Euro SIFMANet Online Report

In May 2024, the Centre for Finance and Security (CFS) at RUSI convened a roundtable discussion with 23 stakeholders from the public and private sectors in Europe. The event was part of RUSI’s work to raise awareness on key challenges for sanctions implementation through the European Sanctions and Illicit Finance Monitoring and Analysis Network (Euro SIFMANet), funded by the National Endowment for Democracy. The discussion centred on outlining the scope of Russian sanctions evasion activity in the virtual asset industry, as well as jurisdictional vulnerabilities that can enhance exposure to this threat, and practical steps to mitigate the risk. This conference report represents the findings discussed in the roundtable discussion. None of the discussions from the event are attributable.

Background

An opening question considered the extent to which virtual assets are being used as part of sanctions evasion strategies. Roundtable participants agreed that when comparing the current level of sanctions evasion by the Russian government within the virtual asset industry to circumvention through traditional financial institutions, the virtual asset industry is not currently a priority for transferring funds. However, the threat of sanctions on traditional financial institutions may trigger the Russian government to redirect its focus to the virtual asset industry in order to move funds, and thus coalition countries should be exploring and anticipating such activity.

The US, for example, restricted Russian circumvention networks in 2023 when the Biden administration announced an executive order on “Taking Additional Steps with Respect to the Russian Federation’s Harmful Activities”. This executive order authorised the US Department of the Treasury to designate a foreign financial institution that has “conducted or facilitated any significant transaction or transactions for or on behalf of any person designated” for “such sectors as may be determined to support Russia’s military-industrial base”. As a result, the risk appetite of banks, particularly in China and Türkiye, may alter, resulting in their restricting support for the movement of funds on behalf of the Russian government. With these limitations in place, the Russian government may change its operations for financial transactions.

In the last three years, multiple Russian-based virtual asset companies have fallen under US sanctions. This report frequently reflects upon one of these companies, known as Garantex, as the operations of this exchange dominated the roundtable discussion. In April 2022, the US designated Garantex, operating out of Moscow, on account of its “operating or having operated in the financial services sector of the Russian Federation economy”. This exchange, according to roundtable participants, continues to operate through regulatory arbitrage – that is to say, exploiting gaps in different countries’ regulations – as the international community has failed to anticipate the adaptations in sanctions circumvention techniques. There is, therefore, a critical need to identify the scope of threats and vulnerabilities related to the virtual asset industry.

Assessing the Scale of Risk

The overarching question of the roundtable discussion centred on whether state sponsorship of virtual asset activity is present. In the case of Garantex, the US Department of the Treasury notes that the transaction record tied to the exchange depicts the facilitation of nearly $6 million in transactions for the Russian ransomware as a service (RaaS) group Conti, and approximately $2.6 million from a darknet market known as Hydra. As noted, despite US sanctions, Garantex continues to operate by deploying different laundering methods to obscure the source of funds. However, it is not known whether such virtual asset activity can be attributed to the Russian government or oligarchs.

To fully understand the extent of Russia’s potential circumvention activity, the international community also needs to consider the available channels for Russia’s use of virtual assets to purchase dual-use components. To carry out this process, the Russian government or third-party individuals operating on behalf of the state would most likely need to convert virtual assets to fiat currency, as there are limited suppliers that would accept virtual assets as a legitimate form of payment. Subsequently, virtual assets would be one component in the broader sanctions evasion activity of the Russian government and therefore, the integration of this avenue within traditional circumvention techniques needs evaluation.

Compounding the threat, one roundtable participant noted that malign actors tend to rely on the same platforms and facilitators. As shown by blockchain analytic data, North Korean actors have used Garantex to obscure the origins of criminal proceeds. If an attribution is uncovered, to any degree, of Russian state sponsorship of the Moscow-based exchange, financial evidence could further confirm UN sanctions violations.

Key Concerns for Russian Virtual Asset-Focused Sanctions Evasion

Virtual asset-focused activity linked to potential Russian sanctions evasion includes the use of stablecoins, regulatory arbitrage, credit settlement in virtual assets, and virtual asset mining. This section outlines these avenues according to the roundtable discussion.

Stablecoins

Stablecoins – digital tokens that are pegged to an asset, generally fiat currency – are trending to be the preferred option for sanctions evasion, due to the lack of price fluctuation when compared to other prominent tokens. Furthermore, sanctioned entities have a greater incentive to use stablecoins pegged to the US dollar, as the US dollar still represents the primary reserve currency on an international scale, and accessing this currency through traditional means poses a challenge for such actors.

