shabaab, IS-S emerged as a key player in Islamic State’s broader global network, overseeing the financing of other Islamic State affiliates around the world through the al-Karrar office. It is estimated that IS-S generated between$100,000and$360,000per month through extortion and illicit taxation in 2023 and 2024. At the group’s height, IS-S maintainedentrenched criminal networksthat operated across Iran, Yemen, and Somalia, facilitating the smuggling of arms, ammunition, migrants, black market fuel, and other illicit goods. The group also oversawfinancial networks and cellsoperating in Kenya, Uganda, Tanzania, and South Africa.

Cryptocurrencyemerged as an increasingly important mechanism for IS-S to move funds and fund activities, while individuals associated with the group have been linked to investigations of terror-related financial activity ononline gaming platforms.Gold smugglingand trafficking also emerged as a revenue source for IS-S.

Puntland regional security forces with U.S. counterparts on a counterterrorism operation in the mountainous areas of the Bari Region. (Photo: horseedmedia)

IS-S’s local revenue generating and other operational capabilities have beensignificantly degradedbyOperation Hilaac(Lightning)—the joint operation between Puntland State, other local allies, and international partners such as the United States launched in December 2024. The operation has also resulted in thecaptureof key IS-S figures responsible for its extortion and financial operations. Nonetheless, IS-S has demonstrated signs of amodest resurgenceand retains somecapacity for revenue generationthat warrants close monitoring.

Given the increasingly transnational nature of al Shabaab and IS-S’s financial networks, effective counterterrorism efforts will depend on enhanced regional cooperation to identify, disrupt, and dismantle terrorist financing networks.

Countries worldwide are responsible for establishing a financial intelligence unit (FIU) for receiving, analyzing, and disseminating financial intelligence consistent with the Financial Action Task Force (FATF), the international standard-setting body for the AML/CFT framework. All East African governments have made meaningful strides in operationalizing FIUs and integrating them into broader counterterrorism and AML efforts followingFATF Recommendation 29and Article 14 of theUnited Nations Convention against Corruption (UNCAC).

While FIUs are national-level institutions, they cooperate extensively with regional and international networks. This includes the Eastern and Southern Africa Anti-Money Laundering Group (ESAAMLG), a FATF-style regional body that promotes implementation of international AML/CFT standards through mutual evaluations, technical assistance, training, and regional cooperation. Efforts have also been made to improve cooperation and intelligence-sharing between national FIUs in line with best practices established by the Egmont Group, a global network of more than 170 FIUs. FIUs in the region also coordinate with the United Nations Office on Drugs and Crime (UNODC) to strengthen regional and international CFT collaboration.

Reports submitted to financial intelligence units often lack actionable details.

However, challenges persist. Reporting suspicious transaction reports (STRs) to FIUs by banks, money service providers, and other regulated entities, depending on the country’s laws, remainsinconsistent and insufficient. STRs submitted to FIUs often lack actionable details or arrive too late to support timely assessment and dissemination of intelligence to support investigations.

Reporting compliance among a wide range of money service businesses remains loose, particularly among businesses and professionals outside the traditional financial sector that are legally required to submit STRs. Contributing factors include limited training on what constitutes a suspicious transaction, fear of regulatory scrutiny or liability leading to “defensive reporting,” and weak supervisory oversight in environments where financial transparency and regulatory oversight remain underdeveloped. In many cases, institutions file reports solely to meet legal requirements or fail to report at all.

In other cases, FIUs’ capacity is constrained byinstitutional fragmentation, overlapping mandates, and low trust between agencies. These have implications on the extent to which FIUs coordinate with relevant intelligence and law enforcement bodies, especially when other agencies possess their own dedicated financial investigation units and maintain principal responsibility over all counterterrorism matters. Gaps intechnological tools and analytical capacityfurther hinder the ability of FIUs to process STRs effectively, reducing their utility to other investigative agencies, such as law enforcement bodies.

Even where FIUs are coordinating well with other agencies and are producing and disseminating actionable intelligence, such as in Kenya,action to seize assets and initiate enforcement measures can remain uneven, thereby limiting the operational impact of financial intelligence. These challenges underscore the difficulty of translating financial intelligence into sustained enforcement action.

Tools and laws designed for more formal economies are often ill-suited to conflict-affected environments.

The pace at which financial transactions have evolved from traditional cash systems to decentralized digital financial ecosystems has also outpaced existing regulatory frameworks and traditional investigative methods. These digital platforms and assets includemobile money platformsand digital wallets,cryptocurrencyexchanges and blockchain transactions, andonline gambling platforms, all of which groups like al Shabaab and IS-S have exploited.

