Intelligence Assessment Moscow Mirror Network Demonstrates Anti-Money Laundering Vulnerability in Global Securities Market Intelligence Assessment Law Enforcement Sensitive/Contains BSA Information INTELLIGENCE DIVISION Moscow Mirror Network Demonstrates Anti-Money Laundering Vulnerability in Global Securities Market Executive Summary: Mirror trading?a foreign exchange strategy that uses offsetting securities trades across different jurisdictions?highlights a vulnerability in the global securities market for money laundering. A network of Russian-based individuals and entities, herein the ?Moscow Mirror Network, have used this method as an informal value transfer system to move billions of dollars per year from Russia through European securities markets to other jurisdictions beginning as early as 20l l. Since this network used mirror trading to conduct illicit financial activity. law enforcement and regulators are encouraged to review collections of securities trades for red flags that may detect suspicious uses of mirror trading. Mirror Trading Allows Concealed Transfers of Funds across Borders Mirror trading is an informal value transfer mechanism through which an individual or business purchases securities in one jurisdiction and sells them in another for no economic gain, thereby concealing the funds? original source and final destination. Although not inherently illegal, mirror trading is being used to move funds out of one country by converting domestically-held currency into euros, British pounds, or U.S. dollars through a sophisticated layering process involving two simultaneous, or near- simultaneous, securities trades. Mirror trading can be conducted through a variety of approaches, but one common process is as follows: First, an individual, or ?client." requests that a mirror trading network move money out of one country into another jurisdiction. The network uses the client's funds in its original currency to make over-the-counter purchases of liquid, blue-chip securities on the client's behalf through a securities brokerage. The ownership of the securities is transferred to a shell company, which is often registered in a jurisdiction at higher risk for money laundering. Soon after the initial securities purchase, the offshore shell company sells the securities over-the-counter to a broker-dealer located in anotherjurisdiction. The sale is conducted in the desired currency, such as euros, British pounds, or U.S. dollars. The broker-dealer then sends the proceeds to the shell company's bank account, which is likely located in a jurisdiction that specializes in non-resident or offshore banking. Once converted into the desired currency, the funds are often transferred to additional shell company accounts using book transfers within a bank or via wire transfers to another bank. The funds are ultimately wired to a bank account as directed by the original client. As a result of this process, the identity of the transaction?s true originator is hidden from Western financial institutions, which are likely only aware of the sale of securities by an offshore firm to a European broker. Law Enforcement Sensitive/Contains BSA Information I Intelligence Assessment Law Enforcement Sensitive/Contains BSA Information Figure T: Example of How Mirror Trading Can Transfer Funds from Russia to Europe Russian Securities lusslm Custodian! WNW European Securities Counterparty Securltos Securtlos Counterparty 0 . m" . .. . Ownership lranster of Securities 0.5. DONG lubhs cloarhg Bank 0 I'll Common Ownontib/Control Russian Securities 5 Brokerage 5 I DU. Rubies 6 Client/Start Final Destination/End Step 1: A client requests that a mirror trading network transfers rubles located in Russia abroad. Step 2: A network-controlled securities brokerage purchases securities on behalf of the client from a securities counterparty in Russia. Step 3: The securities counterporty in Russia transfers the securities to the network-controlled securities brokerage. Step 4: The network-controlled securities brokerage transfers ownership of securities to an offshore shell company controlled by the network. Step 5: The shell company sells the securities to a securities counterporty in Europe. Step 6: The securities counterparty sells the securities on behalf of the shell company and puts the sale proceeds in the shell company's bank account. Step 7: The shell company moves the sales proceeds through a book transfer or wire transfer to another network-controlled shell company. Step 8: The funds are transferred to a bank account as directed by the client. knowledge of the mirror trading method is primarily derived from information about the Moscow Mirror Network. Figure and the corresponding steps above demonstrate how Deutsche Bank?acting as one of the securities counterporties in Russia and the United Kingdom?observed the Network transfer funds from Russia to Europe. Law Enforcement