Bottom Line Up Front (BLUF)
The GCTA’s April 2026 financing forecasts held up on direction but not on every mechanism. It was right that jihadist groups have become self-financing through local economies and that hawala-crypto bridges are a core channel; the UN Monitoring Team and FATF now confirm both. It was partly wrong about how money moves inside al-Qaeda: new UN evidence shows affiliate revenue flowing up to the core, not down from it. And it bet on the wrong cryptocurrency: stablecoins, not Monero, now dominate. The GCTA’s central policy recommendation, a multilateral “al-Karrar Financial Accord,” has not been adopted.
Key Judgments
- [CONFIRMED] The GCTA’s forecast that jihadist affiliates would finance themselves through local resource economies rather than donor networks is confirmed by the UN Monitoring Team’s August 2026 report, which found financing relied heavily on local extortion and taxation, and by ACLED’s July 2026 data on JNIM’s control of Sahel gold sites.
- [CONFIRMED] The GCTA’s identification of hawala-crypto bridges as a core financing channel is confirmed by FATF’s September 3, 2026 report on underground banking and by the same UN report’s finding that groups increasingly use cryptocurrency and hawala.
- [ASSESSED] The GCTA’s “venture capital” model of al-Qaeda is partially confirmed. The network is decentralized as described, but the UN has traced a reported $50 million ransom from the Sahel affiliate JNIM to al-Qaeda’s senior leadership: money flows up from the franchises, not only down from the core.
- [ASSESSED] The GCTA’s emphasis on Monero exit ramps is not confirmed. Stablecoins, chiefly Tether on the Tron network, account for most illicit crypto flows, and a July 2026 US sanctions action against Islamic State Khorasan wallets was overwhelmingly Tron-based.
- [ASSESSED] The GCTA’s “Captagon-Gold” hybrid financing nexus is not yet resolved. Since Assad’s fall the Captagon trade has been disrupted and diversified, and no 2026 evidence shows it combining with conflict gold as a terror-financing channel.
What This Part Adds to the Record
CommandEleven Intelligence’s first GCTA audit, Fighting 2026 Terrorism Using The 2000 Playbook (September 18, 2026), recorded the hawala-crypto confirmation. It did not score the financing forecasts that missed. This part does. The Monero miss and the correction to the direction of al-Qaeda’s money flows are on the record here for the first time, alongside the hits, in the standard scorecard format.
A note on terms. The GCTA’s own name for al-Qaeda’s current model is the “Stealth State”: a decentralized, self-sustaining structure that hollows states out from within and is built, in the GCTA’s words, to “survive the death of any single leader.” Its wider framework is Cyber-Kinetic Convergence and the Distributed Strike Doctrine. Earlier CommandEleven Intelligence material used the shorthand “Bin Ladenist Model” for this structure. The GCTA does not use that term, and this series does not use it.
What the GCTA Forecast
The GCTA’s financing analysis runs across its Executive Summary, its “Beneficiary Matrix” section on al-Qaeda’s regional restructuring, and its closing “Strategic Policy and Multilateral Framework (2026–2030)” section. Read together, three linked claims emerge:
- Financing has decentralized. The Executive Summary frames this as “Decentralized Resource Dynamics: Tracking the transition from state-sponsored terrorism to autonomous operational funding, specifically focusing on the JNIM gold-to-arms supply chain, the exploitation of regional artisanal mining, and the weaponization of cryptocurrency mixers.”
- Decentralized money buys survivability. The Beneficiary Matrix describes post-2022 al-Qaeda Central, under Saif al-Adel’s guidance, as having “moved away from being a single organization to becoming a decentralized venture capital firm for insurgency.” The financing section calls the result a Stealth State.
- Specific bridges move specific money. Al-Shabaab, al-Qaeda’s “Cash Cow,” benefits from “AQ’s global Hawala-Crypto bridges” that move its revenue into global markets.
GCTA-FIN-01: Does al-Qaeda Work Like a Venture Capital Firm for Its Affiliates?
GCTA wording (April 2026): Al-Qaeda Central has “moved away from being a single organization to becoming a decentralized venture capital firm for insurgency — providing the funding, technical R&D, and ideological licensing that allows regional groups to thrive.”
Type: Forecast · Score: PARTIALLY CONFIRMED
What held. The decentralized franchise structure is confirmed. The UN Monitoring Team’s 38th report, published August 10, 2026, describes al-Qaeda’s influence as fragmented and decentralized. It also documents the technical-support role the GCTA described: al-Qaeda continued to provide ideological guidance, training and support to the TTP, and one member state reported al-Qaeda trainers working with both TTP and Baloch Liberation Army elements.
