WIREDGOV

A Russian-speaking money laundering network uncovered by the UK’s National Crime Agency shows the clear links between organised crime, sanctions evasion and hostile state activity.

You would be forgiven for thinking that this week’s news from the National Crime Agency (NCA) of the multi-billion-dollar Russian-speaking money-laundering network that it has broken up is actually the script for a new Netflix drama. It has all the makings of a blockbuster.

At its heart are two linked criminal networks, Smart and TGR. These groups provide professional money-laundering services to numerous organised criminal groups operating in the UK and elsewhere. They collect the cash proceeds from street-level drug dealing and exchange it for cryptocurrency, which can then be used by the gangs to purchase drugs and firearms. The cryptocurrency itself is sometimes the product of other criminal activities, notably ransomware, enabling cybercriminals to exchange the proceeds of their crimes for cash. Everyone gets what they want – a perfect vicious circle of crime and money. 

Smart and TGR facilitate money laundering on a vast scale. In one example, two individuals associated with the network and who have now been arrested by the NCA managed a cash courier network in the UK which laundered over £12 million in just 74 days. The groups offer services to sanctioned oligarchs, Russian elites, ransomware operators and organised criminal groups, including the notorious Kinahan cartel, allowing them to move money around the world with ease and impunity. The funds that were laundered were used to conduct Russian espionage activities in Europe and to further the spread of Russian mis- and disinformation, undermining the safety and security of the UK and its allies. 

The Russian-speaking criminal diaspora in the UK, and in other countries, has vastly extended the reach of the Russian state

As Rob Jones, the NCA’s Director General of Operations, stated in the press release accompanying the details of the case, ‘for the first time, we have been able to map out a link between Russian elites, crypto-rich cyber criminals, and drugs gangs on the streets of the UK’.

Everything Old is New Again 

What is notable is that the pure money-laundering element of this case – the physical collection of cash and its exchange into a different form of value – is not really anything new. It is the same principle as Hawala, a traditional method of moving value between countries and outside the formal financial system. But these groups have reinvented Hawala for the 21st century, using US dollar-backed stablecoins, such as Tether (USDT), to facilitate the rapid transfer of value around the world. 

While cryptocurrencies like Bitcoin may have been more traditionally associated with criminal activity, recent months have seen a growing number of stories about the illicit finance risks associated with USDT, including a reported criminal probe into whether Tether has breached anti-money laundering (AML) and sanctions laws in the US. According to the UN Office on Drugs and Crime (UNODC), USDT has emerged as the preferred choice for some organised crime groups in Southeast Asia, attracted by the speed of transfers and low transaction costs, lax AML controls and the relative stability of USDT compared to other, more volatile, cryptocurrencies. 

The money-laundering networks seem to have seamlessly combined traditional techniques – cash couriers hiding bundles of notes in boxes of washing powder, laundering through cash-based businesses – with new mechanisms of payment to supercharge their money-laundering efforts. For the organised criminal gangs who used their services, there could not have been a better business model. 

Blurring the Lines

Smart and TGR are sprawling multinational, polycriminal enterprises, defying any attempts to neatly categorise them. While laundering the proceeds of drug dealing and ransomware may have been a starting point, the groups’ activities do not stop there. Five individuals and four entities linked to Smart and TGR have now been sanctioned by the Office of Foreign Assets Control (OFAC) in the US for facilitating ‘significant sanctions circumvention on behalf of Russian elites’ through digital assets. The services that they provide allow Russian elites, including those subject to financial sanctions, to freely move money out of Russia and into the UK; in one example, TGR moved over £2 million to the UK, masking the source of funds, to allow a Russian client to purchase a property in the UK. A Thai-based company associated with the group is believed to have been involved in exporting electrical components to Russia; this company has also been sanctioned by OFAC.  

The networks and the activities they support also illustrate the blurred lines between criminality and Russian statecraft. Funds laundered through Smart and TGR allegedly supported Russian intelligence operations in Europe, including funding the activities of Russia Today in the UK. In other words, the Russian-speaking criminal diaspora in the UK, and in other countries, has vastly extended the reach of the Russian state. These types of illicit finance networks are now essential to Russian statecraft given the ever-expanding sanctions regimes targeting the country. Russia’s sanctions-busting efforts, covert action and industrial capacity all rely to varying degrees on the ability to circumvent controls on Russian finance and stay out of sight of Western law enforcement and intelligence. As a UK intelligence officer quoted in a recent report by longtime Russia watcher and RUSI Senior Associate Fellow Mark Galeotti said, ‘crime is the magic answer to so many of Putin’s problems’. And given the extensive use of USDT by Smart and TGR, it appears that crypto has also become an answer to some of Putin’s problems. 

What Does That Mean for the Response? 

A recent report from Spotlight on Corruption found that the NCA was ‘on its knees’, haemorrhaging staff and with morale at the agency at rock-bottom. And yet, despite that, the NCA has pulled off an incredible feat, uncovering a vast criminal web that we could previously only see vague shadows of. While this will be a headline-grabber, the NCA has had other notable successes this year, including Operation Cronos, which disrupted the LockBit ransomware-as-a-service operation. One can’t help but wonder, given that the NCA is evidently capable of so much with so little, how much more it could achieve with proper investment in the organisation and its officers.

Although on this occasion the NCA has been successful, the UK system is not generally well set-up to prioritise, identify and mitigate threats that do not fit neatly into criminal or state categories

The case also emphasises that the UK system must be fit for purpose to combat threats that blur the lines between criminal and foreign intelligence operations. The activities exposed by Operation Destabilise are merely the latest example of how hostile states like Russia and Iran are exploiting their access to criminal networks to further their strategic objectives. Although on this occasion the NCA has been successful, the UK system is not generally well set-up to prioritise, identify and mitigate threats that do not fit neatly into criminal or state categories. Unlike in the FBI, where counterintelligence and counter-organised crime agents work under the same roof, in the UK there is a greater sense that law enforcement and intelligence officers should stay in their respective lanes, with spies chasing spies and cops chasing criminals. It is also worth noting that the response to Operation Destabilise has been primarily led by law enforcement, with 84 arrests and millions of pounds seized. Unlike in the US, there does not appear to have been any appetite in the UK to impose sanctions on any of the individuals involved in the case. 

While the success of Operation Destabilise should be lauded, it is a success that was very much against the odds. Given that more than £100 billion is likely laundered through the UK each year, the NCA’s budget of £870 million in 2023–24 (which covers all of the NCA’s activities and the operation of the UK’s Financial Intelligence Unit) seems woefully small, especially with the increased number of complex ways in which criminals are able to launder money. While it was recently announced that the NCA’s budget for 2025–26 will increase by £58 million, these funds are earmarked for border security. In a world of competing priorities, maintaining momentum – and resources – to tackle industrial-scale financial crime is essential. As Operation Destabilise has clearly shown, failure to do so clearly threatens our national security. 

© RUSI, 2024

The views expressed in this Commentary are the authors’, and do not represent those of RUSI or any other institution.

For terms of use, see Website Ts&Cs of Use.

Have an idea for a Commentary you’d like to write for us? Send a short pitch to commentaries@rusi.org and we’ll get back to you if it fits into our research interests. Full guidelines for contributors can be found here.