Kroll 2 3

I Kroll
22 March 2018
Project Tenor 11 - Detailed

Report
Report Prepared for
The National Bank of Moldova

---------·-- ----··--····
Nexus Place, 25 Farringdon Street

London EC4A 4AB
T +44 (0)20 7029.5000
kroll.com
Privileged and Confidential

II Kroll Project Tenor II - Detailed Report - Contents
Privileged & Confidential

Restricted Use Warning
This report was prepared by Kroll at the request of the client to whom it is furnished . The client agrees that
reports and information received from Kroll , including this report, are strictly confidential and are intended
solely for the private and exclusive use of the client only in connection with a business , investment or other
commercial purpose. Any other use (includ ing for employment purposes, credit evaluation or insurance
underwriting purposes) is strictly prohibited and client has agreed that no such use will occur. Any
communication, publication, disclosure, dissemination or reproduction of this report or any portion of its
contents to third parties without the advance written consent of Kroll is not authorized . Kroll assumes no
direct, indirect or consequential liability to any third party or any other person who is not the intended
addressee of this report for the information contained herein, its interpretation or applications, or for
omissions, or for reliance by any such third p·arty or other person thereon . To the extent information provided
in this report is based on a review of publicly-available records, such information, as presented , relies upon
the accuracy and completeness of those records, which have not been corroborated by Kroll. Statements
herein concerning financial , regulatory or legal matters should be understood to be general observations
based solely on Kroll's experience as risk consultants and may not be relied upon as financial, regulatory or
legal advice , which Kroll is not authorized to provide. All such matters should be reviewed with appropriately
qualified advisors in these areas. THIS REPORT DOES NOT CONSTITUTE A RECOMMENDATION,
ENDORSEMENT, OPINION OR APPROVAL OF ANY KIND WITH RESPECT TO ANY TRANSACTION,
DECISION OR EVALUATION, AND SHOULD NOT BE RELIED UPON AS SUCH UNDER ANY
CIRCUMSTANCES.
Privileged and Confidential 2