Meanwhile, AML/CFT tools and laws designed for more formal economies are oftenill-suited to conflict-affected environments. This is particularly the case in contexts that rely heavily on informal financial systems, where financial literacy concerning illicit finance is low, and coercion by armed groups undermines compliance, such asSomalia. Identifying and freezing assets of sanctioned individuals is also challenging where civil registries are weak, inconsistent, or easily manipulated.

As groups such as al Shabaab and IS-S increasingly adopt digital mechanisms to raise, conceal, and move funds, financial intelligence and investigative teams are beginning to incorporate open-source intelligence (OSINT), blockchain analytics, machine learning, and artificial intelligence (AI) into financial intelligence (FININT) and counterterrorism financing investigations. The growing use of digital platforms and financial services generates extensive digital trails, while the broader digital ecosystem exploited by terrorist groups for recruitment, propaganda, operations, and communications produces large volumes of publicly available information. By systematically collecting and analyzing these data, OSINT enables analysts and investigators across FIUs, law enforcement agencies, and intelligence services to identify, corroborate, and contextualize suspicious financial activity.

The broader digital ecosystem exploited by terrorist groups for recruitment, propaganda, operations, and communications produces large volumes of publicly available information.

AI and machine learning tools further enhance these capabilities. These tools can enable analysts to rapidly collect, process, and synthesize large volumes of data, particularly in resource-constrained settings with small analytic teams. However, their greatest value lies in their integration with other intelligence disciplines to produce a more comprehensive picture of terrorism financing networks, underscoring the importance of multiagency coordination and intelligence fusion. These efforts can be facilitated throughfusion centers—interagency mechanisms that bring together information, intelligence, expertise, and capabilities from multiple government entities to develop a shared understanding of threats, support early warning, inform decision-making, and enable coordinated operational responses.

Although adoption across East Africa remains uneven, regional institutions and international bodies, including the East African Police Chiefs Cooperation Organization’s (EAPCCO) Counter-Terrorism Centre of Excellence, INTERPOL’s Regional Bureau for Eastern Africa, and national-level bodies in Ethiopia, Kenya, Tanzania, and Uganda, have also made efforts to incorporate OSINT capabilities into their capacity-building initiatives. Some are also activelybuilding partnerships with the private sectorto strengthen analytic capabilities and improve real-time financial intelligence in support of counterterrorism objectives. Despite the significant potential of OSINT, AI, and machine learning, efforts to leverage them continue to be constrained by the lack of required technologies, inconsistent investment in human expertise, andother significant capacity gaps.

Military intelligence has played adecisive role in identifying and disrupting terrorism financing networks, particularly in conflict-affected regions. This is evidenced by the July 2025 capture of Abdiweli Mohamed Aw-Yusuf (Walalac), head of IS-S’s Finance Department.

Military forces operating in conflict zones and border areas, however, often lack the training protocols forevidence collection, chain of custody, and interagency transfer. This results in gaps in identifying individuals involved in terrorism financing, as well as preserving and transferring evidence to the relevant civilian authorities for terrorism financing investigations, asset forfeitures, and ultimately successful terrorism prosecutions.

Coordination between FIUs, law enforcement agencies, intelligence actors, prosecutors, and even private sector stakeholders across East Africa is improving.Kenya, for instance, has institutionalized interagency guidelines for cooperation and collaboration in the investigation and prosecution of terrorism financing. These guidelines link the Anti-Terrorism Police Unit (ATPU) with the Financial Reporting Centre (Kenya’s FIU), and the Office of the Director of Public Prosecutions (ODPP). Kenya’s Financial Reporting Centre alsoleverages its partnershipswith the Directorate of Criminal Investigations and the Asset Recovery Agency to deploy multiagency financial crime units to the country’s borders to combat money laundering.

Criminal Investigative Directorate building in Garowe, Somalia. (Photo: Garowe Online)

Somaliahas also made notable strides. Federal law enforcement bodies have improved information sharing with key counterparts, such as the Financial Reporting Centre (Somalia’s FIU), the National Intelligence and Security Agency, the Attorney General’s Office, the Central Bank, and the Ministry of Justice.Uganda, likewise, has made efforts to reinforce collaboration between the Financial Intelligence Authority (Uganda’s FIU), law enforcement investigators, and prosecutors in terrorism financing cases.

