The assumptions we built aid around

You may have noticed, if you follow my Aid & Dev Dispatches, that I have not been writing much recently about what is happening in the sector. Part of that is that I am doing a lot of work on AI, and have quite a bit to say about it. But if I am being honest, I think part of the reason I have struggled to write about the aid sector is that the question underneath everything feels almost too large to engage with.

We are discussing funding cuts, restructuring and how to deliver more with less. All of that matters. But I keep wondering whether we are trying to stabilise and repair a system whose foundations have changed. In the rush to keep it all going, we are not really able to step back and see how the world around us has moved.

Then came the past week's news. Politico reported that the Trump administration opposes every candidate for the next UN Secretary-General and wants new ones. Writing in The New Humanitarian, Damian Lilly and Mike Pearson said that "the humanitarian system has experienced the financial equivalent of the Great Depression". And, most clearly of all, the US government is now directly sanctioning the International Criminal Court (ICC).

In a world where so much is happening, it is hard for that to register. It is surprising how something can be so shocking and yet not at all unexpected. But it is worth quoting the ICC on what this means, in its own words:

This measure targets an independent judicial institution, created by treaty and entrusted by 125 States Parties with investigating and prosecuting genocide, crimes against humanity, war crimes, and the crime of aggression. It is an attempt to obstruct the course of justice and to prevent the Court from doing what it was created to do. It is an assault on the rule of law and on the very foundations of the international legal order which strikes at the simple principle that no one stands above the law.

There are many ways to think about this, but the most direct is that the US Office of Foreign Assets Control (OFAC) has added the ICC itself to its sanctions list. So what does that mean?

It means that US banks and companies can no longer deal with the Court unless the US Treasury allows it. Many European companies that rely on US banks, card networks or software now have to decide whether they are willing to take the risk.

Think of an ICC staff member paying for a tram in The Hague. Her account is Dutch, the fare is in euros and the operator is European. If her card uses Visa or Mastercard, the transaction still depends on that scheme. A refusal at that point cannot be solved simply by moving the card into another phone wallet or obtaining another card that uses the same affected route.

The example is illustrative. The designation names the Court, not its staff, but the same banks and card schemes sit behind its payroll and suppliers. Having the money and being able to use it are separate conditions.

We already know what that can look like for one person. The US sanctioned Karim Khan, then the Court's chief prosecutor, in February 2025. Three months later, the Associated Press reported that his bank accounts in the UK had been blocked.

That was one sanctioned individual. This time the designation names the institution itself. The Court's staff are not personally sanctioned. But the institution that pays them, equips them and holds their records relies on the same banks, card networks and software providers. That applies to the staff member in The Hague. It applies just as much to colleagues in the Court's field offices in Kinshasa and Bunia in the Democratic Republic of the Congo, in Bangui in the Central African Republic, or in Kampala.

What assumptions do we now need to check?

So let's take a moment to step back and consider what this is really telling us.

The ICC is a court, not a humanitarian agency. But it is an international institution created by treaty. In principle, nothing stops the same tool being used against others, whether a UN agency such as UNHCR, a body such as the Human Rights Council, or an organisation such as the ICRC. The US has already sanctioned a UN Special Rapporteur, Francesca Albanese, in July 2025.

Anyone who has done a market analysis will recognise the picture. Every market has a value chain, the supporting infrastructure and services that keep it moving, and an enabling environment of rules and policies that lets it function. Humanitarian operations are no different. Our value chain runs from donor to agency to partner to the people we serve. It moves on supporting infrastructure: banks, card networks, cloud providers and software. And it works within an enabling environment set largely by a few governments.

The ICC case shows what happens when that enabling environment turns hostile. A government can use the supporting infrastructure against an institution with 125 member states, without touching its funding at all. So it is worth asking what else we have assumed would always be there.

When I look at it that way, the Western-led humanitarian system appears to have been built around two assumptions. The first concerned the political agreement that funded it. The second concerned the infrastructure that allowed it to work. Both were understandable. Both now need examining.

The first assumption was that the political agreement would hold

Funding would rise and fall. Governments would change. Donors would argue about particular crises. But underneath, there would be enough agreement among the United States, Europe and other major donors to sustain an international humanitarian system and the institutions within it.

That did not make every programme secure. It meant agencies could recruit people, build institutions and make commitments on the basis that the system would continue, even when its resources fell short.

