A billion-dollar criminal ecosystem has been uncovered by the National Crime Agency (NCA) after its operators built a cash-to-crypto machine spanning at least twenty-eight UK cities and towns. This organisation turned proceeds from drug trafficking, firearms supply and organised immigration crime into cryptocurrency that was then routed into a Kyrgyz financial institution purchased expressly for sanctions evasion. Intelligence shows that the funds moved through this structure ultimately supported entities linked to Russia’s military industrial base, making the network an active financial contributor to the war in Ukraine. Several individuals steering the scheme, including Ekaterina Zhdanova, George Rossi and Elena Chirkinyan, played critical roles in connecting street-level crime in Britain with state-aligned activity overseas. The scale of the network demonstrates how local criminality can become integrated into geopolitical operations when professional launderers are involved.

Russian laundering network structure and operational design

The Russian laundering network uncovered by the NCA relied on a tiered architecture that blended physical cash collection, cryptocurrency conversion and international money movement. At the base of the structure were couriers who operated widely across cities such as London, Birmingham, Manchester, Leeds and smaller regional hubs. Their assignment was straightforward but essential. They collected large volumes of illicit cash generated by criminal markets and transported it through pre-determined routes for handover to crypto conversion specialists. These collections often happened in car parks, service stations and private residences to limit exposure.

Once collected, the cash was quickly converted to cryptocurrency through intermediaries skilled in high-volume swaps. This conversion was a crucial step that allowed the funds to bypass conventional financial institutions. After conversion, the digital assets were directed through accounts and wallets controlled by Smart and TGR, the two criminal groups exposed by the NCA in December 2024. Smart was led by Ekaterina Zhdanova, alongside associates Khadzi Murat Magomedov and Nikita Krasnov. TGR was headed by George Rossi, with support from Elena Chirkinyan and Andrejs Bradens.

The sophistication of the operation increased upstream. Smart and TGR collaborated to enable payments for Russian clients seeking to bypass financial restrictions. The most significant development was the purchase of Keremet Bank in Kyrgyzstan by Altair Holding SA, a firm linked to Rossi. Altair purchased a seventy-five percent stake in the bank on Christmas Day 2024, providing the network with direct control over a regulated entity. With this control, they facilitated cross-border payments for Promsvyazbank, a Russian state-owned institution supporting companies tied to the military industrial complex. The combination of crypto conversion, international payments, and bank ownership allowed the network to move funds with both agility and cover.

International cooperation and jurisdictional reach

The global span of the laundering scheme was reflected in the scale of cooperation necessary to disrupt it. The NCA coordinated with domestic partners including the Metropolitan Police Service, Police Scotland, HM Revenue and Customs, the Crown Prosecution Service, Border Force and the National Police Chiefs’ Council. The operation also included authorities in Jersey, Ireland, the United States, France, Finland, the Netherlands and Spain. These relationships enabled simultaneous arrests, seizures and intelligence exchange across borders.

The United States contributed through agencies such as the Drug Enforcement Administration, the Office of Foreign Assets Control, the Federal Bureau of Investigation and the United States Secret Service. France contributed via its central police judiciaire directorate, while Ireland’s An Garda Síochána took part through its organised and serious crime units. Finnish, Dutch and Spanish authorities added further expertise on crypto tracking, financial intelligence and international payments. The collective effort produced notable results, including foreign seizures valued at twenty-four million dollars and over two point six million euros.

The cooperation also illuminated the role of Russian-affiliated actors operating through Europe. Zhdanova was later detained in France pending trial, while individuals linked to Russian intelligence attempted to use her Smart Group to finance activities in Europe. One example involved a UK-based group of Bulgarian nationals led by Orlin Roussev, later convicted for espionage on behalf of Russia. This case demonstrated how the laundering network was not only a mechanism for turning street cash into crypto but also a vehicle for intelligence activity, covert financial support and destabilisation.

The reach of the network extended to Moldova through the involvement of Ilan Shor, a Russian Moldovan oligarch who previously played a central role in the one billion dollar theft from Moldovan banks in 2014. Shor’s payment service company A7, now sanctioned by both the UK and EU, was part of the sanctions evasion architecture linked to Keremet Bank. A7 and Promsvyazbank jointly announced the launch of the A7A5 token, described as a rouble-backed stablecoin designed to facilitate cross-border payments for sanctioned entities. These links underscore how the laundering scheme moved beyond organised crime and became part of a state-aligned financial strategy.