Sensitive/Contains BSA Information 2 Intelligence Assessment Law Enforcement Sensitive/Contains BSA Information Moscow Mirror Network Transfers Billions of Dollars Using Russian and European Securities Markets Four key individuals have used mirror trading to transfer billions of dollars per year, and at least $1 billion per month in some instances, from Russia to other jurisdictions and, at times. on behalf of illicit actors. In an apparently ongoing process, these individuals, who have engaged in suspicious behavior, ensure that the funds transfers are processed opaquely fora fee of up to five percent. assesses that these individuals and entities constitute a network. involving at least 54 shell entities and nine financial institutions {see Attachment This ?Moscow Mirror Network" or "the Network" urchased Russian blue?chip securities stocks and bonds?and sold them on the European market to well-known firms, such as Deutsche Bank, . and . Key European counterparties of the Network include Schildershoven Finance and Tristane Capital B.V. of The Netherlands, Baltic Credit Trading Group of Latvia, and Figure 2: Key Individuals in the Moscow Mirror Network Andrey Yurlevlch Babenko is a Russian Oleg Aleksandrovich Belousov is a Russian stockbroker. bank owner and executive. Belousov had shared or complete ownership of 24 Network entities. many of which he shared with Kulikov. Babenko had shared or complete ownership of two Network entities. He was also a director at . the London branch of a Russian brokerage firm to which the Network later sold securities. Andrey Vladimirovlch Gorbatov is a Russian Alexey Anatolevlch Kulikov is a Russian stock and equities trader. businessman and bank executive. Kulikov had shared or complete ownership complete ownership of of 26 Network entities, many of which he four Network entities, shared with Belousov. He was detained on including RMG Securities, 0 3 March 20l6 for two months at the request Russian securities of the Russian Interior Ministry on ?nancial brokerage through which crime charges.? the Network purchased securities. Gorbatov had shared or The entities involved in the securities trades share common characteristics?such as ownership. place of registration. and banking location?suggesting that they may have acted in concert with each other to formulate the process of moving the Law Enforcement Sensitive/Contains BSA Information Intelligence Assessment Law Enforcement Sensitive/Contains BSA Information funds out of Russia. Three examples of shared characteristics between Network entities are as follows: . Common Banks: Forty?six of the 54 shell entities held accounts at one or more of the following banks: Trasta Komercbanka (Latvia), Danske Bank (Estonia), and Cyprus Development Bank latter formerly majority-owned by Kulikov, Belousov, and Gorbatov. Four of the entities also held accounts at Promsberbank, which was partially-owned by Kulikov and Belousov.7 . Common Ownership: The four key individuals have shared or complete ownership of 32 Network entities. Furthermore, Igor Marakin. and a orney repea appeare on company records: for examp e, as wor entities' ultimate beneficial owners, attorneys, and shareholders. . Common Addresses: The reported physical addresses and places of registration were also shared between the Network entities. For example. out of the 34 entities with reported addresses, nine of them are reportedly located at 22 Begovoya Street in Moscow.3 The Network and its Clients Involved in Suspicious Activity Network individuals and entities have histories of anti-money laundering violations and direct involvement in mirror trading scandals. For example: . Deutsche Bank fired three employees in April 2015 related to a $10 billion mirror trading scheme.? Deutsche Bank identified that l3 Network entities were part of this scheme.? 5 Kulikov was detained for two months at the request of the Russian Interior Ministry, and the Russian Central Bank revoked the license of Network brokerage RMG Securities for related allegations.6 . In July 2015, the Central Bank of Russia revoked the license of Promsberbank, which was partially-owned by Kulikov and Belousov. after determining the bank had inappropriately transferred l.3 billion rubles, or approximately $21,268,000, to a foreign insurance company that was ultimately determined to be a shell company. 0 7 Deutsche Bank identified the following entities as part of The Network: Bonnicrest Management Limited. Trade LLP, Cherryfield Managment Ltd., Ergoinvest LLP. OSJ Ray Man Gor Securities. 