[This piece is part of a yet-to-be-launched investigative section called “For the Record”. The New Arab believes that public interest comes first and that publishing research findings, even if not conclusive, can inform future investigative efforts.]
It’s March 4 in Baghdad. The operations room at the command headquarters of the Iran-backed Popular Mobilisation Forces (PMF) is bustling. Faces are tired and tense, eyes darting between screens connected to thermal cameras deployed across operational sectors and tablets displaying military maps. It is 9:00pm, and all indications suggest that the night would be as long as the ones before it.
Most officers in the room are monitoring developments at sites targeted by US and Israeli aircraft, while the rest engage in detailed discussions about the operational landscape, trying to predict the targets of the jets that night.
Amid heated discussions about the flashing lights that represent incoming aircraft, a flood of cables pour in from various units. Unlike the previous cables, the content of which summarised the casualties and damage from enemy airstrikes, these cables report that thousands of fighters received SMS and WhatsApp messages from foreign numbers on their personal mobiles. The messages either threatened them, or urged them to turn on their commanders.
“Your support for the Iranian Revolutionary Guard’s operations will not go unpunished. We will find you,” one of the SMS reads.
“Our ability to strike you is limitless. Every step you take brings you closer to your destruction,” read another.
The potential impact of the messages on fighters’ morale did not overly concern an “ideologically driven force” such as the PMF, one of its commanders told The New Arab (TNA). Broadcasting a single recorded speech of the assassinated Iranian Supreme Leader Ayatollah Ali Khamenei would reportedly “revive the fighters’ morale and push them to sacrifice themselves,” he continued.
Thousands of PMF personnel received threatening messages from foreign numbers as a part of a psychological operation in March. The message above reads “Your support for the IRGC’s operations will not go unpunished. We will find you”.
The instructions given to PMF troops were clear and simple: do not reply, report immediately to your direct officer, document the SMS and the sender’s number, then block it, PMF commanders told TNA.
The flood of messages did not stop. They arrived in waves, once or twice a week throughout the course of the war, commanders said.
“Your leaders have abandoned you. They are enjoying the money they stole and living luxurious lives with their families, while they leave you to be killed for their own interests,” another SMS read. The messages were directed primarily at detachment and battalion commanders, fighters, and mid-level administrators rather than senior commanders or officials, suggesting a pattern of selective targeting.
The messages alarmed the Iraqi Joint Operations Command (I-JOC), the body that coordinates all branches of the Iraqi armed forces. They requested an investigation to determine the source of these messages, the extent and scope of the security breach, and the resulting damage, military officials told TNA.
Who are the PMF?
The PMF is an umbrella organization of armed groups that were originally established following Islamic State’s (IS) capture of Mosul in 2014, but a 2016 law formalized the its legal status as a part of the Iraqi state.
Some but not all PMF factions have close links to Iran’s Revolutionary Guards Corp (IRGC). Major Iranian-linked factions include Kata‘ib Hezbollah and Harakat al-Nujaba.
In 2025, Washington escalated its direct push for the Iraqi government to disarm the PMF. Iraqi Prime Minister al-Zaidi, who took office earlier this year, agreed to a September 2026 deadline. Key Iran-backed factions rejected al-Zaidi’s move, but others, such as the Sadrist Movement’s Saraya al-Salam, have accepted the proposed timeline.
“The PMF rejected a request to let us investigate the incident, so we asked them to conduct an internal investigation,” a member of the Iraqi Joint Military Operations Command told TNA.
Preliminary PMF probes found that around ten thousand fighters had received such messages. Geographically, units deployed in Mosul, Kirkuk, and Anbar were among the most heavily targeted. Most of the attacks that targeted US military installations in Iraqi Kurdistan had originated from these areas, leading Iraqi commanders to believe this explained why personnel deployed there were the key targets of the messaging campaign, a member of the I-JOC told TNA.
Fighters and commanders affiliated with Iranian-backed armed factions were the target of these messages despite the deployment of army and federal police forces in the same areas, a military commander familiar with the investigation told TNA.
Mourners carry the caskets of PMF forces slain by US-Israeli airstrikes in March 2026. [Getty]
Investigators began examining possible data sources that could explain the potential pattern of messages and recipients’ selection; the findings pointed to the PMF’s centralised personnel and payroll database.
