The Hinterland Paradox in South Africa
Throughout 2024, while South African soldiers died fighting M23 rebels in the DRC, the insurgent group’s political leadership maintained operations from a Johannesburg office building. They were raising funds, managing propaganda, and running what amounted to a shadow government. This surreal arrangement exemplified South Africa’s transformation from regional hegemon to what security analysts began calling a “continental hinterland”: the insurgent’s back office, where the messy business of modern warfare was coordinated at a comfortable distance from actual combat. Though M23’s operations have since shifted to territories under their control in eastern DRC, the pattern they established—and which other groups continue to exploit—reveals how South Africa’s institutional decay has made it essential infrastructure for transnational insurgency. All of the coordination, none of the violence. Until the violence comes home.
The Dual Reality
Few episodes better illustrated South Africa’s compromised security posture than what transpired throughout 2024. South African National Defence Force (SANDF) soldiers died in combat against the M23 rebel group in the Democratic Republic of Congo, ultimately forcing a humiliating withdrawal in February 2025 (according to an International Crisis Group assessment) [1], [2]. For much of that period, the political leadership of that very same insurgent force operated from an unremarkable Johannesburg office building, raising funds, managing propaganda, and coordinating what could only be described as a parallel state apparatus [3].
Yet M23’s playbook of diaspora mobilization, procurement networks and female-coordinated logistics wasn’t unique. It was a template other groups had already perfected. While bombs detonate in Mogadishu and the Sahel descends further into chaos, the financial plumbing, political coordination, and logistical architecture sustaining these conflicts continues to run through Cape Town, Durban, and Johannesburg. South Africa’s transformation from regional power to insurgent logistics hub represents a deliberate confluence of institutional decay, diplomatic ambiguity, and strategic incoherence. The violence happens elsewhere; Johannesburg still provides the back office.
Thanks for reading The Spotted Ape! Subscribe for free to receive new posts and support my work.
The term “continental hinterland” describes precisely this arrangement—a back office where the messy business of insurgency is conducted at a comfortable distance from actual fighting [3]. By early 2025, M23 had consolidated control over Goma, Bukavu, and other territories in North and South Kivu provinces, shifting their operational base to areas under their direct military control. Their South African presence served its purpose: establishing financial networks, procurement channels, and diaspora coordination mechanisms that could later be managed remotely. The infrastructure outlasted the physical presence.
Why Did M23 Operate Openly in Johannesburg?
Throughout 2024, the Congo River Alliance (AFC), M23’s political wing, maintained an operational hub in South Africa’s commercial capital [1], [2]. Whether the AFC was formally registered as a South African entity remains unclear from public records, but its operations were hardly clandestine—diaspora mobilization, narrative management, and according to intelligence assessments, the laundering of proceeds from mining operations in the mineral-rich Kivu provinces [3].
The cognitive dissonance bears repeating: Pretoria dispatched battalions to MONUSCO peacekeeping operations to contain an insurgency whose political leadership enjoyed freedom of operation within South Africa’s borders. Between 2023 and 2024, South African forces suffered casualties in direct combat with M23 fighters [2]. The political apparatus directing those fighters, coordinating their messaging, managing their finances, and procuring advanced military technology operated in Johannesburg, unmolested by law enforcement [3], [4].
Strategic incoherence seemed the obvious diagnosis. The more accurate interpretation: deliberate diplomatic ambiguity providing insurgent groups with a permissive operating environment. South Africa’s foreign policy establishment prided itself on “South-South solidarity,” on refusing to simply adopt Western designations of terrorist organizations, on commitment to “African solutions to African problems.” These may be noble principles. When they translated into allowing an insurgent group’s political wing to openly fundraise and procure military equipment while your own soldiers died fighting that group’s military wing, principle had curdled into something else entirely.
Women played a critical coordinating role in M23’s South African operations during 2024, particularly in managing community-level fundraising networks within Congolese diaspora populations. Female relatives of combatants maintained family connections that facilitated both recruitment and resource extraction, operating through positions of trust that made them less visible to intelligence services focused primarily on identifying male financiers and procurement specialists (based on gendered intelligence patterns documented by the Global Initiative Against Transnational Organized Crime) [5].
