UN ¦ CTED’s Latest Trends Report Examines the Evolution of Terrorist Propaganda

Terrorist propaganda has become financial infrastructure

Terrorist propaganda is not limited to ideological messaging, recruitment videos or claims of responsibility. It increasingly functions as operational infrastructure – connecting narrative, recruitment, fundraising, governance and attack planning within a single adaptive system.

This shift has important implications for financial crime prevention. Propaganda can create the trust, legitimacy and sense of belonging needed to turn passive audiences into donors, facilitators and financial intermediaries. It can also provide practical instructions for transferring funds, promote virtual asset wallets and conceal fundraising appeals within apparently humanitarian, political or community-oriented messages.

For financial intelligence units, law enforcement agencies and regulated firms, the central question is therefore not simply whether content expresses support for terrorism. It is whether the surrounding ecosystem enables money to be raised, transferred, stored or used for terrorist purposes.

The predicate offense behind the propaganda

Terrorist financing is the principal financial crime concern. The underlying predicate conduct may include terrorist attacks, kidnapping, extortion, robbery, trafficking, fraud, sanctions evasion, unlawful taxation and the exploitation of charitable or humanitarian channels. Funds can also originate from lawful income or donations before being diverted to terrorist activity.

Propaganda helps bridge the gap between the predicate offense and the financial system. A group may use violence, extortion or illicit taxation to generate proceeds, then use media channels to portray those activities as legitimate governance or community protection. Conversely, it may use ideological content to solicit donations from supporters who believe they are assisting humanitarian relief, prisoners’ families or displaced communities.

This creates a laundering risk even where the initial funds are not criminal proceeds. Terrorist financing does not require funds to originate from an unlawful source. The decisive issue is the intended use of the money. A lawful donation, salary, business revenue or crowdfunding contribution can become terrorist financing once it is knowingly or recklessly directed towards a terrorist organization, facilitator or attack.

Bastian Schwind-Wagner _Follow

"Terrorist propaganda has evolved into operational infrastructure that supports recruitment, radicalization, fundraising and the movement of funds. By combining ideological messaging with cryptocurrency appeals, gaming platforms, private online communities and AI-enabled outreach, terrorist actors can build trust, attract donors and conceal financial activity across jurisdictions.

Financial crime controls must therefore assess propaganda alongside transaction data, customer profiles and network connections. A risk-based response should identify links to predicate offenses such as extortion, trafficking, unlawful taxation and fraud, while strengthening cooperation among financial institutions, virtual asset providers, technology platforms, financial intelligence units and counter-terrorism authorities."

Propaganda as a trust mechanism for terrorist financing

Terrorist organizations need more than payment tools. They need credibility. Donors must believe that a campaign is genuine, that the recipient is connected to the cause and that the contribution will be used as promised. Propaganda supplies that credibility by presenting the group as disciplined, effective and socially embedded.

Media products can celebrate territorial control, distribute statements from leaders, show service provision and highlight perceived abuses by State authorities. These narratives can make a terrorist organization appear to be a political movement, security provider or community institution. Financial support can then be framed as an act of solidarity rather than a contribution to terrorism.

This trust function is particularly significant in decentralized networks. A central organization may publish the narrative, while affiliates, supporters and local intermediaries raise or move funds through separate channels. The relationship between the donor and the ultimate beneficiary can therefore be obscured by layers of online communities, informal representatives and payment facilitators.

Virtual assets and embedded fundraising appeals

Terrorist groups have used digital propaganda to publish cryptocurrency addresses, QR codes and payment instructions. Such appeals can be placed directly within newsletters, videos, social media posts or encrypted communications. The financial request may be brief, but its effect is amplified by the surrounding narrative and the apparent authority of the channel.

Virtual assets can offer speed, cross-border reach and access to payment infrastructure outside traditional banking relationships. Privacy-enhancing coins, mixers, unhosted wallets and peer-to-peer transfers may create additional challenges, although the level of anonymity varies by asset, service and transaction pattern.

