The Terror Ecosystem

Terror Financing

Money is the oxygen of terrorism. Recruitment, training, weapons, safe houses, communications, propaganda and the upkeep of families of cadres — every link in the chain has a price, and cutting the money is often more effective than chasing the man with the gun.

This is why financial intelligence has moved from the margins to the centre of counter-terrorism, and why the international community increasingly treats terror financing as a more serious and structural threat than an individual attack: choke the funds and the whole enterprise withers.

The Sources of Terror Money

Terror groups in India draw on a mix of sources that shifts with the group and the geography. What follows maps the principal channels; the trafficking and laundering mechanics that underlie several of them are developed fully in the treatment of narco-terrorism and of money laundering and organised crime, and are only referenced here.

Source	How it works	Where it shows up
State sponsorship	A hostile state channels money, arms and training to deniable proxies	The classic model of cross-border terrorism directed at Jammu and Kashmir
Hawala / hundi	Informal, trust-based value transfer that leaves no banking trail	The dominant conduit for moving funds to and among groups
Charities, trusts and NGOs	Legitimate-looking fronts collect donations “for relief” that are diverted to violence	Jihadi fundraising abroad; front trusts historically routed money to proxies
Fake Indian Currency Notes	Counterfeit currency both funds operations and attacks the economy itself	Pushed across the western and eastern borders — an economic-security threat
Narcotics	Drug profits self-finance cadres and arms; a deniable, renewable stream	The narco-terror seam along the Punjab and Jammu borders
Extortion and “levy”	Forced collections from contractors, businesses and development projects	The mainstay of North-East insurgent and Left-Wing Extremist economies
Abuse of formal channels	Salaried professionals and shell accounts route clean-looking money	The financial signature of the newer “white-collar” modules

Two features deserve emphasis.

• First, the sophistication of mixing — legitimate earnings, charitable donations and laundered funds are blended into a single, innocuous-looking financial trail that defeats routine checks.
• Second, the counterfeit-currency channel is unique in that it simultaneously funds terrorism and assaults the economy, which is why India’s law explicitly folds it into the definition of a terrorist act.

Virtual Assets and Cryptocurrency

The newest and fastest-moving channel is the virtual digital asset. Cryptocurrencies and other tokens offer terror financiers exactly what hawala once did — value transfer that is fast, cross-border and hard to trace — but with global reach and pseudonymity built in.

Funds can be raised through online appeals, moved through wallets and “mixers” that obscure the trail, and cashed out far from where they were collected, all without touching a regulated bank.

India has responded by pulling this world inside the regulatory net. In March 2023, activities involving virtual digital assets — trading, transfer, custody and exchange — were brought under the Prevention of Money Laundering Act, making crypto exchanges and wallet providers “reporting entities” obliged to run KYC checks, register with the financial-intelligence unit and file suspicious-transaction reports.

The regulatory challenge, taken up more fully in the money-laundering chapter, is to close this channel without smothering a legitimate emerging technology.

Trade-Based Laundering and Shell Entities

A quieter but high-volume channel is trade-based money laundering — disguising the movement of value inside apparently ordinary commerce.

By over- or under-invoicing goods, misdeclaring quantity or quality, or invoicing the same shipment multiple times, illicit value is moved across borders under cover of legitimate trade documents.

Shell companies — entities that exist only on paper — then layer and integrate the money, providing a clean façade of contracts, invoices and bank accounts.

For terror financing this offers two advantages: the sums hide in the enormous daily volume of genuine trade, and the paper trail looks entirely commercial. Detecting it requires matching customs, banking and corporate data — precisely the kind of cross-database analysis that modern financial intelligence is built to do.

India’s Response to Terror Financing

India has assembled a layered response that combines a specific legal offence, dedicated investigation, financial intelligence and asset seizure. The generic anti-money-laundering machinery — the enforcement agency, the reporting chain and the courts — is detailed in the money-laundering chapter; the terror-specific elements are set out here.

• Terror financing as a distinct offence. The anti-terror law makes raising, providing or collecting funds for terrorism a serious crime, with dedicated provisions that criminalise financing and allow the freezing, seizure and attachment of property connected to terrorism — the financial edge of the statute rather than only its violent-act provisions.
• Federal investigation. The national investigative agency runs dedicated terror-funding cases, following the money from street collection to handler; its remit expressly covers terror financing and cross-border links.
• Financial intelligence. The financial-intelligence unit collects and analyses suspicious-transaction and cash-transaction reports, feeding leads to investigators — the analytical hub of the system.
• Dedicated counter-financing capacity. A specialised Combating Financing of Terrorism cell in the Home Ministry coordinates the financial dimension of counter-terrorism across agencies.
• Systemic hardening. Improved currency security features, tighter reporting obligations and periodic action against front organisations reduce the room in which illicit money moves.

