Undercover reporting reveals a parallel financial system moving illegal payments in and out of Russia—and backed by the Kremlin

By SourceMaterial and Nathaniel Peutherer

Do you want to sell drones to Russia? Are international sanctions putting an inconvenient brake on profits? Dima is on hand to help.

“We have our own companies all over Europe,” says the broker in a chat on Telegram, the encrypted messaging platform, explaining how he can easily route illegal payments from Russia to Europe through a string of intermediaries. “The directors are not Russian, there will be no trace.”

In late 2024 police from the UK, US, France and Ireland swooped on a sprawling money laundering web spanning 30 countries. Operation Destabilise exposed a parallel financial system moving cash for sanctions-dodging oligarchs and criminal gangs—as well as helping Russia fund its war in Ukraine, according to the UK’s National Crime Agency. 

Dima is speaking to an undercover SourceMaterial journalist posing as a European businessman as part of a year-long investigation. It reveals how, despite the crackdown, the evasion networks uncovered by Operation Destabilise are thriving—with apparent encouragement from the Kremlin.

One broker that offered to help undercover reporters with suspect transfers, SCS Consulting, is run by the chairman of an inter-governmental committee tasked with easing payments between Russia and its allies.

Another, FinPlatform—shuttered shortly after reporters approached it last year—was developed by a sanctioned company certified by the FSB, Russia’s domestic intelligence agency, and the Federal Service for Technical and Export Controls, the body that oversees sensitive imports including weapons technology. 

“There’s been clear messaging from the Russian government to businesses to invest in exploring new ways of sending and receiving funds,” said George Voloshin, a sanctions expert at the Association of Certified Anti-Money Laundering Specialists.

‘Nuclear option’

In March 2022, days after Russian troops surged into Ukraine, the European Union, the UK, Canada and the US activated what finance experts called the “nuclear option”, cutting off Russian banks from Swift, the communication system for international money transfers.

That reaction has spawned a flourishing shadow industry of payment providers—some publicly touting their assistance in bypassing the international blockade on Russia. “When sanctions shuffle the cards, we offer real solutions,” read an advertisement for FinPlatform. 

The mechanisms they use can be complex, relying on layers of intermediaries to hide the origins and destinations of illegal payments. 

“These shady operators often leverage white-label and third-party service providers in order to access mainstream payment networks like Visa and Mastercard,” said Elise Thomas, an investigator at the Centre for Information Resilience.

To understand the inner workings of the market, SourceMaterial and its partner Delfi went undercover, adopting various guises as Russian or European businessmen hoping to hide questionable transactions.

“No visible connection with Russia”

Of nine payment providers contacted by reporters on Telegram, Russia’s most popular messaging platform, seven were eager to help. They offered to route suspect payments in and out of Russia through companies across the world, including in Western countries that have banned such transactions.

“We can pay Swift,” said Dima, whose CW Group uses Telegram to advertise “legalisation” of transfers to Europe through companies around the world and does not appear to be officially registered in any jurisdiction.

In separate conversations spanning several months, Dima offered to facilitate payment for drones shipped to Russia from Germany—a sanctions breach punishable in the US and other countries with financial penalties and a possible prison sentence.

“Payment will go without a trace, from a good company. We can attach agreements, contracts, invoices, everything,” he said, explaining how cash could be sent through entities in the EU, Canada and the Middle East, and promising “no visible connection with Russia”. 

For the drone transaction, Dima recommended routing payments from Russia to Germany through a UAE-based intermediary owned by a former manager of Severstal, a major Russian steelmaker.

To avoid drawing unwanted attention, he advised limiting transfers to “no more than $200,000 per day”.

Dima did not respond when later confronted with specific allegations that he was willing to facilitate sanctions breaches.

“Our activities are focused exclusively on supporting international settlements and selecting relevant payment solutions for specific client needs,” he said. “Companies and partner structures we use may change depending on current market conditions, bank requirements, compliance, limits, and workload.”

European route

In a separate conversation with another journalist using a different cover story, Dima offered to channel payments from China to Russia through companies in the EU and Canada in order to cloak Russian involvement.

Although China has not sanctioned Russia, banks there could still face penalties from the US under secondary sanctions aimed to limit transactions by the Russian defence sector, according to Voloshin, the sanctions expert.

Dima said his CW Group could use companies in Hong Kong to issue fake invoices to mask the payment. An initial transfer would then be made through the UAE, Europe or Kyrgyzstan, and the funds moved onwards to Russia “in cash or crypto”, he said.

He gave undercover reporters account details for a test payment to a Canadian company via a Lithuanian bank.

Corporate records in Lithuania and Canada, as well as archived websites, reveal that both of these entities are run by former business associates of the TGR group—the laundering network targeted by Operation Destabilise. 

