Since the US withdrawal from Afghanistan in August 2021, the Islamic State in the Khorasan Region (ISKP) has formed the main domestic opposition to Taliban rule. Despite the best efforts of the Taliban’s ongoing counter-insurgency campaign, ISKP carries out regular domestic acts of terror, and has been identified by the United Nations Security Council (UNSC) as a destabilising actor within the country.

ISKP’s most recent high-profile attack was on Kabul Airport, during the US evacuation of Afghanistan in 2021. The Islamic State’s official Amaq news agency reported that one of its members, Abdul Rahman al-Logari, was responsible for a suicide bombing which killed 13 U.S. troops and as took the lives of as many as 170 civilians. This was the first time in nearly two years that any American soldier had been killed in an armed attack in Afghanistan, and the incident gave international attention to the then little known off-shoot of the ‘Islamic State’.

Two years later, there appears to be mounting concern amongst the US intelligence community and other policy makers that ISKP will be able to conduct terror operations outside Afghanistan in the near future. US Army General Michael Kurilla warned Congress in March 2023 that the group could launch external operations against US and European targets with “little to no warning” in less than six months. That puts the West on track for a potential terror attack by the end of the year. Of course, many intelligence communities have a habit of over-stating threats in times of budget constraints, but this article hopes to examine the degree that such a threat from ISKP is at all credible.

Whilst most of the world’s focus has been diverted to examining and responding to state-on-state violence following Russia’s full-scale invasion of Ukraine, the UN’s Analytical Support and Sanctions Monitoring Team have been working in the relative shadows in order to dissect the global networks that keep Islamic State hubs financed and, as such, able to carry on their prolific Improvised Explosive Devices (IED) attacks. The UN’s findings seem to indicate that ISKP is a net-benefactor of these international networks, with IS hubs around the world routinely sending funds to Afghanistan. 

Kidnap-for-ransom, smuggling and extortion continue to be lucrative revenue streams for ISKP, but the group is reported to rely largely on its fellow hubs for financial support. Cryptocurrency has been used to transfer funds to ISKP, albeit on a relatively small scale, with the main route for illicit funds flowing – as has been well established with other non-state group funding channels – through the ‘hawala’ money transfer networks that have existed in Afghanistan and the Middle East for centuries. As the armed capability of ISKP grows, so too will engaged states seek to dismantle their financial networks and starve them of the resources needed to commit acts of terror.

Background

The US Treasury Department reported that the formation of ISKP came in 2015, after the Pakistani national Hafiz Saeed Khan was given the task of creating a base for Islamic State operations in Afghanistan. As the Islamic State of Iraq and Syria suffered territorial defeats, with its eventual collapse in 2017, the leadership increasingly turned to Afghanistan as the new centre for its global caliphate.

However, a major stumbling block for ISKP’s ambition has been the Taliban’s sustained opposition. Since its inception, ISKP has been fighting the Taliban. This is partly because they move within similar ideological waters; both following in the footsteps of the Sunni jihadist tradition, with the aspiration of creating a caliphate governed by their interpretation of sharia law. 

There are, however, ideological nuances between the two groups which fuel their inter-group violence. For example, ISKP opposes the trade in heroin and opium which the Taliban have profited from for decades. They view the use and/or sale of drugs as ‘haram’ or ‘forbidden’. This position reportedly led to a flare-up in violence between the two groups in 2017, when ISKP arrested three Taliban backed opium dealers in the northern Afghan province of Jowzjan. 

ISKP has some success in recruiting disaffected Taliban fighters, but they remain a relatively small presence within Afghanistan. The United Nations Security Council suggests that ISKP has between 1,000 and 3,000 active fighters in the country, compared to the estimated 60,000 at the disposal of the Taliban. Despite this gap in capability, IS-Core leadership see Afghanistan fertile soil for future operations.