FATF Leverage on Pakistan

The single most effective external pressure on state-sponsored terror financing in the last decade came not from a court or an army but from a standards body: the Financial Action Task Force (FATF), the global watchdog that sets anti-money-laundering and counter-terror-financing standards through its Forty Recommendations and grades countries against them.

FATF’s “grey list” — the list of jurisdictions under increased monitoring — became a powerful lever on Pakistan. The mechanism works through reputational and financial cost: a grey-listed country finds foreign investment, credit ratings and international borrowing more expensive and harder to obtain, creating real incentive to act against terror financiers on its soil.

Case Study — Pakistan’s Grey-List Episode (2018–2022) Pakistan was placed on the FATF grey list in June 2018 and given a detailed action plan — ultimately a combined 34 items — to fix deficiencies in its anti-money-laundering and counter-terror-financing systems, including action against UN-designated individuals and groups. Under sustained scrutiny, Pakistan was compelled to take visible steps — legislation, prosecutions and moves against certain financiers — that it had long resisted. It was removed from the grey list in October 2022 after being assessed as substantially compliant. The lessons cut both ways. First, multilateral financial pressure works where diplomatic condemnation does not — the grey list achieved concrete, if grudging, action. Second, compliance is not the same as conviction: delisting reflected procedural box-ticking more than a strategic abandonment of proxy warfare, and the watchdog itself has cautioned that exit confers no immunity. The pressure must therefore be renewable, not one-off.

The No Money for Terror Conference

India has sought to move counter-terror-financing from a technical, expert conversation into a standing ministerial-level political commitment. The “No Money for Terror” (NMFT) Ministerial Conference is the chosen vehicle — a series that began in Paris (2018) and continued in Melbourne (2019) before India hosted the third edition in New Delhi on 18–19 November 2022, drawing some 450 delegates from around 70 countries, opened by the Prime Minister.

Dimension	Substance
Aim	Build a sustained, high-level global consensus to deny terrorists money — treating financing as the decisive vulnerability of terrorism
Objectives	Examine trends in terror financing; scrutinise both formal and informal fund channels; confront the misuse of emerging technologies such as crypto; and deepen international cooperation and information-sharing
India’s emphasis	That terror financing is more damaging than terrorism itself; that states offering safe havens and sponsorship must be held to account; and that a permanent follow-up mechanism is needed so momentum is not lost between conferences
Outcome	Reinforced political consensus and a shared agenda on emerging-technology financing; the enduring value is diplomatic — keeping counter-financing on the ministerial radar and isolating sponsors

The candid assessment is that such conferences build norms and consensus rather than binding obligations — their power is to name the problem, coordinate standards and raise the diplomatic cost of sponsorship, complementing the harder leverage of bodies like FATF.

Current Status (as of July 2026) Pakistan remains off the FATF grey list since October 2022, but faces continuing scrutiny; the watchdog has publicly warned that delisting does not shield it from renewed monitoring on terror-financing. Virtual digital assets have been inside the anti-money-laundering framework since March 2023, with exchanges now registering as reporting entities — the regulatory frontier has shifted decisively toward crypto and decentralised finance. India continues to press for a permanent institutional follow-up to the No Money for Terror process and for tighter global rules on new payment technologies.

External State Actors

The defining feature of terrorism in India is that so much of it is manufactured abroad. A hostile state that cannot prevail in a conventional war can still bleed its rival through deniable proxies at a fraction of the cost and risk. Understanding the external state actors — their doctrines, instruments and calculations — is therefore essential, because a purely internal response treats the symptom while the cause sits across the border.

Pakistan — The Thousand Cuts Doctrine

Pakistan is the principal external state actor arrayed against India’s internal security. After failing to alter the map through the conventional wars, and especially after 1971, its establishment adopted a doctrine of sub-conventional or proxy war — famously summarised as bleeding India through “a thousand cuts.”

The instrument of that doctrine is the Inter-Services Intelligence (ISI), which creates, trains, arms, funds and directs terrorist groups while preserving the fiction that they are independent “non-state actors.”

The value of the proxy model to Pakistan is deniability — a concept examined earlier in the treatment of proxy organisations — but the documented reality is that groups such as Lashkar-e-Taiba could not operate with impunity without active funding, logistics and military support from across the border.