Regional bodies, with support from external partners, have also launched a range of workshops and training initiatives to strengthen national investigative and multiagency mechanisms as well as regional cooperation. Thesecapacity building initiativesconvene investigators, prosecutors, judges, financial intelligence analysts, and other practitioners from across the region to build skills in blockchain analytics, virtual asset investigations, the preservation of electronic evidence, the preparation of mutual legal assistance requests, the conversion of digital intelligence into admissible evidence, and the effective presentation of virtual assets and other digital evidence in court.

Nonetheless, investigations continue to struggle with inefficiencies in collecting, organizing, processing, and sharing evidence. In some instances, this stems from the ongoing reliance on manual, paper-based procedures and the absence of standardized digital case management systems,as can be seen in the case of Somalia. Training gaps also persist, especially in specialized areas such as digital financial crime investigations, advanced forensics, and the handling of cryptocurrency or other forms of digital evidence despite ongoing capacity building initiatives. Furthermore, the investigative and judicial pipeline frequently breaks down due to weak standard operating procedures for recording and transferring evidence.

Unlike traditional law-enforcement-led approaches that typically involve prosecutors later in the investigative process, prosecution-led investigations engage prosecutors from the outset. Doing so ensures proper collection, preservation, documentation, and transfer of evidence to meet admissibility standards in court. Thesuccessful prosecutionof the individuals involved in the 2019 DusitD2 attack in Nairobi, Kenya, illustrates theeffectiveness of prosecution-led investigations. In that case, the ODPP and the ATPU collaborated closely with regional and international partners to trace the digital evidence and financial transactions that enabled the attack, ultimately leading to the conviction of two suspects on charges of conspiracy to commit a terrorist act and facilitation of a terrorist act.

Despite this progress,cases like the DusitD2 remain the exception. The admissibility of digital evidence, including electronic communications and digital financial transactions, continues to be problematic, largely due to unclear and inconsistent procedures for collecting and handling such evidence. Lengthy prosecution timelines also hinder justice, with mutual legal assistance requests often delayed by diplomatic and bureaucratic hurdles. This forces prosecutors to rely on informal channels for timely information sharing. Additionally, investigators frequently lack adequate training to effectively use financial intelligence provided by FIUs and convert it into prosecutable evidence, limiting the overall effectiveness of terrorism-financing prosecutions.

Regional and continental bodies—such as the EAPCCO, East African Community (EAC), Intergovernmental Authority on Development (IGAD), ESAAMLG, African Union Mechanism for Police Cooperation (AFRIPOL), The African Union Counter Terrorism Centre (AUCTC), and the Committee of Intelligence and Security Services of Africa (CISSA)—haveinvested in efforts to enhance national and cross-border capabilitiesto counter terrorism financing. With support from INTERPOL, UNODC, UNOCT, and other international partners, these organizations are supporting capacity building, training, operational coordination, and joint actions to disrupt terrorist networks and their facilitators.

An EAPCCO meeting in Kigali, March 2026. (Photo: RIB)

Working closely with one another, INTERPOL, SARPCCO and EAPCCO have provided training on financial investigations, including joint sessions for law enforcement agencies and FIUs. AFRIPOL has coordinated successful joint operations across West, Central, and Eastern Africa, resulting in the arrest of key terrorist operatives and facilitators. ESAAMLG continues to strengthen FIUs, improve their ability to analyze suspicious transactions related to terrorism, and train investigators to convert financial intelligence into prosecutable evidence. ESAAMLG has also partnered with other FATF-style regional bodies (FSRBs), such as the Action Group Against Money Laundering in Central Africa (GABAC) and the Intergovernmental Action Group against Money Laundering in West Africa (GIABA), to foster cross-regional coordination.

Despite this progress, technical assistance remains fragmented with limited interoperability across platforms and institutions. Different international partners provide technologies and training with limited coordination, resulting in parallel or even contradictory investments. Coordination between regional initiatives can also be inconsistent, and duplication of efforts remains a challenge.

Despite notable advancements in strengthening countering terrorism financing in East Africa, terrorist groups like al Shabaab continue to adapt and exploit institutional gaps. To further disrupt the financial lifelines that sustain terrorist groups, an enhanced multisectoral approach involving FIUs, law enforcement, military, prosecutors, judges, as well as regional and international partners is needed.

Analysts, investigators, and prosecutors from across the region should receive ongoing, practical training.

More on:Countering Violent Extremism in Africa

Based on reporting by ACSS