“The [leaked] information actually came from the payroll database,” a Joint Operations Command officer familiar with the investigation told TNA, “[the PMF] have a [payroll] database that includes sector deployments, tasks, and affiliations, and then the leads are connected.”
Over the past five months, The New Arab sat down with an array of high-ranking military and security officials in Iraq, who were all relatively confident that access to this specific database had enabled the psyop (psychological operation) against the Iran-backed PMF. Although the operation was not successful in turning low-ranking soldiers against their commanders, our findings suggest that K2 Integrity – a financial intelligence firm with ties to the US Treasury and Israel – could have played a role in granting Iran’s foes access to a goldmine of information on its allies in Iraq.
As the US-Israeli war on Tehran rages on, K2 Integrity’s operations sprawl across the region – including Libya, Lebanon and Iraq – and, in line with the vision of its founders, continue to serve as an asset in Washington’s financial War on Terror.
‘Ghost’ imports
For years, US officials expressed frustration over the continued flow of large numbers of US dollars – sold through the Central Bank of Iraq’s dollar auction – to Iran and sanctioned entities.
Discussions during periodic meetings between the US Treasury, the Federal Reserve, and the Central Bank of Iraq (CBI) often revolved on the need for effective mechanisms capable of tracing dollar transfers and identifying the ultimate beneficiaries.
Restricting participation in the foreign currency auction to holders of Iraqi Chambers of Commerce Union ID cards, as had been the practice before 2011, or to registered companies thereafter, did not prove effective in limiting dollar flows outside Iraq.
“We […] identified the problem, but fixing it is difficult,” a former senior CBI official told TNA, “we have open trade with China and Turkey. This is clear and transparent, but […] those who trade with Iran buy dollars from the parallel market because it is a sanctioned country, so there is always demand and pressure for dollars outside the official [banking] sector.”
The gap between sales through the CBI’s foreign currency auction window, Iraq’s main channel for accessing official US dollars, and the country’s recorded imports illustrates the scale of dollar flows. The CBI sold approximately $180 billion through its foreign currency auction window between 2018 and 2021. Around 85 percent of these funds ($155 billion) were allocated to financing imports, although Iraq only imported $87 billion worth of goods of services in that same period.
Iraqi and US officials attributed the difference to fictitious or “ghost” imports used to facilitate the transfer of dollars abroad.
In March 2021, Washington started pushing for the creation of an electronic system linked to the CBI’s foreign currency auction window.
Four months later, CBI announced the launch of a platform to exchange documents and data with all banks. All licensed banks were instructed to subscribe by 15 August 2022.
Iraqi and US officials agreed that the platform would start operating on a trial basis at three banks – Baghdad Bank, al-Mansour Bank, and the Trade Bank of Iraq – while the foreign currency auction window would continue operating in parallel to mitigate the potential disruptions to the dollar exchange rates in the markets .
A full transition to the electronic platform as the sole channel for obtaining official dollars was scheduled for the beginning of 2023, but this timeline was soon abandoned.
In October 2022, former acting Finance Minister Ihsan Abdul-Jabbar revealed the theft of more than $2.5 billion in tax deposits held in an account at the state-owned Rafidain Bank.
Iraqi Prime Minister Mohammed Shia al-Sudani publicly acknowledged that a significant amount of the stolen funds had been smuggled out of the country; Iran-aligned actors reportedly played a key role in the embezzlement.
The scale of theft from the government purse, “The Heist of the Century”, likely hardened the US authorities’ stance towards Iraq. Washington demanded the immediate shutdown of the foreign currency auction window and the adoption of the electronic platform as the sole channel for accessing US dollars.
“After a month and a half of operation [of the platform], [US officials] said: ‘It’s over, the platform is in control,” a former senior CBI official involved in talks told TNA.
Enter K2 Integrity
Since 2004, Iraq’s oil revenues have been deposited in an account at the New York Federal Reserve Bank, managed by CBI on behalf of the Iraqi government.
By late 2022, dollar auction sales sharply declined as a result of banks and exchange companies’ reluctance to participate in the newly instituted electronic platform and be subjected to further scrutiny.
The growing shortage of dinars, which the central bank obtains from the sale of dollars to the private sector, quickly evolved into a broader financial crisis in which the government was left struggling to pay public sector workers’ salaries.