The Financial Architecture of Modern Insurgency
South Africa possesses, simultaneously, one of Africa’s most advanced banking sectors and one of its largest informal economies. For insurgent financiers, this is the entire point.
The Hoomer and Miller networks in Durban and Cape Town, partially disrupted by U.S. Treasury designations in 2022, operated through a clever integration of legitimate businesses and informal value transfer systems. Treasury documented transfers exceeding $69,000 to the Allied Democratic Forces in the DRC and ISIS operations across the continent (according to U.S. Treasury sanctions documentation) [6], [7]. Gold trading firms, retail operations, and import-export businesses all provided cover for what Treasury described as “many-to-one” transaction patterns, where fragmented hawala remittances coalesced into larger transfers.
The amounts might seem modest by Wall Street standards. In conflict zones, that sum buys substantial ammunition, significant bribes, and sufficient logistical capacity to sustain operations for months [7], [8]. The sophistication lies in methodology, exploiting the gap between South Africa’s formal banking oversight and its sprawling, largely unregulated informal economy.
Al-Shabaab’s fundraising apparatus demonstrates a different approach. The group relies on what it terms zakat—the extraction of obligatory Islamic charitable contributions from the Somali diaspora through religious obligation and familial coercion. There is nothing subtle about this: families in South Africa receive visits, phone calls, reminders that relatives back home might face consequences should contributions dry up. The funds flow through community networks, automotive businesses, grocery stores—sectors historically resistant to state oversight and well-suited to cash-based transactions [5], [9].
Women manage the operational backbone of these financial networks within South African diaspora communities. In Johannesburg and Cape Town, Somali women operate the small retail businesses (spaza shops, clothing stores, remittance outlets) that serve as conduits for laundering extortion proceeds. These women maintain the family connections enabling coercive fundraising, where implicit threats to relatives in Somalia ensure compliance. Traditional intelligence paradigms focus on male combatants and financiers, creating blind spots that al-Shabaab exploits systematically. The women coordinating these community-embedded networks occupy positions of trust that make them ideally placed to manage the micro-logistics of insurgent financing while remaining largely invisible to law enforcement (according to regional security assessments) [10], [11].
What makes South Africa particularly attractive is the integration of informal channels with sophisticated formal banking infrastructure. Money enters through hawala systems, launders through legitimate businesses, exits through conventional banking, all while exploiting regulatory gaps and enforcement weakness [4]. A three-card monte performed with regulatory oversight consistently watching the wrong hand.
The Hollowing of the State
None of this would be possible without what South Africans euphemistically call “state capture”—the systematic corruption and institutional erosion that characterized the Zuma administration and whose aftereffects continue to reverberate. When insurgent financiers exploit South African infrastructure, they aren’t defeating state institutions so much as operating in the vacuum left by their collapse.
The South African National Prosecuting Authority and the South African Police Service emerged from the state capture era as hollow institutions—organizationally intact yet operationally enfeebled. Critical investigative units were dismantled, experienced prosecutors driven out, intelligence capabilities allowed to atrophy. What remained was a culture of non-enforcement, where even when suspicious transactions were flagged, the capacity or will to pursue them was absent.
This institutional decay creates what might be termed “structural impunity.” Farhad Hoomer, the Durban-based businessman designated by U.S. Treasury for ISIS financing, operated for years before facing consequences (according to Treasury sanctions documentation) [7]. His network wasn’t particularly well-hidden; it simply existed in an enforcement vacuum.
The problem extends beyond individual prosecutions. The infrastructure of enforcement—interagency coordination, financial intelligence analysis, cross-border cooperation—was allowed to deteriorate during state capture and has not been rebuilt. The Financial Intelligence Centre can flag suspicious transactions; when those flags lead nowhere, when investigations stall, when prosecutions fail to materialize, technical compliance becomes theatrical. Impressive on paper, meaningless in practice.
The Grey List Paradox
South Africa’s removal from the Financial Action Task Force grey list in October 2025 was hailed by government as vindication of counter-financing reforms. From a technical standpoint, the reforms were substantial: enhanced customer due diligence, improved beneficial ownership transparency, strengthened reporting requirements. The kind of measures that look impressive in FATF evaluation reports [12].