l Kroll Project Tenor II - Detailed Report - Contents
Contents
1. Introduction to Detailed Report .. .......... ..... ...... .... ... ... .... ................ .............. ......... .... .... .... 10
2. Glossary of definitions .. .......................... .. ...... .... ....... ... ...... ...... ... .......... .. ......... ..... .. .... ... . 11
3. The Shor Group .... ... ...... ........... ... ............ .. ..... .. ...... ..... .... ......... .. .......... .... .... ......... ... ... ... . 13
3.1 Moldovan Shor Group Companies identified by NBM in the Scoping Phase (39 Companies) ..... .... ...... 15
3.2 Moldovan Shor Group Companies identified to date (77 Companies) ..... ...... .... ............. .. ...... ...... ....... ... 18
4. Approval of loans at BEM .. ... .. ..... .... .... ... ..... ..... ....... .... .... ... ...... .. .. .. ........ ... ...... ...... .. .... .... 23
4.1 Process for issuing loans at BEM .... ..... ............... .... .... ... ... .... ............. ... ................ .... ... .. ...... ...... .... ......... 24
4.2 Composition of BEM's Board during November 2014 .... ..... .. .. .. ...... ........ ..... ... ........ ....... ..... .... ............. ... 25
4.3 Regulator participants of the Board not in attendance ...... ... ............ ........... .... ...... ............. ... .. ..... ....... .... 25
4.4 Log of Board meetings of BEM in November 2014 ..... ....................... ................ ..... .... ........... ........ ......... 26
4.5 Example minutes of a BEM Board meeting ....... .... .......... ..... ........ ..... .... .. ... ... ................... ... ... ....... ... ...... . 27
4.6 Examples of risks identified by senior employees .... .......................... ...... .... ..................... ......... ............. 28
4.7 Communication between Shor Group and senior employees relating to loan documentation ...... ...... .. .. 31
5. Analysis of loans .. .................... ........ .... ......................... ..... .. ........ ............. .............. ... ... .. 33
5.1 Methodology for loan analysis ............. ......... ...................... ...... .. ...................................... ................. ...... 33
5.1. 1 Creating a log of all loans issued by the Three Moldovan Banks ... ..... .... .. ... ..... .... .... ... ........ .. ......... 33
5.1.2 Initial traces .... .... ... ...... ............... ............ .. ...... ..... .. .......... ...... ........... .. ........ .... .......... ...... ..... ... ... ... .. ... 33
5.2 Details of loans granted ...... .. .. ..... ... .... ..... ............ .. ......... ................. ......... ..... ............... .......... ................. 34
5.3 Initial destination of loan funds ......... .......... ....... ................ ..... .... ....... .... ... ..... .... .. ... .... .. .... ..... .... .. .. .......... 40
5.4 Loan proceeds transferred to Core Laundering Mechanism .................................................................. .40
5.5 Loan proceeds transferred to other ABLV / Privatbank accounts .............................. .......... .. ........ .. .......42
5.6 Loan proceeds transferred to Moldovan companies ........................ .................. ........ ........... ............ ...... 42
5.6.1 Proceeds of loans used to repay earlier loans at the Three Moldovan Banks ... .. ......... ... .... .... ... .. ..... 43
5.6.2 Proceeds of loans transferred to other Moldovan Banks ... ..... .... ......... ... .... . ........ 45
5.6. 2.1 Loan proceeds used to repay loans at other Moldo va n banks ... .... .. ......... .................... 45
5.7 Loan proceeds transferred to other jurisd ictions ... ........ ... .. .......... ..... ...... ..... ....... ......................... .......... .47
6. Switch of the entire loan portfolio on 25-26 November 2014 from BEM to BS .. .... ..... .... 49
6.1 Fake Overdraft ................................ .................... ............ .. ... .... ............ .......... .... ...... ............................... 51
6.2 Reallocation of interbank deposits .. ..... .... ................. ...... .... ... .... ..... ....... ............. .. .... ....... .. ..... ............ .... 52
7. Fund flows relating to acquisition of shares in the Three Moldovan Banks ....... .... ... ...... 53
7.1 UB share acquisition ..... ...... ....... .... .... .............. ........... ...... ........ ........ ................... ................ ...... .... ......... 53
7. 1. 1 Funds from accounts at the Three Moldovan Banks .... .... ..... .......... .. ... ...................... .. ....... ..... ......... 54
7.1.2 Funds from Russian accounts ... ..... ... ... ... ...... .... .. ... .. ... .. ..... .. ..... .. ...... .. .. .. ...... ... ...... .... .. .. ..... 55
7.1.3 Funds from Shor Group accounts at other Moldovan banks ...... ... ..... ........ .... .......... .. ... ..... .... ... ........ 55
7.1.4 Fund flo ws to fund shareholdings in UB ........... ........ .... .. .. .... ........................ .... .... ..... .. .................... 57
7.2 BS share acquisition .... .... .. .... ........ .... .......... ....... .. .. ........ ........ ...... ................. .. .... ..... ... ........ .. ......... ... .... .. 64
7.2.1 Funds from accounts at Russian banks .. ... ... .. ............... .......................... ......... .... .... .... ...... ............ ... 65