The presence of a wallet address alone does not establish terrorist financing. However, it may become highly significant when combined with indicators such as terrorist branding, repeated donation requests, references to operational needs, instructions to avoid detection, links to designated entities or transfers involving known facilitators. Blockchain analysis can help identify exposure, but it must be combined with open-source intelligence, sanctions screening, device evidence and transaction context.

Gaming platforms and alternative payment channels

Gaming platforms, streaming services and private online communities create a particularly complex environment. They combine real-time communication, social interaction, virtual goods, donations, subscriptions and in-game purchases. These features can support recruitment and fundraising within the same community.

Small-value transactions are not necessarily low risk. Microtransactions can be used to test payment routes, distribute funds across numerous accounts or make financial support appear routine. In-game economies may also provide methods for transferring value through purchases, gifts or virtual items. The commercial relationship between a platform, a user and a payment provider can make it difficult to identify the ultimate purpose of a transaction.

For financial crime teams, this requires attention to payment behaviour rather than only transaction size. Relevant patterns may include repeated low-value payments to newly created accounts, unusual concentration of donations among members of a closed community, rapid movement between payment services and virtual asset platforms, or links between online fundraising activity and sanctioned individuals or terrorist content.

Artificial intelligence increases scale and targeting

Artificial intelligence is making terrorist propaganda faster to produce, easier to translate and more precisely targeted. Generative tools can help create multilingual appeals, personalized messages and visually polished campaigns at low cost. This may allow terrorist actors to reach diaspora communities, exploit local grievances and engage potential donors in languages that were previously difficult to support.

The financial effect is significant. A fundraising campaign can be adapted to different audiences, with separate narratives emphasizing religion, ethnicity, political grievances, humanitarian concerns or personal identity. Automated or semi-automated engagement can also maintain contact with supporters and direct them towards private channels or alternative payment mechanisms.

AI-generated material should not be treated as suspicious solely because it appears synthetic. The relevant assessment concerns the wider context, including the identity of the publisher, the destination of funds, the narrative used to solicit support, the transaction structure and links to known terrorist networks. At the same time, institutions should recognize that synthetic content may complicate attribution and make it easier for bad actors to imitate legitimate charities, activists or community organizations.

The laundering of terrorist narratives

Terrorist financing risks are closely connected to information laundering. False or misleading claims may begin on fringe platforms, move through private groups and later appear to have independent support after being repeated by multiple accounts. This can make fundraising campaigns appear more credible and reduce the visibility of the original source.

The same process can disguise the relationship between a donor and a terrorist organization. Funds may be solicited through an informal campaign, transferred to a third party and then routed through several wallets, payment services or money transfer channels. Narrative fragmentation mirrors financial fragmentation: no single message, account or transaction necessarily reveals the complete picture.

This is why a narrow focus on individual transactions can fail. A suspicious activity investigation may need to connect online identities, content publication, wallet ownership, payment accounts, sanctions exposure, travel history and known associates. Where lawful and proportionate, information-sharing between financial institutions, technology companies, financial intelligence units and counter-terrorism authorities is essential.

Governance claims can conceal criminal proceeds

In areas affected by conflict or weak State presence, terrorist groups may collect taxes, impose fees, operate checkpoints, control trade routes or provide dispute resolution. They can then publicize these activities as evidence of governance and legitimacy.

From a financial crime perspective, these activities may involve extortion, coercive taxation, unlawful seizure, trafficking and the exploitation of natural resources. Propaganda can help normalize the resulting revenue and encourage businesses or communities to comply. It may also obscure the coercive nature of payments by presenting them as zakat, administrative fees, protection payments or contributions to public services.

Financial institutions and businesses operating in affected regions should therefore assess whether apparently local or commercial payments are connected to territorial control by a terrorist group. Trade finance, remittances, cash-intensive businesses, transport services and commodity transactions may all be exposed, particularly where customers operate near conflict zones or rely on intermediaries with unclear affiliations.

Ideological fluidity complicates detection

Online extremist ecosystems increasingly combine terrorism with misogyny, conspiracy theories, antisemitism, racism, accelerationism and nihilistic violence. Individuals may move between communities without adopting a single coherent ideology. This creates difficulties for traditional monitoring models that rely on fixed labels, known slogans or established organizational structures.