What needs correcting. The funding direction. A venture-capital model implies money flowing from the core to the franchises. The UN report instead traces a reported $50 million ransom from JNIM in the Sahel to al-Qaeda’s senior leadership. The UN also found that about two-thirds of both al-Qaeda’s and the Islamic State’s fighters are now in Africa. Taken together, the evidence points to rich African affiliates funding the core.
Correction for future assessments. “Franchise with royalties” is a better model than “venture capital”: the core licenses the brand, provides training and doctrine, and receives a share of affiliate revenue. How the JNIM funds moved, and through which intermediaries, is not yet known.
GCTA-FIN-02: Have Affiliates Replaced Donors With Local Economies?
GCTA wording (April 2026): “Old AQ relied on the golden chain of wealthy donors. New AQ is self-sustaining. In the Sahel and Somalia, they have nationalized the artisanal gold and charcoal industries. They don’t need wire transfers; they own the mines.”
Type: Forecast · Score: CONFIRMED
Evidence.
- UN Monitoring Team, August 2026: financing relied heavily on local extortion and taxation, increasingly supplemented by cryptocurrency and hawala. The same report notes AQAP expanded domestic revenue through front individuals in real estate and vehicle trading.
- Sahel gold: A July 2026 ACLED report examined more than 1,000 violent incidents around gold sites in Burkina Faso, Mali and Niger between 2015 and June 2026. It found JNIM is the dominant armed actor in the Sahel’s mining sector and has turned some artisanal sites into semi-permanent bases.
- Somalia: The UN reported in February 2025 that al-Shabaab’s annual revenue ranges between $100 million and $200 million, mainly from taxation and extortion, and the Combating Terrorism Center at West Point identified it in 2025 as al-Qaeda’s most profitable affiliate.
Caveat. The gold half of this forecast is strongly evidenced. Charcoal remains a documented al-Shabaab revenue stream, but 2026-specific data on its scale is thin. The score reflects the forecast’s core claim about self-financing, which is clearly confirmed.
GCTA-FIN-03: Are Hawala-Crypto Bridges a Core Financing Channel?
GCTA wording (April 2026): “AQ’s global Hawala-Crypto bridges” move affiliate revenue, including al-Shabaab’s, into global markets.
Type: Forecast · Score: CONFIRMED
Evidence.
- FATF, September 3, 2026: FATF’s report on underground banking identified “digital hawala,” hawala networks integrating with formal finance including cryptocurrency, as a principal money-laundering channel, used by more than 80 percent of reporting jurisdictions. CommandEleven Intelligence’s September 18 audit first recorded this; it is re-recorded here in the standard format.
- UN Monitoring Team, August 2026: jihadist financing increasingly relied on cryptocurrency and hawala. The report recommended adding digital-currency fields to the UN sanctions list, an institutional acknowledgment that the channel is now material.
GCTA-FIN-04: Are Monero Exit Ramps the Channel to Watch?
GCTA wording (April 2026): The GCTA’s monitoring strategy centered on “Monero (XMR) exit ramps,” and its policy section proposed a multilateral “Privacy Coin Task Force” to target them.
Type: Forecast (implicit: that Monero would be a priority terrorist-financing channel) · Score: NOT CONFIRMED
Evidence against.
- FATF, March 3, 2026: FATF’s targeted report on stablecoins cited Chainalysis data showing stablecoins accounted for 84 percent of illicit virtual-asset transaction volume in 2025, and named terrorist financiers among the users.
- US Treasury, July 2, 2026: OFAC sanctioned 134 cryptocurrency addresses linked to Islamic State Khorasan. 131 were Tron-network wallets and only three were Monero addresses.
- Longer-term pattern: Hamas’s military wing began shifting to Tether (USDT) in late 2021. Monero’s low liquidity and delisting from major exchanges make it harder to convert to cash, which limits its use at scale.
What the GCTA got wrong. It overweighted anonymity and underweighted liquidity. Groups need to spend money, not just hide it, and stablecoins offer both reasonable cover and easy conversion. Monero appears in terrorist financing, but at the margins.
Correction for future assessments. The monitoring priority is stablecoin flows on Tron and similar networks, especially through unhosted wallets and peer-to-peer brokers, with privacy coins as a secondary layer.