The ISI’s working objectives, distilled from decades of pattern, are a useful analytical checklist.

• To sustain militancy in Jammu and Kashmir as the central front of the proxy war.
• To destabilise the wider economy through counterfeit currency and disruption.
• To supply arms and explosives to a range of militants and to exploit anti-state groups within India.
• To spread communal discord, mobilising and radicalising along religious lines to divide and weaken.

The strategic shift since 2019 has been toward deniable fronts — outfits with local-sounding names spun up to project “indigenous” resistance and to evade international designation.

The most prominent is The Resistance Front, a Lashkar proxy that emerged after the constitutional change in Jammu and Kashmir and claimed the 2025 Pahalgam attack; its designation as a foreign terrorist organisation abroad is examined in the treatment of the Kashmir theatre. The doctrine is unchanged; only the branding is new.

China — Strategic Shielding and the Sovereignty Question

China’s challenge to India’s internal security is subtler than Pakistan’s but no less consequential. It operates less by sponsoring terror directly than by shielding those who do, contesting India’s sovereignty, and applying pressure that multiplies India’s internal vulnerabilities.

The most direct instrument is diplomatic protection at the United Nations. As a permanent member of the Security Council, China has repeatedly used “technical holds” in the sanctions committee to block the listing of Pakistan-based terrorists proposed by India and its partners — delaying the designation of the Jaish chief for years, and more recently stalling proposals against several Lashkar figures.

The eventual designation of a senior Lashkar leader in January 2023, once China lifted its hold, showed both the obstruction and the pressure that can overcome it.

The sovereignty objection is the second axis. The China–Pakistan Economic Corridor, the flagship of China’s Belt and Road Initiative, runs through Pakistan-occupied Kashmir — territory India claims as its own. India’s principled objection is that a connectivity project cannot be built on disputed land without consent; the deeper security concern is that Chinese investment and presence entrench Pakistan’s hold on the territory and complicate India’s position.

Two further dimensions round out the picture.

• Information operations and the shaping of narratives form part of the contemporary grey-zone contest.
• And the pressure along the Line of Actual Control functions as an internal-security multiplier: a live border with China forces India to hold forces and attention on a second front, constraining the resources available for its other theatres — a classic two-front dilemma that an adversary can exploit without firing on Indian soil.

Analytical Note — China’s Technical Holds at the United Nations A “technical hold” lets a Security Council member freeze a listing proposal without formally vetoing it — a low-cost way to protect an ally’s proxies while avoiding the public cost of an outright veto. China has used this device repeatedly to shield Pakistan-based figures, at one point stalling several Lashkar-linked designations in a single year. The pattern illustrates how great-power politics blunts the multilateral counter-terror regime, and why India argues that selective protection of terrorists discredits the whole system — a theme returned to in the assessment of why multilateral counter-terrorism underdelivers.

The Neighbourhood — Bangladesh, Nepal, Myanmar and Sri Lanka

Beyond the two principal adversaries, India’s smaller neighbours matter less as sponsors than as space — transit routes, safe havens and theatres of instability that hostile actors exploit. The recurring risk factor is fragility: when a neighbour’s politics turn or its writ weakens, the seams open.

• Bangladesh has been, at various times, both a source of concern and a partner. Under a cooperative government it acted against anti-India outfits sheltering on its soil; but the trans-border movement, illegal migration and periodic activity of radical groups remain live issues, and a change of regime can reopen questions India thought settled.
• Nepal presents the problem of the open border. The free movement that binds two friendly peoples is also exploited by terror and crime networks as a gateway into India — for infiltration, fake-currency circulation and trafficking — and has historically been used by the ISI as a soft entry route.
• Myanmar offers sanctuary and a drug corridor: difficult terrain along a porous border has long hosted insurgent camps, and post-coup instability has deepened both the refugee inflow and the narcotics flow from the eastern drug belt.
• Sri Lanka is chiefly a lesson in how quickly a jihadist cell can form even in a country long associated with a different conflict — a reminder that the transnational ideological threat respects no established script.

Case Study — Bangladesh After 2024 In August 2024, long-serving Prime Minister Sheikh Hasina — India’s closest partner in Dhaka, who had firmly suppressed anti-India militants — was ousted amid mass protests and fled to India; an interim government under Muhammad Yunus took charge. For India the transition revived several anxieties: the possible re-emergence of radical and Islamist currents, an opening for Pakistan’s intelligence to regain a foothold, the safety of minorities, and rising tension along the shared border. The wider point: India’s internal security is deeply sensitive to the domestic politics of its neighbours. A friendly, stable neighbourhood is itself a security asset; instability next door is imported as a threat at home — which is why diplomacy and internal security are inseparable in the sub-continent.

