SA’S IS CRISIS | How R6bn got from spaza shops to African terrorists

LISTEN TO THE STORY: 

Islamic State (IS) and linked extremists are believed to be hijacking SA’s smaller financial services to fund terror attacks across Africa by moving billions of rand through spaza shops and retail outlets in the informal sector.

A TimesLIVE investigation can reveal that several organisations are operating independently from one another in SA to sponsor terrorism in different parts of Africa, including through:

• The transfer of money through third-party payment providers (TPPPs) by mainly Somalis, Kenyans and Democratic Republic of the Congo (DRC) nationals to the Horn of Africa. Some of the funds are believed to have been used in an attack on the Westlands office retail park in Kenya 2019 that killed 22 people, including South African Luke Potter; and
• Generation of local crime proceeds from ransom kidnappings, robberies and gold smuggling to fund terror activities in Mozambique.

Kenyan financial and security authorities, as part of an international investigation, are working with the Hawks and the Financial Intelligence Centre (FIC) to probe how the money has been smuggled from SA since 2018 for use by foreign and local organised crime and terrorism networks in Kenya, the Democratic Republic of the Congo and Mozambique.

“TPPPs’ poor regulation has seen terror organisations exploiting their systems. Organised-crime networks and terrorists hijacked their systems. SA is bleeding huge volumes of untraceable money,” said a detective with knowledge of the investigation.

In February, the FIC warned of a direct threat to SA’s national security from terror financing.

“Detecting the collection of cash and the cross-border remittance via alternative remittance systems ... to conflict areas abroad remains a challenge,” the FIC said in an assessment into terrorism financing from SA.

“Terrorism financing concerns exist due to the possibility these funds may be directed to IS supporters in the region, notably in the DRC, Kenya or Mozambique. Claims of funding for attacks in Mozambique and Kenya emanating from SA is of serious concern. Investigations to confirm or refute claims are ongoing.

“The use of unregulated and alternative remittance services and mobile money payments by low-income groups and émigré communities is prevalent in SA ... It is challenging to distinguish between legitimate diaspora remittances for financial support of families in countries of origin and money siphoned off to fund terrorism-related activities.”

Terror cells and organised-crime bosses are suspected of having manipulated the payment systems of TPPPs, usually used by spaza shops and retailers in the informal sector, to move money out of the country. In one instance, a TPPP operator said his system was compromised, resulting in more than R6bn being transferred in a series of transactions between January 2020 and March 2021.

The Hawks and SAPS Crime Intelligence Unit counter-terrorism sources, with knowledge of terror financing inquiries under way, including the international probe which began in 2021, confirmed that suspected Somali organised crime and terrorism networks, through just one SA company, transferred the R6bn for crimes in East Africa. At least one of those under investigation is a Somali asylum seeker who allegedly moved money through a Gauteng TPPP to Kenya to help fund the 2019 attack.

TimesLIVE was able to independently verify that a compromised TPPP system belonging to one Gauteng-based company resulted in R6bn in dodgy international transfers.

Police sources, with knowledge of the international investigation, claim that based on the transactions from this company, along with four others under investigation, the total value of transactions under investigation could be far higher, with the movement of funds possibly going beyond 2018. 

Additional to the transfer of R6bn on the one TPPP system, sources say several other TPPPs are also under investigation. It is believed their systems were used to transfer slightly smaller amounts, varying between R4m and R500m, through multiple transactions.

The targeted TPPPs work specifically with remitters linked to East and Central Africa. Remitters facilitate the non-commercial transfer of money for people globally.

SA’s TPPPs, regulated by the Payments Association of SA, provide payment services, including the acceptance of funds from the public for subsequent bill payments. They are allowed to accept funds from the public, which are deposited into a TPPP’s bank account for bill payments or purchases of vouchers, airtime or SIM cards. Other services include the use of electronic wallets to deposit and withdraw funds globally.

Investigators have told TimesLIVE that so far they are looking into five SA TPPPs, with at least 15 to be probed. 

One TPPP director, who did not want to be named, said the system was designed in such a way that “you cannot see whose money it is, where it comes from, who deposits it or who withdraws it.

“The only people known are essentially the store owners who use our pay-point equipment and systems.”

He said after repeated requests from their clients, they adapted the system to allow remittances.

“That was one of our biggest mistakes. We partnered with well-known businesses operating in Africa. Certain bad guys, however, saw us as an anonymous mechanism to move money for nefarious means.”

He said they became suspicious when they suddenly saw huge transfers being done “on scale on individual client profiles, who in the past had hardly done any transactions.

“At the peak, we were seeing transactions of more than R1bn a month on some clients’ profiles. The peak for the suspicious transactions, which were from roughly 500 shops, was in November 2020.”

He said while he only did business in Gauteng, his staff recovered their pay-point devices, which allowed clients to make payments of up to R4,999 a transaction, in the Western Cape, Eastern Cape, Northern Cape, Free State and Mpumalanga.

“They were with people not registered on my database.”

He said their investigations showed their clients had created thousands of fake profiles of South Africans to perform these financial transactions.

