Economic Kill Chain (EKC)

The Economic Kill Chain (EKC) is Tennant's seven-phase Economic Kill Chain framework, published under his sole byline in 2026, for planning and assessing financial-warfare operations: reconnaissance, mapping, positioning, execution, amplification, exploitation and assessment. The publication record is James J. Tennant, "The Economic Kill Chain: What States Can Learn from Wall Street," FININT, 22 February 2026. The model adapts sequencing logic associated with cyber defence and joint targeting to financial operations. It is an attributed analytical model, not an established military doctrine or an empirically validated law of campaign success.

Provenance and scope

The project record confirms a public FININT essay, "The Economic Kill Chain: What States Can Learn from Wall Street", published on 22 February 2026 under James J. Tennant's sole byline, and an unpublished Tennant manuscript carrying the same seven-phase sequence. It also contains earlier internal references to a Tennant/Dorman model. The documentary record does not yet reconcile those references with the later solo byline.

The permitted public description is therefore limited to: "Tennant's seven-phase Economic Kill Chain framework, published under his sole byline in 2026." This wording does not resolve the underlying contribution history. The public article and its seven-phase sequence are verified, but the earlier Tennant/Dorman references mean that the entry must not claim exclusive creation or resolved contribution history unless the relevant drafts, correspondence and contribution record are examined.

Strategic classification

The EKC sits inside the warfare mode of economic statecraft. Its stated purpose is to organise financial-warfare campaigns, not to classify every sanction, regulatory intervention or act of economic coercion as warfare. Under the Encyclopedia's ontology, economic warfare requires intended structural degradation of an adversary's capacity to govern, project power or resist.

The framework is offensive in orientation, but several phases can support defensive analysis. A state can map its own dependencies, identify where an adversary could position authorities or market exposure, and design measures that break or absorb a prospective chain. The model spans finance, trade, technology and information where those domains contribute to a financial operation.

Intellectual lineage

The EKC draws on three bodies of work. First, Eric Hutchins, Michael Cloppert and Rohan Amin's 2011 intrusion kill-chain paper used a seven-stage sequence to analyse computer-network attacks and identify opportunities for defence. Second, US Joint Publication 3-60, Joint Targeting, dated 28 September 2018, presents joint targeting as a structured cycle connecting objectives, target development, capability analysis, decision, execution and assessment. Third, Farrell and Newman's theory of weaponised interdependence explains how hierarchical networks can give states information and denial capabilities through the panopticon and chokepoint effects.

These sources establish relevant antecedents. They do not establish the EKC's seven financial phases, thresholds or empirical validity. Those elements belong to Tennant's attributed framework.

The seven phases

1. Reconnaissance

Reconnaissance collects financial and economic intelligence about the target, its dependencies and potential vulnerabilities. Relevant data may include corporate ownership, trade exposure, reserve composition, funding needs, payment relationships and supply-chain concentration. The output is a set of candidate vulnerabilities, not a final target decision.

2. Mapping

Mapping converts observations into a model of relationships, control points and transmission paths. It identifies institutions, beneficial owners, counterparties, jurisdictions and potential strategic nodes. The phase should record uncertainty and alternative routes. A map that excludes substitutes or allied dependencies will overstate the apparent chokepoint.

3. Positioning

Positioning prepares authorities, coalition arrangements, implementation capacity and communications before an intervention. It may include drafting legal instruments, coordinating lists, consulting regulators and assessing market exposure. Positioning is analytically distinct from execution because legal readiness and coalition coverage can determine whether an announced action produces operational effect.

4. Execution

Execution releases the selected instrument. Possible effectors include asset freezes, transaction prohibitions, Section 311 special measures, export restrictions or reserve measures. The framework treats timing and coordination as operational variables. The existence of a designation or rule establishes that the action occurred, not that it achieved denial, degradation or compellence.

5. Amplification

Amplification concerns effects transmitted by allies, intermediaries and markets after execution. Banks may de-risk, insurers may withdraw, counterparties may demand different terms and asset prices may change. These responses can expand or distort the formal measure. The state may anticipate them, but it does not directly command every private reaction.

6. Exploitation

Exploitation seeks to convert disruption into strategic advantage. That may involve negotiations, revised demands, coalition action or follow-on measures. Pressure without a credible route to a political objective can impose cost without producing exploitation.

7. Assessment

Assessment compares observed results with the campaign's stated and inferred objectives. Financial indicators may show liquidity, price or funding effects, while policy evidence tests behaviour change and strategic capacity. Assessment also examines sender costs, humanitarian effects, evasion and adaptation. It should feed later reconnaissance rather than serve as a retrospective claim of success.

The phases are a planning sequence, not proof that every operation advances linearly. Intelligence collection and assessment can continue throughout. Positioning may begin before mapping is complete, market amplification can precede formal execution when action is anticipated, and failed exploitation can lead to renewed execution.