Afghanistan After 2021

The Taliban’s return to power in August 2021 reopened the oldest question in South Asian security: will Afghanistan again become a space for transnational terrorism? For India, which had invested heavily in Afghan development, the takeover was a strategic setback that removed a friendly government and raised the risk of the country hosting groups hostile to Indian interests.

The picture that has emerged is complicated. The Islamic State’s Khorasan branch (ISKP) operates as a violent rival to the Taliban and has increasingly turned to external operations, with plots linked to it interdicted in several countries including India — making it a direct, if aspirational, concern.

The Tehreek-e-Taliban Pakistan has found renewed sanctuary in Afghan territory, intensifying attacks inside Pakistan and straining Taliban–Pakistan relations to the point of open cross-border clashes. The irony is sharp: the proxy doctrine Pakistan long directed at others now rebounds on it from the west.

For India the calculus is one of cautious, interest-based engagement — guarding against any revival of anti-India terror infrastructure while keeping open humanitarian and diplomatic channels, since disengagement would only cede the space entirely.

Non-State Actors

If external states supply the strategy and the sanctuary, non-state actors are the instruments that carry terrorism out. The category is broad — from transnational jihadist organisations to diaspora networks, arms traffickers, pirates and, in the most contested framing, the multinationals and NGOs invoked in the “foreign hand” argument. What unites them is that they operate without official governmental standing, even where a state quietly stands behind them.

The Transnational Terror Organisations

At the sharp end are the organised terror groups, most of them rooted in the Pakistan–Afghanistan region and oriented against India. They differ sharply in capability and intent: some are high-capability, state-directed and India-focused; others are ideological magnets with a thin operational footprint on Indian soil.

Organisation	Origin and orientation	Capability and status
Lashkar-e-Taiba (LeT)	Founded 1990 by Hafiz Saeed; Pakistan- and PoK-based; focused on wresting Kashmir and striking the Indian hinterland	High capability, ISI-linked; behind the Parliament attack and 26/11; UN-proscribed; now operates through fronts such as The Resistance Front
Jaish-e-Mohammed (JeM)	Founded 2000 by Masood Azhar (freed in the 1999 aircraft-hijack swap); Pakistan-based, suicide-attack specialist	High capability, ISI-backed; behind Pathankot and Pulwama; Azhar designated a UN global terrorist in 2019
Harkat-ul-Mujahideen / HUJI	Older Pakistan- and Bangladesh-based outfits with Taliban links	Behind the 1999 aircraft hijack and several hinterland blasts; degraded but persistent
AQIS (Al-Qaeda in the Indian Subcontinent)	Created 2014 to draw jihadists from India, Pakistan, Bangladesh and Myanmar; operates from the Pak–Afghan region	Low operational footprint in India; mainly an ideological and online-recruitment threat; UN-banned
ISKP (Islamic State Khorasan Province)	Regional branch of the Islamic State; post-2021 focused on external operations from Afghanistan	Aspirational threat to India via online radicalisation and interdicted plots; small physical presence

The strategic reading: LeT and JeM are the state-directed spearheads, dangerous because they marry local reach to external command; AQIS and ISKP are ideological franchises, dangerous less for their footprint than for their ability to inspire self-starters online, as examined in the treatment of radicalisation and recruitment.

Diaspora Networks, Front Organisations and Foreign Funding

Terrorism and separatism increasingly draw sustenance from abroad. Diaspora communities can be a reservoir of funds, propaganda and political lobbying for movements back home — most visibly in the Khalistan case, where overseas activism, examined in the treatment of the Khalistan revival, sustains a demand largely defeated within India.

Front organisations — bodies that present a lawful social, religious or charitable face while feeding a radical pipeline — are the domestic counterpart, which is why the state has moved against several such outfits.

The channel that ties these together is foreign funding, and it sits at the heart of a genuine policy debate. The Foreign Contribution Regulation Act (FCRA) governs foreign money flowing to Indian associations, and successive tightening has been justified on the ground that opaque foreign funds can be diverted to radicalisation, subversion or influence operations.

The counter-view holds that an over-broad regime risks choking legitimate civil society — humanitarian, research and advocacy organisations that depend on foreign grants — and can be used to stifle dissent.

A balanced position accepts both truths: foreign money genuinely can be weaponised and must be monitored, but the regulatory net should be targeted and transparent rather than a blanket constraint on associational life, so that the cure does not damage the democratic fabric the policy exists to protect.

