CFCS Domain 9: Terrorist Financing Study Guide 2026

What Domain 9 Actually Covers

Terrorist financing (TF) occupies a unique position within the CFCS body of knowledge. Unlike most financial crimes that center on concealing illegally obtained funds, terrorist financing can involve money from entirely legitimate sources - wages, charitable donations, small business income - redirected toward violent ends. That inversion is exactly what makes Domain 9 conceptually demanding, and it is why the ACFCS treats it as a standalone domain rather than folding it into Domain 1 (Money Laundering).

Domain 9 asks candidates to understand the full lifecycle of terrorist funds: how they are raised, how they move across borders and institutions, how they are stored between operations, and how they are ultimately used. The exam does not simply test whether you can define "terrorist financing." It expects you to identify it, distinguish it from adjacent crimes, and recommend appropriate institutional responses - all within realistic, scenario-driven question stems.

Why Terrorist Financing Is Distinct from Money Laundering

Candidates who come to the CFCS with a strong AML background sometimes underestimate Domain 9 because they assume TF is just money laundering with a different end-use. That assumption will cost you points. Here is how the two domains diverge in ways the exam will test:

Understanding this table is not enough - you must be able to apply these distinctions in a scenario where a compliance analyst receives transaction alerts and must determine the correct escalation path. That is the level of precision the CFCS demands.

Core Concepts You Must Master

Fundraising Typologies

Terrorist organizations raise funds through a wide range of methods that your exam scenarios may depict. Study each of the following categories with concrete operational examples:

Movement and Storage Mechanisms

Once funds are raised, they must reach operatives. Domain 9 requires fluency in how terrorist networks move value across borders and store it between operational use:

• Hawala and informal value transfer systems (IVTS): Underground broker networks that settle obligations through trust and bookkeeping rather than physical fund movement. Exam scenarios involving hawala are common because IVTS transactions leave minimal paper trails in the formal banking system.
• Bulk cash smuggling: Physical transport of currency across borders, often exploiting weak customs controls or corrupt officials - which creates overlap with Domain 3 (Anti-Corruption and Bribery).
• Prepaid cards and e-wallets: Low-value, low-KYC instruments frequently used for cell-level operational expenses.
• Trade-based value transfer: Over- or under-invoicing of goods to move value internationally, a technique that also appears in Domain 4 (Tax Evasion) scenarios.
• Real estate and luxury goods: Less liquid but used for longer-term storage of TF funds in high-value, opaque markets.

Legal and Regulatory Frameworks

You need to know the architecture of the counter-terrorist financing (CTF) regulatory environment at both the international and domestic level. Key instruments include:

• FATF Recommendations 5, 6, 7, and 8 (terrorist financing, targeted financial sanctions, wire transfers, and NPO risk)
• UN Security Council Resolutions 1267, 1373, and their successor resolutions establishing the Al-Qaida/ISIL sanctions regime
• The USA PATRIOT Act Section 326 (customer identification) and Section 314(a)/(b) (information sharing)
• The EU's successive Anti-Money Laundering Directives and their CTF provisions
• Designation processes: OFAC SDN List, UN consolidated list, and the distinction between statutory and executive-order-based designations

Reporting Obligations and Institutional Response

Domain 9 is not purely academic. The exam will test what a financial institution - or an investigator - should do when TF is suspected. This includes:

• When to file a Suspicious Activity Report (SAR) versus a Currency Transaction Report (CTR)
• The "no tipping off" prohibition and its application to TF investigations
• Freezing assets under OFAC or UN designations without prior customer notice
• Coordinating with law enforcement under Section 314(a) requests
• Enhanced due diligence (EDD) triggers for high-risk customers with TF indicators

How Scenario Questions Test This Domain

The CFCS exam uses 135 scenario-based multiple-choice questions across its 12 domains. Understanding the question architecture is as important as knowing the subject matter. For a deeper breakdown of question formats, review the CFCS Exam Format: Question Types and Time Management guide before sitting your exam.