That assumption is now hard to sustain. ALNAP estimates that international humanitarian assistance fell by about 30% between 2022 and 2025. It says the speed and scale of US cuts in early 2025 "unleashed the effects of the system's dangerous dependency on a small number of government donors". And 16 of 20 traditional donors had already reduced their humanitarian funding in 2024. The weakening was broader than Washington, and it started earlier.

Some of the pressure has been manufactured. In early 2024, German Foreign Office analysts identified about 50,000 fake accounts on X pushing pro-Russian messages. One of the most shared complained that the government "does more for other countries than for its own citizens". Most of the change, though, has come through ordinary politics: elections, manifestos and budgets.

None of this is new to anyone working in the sector. We know how to discuss a funding gap. It is much harder to discuss the possibility that the political agreement beneath the funding has weakened.

The funding story has been told many times, and well. The second assumption has had far less attention, and the ICC case has just made it visible.

The second assumption was that the machinery would keep working

Even when money was scarce, agencies could expect the supporting infrastructure to be there. Europe and the United States had different laws, but their financial and technology systems were connected closely enough that agencies could build across them. Choosing a bank, an insurer or an email provider was a procurement decision, and its political foundations stayed in the background.

The ICC case brings them into view at three layers.

Payment rails and the banks

Most of the sector's money moves on rails it does not own: correspondent banks, mostly dollar-based, and card schemes such as Visa and Mastercard.

Sanctions set the legal line. Each bank then decides how far from that line it wants to stand. When the compliance cost or reputational risk of a client looks too high, the bank simply closes the account. This is de-risking, and it moves faster than sanctions and goes further than they require. When the US sanctioned ICC judge Kimberly Prost, AP reported that she immediately lost access to her credit cards.

It also reaches those who work with the target. In May 2025, AP reported that some NGOs had stopped working with the ICC, and that one had moved its money out of US bank accounts. They acted on their own judgement of the risk.

The sector knows this pattern. In a 2017 study, two-thirds of US-based nonprofits working abroad reported problems accessing financial services. What is new is seeing it reach an institution hosted by an allied European state.

The services an agency runs on

An agency also depends on a long list of contracted services: insurers, auditors, travel agents, airlines, freight forwarders, security firms, landlords. Each has its own compliance team and its own appetite for risk.

On 1 October, Reuters reported that the Court and its health insurer, AXA, had mutually agreed to end their contract. AXA called it "a complex and sensitive case given the risks arising from the extraterritorial application of US sanctions". AXA is a European company. The Court said it would use a new insurer.

Travel works the same way. Khan's US visa was revoked, and the daughters of one sanctioned judge can no longer attend work conferences in the United States. For an agency, the travel agent that books staff, the airline that flies them and the forwarder that clears supplies each face the same question as AXA. None has to be told to stop. Each only has to decide the account is not worth the risk.

The online layer

The deepest dependency is now digital. It runs in four tiers, and each one rests on the tier below.

Email comes first, because everything else is tied to it: password resets, donor correspondence, bank alerts. The same AP report said that Microsoft cancelled Khan's ICC email address, forcing him to move to Proton Mail. Microsoft has strongly denied this. Whatever happened, the episode showed how quickly a professional identity can depend on one account.

Meetings and collaboration come next. Teams and Zoom are how headquarters reaches a field office, a partner or a witness. The Treasury's own General Licence 14 lists email, collaboration platforms, user authentication, payroll and data storage among the services it permits. In other words, the US government has recognised that the Court cannot function without them. But a licence can be amended or withdrawn. And even while it stands, a provider may still decide the account is too risky to keep. In most organisations a single identity account opens email, meetings and files together. Lose that account and you lose all three at once.

Documents and records sit underneath, in SharePoint, OneDrive and their equivalents. An institution can own its records while depending on a provider to open them. Storing data in a European data centre does not settle the question. The US CLOUD Act lets valid US legal process compel a US provider to hand over data it controls, wherever that data is stored. The ICC moved early. It chose an open-source alternative, openDesk, in 2025, before the institutional designation.

