A billion-dollar money laundering network operating out of the UK bought a bank in the Central Asian state of Kyrgyzstan to help launder profits from cybercrime and other criminal activity and convert them into cryptocurrency that was used to evade sanctions on Russia in support of the Putin regime's war with Ukraine, according to the report. National Crime Agency (NKA).
So-called money-to-cryptocurrency exchanges are a major part of the global criminal ecosystem. In 2024, NCA and its European and North American partners came down hard on two Russian-run full-service money laundering networks, TGR and Smart, which were laundering money on behalf of several ransomware groups, including Evil Corporation, Conti And Ryuk, in an ongoing series of actions dubbed “Operation Destabilization.”.
Over the past 12 months, Operation Destabilize has seen 45 suspected money launderers arrested and £5.1 million in cash seized. Since its inception, 128 people have been arrested in the UK and more than £25 million in cash and cryptocurrency assets have been seized, as well as millions more overseas.
“Today we can reveal the scale of these networks and draw the line between crime in our communities, sophisticated organized crime and state-sponsored activity,” said NCA deputy director of economic crime Sal Melki.
“The networks disrupted by Destabilization operate at every level of international money laundering, from collecting street money from drug deals to buying banks and enforcing violations of global sanctions.”
The link to Kyrgyzstan, a former Soviet state sandwiched between Kazakhstan and China, was exposed in August when Altair Holding SA, linked to TGR chief George Rossi, was sanctioned in Britain as part of the repression about Russia’s known attempts to circumvent Western sanctions by exploiting the financial system of Kyrgyzstan.
Now it has become known that on December 25, 2024, Altair bought a 75% stake in the Kyrgyz Keremet Bank. The NCA subsequently determined that Keremet facilitated extensive cross-border payments on behalf of state-owned Promsvyazbank.
Promsvyazbank, which was nationalized by the Russian government in 2018, was also sanctioned by the US and UK after the invasion of Ukraine and was accused of links to Russian attempts to rig elections in Moldova through populist, pro-Russian politician and oligarch Elon Shor, who also orchestrated the theft of more than $1 billion from the country's banking system in 2014.
Shor's company A7 once collaborated with Promsvyazbank to launch the ruble-backed cryptocurrency stablecoin A7A5, and networks associated with the firm were likely designed to enable cross-border payments to circumvent sanctions in support of the Russian military-industrial complex, NCA said.
Beyond ransomware
It was cybercrime, particularly the network's links to Evil Corp and Bitcoin payments made by its victims, that first led the NCA and its partners into this activity when they discovered that profits from ransomware attacks were flowing into an individual cryptocurrency exchange account that was linked to already identified UK money laundering organizations.
However, TGR and Smart's activities extend into other areas of organized crime across the UK, including drugs and firearms trafficking and immigration fraud. However, at this stage the NCA will not be involved in any way in other investigations into cyber crime activity or any major cyber attacks that have occurred in the UK this year.
As well as funneling these funds to support Russia's war with Ukraine (the agency described a “clear link” between small-time cocaine deals on Friday nights in British bars and clubs and Russian missile attacks on Ukrainian civilians), the network also provided money to wealthy Russians living in the West as concierge services and even funneled some of this money back into the UK banking system through traditionally cash-rich businesses such as small construction firms.
Those identified and arrested in connection with online money laundering include two Russian nationals who bought cars and vans in the UK, shipped them to Ukraine and sold them to the Ukrainian government, which was unaware it was funding its enemy's war effort.
Operation Destabilization also ensnared a number of Britons, including Scottish footballer James Keatings, who was witnessed by investigators removing boxes of cash from a van during a transfer of almost £400,000 in June 2024.
Keatings, a former member of Celtic's youth development program who played for Heart of Midlothian and Hibernian during his career, was jailed for 13 months earlier this year after he admitted possessing and transferring criminal property at Falkirk Sheriff Court.
Like Keatings, many of the network's British employees were “mules” tasked by the network's “managers” to travel throughout the country to collect money from low-level criminals.
They are targeted by NCA advertising campaigns in places they frequent, often in motorway toilets. The NCA said its aim was to “make these courier networks sweat” and had had some success in deterring them.
“Millions of Britons have seen these messages at petrol stations, but rest assured they were not intended for you,” Melky said. “For the launderers who have seen them, your choice is simple: either stop this activity or prepare to face one of our officers and the reality of your choice. Easy money leads to hard times.”
