Using financial intelligence to combat Russian influence operations

With the specter of Russian aggression looming, the U.S. and Europe are threatening a wide range of sanctions to deter Vladimir Putin. In the meantime, Russian operatives are waging a campaign to destabilize Ukraine through influence operations to arrange a pretext to legitimize an invasion.[1] Ukrainians are not helpless to this threat and have their own capability to use financial intelligence to protect their country.

The State Financial Monitoring Service of Ukraine (“SFMS”) is the financial intelligence unit (“FIU”) of Ukraine and is responsible for receiving and analyzing reports of suspicious transactions and money laundering. FIUs play a critical role in a country’s national security by providing financial intelligence to law enforcement or the broader intelligence community. Financial intelligence can address a wide array of threats, including corruption, transnational crime, terrorism, and help detect foreign intelligence activities. However, financial intelligence units are often reliant on banks and other financial institutions (such as money exchangers, money service businesses, etc.) to provide this intelligence in the form of suspicious reports which can be used by the authorities to detect malign conduct.

We have helped banks across the globe develop and implement anti-money laundering programs which can generate this financial intelligence. In the interest of the common good, we are providing an update on how U.S. sanctions may be used to deter Russia, but more importantly how Ukrainian financial institutions can use their own compliance programs to produce actionable financial intelligence so that the authorities may combat Russian influence operations.

1. U.S. Sanctions Will Attempt to Deter Putin by Targeting State-Owned Enterprises and His Inner Circle

An attack on Ukraine is not pre-ordained. However, Russian actions continue to paint a picture of a country bent on aggression. Based on recent actions and statements by both the U.S. government and both U.S. political parties in Congress, the U.S. intends to respond to Russian aggression by placing sanctions on Russian state-owned enterprises, senior officials, and oligarchs. Both the Democrats (in the U.S. Senate)[2] and Republicans (in the U.S. House)[3] have circulated their own bills, which agree on the following points:

• Both bills propose blocking all transactions involving Russian financial and energy companies already subject to sectoral sanctions – sanctions which currently only prohibit the dealings in certain debt and equities. The bills would also attempt to cut-off Russian financial institutions from SWIFT.
• The bills would also target certain Russian oligarchs and their personal wealth. The Republican bill is much more direct and provides a list of Russian oligarchs who would be potentially subject to sanctions, while the Democrat bill simply gives a broad authority to do this.
• The bills also outline a “name and shame” campaign designed to identify and disclose the personal assets and riches of Vladimir Putin, his inner circle, and his mistress.
• Finally, both bills would impose additional sanctions on Russian sovereign debt by blocking such property. Currently, U.S. institutions are only prohibited in participating in the primary market of bonds issued by the Russian Central Bank, the National Wealth Fund of Russia, and the Russian Ministry of Finance.

The clear intent of these sanctions is to make any invasion financially painful to Russia and Putin himself. The U.S. is also considering other options outside of this legislation, such as placing export controls against Russia to cripple its technology industries,[4] and placing sanctions on Putin himself.[5] The latter would spawn a world-wide asset hunt to block the Russian President’s property.

2. Ukrainian Banks and Other Financial Institutions Can Help Combat Russian Influence

As the possibility of war between Ukraine and Russia increases, Ukrainian authorities will rely on financial intelligence to detect malign Russian activities. These activities may include influence operations to generate unrest and recruit sympathizers, staging demonstrations and other disruptive activity by inflaming local media, and even conduct acts of sabotage and assassination immediately preceding an invasion.[6] These operatives will also provide Russia with vital human intelligence to assist in their attack.

However, these activities will require money to execute. It’s not unfathomable that they may have smuggled bulk cash, either in hryvnia, rubles, or dollars, to assist in their designs. It’s equally likely that they will have to use Ukrainian financial institutions to withdraw funds for their operations. This cash may have been pre-positioned for just this moment, or may have come from any number of sources both abroad and at home. If war breaks out, they may need a top-up to fund their activities.

This is where Ukrainian financial institutions can help the SFMS, Ukraine’s financial intelligence unit, generate leads for law enforcement to stop these activities. Financial institutions typically use computerized transaction monitoring systems to look through financial transactions and spot suspicious patterns. While these systems are usually used to detect money laundering, the act of criminals turning their illicitly obtained cash into “clean” cash, they can also be utilized to spot the financing of foreign agents, which provides clean cash for illicit activities. Meanwhile, the branch managers of banks can be on the lookout for customers who act suspiciously within the branch themselves. Both monitoring techniques can produce alerts where trained analysts can forward the truly suspicious activities to the authorities.

We are recommending that Ukrainian banks and financial institutions monitor, either through manual or automated processes, for the following typologies, or patterns of activity:

• Financial institutions with branches in Ukraine should be on a lookout for high-volume, high-velocity ATM withdrawals in eastern Ukraine including (but not limited to) the cities of Mariupol, Kharkiv, Zaporizhzhia, Odessa, or Berdyans'k. These withdrawals may occur across multiple ATMs within a single city, may come in bursts of at least five withdrawals in a 24-hour period, and may be withdrawn at the maximum limit for the ATM.
• Financial institutions should monitor any withdrawals using ATM cards issued by Russian or Belorussian banks, withdrawals using stored value cards issued by Russian or Belarussian companies, or internet banking withdrawals coming from IP addresses located in Russia or Belarus.
• Financial institutions should monitor for the rapid movement of funds in accounts over the past two weeks, which saw inward transfers of at least ₴140,000 UAH (~$5,000USD) and withdrawals of an amount which is within 5% of the deposits involving accounts in the cities of Mariupol, Kharkiv, Zaporizhzhia, Odessa, or Berdyans'k.
• Financial institutions should identify account holders who made debits or credits from IP addresses in Russia and Belarus within the past 14 days.
• Financial institutions should inform their branches in eastern Ukraine to be on a lookout for en-masse (5 or more in the same day) account openings in any currency by military age males (between 17 and 40 years old), and to review their log of account openings for similar trends since the month of December.

However, suspicious activity reports filed with SFMS are only useful if they are turned into actionable intelligence. We recommend that, for the duration of this crisis:

• SFMS should provide, confidentially, to financial institutions an updated list of their own typologies and red flags which can be used to detect malign Russian activity.
• SFMS should setup a specific reporting channel which can be used by financial institutions to submit reports relating to typologies potentially involving malign Russian activity.
• The SFMS and Central Bank of Ukraine should consider implementing emergency measures to compel non-bank financial institutions including money exchanges, transmitters, and stored value card providers to detect and report persons who engage in five or more transactions for, in the aggregate, at least ₴28,000 UAH (~$1,000 USD) in the cities of Mariupol, Kharkiv, Zaporizhzhia, Odessa, or Berdyans'k.

Serge Masters is the director of SDM Group Inc., a company which focuses on anti-money laundering and sanctions compliance. He is the former business unit CEO at TNK-BP, a previous joint venture between British Petroleum and Russian TNK (Tyumen Oil Company), as well as Kievoblenergo, Ukraine’s electricity provider (now DTEK). After spending a decade in the oil and gas and energy businesses, he has helped develop and implement compliance technology globally and has served as part of monitorships on behalf of U.S. and European regulators.