In brief
- The UK’s Operation Destabilise has entered its second phase, and has now made 128 arrests and seized over $32 million in cash and crypto.
- The operation led by the National Crime Agency has revealed that Russia-linked couriers operate in at least 28 UK towns and cities.
- One of the networks was implicated in the purchase of a bank in Kyrgyzstan, the NCA found.
A UK-led operation targeting Russian sanctions evasion has now made 128 arrests and seized $32.6 million in crypto and cash, according to a new update from the National Crime Agency.
First publicized in 2024, Operation Destabilise had made 84 arrests and seized $25.5 million as of last December, yet the NCA’s update reveals that it has arrested an additional 45 suspected money launderers and seized over $6.6 million in cash.
It has also gained a bigger picture of the Russia-linked money laundering networks operating in the UK, discovering that launderers have been operating in at least 28 British towns or cities.
Suspected couriers work by collecting illicit cash gained via the sale of drugs or firearms, or via human trafficking, and then converting it to crypto, with the proceeds financing organized crime or even military equipment for use by Russia in Ukraine.
The operation has also uncovered more information regarding Smart and TGR, the two individual networks that have been collaborating to launder money for international crime organizations, and that have assisted Russian individuals in evading sanctions and investing money in the United Kingdom.
In particular, the NCA has discovered that the head of TGR, George Rossi, has links to the sanctioned Luxembourg-based company Altair Holding SA, which purchased a 75% stake of Kyrgyzstan bank Keremet on Christmas Day 2024.
Investigations revealed that Keremet has been enabling cross-border payments on behalf of Russian state-owned Promsvyazbank, which has been providing finance to suppliers of the Russian military.
Promsvyazbank is also one of the entities behind A7A5, a rouble-pegged stablecoin that has been used to evade sanctions, and which passed $40 billion in total transaction volume in July of this year.
Operation Destabilise’s impact
While the latest update from the NCA highlights the scale and extent of UK-based money laundering, it also concludes that Operation Destabilise has had an impact on UK-based money laundering.
Its release concludes that Russia-linked networks are “believed to have reservations over operating in London,” and that the ability of such networks to access legitimate banking services in Western Europe “has been significantly restricted.”
Independently assessing this impact, however, may be difficult, with AMLBot CEO Slava Demchuk telling Decrypt that it’s currently not possible to confirm a measurable decline in Russia-related laundering in London, or the rest of the UK.
“Private-sector firms primarily rely on open data, and without the intelligence held by law-enforcement agencies, the crypto-related activity we can observe shows no clear change linked directly to Operation Destabilise,” he said. “This likely reflects the fact that only a small subset of transactions would have been visible without additional classified context.”
Other blockchain intelligence firms agree that it may be hard to quantify a decline in laundering in London, although they suggest that a more general decline in sanctions evasion can be detected.
“Our data does support the idea that Operation Destabilise and other operational activity by UK authorities has increased friction and risk for parts of the Russian-linked laundering ecosystem—but it’s hard to translate that cleanly into ‘less laundering in London’ specifically,” said Ari Redbord, VP, Global Head of Policy and Government Affairs at TRM Labs.
Speaking to Decrypt, Redbord said that service-level data provides some indication of a drop in activity.
“Following coordinated actions by the NCA, OFAC, and other partners, exchanges and OTC platforms tied to Russian money-laundering networks saw sharp and immediate drops in activity,” he explained. “Across three key platforms—NetEx24, Bitpapa, and Cryptex—inflows fell more than 80% on average in the three months after designation compared with the period before.”
Redbord suggests that a similar pattern is observable with Garantex and Bitzlato, which have both experienced a considerable decline in volumes after being sanctioned by authorities in the U.S., the UK and the EU.
No easy solution
However, the case of Garantex—which appears to have rebranded as Grinex—highlights how stopping laundering in one area or at one source can cause it to move elsewhere.
“What we don’t see is a neat, long-term collapse in Russian-linked laundering overall,” Redbord explained. “Flows tend to reroute to other high-risk exchanges, OTC brokers, and alternative rails rather than disappear altogether, and blockchain data isn’t granular enough to say ‘this dollar was laundered in London versus somewhere else.’”
So while Operation Destabilise may have restricted laundering in London and other major cities in the UK, the transnational scope of laundering and of Russian crime networks means that other centers can emerge.
The groups exposed under Operation Destabilise, including Smart and TGR, “function across Europe, the Middle East, Central Asia, and parts of Asia, using a mix of cash couriers, crypto OTCs, payment processors, and shell companies,” Demchuk said.
Demchuk noted that Russia-linked laundering is “deeply embedded” in over 30 countries, forming a “global ecosystem” that moves billions across borders for the purpose of laundering dirty cash and evading international sanctions.
Daily Debrief Newsletter
Start every day with the top news stories right now, plus original features, a podcast, videos and more.