The financial risk is equally fluid. A supporter may not donate to a formally recognized terrorist organization. Instead, funds may be directed to an individual facilitator, a prisoner-support campaign, a media outlet, a family member or an online collective. The purpose may be operational, logistical or propagandistic, and the recipient may use several identities over time.

Effective detection should therefore consider behaviour and network connections alongside ideological terminology. Repeated fundraising, attempts to evade platform controls, links to terrorist media channels, rapid movement of funds and unexplained relationships with high-risk jurisdictions may be more informative than any single expression of belief.

Children and young people are a growing risk factor

Terrorist and violent extremist actors increasingly target children and young people through social media, gaming communities and youth-oriented online spaces. Recruitment can progress from mainstream platforms to closed groups, where propaganda, grooming and fundraising are combined.

Young users may be used as recruiters, payment intermediaries or account holders. Their accounts can provide access to peer networks and may attract less scrutiny. They may also be manipulated into making small payments, accepting transfers, opening digital wallets or purchasing virtual goods on behalf of others.

This creates safeguarding and financial crime concerns at the same time. Investigations should distinguish between intentional participation and exploitation. A minor connected to suspicious payments may be a victim, a coerced intermediary or an unwitting money mule rather than a willing supporter. Responses should combine disruption with child protection, victim support and appropriate referral mechanisms.

What financial institutions should reassess

Financial crime controls should treat terrorist propaganda as a potential risk signal, not merely as a content moderation issue. Institutions should examine how customers use crowdfunding services, payment processors, virtual asset platforms, remittance providers and online marketplaces. They should also assess whether their monitoring systems can identify risks involving small-value, high-volume and cross-border transactions.

Useful risk indicators may include fundraising linked to designated entities or known terrorist media channels, repeated payments to wallets promoted through extremist content, rapid transfers between social media contacts and virtual asset services, unexplained donations to conflict-linked causes, and accounts that receive funds from many unrelated individuals before sending them to a common destination.

No indicator should be viewed in isolation. A risk-based assessment should consider customer profile, geography, source of funds, transaction purpose, online associations and the quality of supporting documentation. Institutions should avoid relying solely on keyword screening, since propaganda is multilingual, coded and increasingly generated or modified by automated tools.

The need for closer public-private cooperation

The convergence of propaganda, terrorist financing and digital services has outpaced many existing legal and analytical frameworks. Content moderation systems may identify terrorist material without detecting the associated financial activity. Financial institutions may identify unusual payments without access to the online context that explains their purpose. Law enforcement agencies may hold intelligence that cannot be rapidly shared with relevant private-sector actors.

A stronger response requires structured cooperation between financial intelligence units, counter-terrorism agencies, regulated firms, virtual asset service providers, payment platforms and technology companies. Information-sharing should focus on concrete typologies, wallet addresses, facilitators, payment routes and emerging fundraising narratives, subject to applicable legal safeguards.

Human rights protections remain essential. Broad surveillance, indiscriminate account closures and poorly defined content restrictions can suppress legitimate expression, humanitarian activity and community advocacy. They may also reinforce the grievance narratives used by terrorist groups. Measures should be lawful, necessary, proportionate, evidence-based and subject to effective oversight.

Propaganda must be analysed as part of the financial crime picture

Terrorist propaganda is increasingly a system for organizing support, money and action. It can create legitimacy, identify donors, distribute payment instructions, conceal the origin of funds and signal operational priorities. Treating it solely as harmful content misses the financial mechanisms that allow terrorist networks to survive and expand.

The most effective response is not to monitor messages in isolation. It is to connect content, conduct and transactions. Financial institutions and public authorities should understand how terrorist narratives generate trust, how that trust is converted into financial support and how funds move through traditional and digital channels.

That approach places terrorist financing where it belongs – within the wider analysis of predicate offenses, network behaviour, digital infrastructure and operational intent.

Dive deeper

• UN ¦ CTED’s latest Trends Report examines the evolution of terrorist propaganda ¦ Link