Indeed, today ISKP is the coordinating centre for all Asia operations. As noted, they have become the “net-beneficiary” of Islamic State’s international financial networks, with many regional hubs diverting resources to Afghanistan. The UN’s monitoring team’s latest report showed that IS’s Al-Karrar Office, which is based in Puntland, Somalia, routinely sent money to ISKP; and the recent killing of Al-Shabaab financier, Bilal Al-Sudani, by US special forces was partly because of his role in helping transfer funds to Afghanistan.

What these transfers show is a reprioritisation within IS-Core’s strategy. Gone are the days of a quasi-state in Syria and Iraq, but in Afghanistan the IS leadership see a haven from which to conduct international terror. In July 2023, ISKP was responsible for the suicide bombing that killed 54 people in the Khyber Pakhtunkhwa Province, in Pakistan, and the UN’s Security Council (UNSC) has revealed that the group has threatened to attack Chinese, Indian and Iranian embassies. With IS-core seeing Afghanistan as the future operating base for not just Asia but globally, members of the intelligence and security services like General Kurilla are reported to be expecting more threats to civilians coming out of Afghanistan.

ISIS Funding in the Past

The Islamic State of Iraq and Syria, which at its height in 2015 controlled large swaths of territory, could rely on many of the revenue streams typical of a state entity. These revenue sources included ‘taxation’ (or rather extortion) of the local population, custom tolls, smuggling rights and profits from natural resources. This last revenue source was historically a big contributor to Islamic State’s coffers. It has been calculated that during Islamic State’s height in Iraq and Syria, the group’s revenues from the sale of oil and refined oil products alone ran at $40 million per month.

Apart from these traditional sources of income, the Islamic State had also turned to more illicit practices including kidnap-for-ransom and outright theft. However, the most historically and culturally damaging income streams came from the sale of antiques. In the early days of the Islamic State, the sale of artefacts was endemic; Iraqi Intelligence estimated that the group was making up to $100 million per year through the illicit sale of such antiquities alone. 

Most of the artefacts and antiquities looted by Islamic State were smuggled into neighbouring countries, and then passed through “middle-men”, and then sold into Western markets. This has meant that items stolen from Iraq and Syria are, today, often found in private auctions across the continent – with London being a prime location. 

Much of the territory that ISIS held in Iraq and Syria was lost by 2017, and with it access to the lucrative revenue streams from oil, taxation and the sale of antiques. UNSC still estimates that Islamic State has reserves of around $25 million, but with that comes substantial liabilities including fighter pay, compensation to the deceased or imprisoned fighters and other operational costs.

ISKP Financing Today

The decline in IS-Core’s reserves has meant a shift to a “regional hub-and-spoke” system, whereby regional hubs take on more responsibility for their finances and pool resources with other hubs around the world. The Al-Karrar Office in Somalia, for example, was found to be sending $25,000 worth of crypto currency per month to Afghanistan in a sign of the growing importance of ISKP within this global network.

International transfers come with its own risk, and IS financiers have taken advantage of new technologies, like cryptocurrencies, to facilitate money transfers across borders. Project CRAAFT’s review of blockchain analytics shows that donations being made to ISKP’s media units were made in the form of Bitcoin, Ethereum and TRX cryptocurrencies, in a show of greater sophistication within the group’s “financial tradecraft”. 

These crypto-transfers appear to be still on a relatively small-scale, partly because the technology is still relatively new, but also because crypto-currencies have their own challenges. ISKP financiers need to convert virtual currency from their online wallets into hard cash. This has been made all the harder following the Taliban’s nation-wide ban of digital currencies in August 2022, which has seen some crypto-traders arrested by the authorities.

However, it is likely crypto-transfers will continue to be a feature of ISKP financing in one form or another. There is a reportedly persistent appetite for crypto-currencies within Afghanistan, with some analysts suggesting that usage has “mushroomed” since the Taliban’s takeover. This is because cryptocurrencies are seen as relatively safe, and with this demand comes a willingness of some money traders to disregard the threat posed by the Taliban and continue facilitating the conversion of digital currencies into cash. This is a reality that ISKP will no doubt continue to exploit in the future.