GCTA-FIN-05: Is a “Captagon-Gold” Nexus Emerging?
GCTA wording (April 2026, as summarized on the assessment’s download page): “The ‘Captagon-Gold’ Nexus: Hybrid Financing.”
Type: Forecast · Score: NOT YET RESOLVED
What has happened since. The Captagon trade has been disrupted and reshaped, not consolidated. After Assad’s fall in December 2024, the new Syrian government began dismantling Captagon laboratories, and Lebanese forces stepped up arrests and lab raids against Hezbollah-linked traffickers. The Combating Terrorism Center at West Point found production and transit diversifying outward through criminal syndicates and armed groups from Iraq to Libya, West Africa and Europe.
Why it is not scored. No 2026 evidence reviewed for this part shows Captagon revenue combining with conflict gold as a single terror-financing channel. But the trade’s diversification into West Africa, where Hezbollah-affiliated expatriate networks and Sahel gold economies overlap, leaves the forecast open. It is re-checked in December.
Baseline Claim GCTA-FIN-B1: Al-Shabaab’s Annual Revenue
GCTA wording (April 2026): “Al-Shabaab’s $150M annual revenue.”
Type: Baseline claim · Score: VERIFIED
The figure sits within the UN’s February 2025 range of $100 million to $200 million, and within the range the Combating Terrorism Center at West Point gave in 2025. What remains unconfirmed is the specific mechanism the GCTA attached to it, al-Qaeda-run bridges moving that money into global markets; the UN documents hawala and crypto use by al-Shabaab, but not a dedicated AQ-run channel.
Recommendation GCTA-FIN-R1: The al-Karrar Financial Accord
GCTA wording (April 2026): A multilateral “al-Karrar Financial Accord” to move enforcement “from tracking to dynamic freezing of the crypto-hawala nexus,” on three pillars: a Privacy Coin Task Force targeting Monero exit ramps tied to ISIS-Somalia’s al-Karrar office; a mandatory blockchain-based “Conflict Gold Certification” ledger for Sahel artisanal mining; and continued multilateral financial-intelligence sharing.
Type: Recommendation · Status: NOT ADOPTED
Nothing resembling the accord exists in the open record. What 2026 produced instead were separate, channel-by-channel actions: FATF’s reports, the OFAC designations, national seizures. That is the coordination gap the GCTA warned about. [ASSESSED] Two adjustments would strengthen the recommendation if it is revisited: point the task force at stablecoin flows rather than privacy coins (FIN-04), and add affiliate-to-core transfers to its remit (FIN-01).
Scorecard for This Part
| ID | Item | Score | Key evidence |
|---|---|---|---|
| GCTA-FIN-01 | AQ as “venture capital” for franchises | PARTIALLY CONFIRMED | UN S/2026/651: decentralization and training confirmed; $50M JNIM ransom flows up to AQ leadership |
| GCTA-FIN-02 | Self-financing through local economies | CONFIRMED | UN S/2026/651; ACLED July 2026; UN Feb 2025 al-Shabaab revenue |
| GCTA-FIN-03 | Hawala-crypto bridges as core channel | CONFIRMED | FATF Sept 3, 2026; UN S/2026/651 |
| GCTA-FIN-04 | Monero exit ramps as priority channel | NOT CONFIRMED | FATF Mar 3, 2026 (stablecoins 84% of illicit volume); OFAC July 2, 2026 (131 of 134 ISIS-K addresses on Tron) |
| GCTA-FIN-05 | “Captagon-Gold” hybrid nexus | NOT YET RESOLVED | CTC 2025: trade diversified, no combined channel documented |
| GCTA-FIN-B1 | Al-Shabaab revenue about $150M a year | VERIFIED | UN Feb 2025; CTC 2025 |
| GCTA-FIN-R1 | al-Karrar Financial Accord | NOT ADOPTED | No multilateral mechanism in the open record |
Date scored: October 15, 2026 · Next review: December 2026.
What This Part Changes
Two corrections carry forward into CommandEleven Intelligence’s financing analysis:
- Model al-Qaeda as a franchise with royalties. The core licenses, trains and collects; the African affiliates are the revenue engine. Disrupting affiliate-to-core transfers matters as much as disrupting core-to-affiliate support.
- Track stablecoins first. Tron-based USDT flows, unhosted wallets and peer-to-peer brokers are the main crypto channel; privacy coins are secondary.