The benefit of this adaptation by sanctioned entities, however, is that the international community may have options to respond to the evasion due to the underlying design of features linked to the tokens. For example, Tether, a company that issues the stablecoin USDT, works with law enforcement to freeze illicit actor-linked assets. However, in regard to sanctions circumvention, this process is dependent on verifying the activity, and attribution of the individual behind the virtual asset address poses a challenge. In addition, roundtable participants noted that this solution is not always feasible. This limitation occurs if the jurisdiction where investigations take place does not have the appropriate legal provisions to enable law enforcement to carry out the freezing process in partnership with Tether.

Relocation to Other Jurisdictions

In the last two years, Russian-based businesses have relocated to other jurisdictions, including Georgia, the UAE and Turkey. The virtual asset industry is not excluded from this movement. According to participants, Garantex moved activities to Georgia in an attempt to continue operations. However, roundtable participants noted that business operations of the exchange may be impacted, as in June 2023, the National Bank of Georgia announced the approval of a rule requiring registration of virtual asset service providers (VASPs). According to this rule, fit and proper criteria for administrators and significant share owners of the entity are required for VASPs, as well as anti-money laundering/counterterrorist financing requirements. These measures may result in the movement of Garantex once again, to a neighbouring jurisdiction that has yet to implement regulations for the industry.

Along with forming shell companies in neighbouring jurisdictions, Garantex also, according to participants, produces new virtual asset addresses within a five-day period to move funds, and effectively operates as a nested exchange – a company that takes advantage of larger exchanges to service its customers.

Credit Settlement in Virtual Assets

Participants first discussed the use of virtual assets for credit settlement by the Russian government. In March 2024, Russian Federal Law No. 45-FZ, which made amendments to Federal Law No. 259-FZ on digital financial assets and digital currency, included a supplement stating that “digital financial assets may be used as a consideration under foreign trade agreements (contracts) concluded between residents and non-residents, which provide for the transfer of goods, the performance of work, the provision of services, the transfer of information and the results of intellectual activity”. Nonetheless, the definition of a digital financial asset within the legislation may not include virtual assets.

Under Federal Law No. 259-FZ, digital financial assets include digital rights “to demand the transfer of emissive securities that are provided for by the decision on the issue of digital financial assets … the issue, accounting, and circulation of which are possible only by making entries in the information system on the basis of a distributed ledger, as well as into other information systems”. A Russian-based news source argues that, despite the mention of digital ledger, a definition under which blockchain technology falls, the definition excludes cryptoassets, including Bitcoin.

The second part of this discussion involved the current activity within Russia regarding the use of virtual assets in credit settlement. In the event that sanctions evasion through this process occurs, Russia can use virtual assets as a method of credit settlement in a similar way to Iran. In January 2022, the head of Iran’s Trade Development Organization noted that virtual assets can act as a form of guarantee for small and medium-sized businesses that work with counterparts in other countries. Virtual assets, according to local news reports, would provide mutual guarantees and transfer the issuer’s credit to the importer of the goods into Iran.

At least one fintech service in Russia, B-crypto, promotes its specialisation in cross-border settlements in virtual assets. B-crypto supports Rosbank, a Russian credit institution, with conducting pilot transactions for corporate and private clients. According to a Russian news source, the process for cross-border settlements by B-crypto involves the following steps:

1. A Russian company that needs to pay for imported goods or services in virtual assets must provide for the token type and indicate its virtual asset address in the contract with the supplier.

2. A foreign supplier then issues an invoice for payment to the Russian company with a description of the goods and services, the amount in virtual assets and the address of the virtual asset wallet.

3. When the parties sign a contract, the Russian customer deposits fiat money for the purchase of virtual assets into his account in Rosbank and submits an application. The funds are then transferred to B-crypto, which buys crypto in “friendly countries” and sends it to a foreign supplier.

The US designated Russian fintech service B-crypto in March 2024 for “operating or having operated in the financial services sector of the Russian Federation economy”.

Virtual Asset Mining to Generate Revenue

Participants identified that Russia could use natural resources to generate revenue through virtual asset mining. This process, first demonstrated by Iran, incorporates the use of cheap oil and natural gas as energy for virtual asset mining. Through the mining process, miners receive newly minted tokens that represent value on the blockchain that is not tied to previous transactions. In Iran, miners receiving the funds, according to the country’s licensing regime, are required to send funds to the central bank. These funds then support credit settlement for importing goods.

