Europol ¦ ATLAS Network - 2026 Annual Activity Report

Counter-terrorism cooperation highlights the financial intelligence behind organised crime

European counter-terrorism cooperation is increasingly shaped by a threat environment in which terrorism, serious organised crime and hybrid risks overlap. While tactical preparedness is essential, effective disruption also depends on tracing the money that enables attacks, sustains criminal networks and conceals the proceeds of predicate offences.

The ATLAS Network brings together 38 Special Intervention Units from EU Member States and associated countries, representing approximately 4,000 operators. In 2025, its members organised 50 activities across 33 countries, involving more than 1,500 operators. The network’s work focuses on cross-border interoperability, shared expertise, joint training and the ability to provide assistance when a national unit lacks the resources or capability required for a major crisis.

For financial crime investigators, this model illustrates an important principle: operational cooperation and financial intelligence must develop in parallel. A hostage-taking, terrorist attack, weapons incident or organised crime operation may be the visible endpoint of a much broader criminal structure. The financial investigation can reveal how that structure was established, funded and maintained.

The predicate offense remains the starting point

Money laundering cannot be assessed in isolation from the underlying criminal conduct. Investigators must first identify the predicate offense, or the criminal activity that generated the property being laundered. In the context of terrorism and serious organised crime, possible predicate offenses may include terrorist acts, participation in a terrorist organisation, arms dealing, extortion, fraud, corruption, drug trafficking, migrant smuggling and other serious offences, depending on the applicable national law.

The same network can generate proceeds through one offense and use them to support another. A group may obtain funds through fraud or illicit trade, transfer part of those funds through apparently legitimate businesses and then use the resulting assets for recruitment, logistics, weapons, travel or attack planning. The laundering process can therefore obscure both the origin of the money and its ultimate purpose.

This creates a dual investigative task. Authorities must establish the criminal source of assets while also determining whether the funds were intended to facilitate terrorism or another serious offence. The distinction matters because terrorist financing does not always involve criminal proceeds. Lawful income, donations or business revenue may also be diverted to support terrorist activity. An absence of obvious illicit proceeds does not, therefore, exclude a terrorism financing concern.

Bastian Schwind-Wagner _Follow

"European counter-terrorism cooperation shows why financial intelligence must be integrated into operational investigations. Identifying the predicate offense, tracing the movement of funds and distinguishing money laundering from terrorist financing can expose the wider networks behind violent incidents and organised crime.

Cross-border cooperation is essential because criminal assets, facilitators and evidence often span several jurisdictions. Joint exercises, timely information exchange and asset recovery measures can help prevent the dissipation of funds and weaken the financial capacity of criminal and terrorist organisations."

Tactical incidents can expose financial networks

Special intervention operations often arise from events that appear primarily physical or security-related. Yet the facts uncovered during an intervention may have direct financial significance. Digital devices, identity documents, cash, business records, vehicles and communications equipment can provide leads to wider financial activity.

A maritime incident, for example, may reveal links to vessel ownership, charter arrangements, fuel purchases, port services or cross-border logistics. An operation involving public transport may expose fraudulent ticketing, forged documents or the movement of criminal assets. A building intervention may produce evidence of shell companies, cash storage, informal value transfer arrangements or records of payments to intermediaries.

The financial investigation should begin as early as operationally possible. Asset preservation, rapid access to financial intelligence and coordinated evidence handling can prevent the dissipation of funds and improve the prospects of identifying additional suspects. This requires close cooperation between tactical teams, investigators, prosecutors, financial intelligence units (FIUs), customs authorities and asset recovery specialists.

Cross-border cooperation reduces opportunities for concealment

Criminal proceeds move through jurisdictions because fragmentation creates delay, uncertainty and evidential gaps. A suspect may reside in one country, operate a company in another, hold an account in a third and use assets located elsewhere. Terrorist facilitators can exploit the same structural weaknesses, particularly when small-value transactions are dispersed across several individuals or payment channels.

A legally grounded framework for mutual assistance between specialised law enforcement units can support more than the immediate response to a security incident. It can also improve the speed with which authorities identify relevant records, preserve evidence and connect operational findings with financial intelligence held in another country.

The integration of the ATLAS Support Office within Europol’s European Counter Terrorism Centre provides an institutional link between specialised intervention units and broader law enforcement expertise in terrorism and serious organised crime. From a financial crime perspective, such links are valuable because they can connect tactical intelligence with analytical assessments, international information exchange and established channels for cooperation.

