Three days later, the Financial Action Task Force (FATF) published a report that highlights how another class of influencers poses a different threat. Where the finfluencer compromises financial integrity, this one compromises national security.

According to FATF's report Detecting and Disrupting Terrorist Financing Activity through Social Media, Instant Messaging Applications, and Streaming Platforms, terrorists and their financiers are increasingly using a business model indistinguishable from that of mainstream creators to raise money for extremism.

From Hawala to Hashtags

For decades, tracking terror funds was a manageable task for intelligence agencies. Terrorist networks relied on front charities to raise donations, on banking channels to move money, and on underground systems like hawala to transfer funds across borders without leaving a formal trail. These methods were not frictionless: Banking transactions generated records; hawala networks depended on intermediaries who could be monitored through human intelligence. Financial intelligence units and law enforcement could, eventually, identify and disrupt the flows.

Modern technology platforms have fundamentally altered this architecture. Today's social media, messaging, and streaming services are not only communication channels; they are full-fledged digital marketplaces equipped with in-app wallets, digital tipping, livestream monetisation, peer-to-peer transfer features, and embedded links to virtual assets. The line between a content platform and a payment platform has been blurred, although the compliance frameworks have not kept pace.

This shift creates a new vulnerability. Radical creators produce highly-charged content and spread false narratives, targeting audiences most likely to be receptive. A creator does not need to physically interact with anyone to build a radicalised following. When a geopolitical conflict or humanitarian crisis creates the right emotional moment, these harmfluencers launch opportunistic digital fundraising drives, using the infrastructure already embedded in the platform.

Their revenue model runs on two tracks simultaneously. First, creators earn advertising income from the viewership that radicalising content attracts. Secondly, that newly (and already) radicalised audience becomes a source of donations. Artificial intelligence has accelerated both tracks by enabling higher volumes of targeted content at lower production cost. The result is a financing model that requires no front charity, no banking relationship, and no hawala intermediary.

The Micro-Donation Architecture

Rather than soliciting large transfers that raise suspicion, these networks run on crowd-sourced micro-donations: individually small contributions that, in aggregate, amount to large capital for terrorist operations. For instance, UN-sanctioned organisations Lashkar-e-Taiba and Jaish-e-Mohammed both pivoted toward micro-donation collection through social media platforms after their access to conventional financial channels was curtailed after sanctions enforcement.

The FATF report highlights that the method is deliberately layered. Fundraising campaigns begin on mainstream platforms to reach the widest possible audience. Once a follower shows active interest, they are redirected to private, encrypted channels where payment instructions consisting of temporary virtual asset wallet addresses, peer-to-peer transfer links, and mobile voucher codes are shared. By the time money moves, it has already left the content platform where the audience was cultivated and sits on a payment rail with no link to the content that generated the donation. Banks, which have the obligation to detect and flag suspicious transactions, only see a small transfer with no context.

The potential scale of this model is visible in JeM's fundraising efforts after the losses it sustained during Operation Sindoor. Proxy accounts and affiliated commanders posted appeals across social media platforms, and interested followers were redirected to a network of mule digital wallets hosted by Easypaisa and Sadapay. The collection target was Rs. 3.91 billion, intended to rebuild terrorist infrastructure.

The Policy Blind Spot

The regulatory architecture has to keep pace with these shifts. Current compliance obligations on technology companies focus on content: a platform is required to take down material that constitutes a terrorist manifesto or a violent video. Content that inflames, radicalises, or amplifies extremist narratives without crossing that legal threshold is treated as a separate matter and it stays on the platform, and continues generating advertising revenue.

Global regulations track content and not money. Social media companies have invested heavily in AI to identify hate speech and extremist material, but not enough to monitor suspicious financial flows. FATF notes that the capacity to identify and disrupt accompanying financial flows is still being developed. Content moderation and transaction surveillance are different disciplines, and progress on the first does not address the second.

Building the response

Innovation should not be stifled, but when a "like" generates ad revenue for terrorists and a tipping feature can aggregate donations for a banned organisation, there is a case for treating these functionalities as regulated financial infrastructure. The question of where platform responsibility begins and payment provider responsibility ends is one that requires regulatory resolution.

SEBI's concern with financial influencers has correctly identified creator platforms as a space where financial activity and financial risk coexist with content. The finfluencer and the harmfluencer operate on the same infrastructure, use the same monetisation tools, and build their audiences through the same algorithmic dynamics. Both need financial intelligence, law enforcement, and platform supervisors working together.

S Swain is co-chair of FATF's working group on risks. K Kompella is an AI Governance expert. Views expressed are personal