Technical compliance can coexist with operational ineffectiveness. FATF assessments evaluate whether regulatory architecture exists, not whether it actually disrupts illicit finance. South Africa built the architecture. Whether it functions as intended remains a different question entirely.
The grey list removal may actually worsen the problem. It reduces international scrutiny precisely when that scrutiny might be most needed. It signals that the money laundering problem has been addressed when, in reality, only the regulatory framework has been updated. The networks that sustained ISIS financing before October 2025 didn’t dissolve with South Africa’s delisting; they continued operating beneath a more polished regulatory facade.
The emphasis on formal banking sector compliance misses the point when much problematic activity occurs in the informal economy. Enhanced bank supervision becomes irrelevant if money never touches a bank. Hawala networks, cash-based businesses, community-embedded extortion—none of this falls neatly within FATF’s evaluation criteria, which are designed for formal financial systems.
Even more troubling are sectors that lubricate insurgent logistics while evading quantitative capture entirely. Illegal mining operations (the so-called zama-zamas) and cigarette smuggling networks provide both revenue streams and operational cover for insurgent financing [12], [13]. These informal economies exist in a regulatory twilight zone, too dispersed to monitor effectively, too embedded in local communities to disrupt without significant political cost.
The Emerging Threat of Domestic Blowback
South Africa’s role remains primarily logistical—coordination without combat, infrastructure without carnage. This arrangement contains the seeds of its own transformation. Hinterlands have a nasty habit of becoming frontlines.
The dynamics are straightforward: When insurgent groups establish deep logistical roots in a territory, they develop local networks, recruit local operatives, create dependencies. Over time, these groups acquire the capability and potentially the motivation to conduct operations within their host territory. ISIS affiliates that currently use South Africa for fundraising and coordination could, if circumstances warrant, pivot to using it as an operational theater.
The deepening organizational structure—the recruitment of families, the embedding in community networks, the development of female-managed logistical architectures—indicates these groups aren’t merely passing through. They’re putting down roots. The more embedded they become, the more vulnerable South Africa becomes to domestic blowback that transforms rear bases into frontline targets.
Historical precedents exist, all pointing toward escalation. London served as a rear base for various Middle Eastern militant groups throughout the 1990s until it didn’t. The permissive environment that made it attractive as a logistical hub eventually made it attractive as a target. The 7/7 bombings were conducted by British citizens radicalized within networks initially established for external operations.
South Africa need not replicate London’s experience, but the risk factors are alarmingly similar: deep diaspora networks, institutional weakness, enforcement gaps, and a political establishment that mistakes non-alignment for immunity. The longer these networks operate, the more embedded they become, and the more difficult they are to disrupt without triggering precisely the kind of domestic blowback that officials currently believe they’re avoiding.
What Happens Next?
South Africa finds itself in a paradoxical position: removed from the FATF grey list while functioning as a critical node in continental insurgent infrastructure; having hosted M23’s political operations while sending soldiers to die fighting them; possessing sophisticated anti-money laundering regulations while insurgent financing networks operate with relative impunity.
The fundamental problem is political will masquerading as technical capacity. South Africa’s government has demonstrated it can build regulatory architecture when international pressure demands it. What it has not demonstrated is willingness to actually use that architecture to disrupt the networks that matter. Designating a few financiers to satisfy American demands is one thing; systematically dismantling hawala networks, prosecuting community leaders engaged in extortion, and proscribing insurgent political fronts is quite another.
Such systematic disruption would require confronting an uncomfortable reality: South-South solidarity and non-alignment have practical limits. There is no particular virtue in providing sanctuary to groups engaged in mass violence, regardless of whether Western governments have designated them as terrorists. It would require rebuilding prosecutorial and intelligence capacity gutted during state capture. It would require developing intelligence frameworks that can actually identify and disrupt the female-managed logistics networks that current approaches systematically overlook—frameworks that recognize women’s roles in al-Shabaab’s zakat collection, M23’s diaspora coordination, and ISIS affiliate financial management as central to operational success rather than peripheral support functions.