5 Financial Bridge Investment Company, an . The conversron rom ru es to US dollars is based on the July 31, 2015 close of .01636 from xe.com. Law Enforcement Sensitive/Contains BSA Information 4 Intelligence Assessment Law Enforcement Sensitive/Contains BSA Information - In 201 i. Russian regulators suspended --and Financial Bridge Investment Company--two financial brokerages involved in lhe Network's mirror trading aciivity--reialed to a vaiue added tax fraud scheme totaling 32 billion rubies, or approximately 979,776,000, via overllhe- counter securities lransaclions.c 3 7 Some of the Network's suspected clients have also been involved in suspicious or illicit aciivity. Forlyeone oi the top entities that received funds from the Network were subjects of sensitive financial reporling obtained by and some recipients have been designated by OFAC or convicted ol criminal activity, indicating that at least a portion of the Network's minor trading likely was conducted for illicit purposes.'1 For exampie: - OFAC>>designated Mazaka General Trading LLC {Mazakal received a total of $49,787,532 from five Network eniilies between March 2013 and Aprii 2014. In October 2016. OFAC sanctioned Mazaka for having materiatly assisled. sponsored, or supported the Khanani Money Laundering Organization, which launders iilicit funds for terrorists. drug traffickers, and criminal arganizations.'? . LA Payroll. which was implicated in an alleged tax fraud scheme in the United States in 20] 4 with an estimated total loss of $4 million. sent a wire lor $480,000 lo Network entity Redwind Experts LLP in August 20i . Eurasian organized crime--linked Gurgen House FZCO received a total at $810,000 from two Network eniities--Boizana LLP and Monica Alliance LTD-- in September 20H and February 20l2.'2 OFAC designated Gurgen House FZCO in October 2013 for lies to the Brothers Circle Organization, a Eurasian criminal group involved in drug lrallicking.'3 Additional Factors Concealed Illicit Behavior As part at the Network's mirror trading activity, banking records in Russia reflected the domestic purchase of securities. while banking records in Europe recorded an intro-European purchase of securities. This crassejurisdiclionai separation of recorakeeping iargely hid the true nature of transactions from U.S. dollar-clearing institutions, and obscured individual transactions from other financial institutions involved in the process. The Network further eroded transparency by establishing entities with shell-like characteristics and layers of ownership, and by conducting book transfers to hide lhe conversion lrom rubles to US. dollars is based on the Dec 2'7, 20" close at .031 is tram xe.com. ranked ltte recipients of lunds trom the Network entities and brokerages and then removed banks and cilies listed in lhe results to determine lhe top titty entities that received tunas tram lhe Network. Law Enlorcernenl Sensitive/Contains BSA information -- 5 lnlelligence Assessmenl Law Enforcemenl Sensitive/Conlalns BSA Information who was involved in lhe Nelwork and [or whom lhe funds were being lranslenedl For example: . Use of look Transfers: The Nelwork used inler-occounl lund iranslers wilhin lhe some lrnancial inslilulion, or book lransfers, belween Nelwork enlilies lo furlher hide me money lrail and lhe idenlilies of ifs clienls. These lransfers are recorded for accounling purposes, and mereiore are nol monilored lhrough lhe linancial syslem. 0 Use ol Shell Fiilyrsix Neiwork enlilies have shelHlke characlerislics. such as being engaged in non~proxlmale banking and being reglslered in higher-risk jurisdiclions for shell company formafion, such as Cyprus and lhe Unilea Kingdom. For example, nine are regislered lo 175 Darkes Lane in London. one of lhe mosl common foreign addresses in sensilive financial reporiingfi' . Layers of The Nelwork furlher hid iransacllons lhrough layers of shell companies and nominee shareholders For exam key Nelwark-- controlled securities dealer, was owned by Babenko and Gorbaiov nrough nes mg ownership 0 lwo olner Neiwork Cherryfield Managemeni Limiiea ana Venlarre Limiled." '5 of error lradlng Mirror lraaes are nol inherenfly illegal and, as individual lrades, do nol necessarily appear suspicious, For example. purchasing in one counlrv and selling ihern in anolher is a legilimole way for clienls lo benelil lrorn lhe diilerence belween local and foreign prices of a slack, Mirror lrodlng can also help a securilies brokerage comply wilh counlry capilal conlrols. Mirror lraaes, however, can be used lo focililole illicll financiai aclivilyilo include money laundering, sanciions violalions, and lax avoidance--because of lhe lack of iransporency. Allhough lhe Moscow Mirror Nelwork is operating in Russian and European securilies markels, olher lurisdiclions are also vulnerable lo illiciily mollvaled mirror lrades. Anolher nelwork, lor example, appears lo have moved money oul of China and info lhe Uniled Slates usin securlires lrades." In rm: example on employee or reeledfi indicaled his concerns oboul lhe securilles lrades were "wash and prearranged 9 Nonrproximale relers lo when an l5 reglslered in a lacalron me! is driferenl lrom lhe localiah ol 2r; bank uccouni, In an Execulive Aleri "Panama Prominenl ln lop Addresses lar Shell Company