The Iraqi government attempted to mitigate the disruption domestically by increasing cash-dollar sales and offering banking facilities to traders and investors seeking access to the dollar auction, but to no avail.
Iraqi officials were concerned that failure to meet the US demands would ultimately jeopardise Iraq’s access to funds held at the Federal Reserve.
“They twisted our arm,” a former senior CBI official involved in talks with the US officials told TNA, “we can’t refuse or they will turn off the tap [of dollars]”.
By late 2022, a major shift had taken place in the US approach toward Iraq’s banking sector. Officials moved beyond monitoring dollar outflows and began requesting to trace the source of the dinars used to purchase dollars and the institutions and channels through which they moved, Iraqi officials told TNA.
“The Americans aren’t currently concerned with tracking the dollars, because if they originate from CBI, this means they were laundered and dried,” a former senior CBI official told TNA, “they want to know the source of the dinars that purchased the dollars.”
US officials required the appointment of an international firm to audit foreign currency transfers and trace the origin of dinars used in these transactions.
K2 Integrity, a US financial investigations firm, was among the proposed companies. KPMG, one of the Big Four global accounting firms and the CBI’s technical adviser at the time, recommended the US company.
Unlike the Big Four auditing firms, K2 Integrity specialises in investigations, sanctions compliance, and illicit finance. Many of its senior staff are former officials of the US Treasury. Iraqi bankers said the company was viewed as particularly capable of navigating Washington’s compliance demands.
“[K2 Integrity] knows how Treasury and Federal Reserve officials think, which makes matters easier and helps mitigate the reactions of US officials to any disasters that may be uncovered during audits,” a former government financial adviser told TNA.
Negotiations with the company began in November 2022, with a preliminary understanding that operations would begin in February 2023.
The shift
As Iraqi dinar shortages worsened, the government expanded electronic payments requirements as part of a broader effort to reduce reliance on cash transactions and keep larger amounts of money circulating within the banking sector.
Then Iraqi Prime Minister, Mohammed Shia’ al-Sudani, asked the CBI governor, Mustafa Ghalib, to lower the official dollar exchange rate, Ghalib rejected the request, arguing that the crisis was temporary. To his mind, lowering the exchange rate further would have intensified that demand, reduced government revenues, and driven up consumer prices.
By late January, the crisis had further intensified with the black market exchange rate reaching unprecedented levels and consumer goods prices rising sharply.
Al-Sudani summoned Ghalib again to the presidential palace and renewed his request for a rate adjustment, but the meeting ended with Ghalib submitting a request to be relieved of his duties.
Hours later, Sudani announced his dismissal and the appointment of Ali Mohsen al-Alaq as his successor.
As Iraq relies heavily on imports, sharp fluctuations in the dollar-dinar exchange rate impact household’s purchasing power. [Getty]
Al-Alaq, who had previously served as governor of CBI, maintained longstanding ties with US financial stakeholders. Iraqi officials said the prime minister viewed him as better positioned to restore communication channels with Washington.
Immediately after his appointment, al-Alaq moved to contain the crisis between the CBI, the US Treasury, and the Federal Reserve. Within two weeks, he finalised negotiations with K2 Integrity and signed an agreement on behalf of CBI.
At the same time, the CBI introduced a package of measures to expand access to dollars through official channels for certain businesses, and requested a reduction in the official exchange rate.
Negotiations between Washington and CBI produced a major shift in the regulatory framework governing Iraq’s dollar transfer system: Iraqi and US officials agreed to replace the existing post-review mechanism – which reviewed transfers after dollars had already been released – with a pre-transfer review system.
“Post-audit means oversight. Prior-audit means decision. That is, there is a decision [from the US] to oversee and investigate [transactions],” a former Iraqi prime minister told TNA.
A new tracing system
Unlike post-auditing review, the shift to pre-audit review required an integrated verification framework linking the CBI to multiple government databases, allowing transaction data and supporting documentation to be cross-checked against identity, company registration, tax, customs, payroll, and other administrative records before approval.
Within the CBI, this requirement was addressed through the expansion and redesign of the electronic platform: under the supervision of K2 Integrity and KPMG, the Financial Institutions Transaction Reports (FITR) was developed as a unified system for data collection, verification, and auditing.