Dima advised the undercover reporter to make the test transfer through TeslaPay, a Lithuanian bank that says it is “revolutionising the way the payment industry operates”. 

TeslaPay was co-founded in 2017 by Philipp Larin, a Russian businessman who at a 2024 conference in Uzbekistan invited investors to contact him on Telegram if they were interested in ways to “overcome international economic barriers”. In 2016 Croatian authorities blocked Larin and another TeslaPay founder from taking over a bank in the EU.

Larin previously worked alongside TGR’s alleged chiefs, George Rossi and Elena Chirkinyan, both sanctioned by the UK and the US after Operation Destabilise investigators named them as the network’s ringleaders. 

Together the three helped run Eastern European Payment System, a Latvia-registered agency that operated a card facility for the now-sanctioned TGR, according to the group’s old website.

A second link in Dima’s recommended chain for the transfer was Grata, a Canadian company whose sole director is an Estonian lawyer, Aleksei Ratnikov.

Ratnikov was previously listed as a director of One Remit, a now-defunct British company that handled the TGR group’s international money transfers and one of several network entities registered at 55 Riding House Street, a terraced house in London’s West End. (TeslaPay also set up a UK branch in 2024 but never gained an operating licence.)

The owner of One Remit’s Cypriot holding company at the time of Ratnikov’s appointment was Chirkinyan, the alleged TGR chief.

There is no suggestion that TeslaPay and Grata were aware of the transactions being proposed by Dima.

Responding to questions, Ratnikov said he and Grata Payments had no knowledge of CW Group and “are not aware of any activities taking place on Telegram”. Grata never made payments to or from China and never processes transactions in rubles, he said. He added that the bank details Dima provided for the test payment were not associated with Grata, which had no connections with the TGR group. 

Ratnikov also denied any connection to One Remit, saying it had used his name without his knowledge. 

Eastern European Payment System, Larin, Rossi and Chirkinyan did not respond to requests for comment.

A TeslaPay executive said in an email that the company is “subject to anti-money laundering requirements and regularly supervised by the Bank of Lithuania, including in the framework of a recent anti-money laundering audit”.

He added: “The company has thousands of customers and customer due diligence measures are implemented by competent compliance officers.”

Indonesian villas

While the murkiness of the parallel financing system makes it impossible to calculate its exact size, costs of non-Swift trade with Russia total between $10 billion and $30 billion a year, a “sizeable portion” of which is brokers’ fees, according to research by the Center for Analysis and Strategies in Europe.

That figure doesn’t include money transfers by ordinary Russians who often rely on payment agencies for remittances. Still, sanctions-busting imports are the biggest driver of demand, one broker told undercover reporters in a video call.

“Ninety per cent of the customers are those who work with sanctioned goods,” said Roman, a representative of another payments provider, Adwin, who only gave his first name. “Equipment, various kinds of chips, processors, machine tools, various kinds of machinery.”

Payments could be disguised through 30 companies around the world, Roman said.

“We have a company, for example, that builds villas in Indonesia,” he said. “This is just one example.”

“A billion dollars a day”

“Adwin Finance is another fake payment system that will simply steal your money,” one reviewer wrote on CryptoRussia, which rates payments services.

Asked about negative reviews, Roman called them “false”.

Russia-based payment platform SCS Consulting sometimes processes $1 billion a day, though the average is closer to $20 million, its owner, Aleksandr Maksimkin, told a podcast called ‘How to Earn Millions Under Sanctions’ in December 2025. Recent transactions included €1.5 million for a batch of lorries, with payment routed from Russia to Germany via Turkey.

“Our clients are large—these are billion-dollar companies, exporters, and major importers,” Maksimkin said.

Maksimkin has official connections: he chairs an inter-governmental committee to create a cross-border payments system “in the interests of the Russian Federation and its friendly countries”. 

Adwin and SCS did not respond to requests for comment.

Pulling strings

Operation Destabilise, led by the UK’s National Crime Agency, aimed to cripple Russia’s clandestine payments networks. 

“The NCA and partners have disrupted this criminal service at every level,” said Rob Jones, the agency’s director general of operations, in 2024. “We have identified and acted against the Russians pulling the strings at the very top, removing the air of legitimacy that enabled them to weave illicit funds into our economy.”

SourceMaterial’s investigation shows that the network shut down in 2024 has reinvented itself in other guises—and that Russia’s sanctions evasion system is mutating faster than Western authorities’ efforts to contain it, said Ilia Shumanov, managing partner at TriTrace Investigations, which works for corporate clients to expose sanctions evasion.

“Payment systems are currently one or two years ahead of regulators when it comes to developing mechanisms for sanctions circumvention,” he said. “This is a constantly evolving ecosystem backed by millions of dollars in investment, with clear support from the Russian state.”

Headline graphic: James O’Brien, OCCRP