Analytical use and testing

The EKC is most useful when each phase produces a reviewable claim and a corresponding record. Reconnaissance should identify the source, date and confidence of each observation. Mapping should name the network boundary, the relevant nodes, the assumed transmission path and feasible substitutes. Positioning should record the authority, coalition dependency, implementation owner and legal constraint attached to each proposed action. Execution should identify what the state actually authorised, rather than what markets expected or commentators inferred.

Amplification requires a separate account of private and allied behaviour. A bank's withdrawal, a price movement or an insurer's change in terms may follow an official action without being commanded by the sender. The framework should record competing explanations and the time sequence before treating that response as amplification. Exploitation should state the political opportunity the campaign seeks to create and the decision-maker expected to act. Assessment should then compare observed results with that prior claim, including effects on third parties and the sender.

Three tests can expose weak applications. The first is a sequence test: did the claimed phases occur in the stated order, and did information from one phase materially shape the next? The second is a mechanism test: did the selected control point transmit the effect through the pathway identified during mapping? The third is a counterfactual test: would the target's behaviour or capacity probably have changed without the intervention? Failure on one test does not disprove the whole framework, but it narrows what the case can demonstrate.

The EKC also needs explicit stop conditions. New evidence may show that a supposed node is substitutable, coalition participation is inadequate, the legal basis is unavailable, civilian effects exceed the accepted limit or the political objective cannot be reached through the proposed pressure. In those circumstances, the chain should halt or return to an earlier phase. Treating execution as inevitable would turn a planning aid into a justification mechanism.

Defensive use reverses the perspective without changing the evidentiary burden. A government can test how an opponent might map its payment, technology or commodity dependencies, then reduce exposure through diversification, reserves, legal preparation and allied support. This application remains an extension of Tennant's model. It has not been independently validated as a distinct doctrine.

Application

FinCEN's Banco Delta Asia action provides a bounded illustration of sequence without proving the framework. FinCEN issued a finding and proposed rule on 15 September 2005, then a final rule on 14 March 2007. The official record establishes the procedural sequence. Practitioner accounts describe broader withdrawal from North Korea-related business during the interval. In EKC terms, the case can be read as positioning followed by execution and market amplification. That reading remains an application of the framework, not independent evidence that the seven phases are causally necessary.

The model can also diagnose failure. A campaign may identify a vulnerability but fail to secure coalition coverage. A legal action may execute but produce limited amplification because substitutes remain open. Pressure may impose substantial costs but fail at exploitation because demands are unclear or the target values resistance more highly than the sender anticipated.

Evidence, contestation and limits

Three limits govern publication claims. First, the internal Tennant/Dorman contribution discrepancy remains unresolved, so the public solo byline does not establish exclusive creation. Second, no independent study has established that the seven phases are necessary, sufficient or superior to alternative planning models. Third, the framework's empirical applications require case-by-case testing with primary evidence.

There is also a category risk. Kill-chain language can encourage officials to treat civilian financial systems as a battlespace and to compress legal, political and market processes into a military metaphor. The metaphor may improve sequencing and accountability, but it can also obscure recipient agency, legal limits, humanitarian incidence and the difference between coercion and warfare.

The EKC should therefore be used as a transparent hypothesis and planning aid. Analysts should state where a case departs from the sequence, identify evidence that would falsify their reading and compare the model with simpler explanations. Verification of this entry records an accurately attributed published framework. It does not make the framework settled doctrine, independently validate it or resolve its contribution history.

See also

Economic statecraft · Financial warfare · Economic warfare · Weaponised interdependence · Chokepoint effect · Panopticon effect · Reconnaissance (EKC Phase 1) · Mapping (EKC Phase 2) · Financial intelligence (FININT) · The Five Ds (Deny, Disrupt, Degrade, Delay, Drain) · Banco Delta Asia Section 311 action (2005-2007)

Sources

• James J. Tennant, "The Economic Kill Chain: What States Can Learn from Wall Street," FININT, 22 February 2026, public article published under Tennant's sole byline.
• James J. Tennant, "The Economic Kill Chain" (Article 2, PhD corpus, unpublished manuscript, 2026).
• Eric M. Hutchins, Michael J. Cloppert and Rohan M. Amin, "Intelligence-Driven Computer Network Defense Informed by Analysis of Adversary Campaigns and Intrusion Kill Chains" (Lockheed Martin Corporation, 2011).
• US Joint Chiefs of Staff, Joint Publication 3-60: Joint Targeting (28 September 2018).
• Henry Farrell and Abraham L. Newman, "Weaponized Interdependence: How Global Economic Networks Shape State Coercion," International Security 44, no. 1 (2019): 42-79.
• US Financial Crimes Enforcement Network, "311 and 9714 Special Measures," accessed 29 July 2026.
• Juan C. Zarate, Treasury's War: The Unleashing of a New Era of Financial Warfare (PublicAffairs, 2013).