The UK’s National Crime Agency (NCA) has revealed that a billion-dollar money laundering network operating in Britain purchased a majority stake in a bank in Kyrgyzstan to process the proceeds of cybercrime and convert them into cryptocurrency that could evade Western sanctions and support Russia’s war in Ukraine.
The development emerged as part of Operation Destabilise, an international investigation targeting two major Russian-run money laundering groups known as TGR and Smart. The networks allegedly handled ransom proceeds for some of the world’s most aggressive cybercrime groups, including Evil Corp, Conti, Ryuk and LockBit.
According to the NCA, cash-to-crypto swaps have become a crucial layer of the global criminal ecosystem, allowing ransom funds to be converted into digital currency and transferred across borders with minimal oversight.
The NCA said that a company tied to alleged TGR ringleader George Rossi, called Altair Holding SA, acquired a 75 percent stake in Keremet Bank in Kyrgyzstan on 25 December 2024. Investigators later concluded that Keremet had conducted extensive cross-border transactions on behalf of Russia’s state-owned Promsvyazbank, an institution sanctioned by the US and UK after the invasion of Ukraine and previously linked to political interference in Moldova.
The Kyrgyzstan connection came after UK authorities sanctioned Altair Holding in August 2024 in an effort to block Russian attempts to exploit the Kyrgyz financial system as a workaround to Western restrictions. The laundering route involved converting ransom proceeds into cryptocurrency, including a ruble-backed stablecoin known as A7A5, before sending funds to Russia. The NCA believes the system helped channel money into Russia’s military-industrial network.
“Today, we can reveal the sheer scale at which these networks operate and draw a line between crimes in our communities, sophisticated organised criminals and state-sponsored activity…”
“...The networks disrupted through Destabilise operate at all levels of international money laundering, from collecting the street cash from drug deals, through to purchasing banks and enabling global sanctions breaches, said Sal Melki, NCA deputy director for economic crime. ”
Operation Destabilise has resulted in 128 arrests since launch, including 45 suspects detained in the past 12 months. More than £25 (US $33.25) million in cash and cryptocurrency has been seized in the UK, with additional funds seized abroad. The investigation has also uncovered links between cybercrime proceeds and other UK-based criminal markets, including drugs trafficking, firearms sales and immigration fraud.
The NCA said the laundering networks not only funneled money to the Russian state but also acted as a high-end financial concierge for wealthy Russians living in Europe.
Investigators also tracked part of the profits back into the UK economy, including small construction businesses and vehicle exports. Two Russian nationals were arrested for purchasing cars and vans in the UK and exporting them to Ukraine, where the vehicles were sold to the Ukrainian government, which was unaware that the payments indirectly helped finance the Russian war effort.
Operation Destabilise also exposed the role of low-level cash couriers working for TGR and Smart. Several UK nationals were arrested, including former professional footballer James Keatings, who admitted possessing and transferring criminal property after investigators saw him moving boxes of cash during a £400,000 ( roughly US $526,500) handover in June 2024.
Melki said the NCA has intentionally targeted the network from top to bottom. “To the launderers who will have seen our messages, your choice is simple, either stop this line of work, or prepare to come face to face with one of our officers and the reality of your choices. Easy money leads to hard time,” he concludes.
