Trace the funding behind the threat.
Connect small financial signals with identity, infrastructure, and source-linked intelligence on how terrorist groups and their supporters fundraise and move funds.
Problem
The threat spans platforms, operations, and financial networks.
Actors change accounts and platforms.
Aliases, channels, and websites change. Investigators need to connect those identifiers to understand who is communicating and how the network operates.
Preparations appear as separate activities.
Recruitment, communications, procurement, and travel can sit in separate records. Investigators need to establish which activities are connected and what each person contributes.
Small transfers resemble ordinary activity.
Campaign donations can sit below threshold-based controls and use funds that appear lawful at the point of origin. Their significance depends on who receives them and what they support.
69%
Enforcement capability gap
Share of assessed jurisdictions with major or structural deficiencies in investigating, prosecuting, and convicting terrorist-financing cases.
Source: FATF · Comprehensive Update on Terrorist Financing Risks 2025 (opens in a new tab)
$20
Low-value campaign signal
Lower bound in TRM's published analysis of donations to extremist campaigns, which ranged into the tens of thousands.
What is Ardence?
Ardence is an AI investigation platform built for all-source intelligence. For terrorism and violent extremism investigations, teams can connect identities, communications, infrastructure, operational activity, and financing in one assessment.
How it works
Connect the actors, operations, and funding behind the threat.
Identify
Follow an alias beyond the first platform. Compare accounts, communications, and shared infrastructure to identify connections and track the actors behind them.
- Connect aliases, contact details, channels, and websites across platforms
- Compare messages and activity with TRM threat research to identify possible links
- Preserve the source for each identity link and flag connections that need corroboration
Trace
Follow the funding into the wider operation. Connect donations and payment activity with intelligence about recipients, facilitators, and procurement to assess what the funds may support.
- Trace inbound cryptocurrency transfers and identify originating services
- Identify receiving wallets, intermediaries, and cash-out services for further investigation
- Connect financial activity with off-chain intelligence about facilitators, suppliers, and purchases
Assess
Put communications, relationships, and financial activity together to assess each actor's role. Distinguish fundraising, recruitment, procurement, and operational support, and separate observed behavior from judgments about intent.
- Map connections between people, accounts, infrastructure, and activity
- Compare communications and transaction patterns to assess possible roles
- Document evidence gaps and prioritize the actors and connections that need further investigation
Act
Bring identity, communications, infrastructure, and financial findings into one source-linked record. Preserve the evidence and analytic limits so your team can corroborate findings and prepare the next action.
- Document sources, timelines, and supporting analysis for investigative and prosecutorial review
- Identify relevant services and asset issuers, and prepare evidence to support asset freezes or address blocklisting
- Prepare referrals and supporting records for action by the agencies or providers with the relevant authority
Identify
Follow an alias beyond the first platform. Compare accounts, communications, and shared infrastructure to identify connections and track the actors behind them.
- Connect aliases, contact details, channels, and websites across platforms
- Compare messages and activity with TRM threat research to identify possible links
- Preserve the source for each identity link and flag connections that need corroboration
Trace
Follow the funding into the wider operation. Connect donations and payment activity with intelligence about recipients, facilitators, and procurement to assess what the funds may support.
- Trace inbound cryptocurrency transfers and identify originating services
- Identify receiving wallets, intermediaries, and cash-out services for further investigation
- Connect financial activity with off-chain intelligence about facilitators, suppliers, and purchases
Assess
Put communications, relationships, and financial activity together to assess each actor's role. Distinguish fundraising, recruitment, procurement, and operational support, and separate observed behavior from judgments about intent.
- Map connections between people, accounts, infrastructure, and activity
- Compare communications and transaction patterns to assess possible roles
- Document evidence gaps and prioritize the actors and connections that need further investigation
Act
Bring identity, communications, infrastructure, and financial findings into one source-linked record. Preserve the evidence and analytic limits so your team can corroborate findings and prepare the next action.
- Document sources, timelines, and supporting analysis for investigative and prosecutorial review
- Identify relevant services and asset issuers, and prepare evidence to support asset freezes or address blocklisting
- Prepare referrals and supporting records for action by the agencies or providers with the relevant authority
Terrorist financing investigations.
TRM connected attack funding to an ISKP wallet.
TRM traced funding from the wallet that financed the Moscow attackers to a wallet attributed to ISKP.
A TRM lead supported a terrorism-financing conviction.
TRM supported Swedish law enforcement in an investigation that resulted in a three-year sentence under Sweden's new terrorism-financing law.
Intelligence
Intelligence on the actors and networks behind the threat.
TRM threat research
Intelligence informed by deep analysis.
TRM investigators' deep analysis informs intelligence on identities, channels, infrastructure, financing, and off-chain facilitators. This intelligence supports investigations across TRM's products and services, including Ardence.
Blockchain intelligence
Trace funds through the wider support network.
Connect wallets, services, transaction paths, and attributed entities while keeping the source basis available for review.
All-source intelligence
Dozens of data partners. One investigation platform.
Ardence brings intelligence from TRM and specialized data providers into one investigation under a single Ardence contract.¹
Use Ardence to analyse online identities, domains, infrastructure and companies alongside your team's communications, financial evidence and other records. Commercial partner intelligence and open-source information help teams investigate how the wider network operates, subject to each source's permitted-use and disclosure restrictions.
¹ Provider availability varies by customer and jurisdiction. Supplemental terms may apply.
Services
Training and specialist support for counterterrorism teams.
- Learn more
TRM Academy
Training led by national security professionals helps teams develop practical investigation skills and apply intelligence to their mission.
- Learn more
Investigative support
Work with TRM specialists to investigate threat networks, interpret intelligence, and document findings for your team's next action.
Community
Build capability around the same threat.
- Learn more
Resolve: Threat Finance
Get hands-on training and connect with fellow investigators at Resolve: Threat Finance, a dedicated mission track focused on the challenges your team faces.
Disruption Sprints
Recurring events that bring investigators and partners together to work live cases and carry out coordinated disruptions against terrorist and violent extremist networks.
Questions
FAQ
Start with a person, alias, message, account, website, payment address, or other lawfully obtained lead. TRM helps connect it to identities, communications, infrastructure, operational activity, and financial context.
Yes. Terrorist financing can involve small transfers from lawful sources. The transaction is an investigative signal, not proof of intent by itself, and the surrounding context determines its meaning.
Ardence brings blockchain intelligence from Forensics into a broader investigation alongside other evidence. Forensics provides a dedicated platform for deeper crypto tracing and analysis.
No. Attribution links an identifier to a person, entity, or campaign. Investigators must corroborate the finding with other evidence and apply the legal standards that govern their inquiry.
TRM threat research informs intelligence on off-chain facilitators and financial networks. Ardence helps investigators connect that intelligence with identities, communications, and other evidence, whether or not the investigation includes a blockchain transaction.
TRM supplies intelligence and documents findings. Financial institutions, asset issuers, courts, law enforcement, and government authorities make operational and legal decisions under their own powers.
Insights