“These syndicates paid random people R200 to have a photograph of themselves and their identity documents taken. These were used to create fake profiles for the transfers. 

“Our audits revealed that nearly 60,000 SIM cards were used in the transfer of the money from SA. Nearly 300 SIM cards were used to move R300m in 26,000 transactions. We have been informed through investigators, and our sources, that one of those sending huge volumes of money is apparently linked to the 2019 Kenyan mall attack.

“This was nothing but pervasive abuse of our systems.”

A crime intelligence source said: “This is probably our biggest single case of terrorism financing.

“The volumes are staggering. These transactions go beyond 2018.”

Wallace Kentai, spokesperson for Central Bank of Kenya which apparently first tipped off SA authorities, failed to answer questions on the investigation. Detectives, with knowledge of the Kenyan probe, claim the obscure operations of TPPPs leave formal financial regulators blind in trying to identifying the source or owners of the funds which pass through their systems.

The Kenyan investigation is believed to have started after that country’s financing and security authorities, working with their international counterparts, were alerted to large volumes of suspicious payments coming into their country through SA-based TPPPs and several popular African-based remitters.

Local crime proceeds flowing to Mozambique

The FIC assessment also warned of the involvement of local IS supporters in organised crime, highlighting how major businesses are potentially behind terrorism financing. 

“Legitimate businesses and front companies are used to send or receive funds transiting through mainstream financial channels. This access to cash allows IS supporters, some of whom operate large and diverse businesses with international reach, to operate with impunity.”

While the Hawks are looking into terrorism and organised crime financing in East Africa, they are also investigating potential evidence of the financing of alleged IS operations in Mozambique by KZN-based supporters. 

WhatsApps seen by TimesLIVE show communications between the leader of an alleged KZN IS-linked organised crime group and a DRC-based IS figure, which discuss financing. The messages admonish the KZN leader for directly “financing the brothers in Mozambique”.

“All coordination needs to be done by us,” states the DRC leader.

Other messages show the IS KZN group allegedly engaging in crimes including ransom kidnappings, robberies and gold smuggling, with the leader instructing his group’s members and others in Cape Town on how to use organised crime for financing.

While it has long been suspected SA-based groups were helping finance the Mozambican insurgency, until now no clear evidence of that has been found. The messages provide the clearest evidence yet that South Africans are funding the insurgency SA troops have been fighting for months.

The messages illuminate the significance of what that financing means in terms of the potential loyalty to the insurgents.

In March, the US Treasury’s office of foreign assets controls sanctioned SA citizens Siraaj Miller and Farhad Hoomer, Ethiopian Abdella Hussein Abadigga and Ugandan Peter Charles Mbaga for allegedly financing IS in Mozambique.

‘Definite cause for concern’

Terrorism expert Jasmine Opperman said while SA’s terror financing was dwarfed by other countries, “there is definite cause for concern regardless of whether R1m or R100 is moved.

“Money flows are taking place from SA. Investigations into these crimes are complex. It is difficult to prove what happens to these monies and where they end up.

“Financing occurs through various methods from informal online virtual payments to systems used by organised crime gangs. Extremists form symbiotic relations with organised crime gangs and piggyback on their money laundering systems.”

Olwethu Majola, a transnational organised crime researcher at University of Cape Town’s Centre for Criminology, said terrorism was simply not on SA authorities’ radar as a security priority.

A damning assessment in October by the Financial Action Task Force (FATF), an intergovernmental organisation, said SA authorities had only confiscated terrorism finance-related assets valued at R6m.

“SA has failed to demonstrate it is effectively identifying the specific roles played by terrorist financiers [and] has limited experience prosecuting terrorism financing offences,” states the FATF assessment.

Majola said: “There is a serious reluctance and political will to label organisations or people terrorists. FATF in their report noted this reluctance and serious flaws within SA’s anti-money laundering enforcement framework, where investigators do not look at money laundering, and organised and financial crimes from the perspective of terrorism financing ...

“We must drop the narrative that just because we haven’t felt the physical repercussions of attacks such as the bombings in Kenya’s malls, that we can relax.

“We must realise that we are a serious financial target and adopt legal frameworks to ensure terrorism financing is looked at alongside organised crime during investigations and prosecutions.”

She said the smaller financial sectors were being targeted.

“Under-regulated virtual money transfer service providers, who operate mainly in the informal sector, are used to move money across our borders. It’s here where lots of potential problems lie, where money is moved for lots of non-FICAed people.”

Crisis Group’s Southern Africa senior consultant Piers Pigou said information was emerging of individuals moving finances from SA to extremists in the DRC and Kenya.

“Mobile money networks are critical in the support of extremist individuals and small cells.”

Hawks spokesperson Brig Thandi Mbambo confirmed an investigation involving the Kenyan authorities and the Hawks Counter Terrorism Unit was underway but declined to elaborate. She confirmed the Hawks, SAPS, FIC and “other SA intelligence divisions” were collaborating on antiterrorism investigations.

PASA spokesperson Rosa-Mari le Roux said while they played a role in preventing abuse in and fraud of all formal payment systems, “the combating of money laundering and terrorism financing was the FIC’s domain”. 

The FIC does not comment on investigations.