In April 2022, the US sanctioned BitRiver, a company that hosts mining equipment for customers. In return for hosting the equipment, the client pays for the energy consumption and machine maintenance. According to the US Treasury, BitRiver helped Russia to “monetize its natural resources”. One participant identified that the underlying risk of generating newly minted virtual assets is that a VASP may not identify the source of funds as high risk, meaning that an individual can exchange the funds for fiat currency.

Outside of undisputed Russian territory, this process is carried out by Russian individuals in illegally annexed and occupied territories. In these areas, the Russian government provides subsidised energy to keep the territory operational. Some of this energy, depending on the territory, is then fed into virtual asset mining operations to generate revenue that is free of any indication of sanctions evasion activity, and can be used to fund procurement or other illicit international Russian activity. Participants also noted that there is a potential exposure to this threat in Africa due to the presence of the Wagner Group and cheap electricity.

There is also a risk of virtual asset mining pools being used as a laundering mechanism. Notably, B-crypto, the fintech service in Russia, claims on its website to have “access to the largest mining pools”. Participants noted that when monitoring virtual asset mining activity, stakeholders can identify where the nodes are located and determine an estimation on the level of revenue generation, but error exists in the case of a miner using a virtual private network to obfuscate their location. To resolve this challenge, the private and public sectors need to identify where the newly minted coins are sent. Notably, in the past, new coins were perceived as more valuable, as they had less exposure to potential crimes given their brand new nature. As of 2024, this perception has changed considerably, and now new coins are seen as a risk by some VASPs. However, there is still a possibility for miners to try to develop a legitimate transaction history prior to the funds reaching a VASP.

A notable deficiency is the lack of attention applied by jurisdictions to virtual asset mining. Virtual asset mining companies often do not fall under the Financial Action Task Force (FATF) definition of a VASP due to the lack of custody of the client’s funds. As a result, some jurisdictions do not consider related risks while conducting a sectoral virtual asset risk assessment.

Public Sector Challenges and Responses

Regulators of the industry need to understand how to identify and tackle sanctions evasion in the virtual asset industry. The roundtable participants discussed three topics in this regard: vulnerabilities that exacerbate exposure to Russian sanctions evasion activity; challenges around virtual asset regulation and enforcement; and lack of training and resources.

When outlining general vulnerabilities that increase jurisdictional exposure to Russian sanctions evasion, participants identified that these factors include, but are not limited to: the ease of immigration for Russian nationals to that jurisdiction; the level of Russian language in the population; and lack of enforcement.

The roundtable participants then discussed challenges around virtual asset regulation and enforcement. One concern raised by participants was the pressure applied to jurisdictions by the FATF to quickly implement regulation for the virtual asset industry. The short timeline for a jurisdiction to implement the related requirements in order to avoid censure and greylisting has resulted in inefficient regulation favouring form over substance, without consideration of associated risks. Jurisdictions need to be cautious about this process and ensure that they pass legislation that they can enforce.

In relation to enforcement, authorities still have difficulty identifying VASPs that are operating illegally. To compound this challenge, participants said that company formation agents set up by Russian individuals are facilitating the relocation of high-risk VASPs. Along with this movement, participants noted that some high-risk VASPs have started to use obscure names for their companies to mask their involvement in virtual assets and evade oversight by designated authorities.

Challenges around suspicious transaction reports (STRs) also persist. The designated authority for receiving STRs in high-risk jurisdictions needs training to understand how to identify and analyse sanctions evasion activity in the virtual asset industry. However, this challenge is exacerbated if the quality of the STRs submitted by VASPs is low. Supervisors therefore need to ensure that the reports submitted by VASPs are meeting expectations and that feedback is provided to the VASP industry on how to meet those expectations. Participants noted that in some cases, VASPs dump information from blockchain analytics tools into an STR, overloading the designated authority receiving the report.

Finally, the roundtable discussion resulted in a question on how jurisdictions should identify which blockchain analytics tool to purchase in order to investigate suspicious activity. Each blockchain analytics company uses publicly available information on transactions and analyses it through company-specific methods, which the companies do not share, in order to keep a competitive edge. Along with separate methodologies, companies may have different data coverage and data available within their product. However, it may not be feasible for authorities in certain jurisdictions to purchase more than one tool to access the full scope of information, and therefore, investigations may be limited.