7.2.2 Funds from account at Trasta Komercbanka ...... ······ ···· ··· ····· ·· ··· ··•···· ·· ........... 66
7 .3 BEM fund flows .. ......................... ...... ........... ............................ .... ............... ..... ... .......... ............. ............. 72
7.3.1 Funds from Russian accounts used to fund shareholders .. .... 72
7.3.2 Roseau Cession agreement ....... .. .... .... ......... .. ..... .. .... 72
8. The Core Laundering Mechanism .... ........... .................... ............. .. ..... ........ ... ... ........... ... 78
8.1 Common characteristics of transactions .... ............. .. ... ............ ............. ... .. ... ....... ...... .................. ........... 78
8.2 Accounts classified as Core Laundering Accounts .. ........... ................ ....... ... ........ .. .... ......... ..... ..... .. ....... 80
8.3 Shor Group links to Core Laundering Accounts ............... ........ .......................... ........ .... ........ .......... ....... 81
8.4 Credits received into the Core Laundering Accounts ..... ...... ................................. ............. .... .... ... ..... ..... 88
8.4.1 Credits received info Core Laundering Accounts from new loans issued ...... . . ...... ...... . .... 89
8.4.2 Credits received from the Three Moldovan Banks not arising directly from loans .. .......... ... ......... .. 89
8.4.3 Discrepancies between Moldovan and Latvian statements .... ... .. ..... ......... ........ ............ .... ...... ....... .. 90
8.4.4 Russian account analysis.. ... .. .... ....................... ..... ......... ...... ...... ..... .. .. ..... .. .... .. ...................... ... 91
8.5 Treatment of other credits received into the Core Laundering Mechanism ......... .. .... ..... ... ............ .. .... ... 91
8.5.1 Summary of other credits received into the Core Laundering Mechanism ..... .... .... 94
8.5. 1. 1 Analysis of funds received into the Core Laundering Mecl1anism from other Moldovan banks
94
8.5. 1.2 Analysis of other funds received from Latvia .. .. .... .. ....... ...... ........... ..... ...... .... .. .. ..... ..... 95
8.5.2 Other funds traced out ........... . ... .......... ...... ......... ... . ...... 95
8.5.3 Other funds mixed......... ...... .. ... . ........ .. ....... ..... 95
9. Detailed methodology for tracing funds ...... ..... ............ ...................................... .............. 96
9.1 Overview ....... ...... .. ........ ............ .......... .. ............................. ...... ... ............ .... .. .. ... .. ... ........ ........................ 96
9.2 Other funds paid into Core Laundering Accounts ........ .. ... ........ ...... .... ... .... ........... .. .... ........ ........... ..... .... 96
9.2.1 Exact match trace .. ...... ......... .. ....... .. .. .... 96
9.2.2 Blended funds .......... ........... ..... ...... ... .. 97

9.3 Tracing of funds paid out of Core Laundering Accounts - further traces .......... ..... .. ...... ..... ............. .. ..... 98
9.4 First in, first out ("FIFO") ............ .. ........................... .. ..... .. ........... .. ... .... .. .. ....... ......................................... 99
9.4.1 Mixed funds - mixing offraud transfers out of the Core Laundering Accounts with Other Receipts 101
9.4.2 Assumptions ....... . ... ...... ............ .. ..... ............... .......... .... .............. .... .. .. . ................ ... 103
9.4.2.1 Exact match criteria ....................... ... .. .. .................................... ,.. ........ ............. ........... 103
9.4.2.2 Nil balances for residual funds of less than USO 3.000 ..... .. ...... ..... ....... .. ... .. ..... ....... ... 103
9.4 .2.3 USO 50.000 threshold for onward traces ...... ........ .............. ... ... ...... ...... ... .... .... .. .. ........ 105
10. Other laundering mechanisms identified .. ................................................. .......... :......... 106
10.1 Laundering offunds through accounts at other Moldovan banks ......... ................... ...... ....................... 107
10.1. 1 Example of layering through accounts at Victoriabank (1 ) ... ..... ...... 107
10.1.2 Example of layering through accounts at Victoriabank (2) . .......... . ... ... 108
10.1.3 Example ofloan recycling through accounts at Moldindconbank .. ..................... .. . .. .. 109