Both corrections are reflected in CommandEleven Intelligence’s Terrorist Financing: Hawala, Crypto, and the Coordination Gap white paper, which built on the FATF hawala findings and the Hamas shift to stablecoins. Pakistan-specific financing, including the GCTA’s “Project Sentinel,” is scored in Part 2.
Frequently Asked Questions
How accurate were CommandEleven Intelligence’s 2026 terrorist-financing forecasts?
Of five financing forecasts in the April 2026 GCTA, two are confirmed, one is partially confirmed, one is not confirmed and one is not yet resolved. The misses are published alongside the hits.
How do al-Qaeda affiliates fund themselves in 2026?
Mainly through local taxation and extortion, including control of artisanal gold mining in the Sahel, increasingly supplemented by hawala and cryptocurrency, according to the UN Monitoring Team’s August 2026 report.
Does money flow from al-Qaeda’s core to its affiliates?
Increasingly the reverse. The UN Monitoring Team traced a reported $50 million ransom from JNIM in the Sahel to al-Qaeda’s senior leadership, and about two-thirds of al-Qaeda and Islamic State fighters are now in Africa.
Which cryptocurrency do terrorist groups use most?
Stablecoins, chiefly Tether on the Tron network. FATF cited data showing stablecoins made up 84 percent of illicit crypto volume in 2025, and a July 2026 US sanctions action on ISIS-K wallets was overwhelmingly Tron-based.
What is the GCTA’s “Stealth State”?
The GCTA’s term for al-Qaeda’s current model: a decentralized, self-financing network that licenses its brand and doctrine to franchises and is built to survive the loss of any single leader.
Cross-Reference
This part extends Fighting 2026 Terrorism Using The 2000 Playbook and the Terrorist Financing white paper. The full method and running scorecard are in the GCTA Foresight Audit introduction.
Sourcing Base (Confidence-Tiered, with Links)
CONFIRMED, Primary/Official Record:
- UN Security Council, Thirty-eighth report of the Analytical Support and Sanctions Monitoring Team (S/2026/651), Aug. 10, 2026 (copy hosted by FTL Somalia)
- FATF, “New FATF report finds underground banking and hawala are key channels for professional money launderers,” Sept. 3, 2026
- FATF, “Targeted Report on Stablecoins and Unhosted Wallets,” Mar. 3, 2026
- CommandEleven Intelligence, 2026 Global Counter-Terrorism Assessment, April 2026 (source document under audit: Executive Summary; “The Beneficiary Matrix”; “From Donations to Taxtortion” and “Strategic Wrap: The Stealth State”; “Strategic Policy & Multilateral Framework (2026–2030)”)
ASSESSED, Credible Secondary Reporting and Analysis:
- Insight Threat Intelligence (Jessica Davis), “The $50 Million Signal,” Aug. 12, 2026 (UN Monitoring Team coordinator interview on the JNIM revenue transfer)
- FDD’s Long War Journal, “The UN Monitoring Team’s latest report,” Sept. 2, 2026 (two-thirds of fighters in Africa)
- Ng Teng Fong Sino Group Belt and Road Research Institute, summary of S/2026/651, Aug. 2026 (financing; AQ-TTP-BLA training)
- Africa Defense Forum, “Control of Gold Mines Fuels Sahel Terrorism,” Aug. 2026 (ACLED gold-site findings)
- Horn Review, “How Gold Mining Sustains Conflict in the Sahel and the Horn of Africa,” Aug. 20, 2026 (ACLED July 2026 report scope)
- Insight Threat Intelligence, “How does Al-Shabaab have so much money?,” Mar. 2025 (UN February 2025 revenue range)
- Hiiraan Online, “Report: Al-Shabaab earns $200 million yearly,” Oct. 2025 (CTC West Point assessment)
- Cointelegraph, “OFAC sanctions 134 ISIS-K crypto wallets; Tether freezes 131,” July 2026 (OFAC action)
- Crowdfund Insider, “Chainalysis Analyzes OFAC’s Expansion of ISIS-K Crypto Sanctions,” July 2026
- HDIAC, “Financing Terrorism Through Cryptocurrencies,” May 2025 (Hamas USDT shift; Monero liquidity limits)
- Combating Terrorism Center at West Point, “The Future of the Illicit Captagon Drug Trade,” Oct. 2025
Excluded from this part: Any claim that the UN Monitoring Team, FATF or the US Treasury drew on the GCTA. The audit records independent confirmation only.
