Terrorist Financing in Mozambique (2017–2025)

Deep Analytic Report – By African Security Analysis (ASA)

Executive Assessment

Terrorist Financing (TF) in Mozambique is systematic, deliberate, and regionally embedded. Between 2017 and 2024, over 458.6 million meticais (~USD 7 million) were mobilized through fragmented deposits, structured withdrawals, and layered transfers across banking and mobile money systems. These flows sustained recruitment, logistics, and insurgent operations in Cabo Delgado.

The September 2025 Gabinete de Informação Financeira de Moçambique (GIFiM) (Mozambique’s Financial Intelligence Unit) analysis demonstrates how insurgents manipulate formal and informal financial channels, while the UN Expert Panel (July 2025) confirms the criminal-terrorist hybridisation of these networks, now incorporating kidnapping-for-ransom and resource exploitation.

Critically, the insurgency in Mozambique, led by Ahlu Sunnah Wal Jama’a (ASWJ), maintains operational and logistical linkages with the Allied Democratic Forces (ADF) in eastern DRC, both under the umbrella of the Islamic State’s Central Africa Province (ISCAP). Evidence indicates exchange of fighters, training, and financing techniques, suggesting a shared resource pool across Mozambique and the Great Lakes region. This regional interconnection raises the threat profile beyond Mozambique, embedding Cabo Delgado within a continental jihadist architecture.

African Security Analysis (ASA) assesses that unless disrupted, Mozambique risks consolidating into a regional hub for terror-crime convergence, with consequences extending across Southern and Eastern Africa.

Strategic Context

1. Conflict Evolution: The insurgency in Cabo Delgado, led by Ahlu Sunnah Wal Jama’a (ASWJ), an affiliate of the Islamic State’s Central Africa Province, has shifted from sporadic raids to a persistent insurgency with hybrid financing models.

2. Regional Trends: The Mozambican case reflects broader African dynamics: jihadist groups sustaining themselves through local illicit economies (Sahel: gold/minerals; Horn: charcoal, livestock; Mozambique: timber, drugs, and mining).

3. Demographics & Recruitment: The UN estimates 300–400 fighters active in Cabo Delgado, nearly half minors under 17, forcibly recruited. This reliance on youth underscores the insurgency’s long-term horizon.

4. Leadership: Since January 2025, the movement has been led by Suleimane Nguvu (Tanzanian), who has stabilized the group despite military pressure.

Modus Operandi of Financing

• Fragmentation & Structuring: Deposits and withdrawals are deliberately broken down into small units to avoid AML/CFT thresholds.
• Channel Dualism: Both banks and mobile money services are exploited. Mobile money provides speed, anonymity, and access in rural zones; banks are used for layering and legitimacy.
• Use of Fronts & NPOs: NPOs, schools, and even public accounts are infiltrated, allowing insurgents to disguise flows as legitimate community or state transfers.
• Cash Dependence: ATMs in border towns (Mocímboa da Praia, Nampula, Beira, Chimoio, Nicoadala) are used for rapid withdrawals. Cash then finances logistics, recruitment, and operational payments.
• Diversification: Funds originate from both licit trade (food, fishing, fuel, mobile commissions) and illicit activities (narcotics, timber, gold/precious stones, arms trafficking).

Geographic Mapping of Flows

• Cabo Delgado (Palma, Mocímboa, Chiúre): recruitment base, ATM withdrawals, and staging ground for insurgent logistics.
• Zambézia (Gurué, Nicoadala, Milange): laundering corridor, with links to mining and agricultural trade.
• Nampula City: commercial hub, also a recruitment and financial redistribution centre.
• Beira (Sofala): significant port city used for imports/exports, doubling as recruitment node.
• Chimoio (Manica): suspected financial hub tied to mining flows.
• Maputo City: less operational but serves as central point for laundering via banks and businesses.
• Regional Links: Tanzania, Kenya, Malawi, DRC—corridors for smuggling, illicit goods, and cross-border remittances.

Actors & Ecosystem

• Local Traders & Entrepreneurs: provide both voluntary and coerced contributions, serving as key financial intermediaries.
• Mobile Money Agents: critical enablers due to weak oversight in conflict areas.
• Public Officials: evidence of insider facilitation—treasury funds diverted to insurgent families.
• Private/Public Enterprises: construction firms, fuel distributors, and state-linked companies implicated.
• NPOs: some charitable and religious structures infiltrated or abused.
• Foreign Facilitators: Tanzanian, Malawian, and Kenyan actors in cross-border smuggling.

Financial Patterns

• Licit: petty commerce, fishing, fuel distribution, mobile commissions.
• Illicit: narcotics trafficking, timber smuggling, illegal mining, arms trading, kidnapping-for-ransom.
• Hybridization: insurgents increasingly combine licit business operations with illicit flows, ensuring resilience.
• New Trend (2025): kidnapping-for-ransom via mobile payments generating ~$3,000/week in mining zones (UN).

