News Image

When Criminals Donate (Part 2 of 2)

NPO Vulnerability Self-Assessment: A Practical Guide
JULIA CHIN
BY JULIA CHIN

  • Even reputable charities can be unwittingly used to launder reputations as they may lack the frameworks to detect sophisticated threats.
  • It is important that charities know their vulnerabilities, so they can take action to build or strengthen capability in those areas.
  • The NPO Vulnerability Self-Assessment Checklist examines 25 controls across five sections, namely, governance and oversight, financial controls, donor due diligence, programme delivery, and reporting and response.

Part 1 of this article explains why criminals donate, and how non-profit organisations (NPOs) become the unwitting accomplices to “clean” the donors’ public image.

The white-washing threat is real, and finance professionals can do their part to help NPOs strengthen their anti-money laundering capability. NPOs can also evaluate their susceptibility to unlawful exploitation, such as through the use of an NPO Vulnerability Self-Assessment Checklist (Checklist) – a practical tool for assessing the organisation’s governance, financial controls, donor due diligence, and reporting readiness.

This article delves into the details of the Checklist.

WHY SELF-ASSESSMENT MATTERS

Singapore’s S$3-billion money laundering case revealed that even reputable charities can be unwittingly used to launder reputations. More than S$800,000 in donations from convicted individuals flowed to respected organisations, not because those charities failed, but because they lacked the frameworks to detect sophisticated exploitation.

This article expands on the Checklist by explaining each control area, and offering tailored action plans based on your score.

The Checklist also helps to address the “NPO paradox”, where the same qualities that make charities powerful – trust, community access, and diverse funding sources – also make them attractive targets. This isn’t a reason for paranoia; it’s a reason for proportionate vigilance.

HOW TO SCORE

For each of the 25 controls across the five sections, assess your current state:

  • In place (1 point): Control exists, is documented, and actively used
  • Partial (0.5 points): Control exists but is informal or inconsistent
  • Not in place (0 points): Control doesn’t exist

Look hard. This assessment is for your organisation’s benefit. Involve finance, programmes, and governance perspectives.

Even the best controls can’t prevent every incident. What matters is whether your organisation can detect problems early and respond appropriately.

RED FLAGS QUICK REFERENCE (NON-EXHAUSTIVE): BAD PEOPLE DON’T WALK AROUND WITH RED FLAGS

Donor red flags:

  • Donation size inconsistent with apparent wealth
  • Unusual requests for anonymity or specific routing
  • Foreign national with limited connection to Singapore
  • Donations followed by requests for PR/citizenship support letters
  • Recently arrived or applying for residency
  • Business or source of wealth unclear
  • Donor unusually eager for public recognition or titles
  • Resistance to basic due diligence questions
  • Offers to donate more if given honorary titles or positions


Transaction red flags:

  • Donations just below verification thresholds
  • Multiple donations in quick succession
  • Requests for refunds after donating
  • Large cash donations without explanation
  • Donations timed around immigration milestones


Programme red flags:

  • Beneficiaries who can’t be verified
  • Significant variance between expenditure and outcomes
  • Partners resistant to site visits or transparency

FIVE SECTIONS OF THE CHECKLIST

Strong governance is your first line of defence. When boards actively oversee operations and maintain independence from management, exploitation becomes harder.

Weak financial controls create opportunities for internal fraud, external exploitation, and regulatory breaches.

The S$3-billion case demonstrated that criminals donate to charities not despite their crimes, but because of them. Know Your Donor (KYD) isn’t about treating every donor as a suspect, it's about proportionate vigilance.

Programme delivery is where funds meet mission and where diversion risks are highest.

SCORES AND WHAT THEY MEAN

Score 21–25: Strong foundation

Your organisation has robust controls. Maintain through annual reviews. Document practices to survive staff turnover. Share experience with peer organisations.

Score 15–20: Gaps to address

You have a foundation but with notable gaps. You need to prioritise:

Score below-15: Significant risk

Your organisation has significant control gaps requiring urgent attention. You must take immediate actions:

30-day actions:

  • Brief board on risk exposure
  • Implement segregation of duties for payments
  • Establish basic donor records for donations above S$1,000
  • Designate STR-responsible person


60-day actions:

  • Draft KYD policy
  • Implement monthly bank reconciliation with independent review
  • Conduct basic red flags training


90-day actions:

  • Implement sanctions screening
  • Document incident response plan
  • Establish programme spot checks

Consider engaging external expertise. For example, ISCA Academy offers practical training on NPO governance and AML/CFT compliance.

CONCLUSION: DE-RISKING THROUGH CAPACITY BUILDING

The S$3-billion case was a wake-up call. It revealed that even respected institutions can be unwittingly exploited, not because they failed, but because they lacked the frameworks to detect sophisticated threats.

The answer isn’t to treat every donor as a suspect. It’s not to burden lean charity teams with bank-grade compliance programmes, and it’s certainly not for banks to de-risk the sector entirely.

The answer is proportionate capability building.

Give NPOs the knowledge to understand their risks, the tools to conduct sensible due diligence, the frameworks to escalate and decline when necessary, and the confidence to demonstrate their integrity.

For charity leaders: Use this assessment honestly. Brief your board. Develop an action plan with clear ownership.

For board members: Demand visibility into your organisation’s control environment. Ask the difficult questions.

For finance professionals: Lend your expertise to the charitable sector, as board members, auditors, or advisors. Charities need what you know.

The charitable sector exists to serve those who need it most. Protecting its integrity isn’t just a compliance exercise, it’s how we ensure that trust remains deserved.

Also read Part 1 of the article. It outlines why criminals donate to charitable organisations, and how finance professionals can help NPOs strengthen their anti-money laundering capability.


Julia Chin is Founder/CEO, JFourth Solutions.

Loading spinner