The National Bank of Moldova (“NBM”) has received its fourth formal progress briefing from Kroll on its continuing investigation of a large scale fraud in the Moldovan banking sector, which resulted in the collapse of Banca d’Economii SA (“BEM”), Banca Sociala SA (“BS”), and Unibank SA (“UB”), (together, the “Three Moldovan Banks”). 

The initial phases of work focussed on evidencing the mechanisms which allowed the fraud to take place and on developing a strong working partnership with international regulatory authorities. This allowed disclosure of a large volume of documents which has allowed the investigation team to progress understanding of these mechanisms. As the investigation has continued, the focus has moved towards tracing the fraudulent funds through multiple complex money laundering mechanisms to identify the end destinations of the funds and the beneficiaries of the fraud. The ultimate objective of the engagement is to identify assets which have been acquired with fraud funds and to attempt to recover these assets through legal processes. The investigation has now progressed to a stage where sufficient information has been obtained to start to initiate the recovery phase of the investigation.

Documents obtained clearly demonstrate the involvement in the fraud of a large group of Moldovan companies working in concert, which were linked to Ilan Shor (the “Shor Group”). At least 75 companies made up this coordinated group. Between 2012 and 2014, significant loan funds were provided by the Three Moldovan Banks to Shor Group companies. These loan funds were predominantly transferred to accounts held at two Latvian banks, before being laundered through a network of approximately 100 related corporate bank accounts in Latvia. The majority of these accounts were held in the names of UK registered companies, or companies registered in offshore locations such as Belize, BVI and Panama. Following this complex laundering process, the majority of the loan funds were channelled back to Moldova to pay down existing loan exposures, to create the impression that these were genuine corporate loans and to allow the loan portfolio to grow, whilst approximately USD 600 million was dissipated to bank accounts across numerous jurisdictions.

The fraud required a complex laundering mechanism to ensure that the lending could continue. Liquidity was managed and coordinated between the Three Moldovan Banks through multiple interbank deposits, false collateral for loans was recorded in the submission of daily balance sheets to the NBM and a false overdraft was established in the accounting records to allow further lending. Credit committees within the banks were bypassed and loans were approved by the Board of Directors of the bank, which were controlled by the Shor Group.

The tracing exercise is ongoing and increasing in complexity due to the multiple layers of additional laundering that the fraudulent loan funds were subjected to following the core laundering mechanism. Funds have to date have been traced to accounts in multiple jurisdictions, most significantly other Moldovan banks (outside of the Three Moldovan Banks) (USD 185 million), Cyprus (USD 63 million), China and Hong Kong (USD 61 million), and Switzerland (USD 23 million). Approximately USD 200 million has been traced to other accounts at multiple Latvian banks, subjected to further complex laundering of funds.

A proportion of the funds which have been traced to Moldova has been linked to the purchase of assets. The total value of these assets is not yet clear, but further work will be undertaken to clarify this and to secure these assets through cooperation with the Public Prosecutor. Additionally, the investigation to date has revealed links between individual beneficiaries of the fraud and companies which received fraud funds: Approximately 40 individuals have been identified, who either benefited from or facilitated the fraud. Receipts into personal accounts or into companies known to be linked to these individuals amount to approximately USD 50 million. The majority of individual recipients received amounts in the hundreds of thousands of USD, but investigation to date have also revealed companies which could be linked to individuals whose accounts received tens of millions of dollars. The purpose of the transfer of these funds has not yet been confirmed. Additionally, it is not clear whether the individuals who received funds were directly involved in the fraud or whether the payments were made as gifts or remuneration for services or goods.  The list of supposed beneficiaries must remain confidential to avoid negatively impacting the possibility of future recoveries.

Since the previous update, the NBM has signed a Memorandum of Understanding with the Central Bank of Cyprus and has continued the cooperation with other international financial regulatory authorities, to support the tracing of the fraudulent loan funds and to corroborate further the mechanisms of the fraud. In addition to providing regular updates to the National Bank of Moldova, the Kroll team has also held high level briefings with the Moldovan anti-corruption prosecutor and international regulatory and financing agencies. Kroll also provided an update on the progress and status of the ongoing investigation to the IMF, including the intentions for the continuation of the investigation and the recovery phase.

Kroll and Steptoe and Johnson have provided the NBM with a strategy for initiating legal action in multiple jurisdictions, with the view of obtaining further disclosure, or recovering assets which have been misappropriated. This is currently under review and is expected to proceed shortly. It is important that the confidentiality of the investigation results and proposed legal actions is maintained, to maximise the opportunities for recovery. Due to the multi-jurisdictional nature of the proposed legal action, and the complexity of the processes involved, it is likely that the recovery phase will last a minimum of 18 months to two years. In addition to the initiation of the asset recovery phase, further investigation and analysis will be undertaken to support the ongoing legal proceedings and to clarify the beneficiaries of the fraud. Kroll will continue to provide regular updates to the NBM.