Will crypto brokers take out donation wallets intended for the Russian military?

Between July 15 and October 14, 2022, a team of investigators reviewed hundreds of Russian-speaking Telegram channels looking for donation requests to the Russian army. Across 3,348 Telegram channels, at least 363 cryptocurrency addresses were found. The investigative team has subsequently been able to aggregate transactions from and including February 23, 2022, the day before the Russian invasion, to create a more comprehensive picture.

The transactions made to and from these cryptocurrency wallet addresses donations have been tagged, investigated and tracked. The aim of the investigation has been to understand which Virtual Asset Service Providers (VASPs), the so-called crypto broker, the funds flow from and which VASPs receive the largest amount of transactions.

Despite this, it is still legal to collect donations with cryptocurrencies. Compliance teams of VASPs that have received more than €15,000 in funds should have carried out enhanced due diligence processes (EDD) to ensure that the origin of these funds is clear and not illegal before they are paid out into currencies, such as the Russian Ruble , or exchanged for other digital assets. €15,000 is a known anti-money laundering (AML) threshold within the European Union (EU) that requires platforms to perform enhanced due diligence.

This is a standard practice for the financial institutions, and is called ‘proof of funds’ (POF) and ‘proof of source of wealth’ (POW). The user must provide extensive explanation of the sources of funds and show evidence, and it is up to the risk appetite of different crypto brokers to accept or decline such transactions. In general, according to the anti-money laundering rules, the transactions should have been refused if it was not possible to identify the source of the funds in their entirety.

To date, it remains unclear whether various crypto brokers have completed such investigations and completed payouts of the transactions.

“Throughout the EU, crypto brokers, exchanges and other financial institutions must follow the same anti-money laundering rules. Those transactions exceeding €15,000 should always be reviewed. If they don’t, I would see this as a clear failure of brokers’ AML -commitment, says Dr. Alexandra Andhov, associate professor of law and technology at the University of Copenhagen.

To date, the industry has failed to provide a unified front to the situation of Russian military donations collected with the help of crypto brokers.

In late February, Ukraine’s Ministry of Digital Transformation sent official letters to Coinbase, Binance, Huobi, KuCoin, Bybit, Gate.io, Whitebit and Kuna urging the platforms to stop transactions from Russian users due to concerns that cryptocurrencies could be used to circumvent sanctions.

Of the eight platforms contacted, four did not attempt to take action to comply with the request. Kuna and Whitebit took action. According to an inside source, Binance and Coinbase asked users to show proof of funds.

Furthermore, Coinbased decided to ban 25,000 of its users, a drop in the ocean compared to the number of users from Russia, in concession to the concept of “targeted sanctions” to avoid punishing large amounts of the population.

As described in previous articles, the fifth package of EU sanctions against Russia has asked cryptobrokers to limit the liquidity of Russian citizens, who are not residents of the EU or the European Free Trade Association (EFTA), to a maximum value of €10,000 per User. This sanction has caused headaches for crypto compliance teams due to the high volatility in the value of cryptocurrencies.

For example, on Monday a person’s holdings of digital assets have a value of €11,000 and will be subject to sanctions. On Tuesday, the cryptocurrency could have dropped to €9,000, which would be below the €10,000 mark and no action needed to be taken by cryptocurrency providers.

Dr. Andhov raises questions about the legitimacy of this decision. Since it unilaterally blocks a group of people based on their nationality from using services available to others without proof of connection to the Russian state or war. She claims that this articular decision is still just as highly questionable from the European or international law perspective.

In an interview, Ukrainian officials are grateful for steps taken, but still hope for more self-regulation of the industry.

“It strikes me that some crypto companies, such as Binance or OkX, continue to accept new clients from Russia as of today, potentially putting them into a subsidiary that is not under EU/EFTA jurisdiction to circumvent US and European sanctions ,” says Alex Bornyakov, Deputy Minister of Digital Transformation of Ukraine. “During the Future Blockchain Summit, the head of marketing of the crypto broker OkX, which is headquartered in Malta but operates under a Seychelles-registered company (“Aux Cayes”), has confirmed that they will continue to onboard Russian clients and will continue to do so. It’s tiring that companies focus on profit instead of the human lives of our women and children.”

How to read the visualizations:

There are four visualizations of the surveys that vary depending on the specific type of cryptocurrency and the total number of transactions. For simplification purposes, all wallets have been combined.

Each visualization is divided into three sections:

Cryptocurrency transactions have flowed from left to right. Crypto brokers located on the left show the transaction sources from individual Telegram users to the requested donation wallet. The transactions to the right of the red rectangle visualize which providers the funds were sent to when they were collected.

As of October 14, more than nearly $204,000 was still held in the donation wallets, before being paid out to a dedicated crypto broker, the transfers could either be stopped or frozen.

“We are actively collecting data and appealing to our colleagues in countries where brokers are registered to freeze and seize such funds before they are paid out. Money paid out by the brokers will result in more deaths of children and ruined livelihoods, so it is much more than a financial balance sheet for a crypto company. Since we have the tools to freeze it in real time, why can’t we do it?” says Dr. Tetiana Dmytrenko, a senior adviser at Ukraine’s Ministry of Finance.

As of today, most of the “blockchain analytics companies”, which provide intelligence for compliance teams of cryptocurrency companies, do not consistently flag cryptocurrency wallets linked to donation requests intended for the Russian military.

“As a sign of solidarity, we have set a meeting with other cryptocurrency analytics companies as our team is willing to continuously share cryptocurrency wallet addresses with any blockchain analytics providers and law enforcement agencies willing to flag them as ‘high risk’ in their systems, says Lex Fisun, co-founder of Global Ledger. “Only acting together beyond our commercial interests will help us.”

Although policymakers have yet to provide clear guidance on how to treat Ukrainian or Russian military donation-based wallets, AML limits still apply.

According to Erik Källmen, a former Swedish member of the Ministry of Foreign Affairs, each measure boils down to a business decision about how much capacity each individual company is willing to invest in due diligence.

After the review conducted above, it is clear that platforms have the technical tools to stop transactions to be paid out. If they decide to do so.

Small print:

The methodology of seeing cryptocurrency wallets in Telegram channels: Cryptocurrency wallets are a rather unusual collection of characters, without spaces, and are between 32 and 34 characters long. The initial machine learning review of 3,348 channels yielded over 700 cryptocurrency addresses which were then manually reviewed by GL protocol investigative team members to understand the context of broadcast donation wallets.

What has the collection for Telegram channels been intended for? The pocketbooks have been grouped into two categories:

Main wallets refer to owners of wallets that have indicated direct support to members of the Russian military – Donetsk People’s Republic military and Luhansk People’s Republic military – to support the aggression against Ukraine.

Additional wallets refer to wallets that showed crowdfunding efforts by founders of Telegram channels to keep them active to create and post content. They have argued that an active Telegram channel will attract more readers, which will bring the largest donations to the “main wallets”.

What are the overall results of the funds tracked:

Between February 23 and October 14, 2022, more than $1.78 million was raised (based on the exchange rate as of October 19). The overwhelming majority of these funds have been forwarded to crypto brokers identified below.

Edited by: Grace Marshall