Traditional revenue streams still remain in use. Chief among these being local donations, extortion, kidnap-for-ransom and, to a lesser extent, profits from natural resources. This is because much of the natural resources available to ISKP were lost after the Taliban took control of their southern Nangarhar stronghold in 2019. The group looked to recoup its losses by exacting tolls on farmers and businesspeople in the Kunar province, in a sign that traditional extortion methods continue to be a mainstay of ISKP funding – especially in times of crisis.

When it comes to transferring funds domestically and abroad, it is the ‘hawala’ system that Islamic State financiers used the most. The hawala system has existed for centuries, and is an informal network of brokers who transfer money with little-to-no regulation. In its simplest form, hawala is a series of middle men that can provide cash or make purchases on your behalf. For this service, these hawala middle men will charge a small fee. In a country like Afghanistan, where there are few banks available, the hawala system is a more reliable way for the general population to make transfers, complete purchases and obtain cash on a day-to-day basis.

However, these hawala networks are open to abuse because of the lack of regulation and ease in which money can be transferred anonymously. In countries like India, hawala is illegal because of its role in tax evasion and funding terrorism. Evidence from the US Treasury and the UNSC shows that ISKP follows in that tradition, routinely making use of the hawala networks, particularly in Kabul and Jalalabad, to transfer money across Afghanistan. It is an opaque system, which is the perfect avenue through which illicit funds can flow.

The hawala system is also the bridgehead through which ISKP can get funds out of Afghanistan, and into neighbouring jurisdictions like Turkey, Pakistan, and the UAE. These funds are used to purchase businesses, property and other assets. By integrating illicit capital into the legitimate economy, ISKP can wash funds and guarantee the longer term financial stability of its operation within Afghanistan and abroad.

The US Treasury Department recently sanctioned Ismatullah Khalozai for his use of the hawala system in Turkey in transferring funds to-and-from ISKP. These informal networks are highly effective in allowing international terrorist organisations to move capital in relative anonymity across borders. 

Encouraging greater cooperation with these neighbouring jurisdictions is important in stopping the flow of international funds relating to terrorism. More needs to be done in making the hawala system, particularly in Dubai, more transparent, which would go a long way in making it more difficult for illicit funds to co-mingle with the vast quantities of remittances and trade from Afghanistan and the broader region.

Conclusion

The topic of global terrorism is, today, increasingly out of vogue in the West. Twenty years of war in Afghanistan has left the public and policy makers fatigued with the subject, and attention has been refocused to violence between state actors following Russia’s full-scale invasion of Ukraine and the recent flare up of violence in Israel and Gaza.

But the reality is that whilst global terror may have taken a backseat in the news agenda, it continues to be pervasive across the world, and the ways in which terror networks are financing themselves are changing too.

The Islamic State in the Khorasan Region poses a growing risk to the international community. They are the net-beneficiaries of IS-Core’s financial networks, and the leadership look to Afghanistan as the future base of their operations. With the withdrawal of US forces from Afghanistan, the West has become increasingly reliant on the Taliban to conduct ground operations against ISKP. There is no acknowledged co-operation or intelligence sharing between the US and the Taliban, and so the approach remains disjointed.

What is clear is that for the wider and global protection of civilians from future ISKP attacks, more must be done to dismantle the financial networks that keep ISKP and other Islamic State regional hubs operating. Over the last three years, the UN monitoring team has seen ISKP using new technologies like cryptocurrencies alongside the hawala money transferring networks that have been around for centuries. The international community will need to show just as much ingenuity if they are to stop the flow of illicit funds in and out of Afghanistan, and deprive ISKP of the financial avenues that it relies on to funds in terror operations.

A failure to do so will, AOAV believes, invariably lead to more civilian deaths from suicide attacks, attacks funded by the gains from these often elusive funding channels.

Did you find this story interesting? Please support AOAV's work and donate.
Donate