Connectivity sits beneath everything. In much of the world, it now means Starlink. I know from experience that the humanitarian response in Darfur, and in many other places, runs on it. Without it, there is no access to email, meetings or records. In May 2024, 92 NGOs said that in parts of Sudan cut off from the main networks, "the only available service has been via satellite connectivity devices such as Starlink". That same month, SpaceX said it would restrict roaming in countries where it was not licensed, Sudan among them. Aid groups warned the cut-off "may be considered to be a collective punishment".

Starlink is one US company, run largely at one man's discretion and subject to US law. Elon Musk has already refused to switch on coverage once, near Crimea in 2022. He later said the reason was US sanctions on Russia.

AI is now being built on top of all four tiers, and it deepens each of them. It usually arrives bundled into the cloud and productivity platforms an agency already uses. Once staff draft, summarise and analyse through it, three questions follow. Can our prompts, documents and workflows move to another model? Have our habits and integrations come to depend on one provider? And can US legal process reach what staff upload? Open-weight models, run by an agency or a trusted partner, offer one route out, at the cost of the engineering capacity to run them.

Every one of these tiers can be withdrawn in two ways: by a company deciding the risk is not worth it, or by a government deciding for it.

Permission is not the same as provision

The US has softened the immediate effect. General Licence 13 permits specified transactions to maintain or wind down Court operations until 7 April 2027, including salary payments and health insurance. General Licence 14 has no equivalent expiry in its published text. Neither covers dealings with separately sanctioned individuals. The evidence so far does not show a Court-wide loss of services.

But a licence makes a service lawful. It does not oblige anyone to provide it. That decision stays with the bank, the insurer and the software company.

A government can withdraw its own contribution to an institution. It can also put pressure on the supporting infrastructure through which that institution uses money contributed by other governments. Replacing the donor may leave the second problem intact.

These were understandable assumptions

I find little value in blaming individual agencies for building around arrangements that were capable, widely used and often economical.

Colleagues in sanctioned settings have lived with all three layers failing for years. After August 2021, Afghanistan was cut off from international banking, and the UN began flying cash into the country. SIGAR reported more than US$2.9 billion in shipments by August 2023 to keep humanitarian operations running.

Their experience should have a much larger place in this conversation. But the wider system could treat those problems as belonging to particular operations, while headquarters carried on with familiar banks and software.

The strain on independence was already visible. In ALNAP's 2026 sector review, only 54% of practitioners surveyed rated the implementation of independence as good or excellent, the lowest of the four humanitarian principles. That finding does not name infrastructure dependency as the cause. It does show the concern predates the ICC designation.

Each grant, bank account and software contract may have been a sensible decision on its own. Taken together, they can leave several essential functions resting on the same political relationships.

That is the blind spot I think we need to examine.

And this is where the conversation becomes difficult

One response is to hope that political conditions improve. They might. Another administration could restore funding, remove restrictions and rebuild cooperation. But the systems we procure today will outlast the governments that shape them. If we rebuild the same dependencies whenever relations improve, we will have this conversation again next time, with even more of our work locked into arrangements we struggle to leave.

The other response is to build alternatives. That is where it gets hard. Every layer has a cost. A second payment route needs a bank willing to hold the account and people to maintain it. A new software environment needs migration, training, security and support. Open-source code still needs somebody capable of running it. And for connectivity in places like Darfur, there may be no realistic alternative at all. For a smaller organisation, any one of these is a substantial undertaking.

Within a fixed budget, that spending competes with assistance needed now. I do not find it easy to tell an agency cutting programmes that it should spend more on its own resilience. I also find it hard to accept that we might avoid the question until a payment route or critical system stops working.

Both choices have consequences. Many will fall on local partners and the people receiving assistance, who had very little say in how these systems were chosen.

So what can we do?

The first step is to be honest. Our choice of infrastructure is a choice about our independence. We apply the principle of independence to where our money comes from. We rarely apply it to the bank that moves the money, the company that holds our records or the satellite that connects our field teams.

That honesty has to start at home, so here is MarketImpact's own position. We run our calls on Teams and manage our files in SharePoint. Our AI training is taught on Claude, from the US company Anthropic, because we have not yet found a European or open-source model that does that job as well. We are working on that, and as of this week Mistral supporters may push back on that not being a valid option. Writing this paper made me see these as dependencies, not just tools, and I am now working to reduce them.

I am not expecting MarketImpact to be sanctioned any time soon. But one day we may want to work with an agency that is. If that happens, our systems should not be the reason we cannot.