Indicators of Suspicion (Early Warning)

• Multiple mobile money accounts with no economic rationale.
• Frequent withdrawals in terrorism-affected districts.
• Large unexplained inflows with no business justification.
• Use of nominees/proxies to disguise beneficiaries.
• Funds channelled through schools and public institutions under insurgent control.
• Treasury funds redirected to relatives of insurgent leaders.
• Abrupt closure of companies accused of TF once investigations begin.

Case Studies (Typologies of Terrorist Financing)

Case Study 1 – Direct Infiltration of Banking Systems
A prospective bank client flagged on sanctions lists tied to narcotics/TF attempted to open an account.
ASA Insight: Confirms insurgent networks actively probe formal institutions. Vulnerability: gaps in sanctions screening across Mozambican banks.

Case Study 2 – Mobile Money Agent in Pemba
Agent processed unusually high volumes from Mocímboa da Praia, incompatible with profile.
ASA Insight: Mobile money is the insurgents’ “financial bloodstream.” Oversight is weakest in frontline areas.

Case Study 3 – Public Officials as Financial Conduits
Funds channelled through mobile wallets of a naval student in Pemba, with implausible justification from a construction firm.
ASA Insight: Highlights state corruption risks and complicity in TF networks.

Case Study 4 – Multi-Provincial Operator
Trader in Pemba declared modest income but moved large sums, with ATM withdrawals across five provinces and abroad. Skilled in IT, mechanics, weapons handling.
ASA Insight: Multi-role actors combine financial and operational functions, making them critical nodes in the insurgent ecosystem.

Strategic Challenges

1. Under-reporting: Very few TF-related STRs despite clear flows.

2. Weak Compliance Culture: Reporting entities lack tools to detect complex TF patterns.

3. Judicial Passivity: Courts slow to prosecute TF, allowing impunity.

4. Cross-Border Gaps: Porous frontiers + weak FIU cooperation.

5. Elite Complicity: Public funds diverted, enterprises co-opted.

ASA Assessment

• Resilience: Mozambique’s TF networks are highly adaptive, integrating licit/illicit flows.
• Regional Risk: If unchecked, Cabo Delgado could serve as a long-term hub for jihadist financing in Southern Africa, mirroring Mali’s role in the Sahel.
• Structural Weakness: State corruption and complicity magnify vulnerability.
• Projection: With ASWJ shifting toward criminality (kidnapping, ransom), the insurgency may persist despite battlefield losses, sustaining itself financially.

Recommendations

National Level

• Mandate enhanced Know Your Customer (KYC) procedures and transaction monitoring for mobile money.
• Build judicial capacity for Terrorist Financing (TF) prosecutions.
• Integrate Gabinete de Informação Financeira de Moçambique (GIFiM – Mozambique’s Financial Intelligence Unit) intelligence with the Serviço de Informação e Segurança do Estado (SISE – State Information and Security Service) and the Serviço Nacional de Investigação Criminal (SERNIC – National Criminal Investigation Service).

Regional Level

• Establish joint Financial Intelligence Unit (FIU) taskforces with Tanzania, Kenya, and Malawi.
• Develop a Southern African Development Community (SADC) framework for cross-border mobile money oversight.

International Level

• Engage the Financial Action Task Force (FATF), the Eastern and Southern Africa Anti-Money Laundering Group (ESAAMLG), and the Inter-Governmental Action Group against Money Laundering in West Africa (GIABA) to harmonize typologies.
• Secure donor funding for transaction monitoring technology.

Preventive Measures

• Target illicit economies (timber, mining, drugs) as central nodes.
• Engage Non-Profit Organizations (NPOs) and community leaders to prevent infiltration.
• Increase citizen awareness campaigns.

Conclusion

Terrorist financing in Mozambique is not incidental but the cornerstone of insurgency survival. By embedding financial systems in both formal (banks, NPOs, public accounts) and informal (mobile money, smuggling, cash couriers) economies, insurgents have established a resilient and adaptive lifeline. The confirmed linkages with the ADF in DRC further demonstrate that Mozambique’s insurgency is not isolated, but part of a regional jihadist ecosystem with capacity for cross-border escalation.

ASA stands ready to provide structured intelligence, risk matrices, and targeted advisory support to stakeholders operating in or around Mozambique and can Offer:

• Early Warning: continuous monitoring of insurgent financial patterns and red-flag indicators for governments, investors, and NGOs.
• Analytic Foresight: scenario-based analysis of how insurgent financing may evolve under pressure (shifting from banks to mobile money, or into new illicit economies).
• Risk Guidance: tailored assessments for international partners, businesses, and humanitarian actors exposed to Mozambique and the broader SADC/Great Lakes corridor.
• Investor Protection: mapping of geographic and sectoral risks, ensuring financial flows avoid infiltration or exposure to insurgent-linked networks.