A report published by CBI in June 2026 identified K2 Integrity as responsible for reviewing foreign currency transfer requests submitted by Iraqi banks on a daily basis.
No public information is available about the first contract concluded by the CBI with K2 Integrity. However, a former senior CBI officials familiar with the terms of the first agreement signed in February, told TNA that the bank had granted the company access to the FITR system. The contract was annual, they said, and valued at nearly $12 million per year, said a former CBI official.
The June report revealed that the CBI had signed a second contract with the company in August 2023, and a third in September 2024.
Following US threats of cutting off the flow of dollars, the Central Bank of Iraq was forced to adopt new digital systems overseen by US firms. [Getty]
Bankers familiar with the process told TNA that K2 Integrity’s work was largely focused on reviewing historical transactions involving sanctioned banks. The third contract tasked K2 Integrity with monitoring 20% of US dollar remittances and 100% of UAE dirham remittances.
The New Arab contacted the CBI and K2 Integrity, seeking comment on this story, but we haven’t received any response in time for publication.
The role of exchange and intermediary companies, previously central to dollar distribution, became limited to cash sales for travel, medical, and education purposes. Their operations, along with daily cash transactions, were routed through FITR and subject to the platform’s approval.
Rather than relying on a one-time review of submitted documents, the FITR system continuously cross-checked records against linked government databases and maintained an updated profile for each applicant.
Iraqi officials described the platform as a turning point, arguing that it had fundamentally strengthened the monitoring of financial transactions and curbed abuse of the official dollar window.
“The platform has become a tracking and verification system for every dinar [used to buy foreign currency] and dollar that moves within Iraq,” a senior Iraqi official told The New Arab, “it is one of the best systems that […] ended the smuggling of official dollars.”
Yet, traders interviewed by TNA offered a more nuanced assessment.
“The electronic platform has benefited legitimate traders but eliminated hundreds of small traders, retailers, as well as fictitious ones. It has also burdened us with excessive paperwork,” Ahmed al-Fahad, an importer and owner of a general trading company told TNA.
Despite the extensive verification and compliance measures imposed by Iraqi authorities since February 2023, the Financial Action Task Force (FATF), the international standard-setting body for combating money laundering and terrorist financing, placed the country on its grey list in June 2026. Baghdad will need to formulate and implement further reforms to be whitelisted.
Shortly after the FATF’s decision, Iraqi authorities launched a sweeping arrest campaign targeting senior officials on allegations of corruption and abuse of public funds. The investigations reportedly led to the seizure of billions of Iraqi dinars, and tens of millions of US dollars, in addition to dozens of properties and kilos of gold, underscoring that major laundering networks remained active despite all the recent restrictions.
Digitising a trove of information… in one database
A significant share of Iraq’s income is tied to public sector employment and state-funded transfers. State employees’ salaries, pensions, and welfare payments represent the primary source of income for more than ten million of the country’s 46-million-strong population.
This level of dependence positioned payroll systems as a fundamental component of fiscal governance and financial inclusion. It also made them a critical tool of state oversight.
In late 2016, with the aim of curbing widespread frauds, the Iraqi government issued the first directive to digitise payroll systems. Subsequent cabinet decisions established a unified employment identifier for all public-sector employees. The programme was later expanded to include retirees and private sector employees.
But Popular Mobilisation Forces (PMF) commanders expressed strong resistance to the digitalisation of their personnel’s salaries, arguing that the system would comprise their safety. To mitigate these concerns, the government introduced a set of arrangements aimed at regulating access to payroll data and controlling its processing.
“We wanted to control corruption and the ghost fighters,” a senior Iraqi official involved in the process told TNA, “the money was distributed in bags, and some fighters received only a quarter or a third of their salaries.”
Under this arrangement, the PMF payroll system operated through a separate payment structure. Starting in 2019, the Finance Ministry funded the Popular Mobilisation Forces’ account at Rafidain Bank, while Qi Card, Rafidain Bank’s electronic payment partner and Iraq’s largest card issuer, would allow troops to access their salaries.
Implementing the arrangement immediately exposed a problem: the salary distribution process relied on fragmented personnel records maintained by formations’ commanders. Hence, Qi Card was tasked with building the PMF’s first unified electronic database.
PMF units were instructed to provide the company’s teams, which had relocated to the group’s headquarters for the project, with detailed financial, military and personal information on their personnel.