Be honest about who can reach our data, and who can switch it off

Two separate powers matter here.

The first is access. As above, the CLOUD Act reaches data a US provider controls, wherever it is stored. Asked under oath by a French Senate inquiry in June 2025 whether he could guarantee French citizens' data would never reach US authorities without French authorisation, Microsoft France's director of public and legal affairs answered: "No, I cannot guarantee it."

Amazon launched its European Sovereign Cloud in Brandenburg in January 2026. It is run by a German entity and EU residents, but it is still owned by a US company. Gartner's Rene Buest called that ownership "the elephant in the room". Forrester said it will take court cases to settle.

The second power is withdrawal. Sanctions, not the CLOUD Act, are what can stop a provider serving you at all. That is the risk the ICC now carries.

The sector is arguing about this right now, and rightly. In July, WFP renewed its partnership with Palantir for another five years. A leaked audit by WFP's own Inspector General, reported by PassBlue and France 24, found that key privacy concerns had not been adequately addressed. It also found that "there is no clearly defined exit strategy" for the data platform WFP built with Palantir. WFP told staff that beneficiary data does not connect to any Palantir technology, and that it avoids being locked into any one provider.

That debate matters. But the same questions apply to the providers that carry everything else: our email, our records, our payments and our connectivity. On 30 September, Defence Secretary Pete Hegseth named Elon Musk to co-lead a Pentagon review of future warfare. Many humanitarian operations depend on his satellites. That should be part of the conversation too.

Payments: look seriously at alternative rails

Stablecoins can move value where banks will not. They are not automatically independent. Circle's USDC terms allow it to block transfers to and from addresses, and holders who deal with blocked addresses can lose the right to redeem. A dollar token can change the route while keeping the dollar exposure and the issuer's control.

Other routes exist too: local mobile money networks, and in Europe, Wero, which is expanding into online and in-store payments as a European alternative to the card schemes. Each has its own operators and controls. The test is simple: can the recipient actually spend the value where they are?

Technology: build an exit before you need one

Open-source alternatives are now credible. The ICC has already chosen openDesk. In July 2026, the Dutch government discouraged public cloud for government email and documents and required exit plans for important services.

Open source still needs people to run it. Few agencies can do that alone. Pooled providers such as the UN International Computing Centre are the natural place to share the cost. The cheapest first step is an exit plan: knowing how you would move, what it would cost and how long it would take. WFP's own auditors found that missing for the platform it built with Palantir.

Start with the functions that matter most

None of this means rebuilding everything. Start with a few concrete tasks: paying a local partner, reaching a field team, opening a sensitive record. For each one, trace what it depends on across each layer: payments, services, software and connectivity. Then work out what a lawful alternative would involve, and who would carry its cost. Learn from colleagues in sanctioned settings who have already had to build these arrangements.

I think we need to begin there

I do not have a settled answer about how much independence the humanitarian system should buy, or what it should be willing to give up to pay for it.

But I think we need to examine these two assumptions together, because the same political shift can weaken both.

How much of our planning still depends on a return to a familiar donor environment? How much of our ability to operate depends on political cooperation between governments whose relationship we cannot control? And which functions would be serious enough to lose that keeping an alternative is justified, even now?

Answering those questions honestly would give us something firmer than either hoping everything returns to normal or declaring that we must rebuild everything.

I started by saying that the question underneath everything felt almost too large to engage with. I still think it is large. The hardest possibility is that the conditions around which we organised the system may no longer be dependable enough to keep building in the same way. I think we need to be willing to consider that possibility before we know exactly what to do about it.

The Court's main licence runs until 7 April 2027. A licence buys time. The question is what we do with it.

The detailed argument and evidence are in my working paper, The infrastructure of independence. It is where my thinking has reached. I would welcome the experience of people who can help take it further.

Tom

Thomas Byrnes leads MarketImpact Digital Solutions, which advises humanitarian organisations on digital systems, payments and AI governance, including the decisions discussed here.

How this was written: I wrote this article with AI assistance. I used AI tools to help research and check public sources, draft and edit parts of this article, and draft and edit the companion working paper. I set the argument and am responsible for the analysis. No confidential client material or beneficiary data was used. If you identify an error, tell me and I will correct it publicly. Read how we use AI at MarketImpact.