Formalion" x-l, lhe fen men-commonly repelled lorelgn addresses used la Iegisler mulliple companles lram 1 July 2m 4 lo 30 June 2m 5. Law Enforcemeni Sensilive/Conlains BSA lnlormallon -- 6 Intelligence Assessment Law Enforcement Sensitive/Contains BSA Information trading to move the money." and suggested that the clients were not looking to profit from the trades, similar to the Moscow Mirror Network case.? Given mirror trades can be used to facilitate illicit financial activity across numerous jurisdictions. the following red flags, taken together. can help financial regulators and law enforcement detect if a collection of securities trades is suspicious: 1. An entity or individual repeatedly requests unprofitable or minimally profitable purchases and/or sales of securities. 2. An entity or individual exclusively requests securities trades in one direction. i.e. buy only or sell only. 3. An entity with shell company-like characteristics requests the sale and/or purchase of securities. 4. An entity shares ownership with other entities requesting similar securities trades or with securities brokerages acting on their behalf. 5. An entity purchases securities and immediately transfers ownership of them. or an entity receives a transfer of securities and immediately sells them. 6. An entity engages in transactions that do not match its customer profile. For example, an entity requests the purchase of securities in oil and gas, even though its customer profile indicates that it is engaged in the trading of textiles. 7. An entity engages in disparate activities. one of which is securities trading. Other activities commonly include the import or export of textiles, electronics. and/or building materials. will continue working with domestic and foreign regulators and regulated entities to understand the scope of this issue and determine to what extent additional awareness of the problem is needed. Source Note knowledge of the mirror trading method is primarily derived from information about the Moscow Mirror Network. We relied on the following sources for this Intelligence Assessment: 0 Open source reporting. including Bloomberg. the New Yorker, and Russian press. for confirmation of the methodology. Law Enforcement Sensitive/Contains BSA Information 7 Intelligence Assessment Law Enforcement Sensitive/Contains BSA Information - Sensitive ?nancial information obtained by which was useful for establishing transactional relations, ownership information, and reported locations of the Network entities. - Deutsche Bank, which provided information into how its services were used by the Network to facilitate the securities trades, and individuals and entities involved in the activities. 0 A foreign government, which provided information regarding a European bank's role in mirror trading and information about related entities that held bank accounts there. Note: encourages all law enforcement agencies that have equities in the subjectts) of this Intelligence Assessment to de-conflict case sensitive information and network. Please contact the Production Management Office if you have any questions pertaining to this report. Reference Report and . Customer Feedback Matters it .I I. - Pil?lf' NOTE: This survey can only be accessed using Internet Explorer or Googto Chrome browsers. Regarding Use And Dissemlnation The information in this document is to be used for lead or investigative purposes only. The information may not be released. disseminated. disclosed. or transmitted outside your organization. or in particular used as evidentiary material or presented in court or other formal proceedings, without the prior. written approval of the Financial Crimes Enforcement Network This document contains information that is protected from unauthorized disclosure by the US. Bank Secrecy Act (BSA) and other laws, as well as the Egmont Group Charter. Unauthorized release of information contained in this document is unlawful and may result in penalties including the loss of access to information. Law Enforcement Sensitive/Contains BSA Information 8 Intelligence Assessment Law Enforcement Sensitive/Contains BSA Information deutsche-bank-trodina-probe, retrieved 3 November 2016. 2 Promsberbank Invent Report. 3 BSA IDs ?ond -, and foreign government source. 4 6/08/29/deutsche-banks- I 0-bittion-scandat, retrieved 6 October 2016892321. retrieved 29 November 2016. 7 22 g34.htm, retrieved 3 November 2016. 3 BSA ID . 9 201 6/08/29/deutsche-bonks- I 0-billion-scandal, retrieved 6 October 201610574.05 retrieved I November 2016. retrieved 13 October 2016. '2 BSA ID and supporting documentation. '3 96.059x, retrieved on 13 October 2016. 1? BSA 10 '5 Sensitive law enforcement information. ?6 The Board of Directors of Chicago Board Options Exchange, Incorporated, Decision No. 14 8D 01, File No. 11-0009, date 29 October 2014. '7 Ibid., p. 14. Law Enforcement Sensitive/Contains BSA Information 9