Domain 9 scenarios typically follow one of three patterns:

1. The compliance officer scenario: A financial institution employee reviews transaction data and must determine whether activity constitutes TF, ordinary ML, or legitimate business. The correct answer often hinges on the destination of funds rather than their source.
2. The investigator scenario: An analyst following a financial trail must identify which technique (hawala, IVTS, trade-based transfer) is being used and recommend the most appropriate investigative step or legal instrument.
3. The policy scenario: A compliance manager must update institutional controls in response to a new typology, designation, or regulatory guidance. These questions test your knowledge of FATF recommendations and domestic frameworks.

In all three patterns, wrong answers are carefully designed to be plausible. Distractors often describe the correct action for a money laundering scenario rather than a TF scenario - reinforcing why the Domain 1 vs. Domain 9 distinctions matter so much in practice.

Cross-Domain Connections That Appear on the Exam

No CFCS domain exists in isolation. Domain 9 has documented, examinable connections to at least five other domains. Candidates who study TF in a silo will miss the integrated questions that test whether you understand financial crime as a system.

A Domain 9-Specific Study Schedule

Because the CFCS exam covers 12 domains across a 4-hour, 135-question sitting, you cannot treat each domain equally. Domain 9 is conceptually dense and cross-linked enough to warrant concentrated, multi-week attention. The schedule below uses spaced repetition and active recall - but mapped specifically to the CFCS content areas rather than generic topic blocks.

Who Hires CFCS Holders and Why Domain 9 Matters

The CFCS credential is recognized across financial intelligence, compliance, law enforcement, and regulatory sectors. Domain 9 proficiency is particularly valued by employers operating in high-stakes CTF environments:

• Financial intelligence units (FIUs): National-level agencies that process SAR data rely on analysts who can distinguish TF patterns from general AML typologies. CFCS holders with strong Domain 9 knowledge are well-positioned for these roles.
• Global banks and correspondent banking departments: Post-FATF Recommendation 13 scrutiny means banks need compliance staff who understand how TF moves through correspondent relationships and can design appropriate screening controls.
• International organizations and NGOs: Multilateral bodies and humanitarian organizations increasingly require financial crime expertise to manage the risk that their own funds may be diverted - a direct Domain 9 concern under FATF Recommendation 8.
• Law enforcement and prosecution agencies: Federal agencies with financial crime mandates, including task forces focused on terrorist finance disruption, recruit CFCS credentialed professionals as analytical staff.
• Fintech and payments companies: As virtual assets and digital payment platforms become primary TF vectors, fintech compliance teams with CFCS holders gain regulatory credibility with examiners.

The breadth of the CFCS - covering 12 domains from Domain 1 through Domain 12 - is precisely what distinguishes it from narrower certifications. An employer hiring a CFCS holder knows that candidate can reason across money laundering, sanctions, human trafficking, and terrorist financing simultaneously, which is how financial crime actually operates in practice.

Exam Mechanics Recap

Before you schedule your exam, make sure you have the logistics confirmed. The CFCS is delivered through the Kryterion Online Proctored (OLP) network, meaning you can sit it from home with appropriate proctoring controls in place. The exam fee is $1,195 for current ACFCS members, $1,395 bundled with a one-year membership, or $1,725 with a three-year membership. Government and public sector rates are available in a lower range. If you are eligible for a government rate, confirm eligibility with ACFCS directly before purchasing.

Once you purchase, you have a 12-month window to schedule your sitting - there is no fixed exam calendar. The exam itself is 4 hours, 135 scenario-based questions, closed-book. You need 88 correct answers to pass. That means you can miss up to 47 questions and still earn the credential - but that margin disappears quickly if you have significant gaps in multiple domains.

Prerequisites are non-negotiable: you must hold an active ACFCS membership and have accumulated 40 earned credits in financial crime and related fields through a combination of experience, education, training, and professional certifications. The certification is valid for three years, with renewal requiring 60 continuing education credits and maintained ACFCS membership.

For scenario-format question practice that mirrors the actual exam experience, use the CFCS Exam Prep practice tests throughout your preparation - not just in the final week. Early exposure to the scenario format helps you internalize how the exam distinguishes between domains before you are under timed pressure.

Frequently Asked Questions