A New Normal: Countering the Financing of Self-Activating Terrorism in Europe

This Occasional Paper analyses the financial behaviours of self-activating terrorists from across the ideological spectrum and offers guidance on how CTF efforts might be shaped to the distinct contours of this threat.

Numerous deadly terrorist attacks across Europe – from the 2015 Charlie Hebdo attack in Paris and the Manchester Arena bombing of 2016 to the far-right firearms assault in Hanau, Germany in early 2020 – demonstrate that self-activating terrorism (sometimes referred to as lone actor or small cell terrorism) has become a major security concern for the continent. 

Much of the current ‘conventional wisdom’ around these kinds of actors assumes that terrorist financing and a counterterrorist financing (CTF) response are not relevant to this growing threat. Reports of attacks involving little to no preparation or financial resourcing have shaped a false perception that self-activator activity produces no usable financial intelligence. This has generated a high degree of unease among both CTF professionals in law enforcement, whose role it is to use legal investigatory powers to apprehend terrorists and would-be terrorists, and practitioners in the financial services sector, whose controls and instruments are designed to identify and report abuse of the financial system by terrorists planning attacks. The natural fear is that if the private sector cannot produce the kind of financial intelligence required, then law enforcement cannot do its job as effectively as it might. 

In light of this, the European Commission commissioned RUSI Europe to carry out this research study as part of Project CRAAFT, which seeks to answer two related research questions: 

1. How do self-activating terrorists operating in Europe conduct their financial attack preparations? 
2. How should the CTF regime be changed to meet this pervasive terrorist threat? 

For evidence, the research team reviewed relevant academic and policy literature and credible media reports, conducted 37 semi-structured interviews with relevant experts, reviewed 106 cases of successful and disrupted self-activated attacks in Europe between January 2015 and November 2020, and carried out three in-depth case study analyses.