Private Sector Challenges and Responses

The roundtable discussion outlined challenges and responses for blockchain analytics companies, financial institutions and VASPs.

Blockchain Analytics Companies

Participants said that illicit actors have attempted to gain access to credible blockchain analytics tools in order to monitor attribution and the level of visibility of their illicit activity. To restrict access that bad actors have to their platforms, blockchain analytics providers should conduct robust know-your-customer measures and due diligence on their customers. One participant highlighted their experience of an entity connected with sanctions evasion that had attempted to gain access to a blockchain analytics tool in order to gather information. To combat this risk and strengthen their sanctions compliance, participants noted that some blockchain analytics providers have denied access to their tools for individuals located in Russia or indirectly linked to Russia, and for entities where the ultimate beneficial ownership is tied to Russia.

Financial Institutions

To procure dual-use items, the Russian government or third-party individuals operating on behalf of the Russian state would most likely need to convert virtual assets to fiat currency. Therefore, financial institutions will still act as gatekeepers for restricting sanctions circumvention. To develop trust and verification for banking VASPs, some financial institutions use blockchain analytics tools. These tools can support financial institutions with identifying risk, as some include additional information on VASPs and their specific exposure to financial crime.

Virtual Asset Service Providers

For VASPs, a challenge can be linked to the fact that when the US Office of Foreign Assets Control lists a virtual asset address on the Specially Designated Nationals and Blocked Persons list, there are other unidentified addresses tied to the sanctioned address. Identifying these virtual asset addresses requires blockchain analytics tools or extensive time to uncover the unidentified addresses manually. Therefore, identifying addresses associated with the sanctioned virtual asset address takes significant resources for less mature VASPs without access to blockchain analytics tools.

Key Insights and Recommendations

The roundtable discussion resulted in the following observations that international stakeholders should consider in order to restrict Russian sanctions evasion in the virtual asset industry.

• Despite US sanctions, the virtual asset exchange Garantex still continues to operate. Garantex continues operations by forming shell companies and registering in neighbouring jurisdictions, as well as producing new virtual asset addresses within a five-day period to move funds for operations.

• The public and private sectors need to coordinate to increase the speed of response to sanctions evasion activity in the virtual asset industry. It is important that VASPs are included in public-private partnerships as they are often not invited to participate. This limitation stems from the fact that such partnerships are built on a circle of trust so that information can be shared. These forums initially developed with commercial banks that have an innate distrust of VASPs, hence the latter’s exclusion. A key development that may begin to address this perception of VASPs in Europe is the introduction – and implementation – of the Markets in Crypto Assets Regulation.

• Funding should be provided by governments to train supervising authorities within jurisdictions neighbouring Russia on how to analyse virtual asset-related STRs. The process of training designated authorities on analysing STRs should provide awareness on Russian sanctions evasion typologies and ensure that there is access to the necessary resources for investigations.

• Blockchain analytics providers should ensure that they closely review customers attempting to gain access to their tools. Illicit actors have attempted to access blockchain analytics tools in order to monitor attributions and the level of visibility into their activities. To restrict this threat, blockchain analytics providers should consider conducting know-your-customer measures on new clients, along with due diligence.

• Jurisdictions need to ensure that they pass virtual asset legislation that they can enforce. The short timeline for a jurisdiction to implement FATF requirements related to virtual assets – and thus avoid the risk of public censure by the FATF – has resulted in inefficient regulation without consideration of associated risks. Jurisdictions therefore need to take a comprehensive approach when developing regulation for the virtual asset industry to ensure that enforcement is feasible, and should avoid prioritising form over substance.

• The FATF should assess the risk posed by virtual asset mining companies falling outside its current definition of a VASP. Virtual asset mining companies often do not fall under the FATF definition of a VASP due to the lack of custody of clients funds. As a result, some jurisdictions do not consider related risks while conducting a sectoral virtual asset risk assessment.

In sum, the roundtable discussion identified a range of areas of vulnerability connected with the potential use of virtual assets and related infrastructure to facilitate Russia’s circumvention of both financial sanctions and procurement restrictions on high-priority items. While this may not currently be a central element of Russia’s sanctions evasion strategy, Ukraine’s allies need to ensure that, as Western sanctions on Russia tighten, the virtual asset community is equipped for what will inevitably be a growing front in the Kremlin’s sanctions evasion activity.

Jack Bell is the Media Relations Manager at RUSI.