10.2 Laundering offunds through accounts at Estonian and other Latvian banks ... .......... .... ..... ...... .. ....... .. 110
10.2.1 Laundering offunds through Latvian accounts .......... ... ..... ................ .. .... ... ... ... .... .. ..... ........ ....... ... 111
10.2.1. 1 Laundering of funds through Latvian accounts - Example 1 ........ .... .. ....................... ... 111
10.2. 1.2 Laundering of funds through Latvian accounts - Example 2 ....... ...... .. ......... .... .......... .. 112

I Kroll Project Tenor II - Detailed Report - Contents
10.2.2 Laundering of funds through Estonian banks .......................................... .. ... ......... .. ... ......... .. .... ...... 114
10.2.2.1 Example oflayering through accounts at Versobank {1) ..... ..... .... .. ... ... .... .. ...... ....... ..... 114
10.2.2.2 Example oflayering though accounts at Versobank (2) ...... ... .... ................ ................. 116
10.2.2.3 Links oetween Estoni0n accovnts .... ... ....... ..... ......... ........ ..... ...................................... 118
10.3 Other laundering schemes ... ....................................... .. ........................................................... ............. 120
11. Involvement of accounts at Russian banks ... .. .. .. .......................................................... 123
11.1 Fund flows with accounts at Alef Bank and Metrobank .............................................................. ........... 123
11.1.1 Loans from Russian banks repaid using loans issued by the Three Moldovan Banks ..... ....... ........ 123
11. 1.2 Overview of fund flows ......... .. .......... ........................................................... ..... .................... ..... ....... 124
11 .1.2. 1 Transactions with accounts at ABLV and Privatbank ................................................... 124
11.1.2.2 Other fl.md flow:, ........... ............. .... .... ...................... .... ,............................. .......... ... .... . 127
11.1.2.3 Overall effect of transactions with Alef Bank and Metrobank ............... .. ........ .............. 129
11.1.3 Links to Shor Group companies and other Moldovan individuals .................. ....... .. .. .......... ...... .. ..... 130
11.2 Loans from Gazprombank ............................. ....................... .. ...... ................ ................... ... ...... ............. 135
11.2. 1 Overview ........ ... ... ......... ......... .. .... .... ... .. .. ...... ...... ................. ... ... ...... ...... ....... .. ............................. 135
11.2.2 Loans to BEM shareholder accounts ...... ....... .... ..... ............... ...... ............ ..... ......... ....... ............ ..... 136
11.2.2. r BEM shareholders· subordinated loans funded by BEM accounts ..... ........ ... ........... .... 136
11 . 2. 2. 2 Additioni.J/ shareholder loan ..................... ......................................... ..... .............. ... .. ... 137
11.2.3 Overnight deposits from BEM to Gazprombank-August 2013 to October 2014 .. ...... ... ......... ....... 140
11.2.3.1 Placement of Overnight deposits ............................ ............................ ........................ 140
11 . 2. 3. 2 Clearing of Overnight deposits ... ...... ....... ........ ....................... ..................................... 141
11.2.4 Other transactions with Gazprombank accounts ........................... .. ........................... .... ........... ... ... 141
11.3 Questionable Russian bank deposits ............. ......... ................. .. ..... ......... .................... ............ ..... .... .... 142
11.3.1 Links between Russian interbank movements and Joans granted ...... ............... .. ............... ........ ..... 142
11 .3.1 .1 BEM ... .. .. ... .. .... ....... ... ........... ........ ........ ... ...................... ..... ...... ... ... .. ....... ...... .... ......... . 142
11. 3. 1. 2 BS and UB ............... ... ........ ................................... .. ..... .......... ... ........ ...... ....... ... ......... 143
11.3.2 Reversal of questionable Russian bank deposits ..... ... ...... . .... ...... ...... ... ...................... .. .. ............... 143
11.4 Overview of amounts dissipated to Russia ......... ........ .... ................ ....... ..... .... ..... .......... ......... .............. 144
12. Overview of destination of fund flows ............................................................................ 145
12.1 Additional detail on jurisdictions that received large transfers of funds ................................................. 148
12.1.1 Latvia (USO 302. 1 million) ........ .. .. 148
12.1.2 Moldova (other Moldovan banks) (USO 169.3 million) .. ........ .... .... 148
12.1.3 Moldova (Three Moldovan Banks) (USO 82.9 million) ... .... ................... ... ...... .... .. ... .. .......... .. ...... .. ... 149
12.1.4 Russia (USO 80.6 million) ........................... ........ ...... ... ......... ..... ............ ...... ...... .... ... ..... .... ...... ...... .. 149
12.1.5 Estonia (USO 51.4 million) ............ .. .. ... ..... ...... ...... ... .. .... ......... .. .. ... ....... .. 150
12.1.6 Payments to accounts in other jurisdictions ................. ............................................................ .. .... . 150
13. Inventory of electronic data collected and reviewed ..................................................... 151