Above all, it would require political courage.
Concrete policy measures that should be implemented immediately:
South Africa’s Financial Intelligence Centre requires two immediate interventions: First, forensic analysis of M23’s historical financial flows to identify ongoing nodes—the businesses, intermediaries, and community structures that don’t dissolve when clients relocate but simply find new ones. Second, emergency funding for a dedicated informal economy monitoring unit focused on hawala networks and cash-intensive sectors like spaza shops, automotive businesses, and gold trading that current formal banking compliance frameworks cannot touch. Al-Shabaab, ISIS affiliates, and other groups continue to exploit precisely these gaps.
Law enforcement must develop gender-sensitive intelligence training programs that recognize female-managed logistical networks as primary targets rather than peripheral concerns. The women coordinating community fundraising, managing small retail businesses, and maintaining diaspora connections aren’t supporting roles in insurgent infrastructure—they are the infrastructure. M23’s 2024 operations demonstrated this; al-Shabaab’s ongoing networks prove it daily.
Until such measures materialize, South Africa will continue its role as continental hinterland. M23 may have relocated to territories under their control, but the financial flows that sustained their 2024 operations continue through other channels and other groups. Al-Shabaab’s extortion networks expand, ISIS affiliate financing persists, and the female-managed logistical architectures deepen. The infrastructure M23 helped establish remains available, adaptable, and increasingly sophisticated.
The question isn’t whether this arrangement is sustainable—it manifestly isn’t—but when and how it collapses. A gradual awakening to the threat, accompanied by genuine institutional revitalization, remains possible. So does an alternative: waiting for a domestic atrocity to concentrate minds.
If there’s one lesson from the last two decades of counter-terrorism, it’s this: by the time the violence reaches home, it’s already far too late to prevent it. The insurgent’s back office doesn’t remain a back office forever. Eventually, inevitably, it becomes the front.
South Africa still has time to avert that future. Time, like institutional capacity and political will, is not an infinite resource. The meter is running.
References
[1] Britannica, “March 23 movement: Leaders, funding, and AFC.” 2025. Available: https://www.britannica.com/topic/March-23-Movement
[2] International Crisis Group, “The M23 offensive: Elusive peace in the great lakes,” Africa Report 320, 2025.
[3] Critical Threats Project, “M23’s state building project: Africa file special edition,” Special Report, 2024.
[4] South African Reserve Bank Prudential Authority, “Money laundering, terrorist financing and proliferation financing sector risk assessment for the south african banking sector,” Sector Risk Assessment, 2025.
[5] Global Initiative Against Transnational Organized Crime, “The terror-crime nexus in south africa: Informal retail and transport extortion,” Research Report, 2025.
[6] The Soufan Center, “IntelBrief: South Africa has emerged as a financial hub for ISIS in Africa.” 2023. Available: https://thesoufancenter.org/intelbrief-2023-march-21
[7] A. Tobin, “U.S. Treasury designates four ISIS financiers in South Africa,” FDD’s Long War Journal, 2022.
[8] E. Sanderson, “The islamic state in South Africa: A 6-month outlook,” Grey Dynamics, 2022.
[9] E. O. S. Odhiambo, E. W. Njoroge, and M. M. Hafez, “Al-Shabaab’s financial fortitude: The link between funding strategies and organizational resiliency,” Open Journal of Political Science, vol. 15, no. 2, 2025.
[10] M. Ewi, “Boko Haram’s South African connections: What do we know?” ISS Today, 2022, Available: https://issafrica.org/iss-today/boko-harams-south-african-connections-what-do-we-know
[11] H. Matfess, Women and the war on Boko Haram: Wives, weapons, and witnesses. Zed Books, 2017.
[12] N. Stewart, “Policy alert: Congress must act to keep South Africa on FATF grey list,” Foundation for Defense of Democracies, Policy Alert, 2025.
[13] S. Haysom, “In South Africa, illicit cigarettes are a smoking gun on corruption,” New Atlanticist, 2019.
Thanks for reading The Spotted Ape! Subscribe for free to receive new posts and support my work.