Unlike conventional payroll systems, the PMF payroll database incorporates extensive military and personal information, including salary records, mobile number, rank, unit, specialisation, and political affiliations, as well as family ties and marital status.
It also contains supporting documentation such as the educational certificates, the spouse’s national ID card, national ID cards for each child, and proof of continued education for children over the age of 18.
“[Keeping all these details in a single database] is a blatant security breach and a major scandal,” a senior military commander told TNA.
Unlike other government salary payments, however, PMF salaries continued to be processed outside the central bank’s platform for electronic transactions, also known as ‘the national switch’, placing them beyond CBI’s direct oversight.
A blind spot emerged within the verification system: salary payments for more than 300,000 PMF fighters were reportedly processed through the banking channels, while the underlying personal records remained outside authorities’ view.
“This blind spot makes the verification process stumbling and slow, and all the information produced from it is treated with suspicion,” a former government financial advisor told TNA.
The verification gap affecting PMF salary payments became one of the key issues raised by the US Treasury in its communication with Iraq over Rafidain Bank. The Treasury warned that the bank could face sanctions unless compliance deficiencies were addressed.
The New Arab contacted the US Treasury, seeking comment on this story, but we haven’t received any response in time for publication.
The pressure intensified at the end of April 2025, when US Deputy Treasury Secretary Michael Faulkender accused Rafidain Bank’s branch in Sanaa of processing payments for Yemen’s Houthis, whom Washington considers as terrorists. Iraqi authorities rejected the allegation, stating that the branch had ceased operations in 2017.
Amid growing concerns over US sanctions, Qi Card stopped distributing PMF salaries in June and withdrew from the arrangement.
That same month, Qi Card entered a partnership with K2 Integrity to “enhance” its financial compliance standards across its operations in the UAE, Jordan, and Iraq.
Just weeks later in August, Rafidain Bank too signed a partnership with K2 Integrity, which a company executive described at the time as an opportunity to “transform its commitment to reform into a demonstrable and institutionalised financial integrity program”.
Despite the precautions taken by the PMF, the leak of sensitive data permitted actors hostile to the units targeted send messages to fighters urging them to turn on their officers. The text above reads: “Your leaders have abandoned you; they are enjoying the money they stole and living lives of luxury with their families while they left you to die for their own ends.”
To shield Rafidain Bank from potential sanctions, the Iraqi government transferred responsibility for distributing PMF salaries to the state-owned Nahrain Islamic Bank in July. At the same time, all PMF personnel were issued new local electronic cards called Al-Muhandis cards, replacing the previous payment arrangement, PMF commanders told TNA.
Although the internal PMF investigation is still ongoing and has not yet reached conclusive findings, the pressure exerted by the US Treasury on Rafidain Bank and Qi Card, followed by subsequent compliance-related arrangements with K2 Integrity, reinforced the Iraqi security officials’ assessment that the data breach could be linked with the PMF payroll system.
Within the PMF payroll system, data transmitted to Rafidain Bank was encrypted and only included the Qi electronic card number and the corresponding salary amount. However, K2 Integrity is believed to have gained access to the PMF database through its review of transactions processed by Rafidain Bank through Qi Card.
During K2 Integrity’s audit of Qi Card and Rafidain, the company’s auditors would have had to review detailed records – including encrypted ones – to verify the authenticity of transfers, thereby revealing PMF personnel’s identities, according to a banker familiar with the matter.
The New Arab contacted Rafidain Bank and Qi Card, seeking comment on this story, but we haven’t received any response in time for publication.
“The source of the leak was almost certainly the payroll database. [It] is a goldmine for intelligence analysts,” a former senior Iraqi anti-corruption official told The New Arab.
“For anyone with access to that data,” he continued, “it becomes easy to reconstruct a person’s daily life, determine where he sleeps, when he visits the barber, and how he spends his time.”
Fact-checking and copyediting:
TNA Investigative Researcher/Journalist Jonathan Cole.
Commissioning, editing and supervision:
TNA Investigative Editor Andrea Glioti.
For questions, comments and complaints please email Andrea Glioti andrea.glioti@newarab.com or TNA Investigative Journalist Jonathan Cole jonathan.cole@newarab.com.
Sensitive info and tips are to be sent via encrypted email to thenewarab@tutanota.com.