Arms Traffickers, Mercenaries and Private Military Actors

Terrorism cannot function without weapons, and a shadowy market of arms traffickers supplies them along the same routes that move drugs and counterfeit currency. Gunrunning feeds militancy in Jammu and Kashmir, the North-East and, increasingly, is delivered by drone drops across the western border — the arms-and-narcotics convergence examined in the treatment of narco-terrorism. The trafficking mechanics and the crime–terror linkage are developed in the organised-crime chapter; the security point here is that disrupting the arms pipeline is as important as neutralising the shooter.

The wider category of mercenaries and private military actors — fighters and outfits offering violence for hire — is more a feature of conflict zones abroad than of the Indian theatre, but it belongs on the map because the globalised market in armed force lowers the cost of violence everywhere and can intersect with terror networks in fragile states along India’s periphery.

Piracy in the Indian Ocean Region

Piracy is the maritime face of the non-state threat, and India — with a long coastline, dependence on seaborne trade and energy, and a position astride the Indian Ocean’s busiest lanes — is directly exposed.

Under Article 101 of the United Nations Convention on the Law of the Sea (UNCLOS), piracy is defined as illegal acts of violence, detention or depredation committed for private ends on the high seas. Its costs are heavy: crews held hostage and traumatised, soaring insurance premiums, disrupted trade and the expense of protective measures.

India has built both a legal and an operational answer. The Maritime Anti-Piracy Act, 2022 gives Indian courts jurisdiction over piracy on the high seas — including the Exclusive Economic Zone — makes the offence extraditable, and designates special courts for speedy trial, though critics note its provision for the death penalty and some definitional looseness.

Operationally, the Indian Navy patrols the piracy-prone waters, backed by the maritime-domain-awareness architecture examined in the coastal and maritime security chapter.

Case Study — The MV Ruen Operation (2024) and the Piracy Resurgence Somali piracy, dormant for years, resurged from late 2023 as global navies were drawn toward the Houthi attacks in the Red Sea, thinning the coverage that had suppressed it. The Maltese-flagged MV Ruen, hijacked in December 2023, was intercepted by INS Kolkata; after a roughly 40-hour operation in March 2024, all 35 Somali pirates surrendered and the 17 crew were rescued unharmed. India deployed a large task force of destroyers, frigates, aircraft and drones to police millions of square kilometres of sea lane. The case became the first successful prosecution under the Maritime Anti-Piracy Act, 2022, with the Mumbai special court convicting the captured pirates — a demonstration that India can now both interdict at sea and prosecute at home. The lesson: maritime security is interconnected — a crisis in one chokepoint reopens a threat in another — and India’s emergence as a net security provider in the Indian Ocean is now backed by both hard naval capability and a working legal framework.

Multinationals, NGOs and the “Foreign Hand” — A Critical Assessment

The broadest and most contested category folds multinational corporations and NGOs into the security conversation through the “foreign hand” argument — the claim that foreign commercial and civil-society actors can be vehicles for external interference in India’s internal affairs. Handled carelessly this becomes a lazy catch-all; handled critically it contains a real kernel that a good answer must weigh on both sides.

On the security side, the concern is not baseless. Foreign funding can be routed to radicalisation or agitation; disinformation and influence operations can be laundered through seemingly independent voices; and commercial actors can, in principle, be leveraged by their home states. Where evidence exists, the state has a legitimate interest in scrutiny.

On the liberty and development side, the cautions are equally weighty. Multinationals bring investment, jobs and technology that build the very stability that starves extremism of recruits; NGOs deliver services and give grievances a peaceful outlet that pre-empts radicalisation. Treating dissent, advocacy or foreign collaboration as inherently subversive risks eroding democratic space, deterring investment and alienating the communities whose trust is the real counter to terrorism.

The measured conclusion is one of evidence and proportion: the “foreign hand” is a hypothesis to be tested against facts in each case, not a verdict to be assumed. Genuine external subversion must be countered firmly, but the label should never become a substitute for evidence or a tool to silence legitimate civil society — because an open, confident society is itself the most durable security.

Current Status (as of July 2026) Pakistan-based LeT and JeM remain the principal organised threats, increasingly operating through deniable fronts such as The Resistance Front to evade designation. ISKP has grown as an external-operations and online-radicalisation concern across the region, with plots periodically interdicted in India. Following the resurgence of Somali piracy amid the Red Sea crisis, the Indian Navy has sustained a large anti-piracy deployment, and the courts have delivered the first convictions under the Maritime Anti-Piracy Act, 2022.