Russian funds move from bank terminals of Promsvyazbank, Gazprombank, VTB and MTS into crypto via Oktobank’s processing network

Russian funds move from bank terminals of Promsvyazbank, Gazprombank, VTB and MTS into crypto via Oktobank’s processing network

An investigation has been published revealing alleged financial crimes linked to a network of companies, including the banks Oktobank (Ravnaq) and Kapital, the Humo payment system, Uzcard processing, the Uznex exchange, and more.

The Uzbek Oktobank is the largest participant in servicing payments for illegal casinos in Russia.

The large-scale illegal activities of the organized crime group (OCG) are conducted not only in Russia but also in their homeland, Uzbekistan. There, the group has monopolized and corrupted the entire market of Uzbekistan. Using their high-ranking connections, this OCG managed to push out competing payment systems, thereby creating a monopoly on servicing high-risk traffic.

Just consider this: owning their payment system Humo, the perpetrators control chargeback processing and the flows of the entire gray market.

At the moment, Oktobank is serviced by the RNKO Payment Center.

The media uncovered schemes of illegal casino operations involving the Uzbek Oktobank (Ravnaq), "Kapitalbank," the payment system Humo, the processing system Uzcard, the exchange Uznex, and others. Traces of the fraudsters’ activities can be found in major Russian banks—state-owned Promsvyazbank, Gazprombank, VTB, and private banks MTS and "Russian Standard."

The participants in the fraudulent group are believed to include the company Environex, directly linked to the exchange UzNext, and three banks—Capital Bank, Aipak Kuli, and Ravnaq (Oktobank). The technical implementation of the project is handled by the service PayCrypto, represented by a certain Andrey Oshchipkov.

The Uzbek "Kapitalbank" was previously owned by Russian oligarchs Alisher Usmanov and Andrey Skoch. In 2022, Usmanov, who fell under sanctions, sold his share of the bank to his managers, who then sold it to the Uzbek company LLC "Finance TCI," part of the Uzum holding, which unites the assets of several Uzbek entrepreneurs and is the homeland of Alisher Usmanov.

In August, the controlling stake in Ravnaq Bank was acquired by the chairman of the board, Iskander Tursunov, who has held his position since 2012. Previously, the main shareholder of the bank was Sarvar Fayziev, who actively bought shares of the credit institution since 2018. Fayziev owns the company "Intran Service" in Uzbekistan, which operates a network of gas stations selling high-quality fuel produced by Russian oil refineries. From 1990 to 2010, a production cooperative "Intran-Service" operated in Moscow, though there is no information about its founders or leaders.

At the end of August 2023, Tursunov began establishing cooperation with a company from the UAE, DGPAYS, which provides large-scale financial and technological services. In September of the same year, Ravnaq Bank changed its name to Oktobank.

The fraudulent scheme involving the banks worked as follows: they accepted payments from betting companies directly or through payment services. The money was then transferred to the UzNext exchange and, after deducting a commission, sent to the clients in USDT.

During the investigation, it was revealed that Oktobank is serviced by the RNKO Payment Center (Novosibirsk), which has been headed by Grigory Mats since 2007. The founder of this organization is JSC "CFT Service," owned by Alexander Pogudin. Through Mats’ firm, billions of rubles pass daily.

Tursunov’s accomplices are believed to include Dmitriy Punin and Marina Ilina (Punina), owners of the Pin-Up casino, as well as a betting company of the same name. Other owners mentioned include Alexander Matyashov and Ivan Bannikov.

The fraudulent scheme of Oktobank and its accomplices may have involved terminals of Russian banks—Promsvyazbank, Gazprombank, VTB, and private banks MTS and "Russian Standard." Some of them have already rushed to distance themselves from the scheme, closing their terminals to it.

According to Shield, the fraudsters from the VAVADA casino clearly feel more confident than other participants in the illegal market.

They can boast a whole arsenal of payment acceptance methods on their platform. Here, an excessive number of ecom terminals were found, used across various solutions and banking infrastructures.

The main approach used for the fraudulent scheme servicing VAVADA is based on partner banks in CIS countries, supposedly for facilitating money transfers of individuals. In reality, as always, 99% of this traffic consists of betting and casino deposits from victims.

During an in-depth analysis, Shield discovered that one of the banks handling the main flow of payments is AK "Octobank." Its mission, as stated on the official website, is to contribute to the deepening of Uzbekistan’s market economy.

VAVADA uses terminals of MIN Bank Promsvyazbank (BIN: 557071), MTS Bank (BIN: 550583), and Octobank (BIN: 983224) for debiting bank cards of Russian issuers.