When cartels become terrorist organizations: what changes for due diligence
In February 2025 the United States designated eight Latin American criminal groups — six Mexican cartels, Tren de Aragua and MS-13 — as foreign terrorist organizations. The list has kept growing. By September 2026 it had reached twenty-one, and it now includes Ecuadorian and Haitian gangs, Colombia's Clan del Golfo, Venezuela's Cartel de los Soles and Brazil's two largest criminal factions, Comando Vermelho and the PCC.
For many compliance teams the first reaction was to check whether their screening tools had picked up the new names. That is the easy part, and the least important. Many of these groups were already sanctioned under counter-narcotics authorities, so dealing with them was off limits before. What the terrorist designation changes is the nature of the exposure.
From a sanctions problem to a material support problem
Providing "material support or resources" to a designated foreign terrorist organization is a federal crime. It carries long prison sentences, reaches conduct outside the United States, and does not require any intent to further violence — knowing who the recipient is can be enough. The definition of support is broad: money, services, transport, lodging, equipment. Designation also opens the door to civil suits by victims against companies accused of assisting a designated group.
None of this is theoretical. Chiquita pleaded guilty in 2007 over payments to a Colombian paramilitary group that had been designated as a terrorist organization, and a U.S. civil jury was still finding it liable for those payments in 2024. Lafarge pleaded guilty in 2022 to conspiring to provide material support to armed groups in Syria so that its cement plant could keep operating. In both cases the company's position was that it paid to protect its people and its business. In neither case did that argument prevent criminal liability.
Where the exposure actually sits
The uncomfortable point for companies operating in Mexico, Ecuador, Colombia or parts of Brazil is that these groups are not distant counterparties. They tax economic activity in the territory they control. Extortion payments — the "derecho de piso" charged to farms, mines, transport fleets and retailers — are a cost of doing business in some areas, usually paid by a local manager, a contractor or a supplier rather than by headquarters. The same groups have moved into legitimate-looking businesses: fuel distribution, trucking, agriculture, security services, construction.
That means the realistic risk is rarely a contract with a listed name. It is a logistics provider that pays for safe passage, a security firm with the wrong owners, a fuel supplier whose prices are too good, or a line in a subsidiary's books labeled "community relations". None of those will ever produce a screening hit. And whether a payment made under threat amounts to a crime is a question for counsel, answered case by case — not something to assume in either direction.
What good practice looks like
The work is the same investigative work as before, pointed at a different question. Map where the company and its critical suppliers physically operate against where designated groups are known to control territory. Look hardest at the third parties that move goods, cash and people through those areas. Ask local management directly about extortion demands, and make it safe for them to answer. Review payments with vague descriptions in high-risk locations.
And document all of it. When the question eventually comes — from a regulator, a bank or a plaintiff — the company that can show it looked, and what it did with what it found, is in a very different position from the one that only ran the names.