Compliance insights, typologies and red flags

The exposure of this laundering system carries significant lessons for compliance teams. At the operational level, the use of cash couriers reinforces that physical cash remains central to high-end laundering, even in an era dominated by digital assets. Cash-to-crypto typologies remain attractive because they allow criminals to break the link between physical cash and electronic transfers. Financial institutions should consider the risk posed by repeated small deposits, high-frequency conversion of incoming funds and accounts associated with unexplained asset accumulation.

The case also highlights the importance of monitoring financial institution acquisitions, particularly involving jurisdictions where regulatory oversight varies. The purchase of Keremet Bank demonstrated that criminals may seek control over financial infrastructure to facilitate sanctions evasion and disguise illicit flows as legitimate payments. Compliance professionals should maintain enhanced due diligence on beneficial owners and verify the legitimacy of cross-border acquisitions with international partners.

Crypto asset service providers remain central to detection. Providers should apply strong transaction monitoring to identify patterns such as rapid conversion, transfers to multiple unrelated wallets or transactions involving stablecoins tied to sanctioned jurisdictions. Blockchain analytics must be complemented with traditional AML controls to understand the underlying behaviour behind wallet activity.

Cases involving Popovych, Lutsak and Tabatadze offer further learning. Popovych and Lutsak exploited the Russia-Ukraine conflict to launder funds through vehicle purchases. Their movement of cash, resale of vans and ultimate conversion to cryptocurrency form a classic trade-based laundering pattern with a crypto exit. Meanwhile, Tabatadze’s role as a courier moving £2.2 million in cash reflects how low-paid operatives are used to maintain a high volume, low visibility supply chain. Financial institutions can identify these patterns through inconsistencies in customer profiles, unexplained belongings, multiple phone numbers, unusual travel patterns or cash-dominant behaviour.

The network’s activity also reveals how criminal organisations adapt quickly to enforcement pressure. During summer 2024, Russian-speaking laundering groups in London increased their commission rates significantly, reflecting a higher perceived risk of operating in the capital. Financial institutions and law enforcement must continuously update typology assessments to stay aligned with these shifts.

A shifting landscape for AML and future risk

The dismantling of the network demonstrates the relevance of integrated AML, sanctions compliance, and crypto oversight. Street-level crime was linked directly to an international scheme benefiting Russia’s war effort, underscoring the convergence of organised crime, financial technology and geopolitical interests. This convergence is likely to grow, making traditional AML frameworks insufficient without the ability to incorporate sanctions intelligence, crypto pattern recognition, and global information sharing.

The NCA’s public campaign directed at couriers, with posters in English and Russian, represents a novel approach to demand reduction. Targeting the lowest tier of the laundering chain disrupts recruitment and reduces the supply of essential labour. The messaging emphasised the low financial reward and high prison sentences facing couriers. This behavioural deterrence, combined with enforcement, indicates a more holistic approach to laundering disruption.

The outlook for compliance professionals is increasingly complex. Criminal networks may continue to pursue bank acquisitions, deploy specialised crypto tokens and exploit geopolitical tensions to launder funds. Public and private sector collaboration will be vital, as will investment in crypto analytics, sanctions due diligence and early detection of unusual asset patterns.

As Operation Destabilise continues, the case sets a precedent for how cross-border laundering schemes linked to state-aligned actors must be addressed. The integration of intelligence from multiple countries, swift operational action and targeted disruption at all layers of the network offer a template for future responses.

---

Related Links

• National Crime Agency official site
• UK Government sanctions enforcement guidance
• US Department of the Treasury sanctions information
• An Garda Síochána official updates
• HM Revenue and Customs financial crime information
• Direction nationale de la police judiciaire (DNPJ)

Other FinCrime Central Articles About Russia Evading Sanctions

• Summer Series #4: Sanctions, Russia, and Evasion Tactics
• U.S. Probes $530 Million Money Laundering and Russian Sanctions Evasions via Evita Crypto Payment Firm
• Billions Laundered Through Garantex’s Surviving Shadow Crypto Empire

Source: NCA

Some of FinCrime Central’s articles may have been enriched or edited with the help of AI tools. It may contain unintentional errors.

Want to promote your brand, or need some help selecting the right solution or the right advisory firm? Email us at info@fincrimecentral.com; we probably have the right contact for you.