Operational cooperation must, however, remain subject to national mandates, data protection requirements and applicable rules governing the exchange of sensitive information. Speed is important, but the reliability, legality and evidential value of shared intelligence are equally critical.

Exercises should include the financial dimension

Large-scale exercises traditionally focus on command and control, crisis response, medical support, transport, aircraft, buildings and maritime environments. These capabilities are indispensable, but exercises can also test the financial intelligence chain that follows a major incident.

A realistic scenario should examine how authorities identify the predicate offense, trace the financing, secure financial evidence and begin asset recovery. It should test whether investigators can obtain timely information about bank accounts, payment service providers, virtual assets, company ownership, property, vehicles and high-value goods. It should also address how financial intelligence is shared with operational commanders without compromising sensitive sources or ongoing investigations.

Exercises involving terrorist incidents should distinguish between funding and laundering. The question is not only whether money came from criminal proceeds. Authorities must also ask whether apparently legitimate funds were collected, transferred or spent for a terrorist purpose. This requires attention to transaction patterns, personal networks, recruitment activity, communications and the use of intermediaries.

The involvement of networks specialising in explosives, aviation security, surveillance, air marshals and other operational capabilities can strengthen this approach. Each network may hold a different part of the picture. Combining those perspectives with financial analysis can help identify the infrastructure supporting a threat before it develops into an attack.

Technology creates both investigative opportunities and risks

The network’s work on unmanned aerial and ground vehicles, reconnaissance, detection and countering hostile unmanned aircraft reflects the growing role of technology in security operations. Technology is equally important on the financial side.

Criminal and terrorist actors can use digital payment services, virtual assets, online fundraising, encrypted communications, fraudulent identities and automated tools to move or conceal value. They may also exploit legitimate platforms and commercial services that were not designed to identify sophisticated criminal activity.

Financial institutions and payment firms should therefore consider operational indicators alongside conventional transaction monitoring. A payment pattern may become more significant when linked to travel, procurement, equipment acquisition, known associates or activity connected with a security incident. Information from law enforcement can help explain those links, while financial data can help investigators identify facilitators who are not present at the operational scene.

The use of technology also raises evidential and governance issues. Data must be collected lawfully, preserved securely and interpreted carefully. Automated alerts are useful for identifying anomalies, but they do not by themselves establish a predicate offense or terrorist purpose. Human analysis remains necessary to distinguish suspicious activity from legitimate cross-border commerce, charitable activity or emergency response.

Asset recovery should follow operational disruption

An intervention that arrests suspects or prevents an attack is only one stage of the response. If criminal assets remain available, the network may regenerate, replace its personnel and continue its activities through new channels.

Financial investigations should therefore continue after the immediate threat has been contained. Authorities should identify property, vehicles, businesses, accounts, cash, virtual assets and other forms of value connected to the suspected offense. Provisional measures may be necessary to prevent dissipation while the underlying case is developed.

Asset recovery also strengthens deterrence. Confiscation removes the resources required to recruit members, purchase equipment, pay facilitators and maintain safe locations. In organised crime cases, it can be more disruptive than the arrest of individual operatives because it targets the economic capacity of the network.

The legal basis for confiscation will depend on the jurisdiction and the facts of the case. Investigators must maintain a clear connection between the assets, the suspect and the predicate offense, while prosecutors must be prepared to present evidence that can withstand scrutiny in court.

A broader security model for financial crime professionals

The experience of European special intervention cooperation offers a wider lesson for the financial crime community. Money laundering and terrorist financing are not separate from physical security. They are often part of the same criminal ecosystem.

The predicate offense may be a violent act, a financial fraud, an arms transaction or another form of serious organised crime. The laundering activity may take place through businesses, cash, informal networks or digital services. The operational response may involve specialised police units, while the financial response requires banks, payment firms, financial intelligence units (FIUs), tax authorities, customs and prosecutors.

Effective prevention depends on connecting these capabilities before a crisis occurs. Joint exercises, trusted information channels, common procedures and clear legal frameworks can improve both the operational response and the financial investigation.

The central objective is not simply to identify suspicious money. It is to understand what the money represents, which criminal activity generated or directed it, who controls it and how removing it can weaken the wider threat.

Dive deeper

• Europol ¦ ATLAS Network - 2026 Annual Activity Report ¦ Link