List of Figures and Tables

Figure 1 - Extract from BEM Board meeting minutes dated 7 November 2014 ...... .... .. ... .... ...... .. 27
Figure 2 - Extract from a memorandum on the company Provolirom SRL prepared by Olga
Botnaru in November 2014 ... ... ...... ....... ... .. .. .... ... ........... .. .... .. ..... ...... .... ... .... ......... .......... ........... .. 29
Figure 3: UB loans merged with other funds and used to pay off loans at BS ..... .. ........ .. ............ 44
Figure 4: Loan funds used to pay off loans at other Moldovan banks .. ....... ....... ... .... ... ...... ...... .... 46
Figure 5: Fund flows to switch the loan portfolio from BEM to BS on 25 - 26 November 2014 .. .. 50
Figure 6: Fund flow for share purchase by Reghina , Abashidze , Grinco, Melnic, Marinsecu,
Bondarciuc, Novosadiuc, Tvic, Lucinschi, Jet-Tech Industries, Pace Global Energy Limited,
Reynosa Management Limited, Dixon Corporation, Veaceslav, Lerson Limited , Negru,
Pleskachevskaya and Tauber in UB . ...... ...... ..... ... .... ... ... ... .... .. ... ....... .. ...... .... .. ......... ....... ... ........ . 57
Figure 7 - Fund flow for share purchase by Pace Global Energy Limited , Abashidze , Tvic and
Pleskachevskaya in UB .... .. .. ... ... ...... .. ......... ........... .. .. ..... .... .... ... .... .. ...... .... ...... .. ... .. ... ..... .. .. .... .... 58
Figure 8 - Fund flow for share purchase by Veaceslav, Abashidze, Novosadiuc, Pleskachevskaya
and Reynosa Management Limited in UB .. .... ...... ......... ... .. .... ....... .......... ........... ....... ........ ... .... .... 59
Figure 9 - Fund flow for share purchase by Luchinschi , Pace Global Energy Limited , Reghina and
Negru in UB .. .... ... ... ... ....... ... ........ .... ... .. ..... .... .... ........ ....... ... .. ... ..... ..... ..... .... ........ .. ...... .. ....... ... .... 60
Figure 10 - Fund flow for share purchase by Tauber, Melnic in UB .. .... ... .... .. .. ... ............ ... .. ... ..... 61
Figure 11 - Fund flow for share purchase by Bondarciuc in UB .. ...... .... .. .... ... .................... ... ...... 62
Figure 12 - Fund flow for share purchase by Rita Tvic in UB ....... ... ....... .................. ... ...... ..... .. .. . 63
Figure 13 - Fund flow for share purchase by Jardan in BS ......... .. .. ... .... ... ... .... ... ....... .... .. ... ...... .. 67
Figure 14 - Fund flow for share purchase by Gojina in BS ...... .... .. .. ... ....... ... .... .. .. .... ... .. ...... ....... . 68
Figure 15 - Fund flow for share purchase by Corsicova, Gorgos, Marinova, Alla and Hariton in BS
···· ···· ··· ··· ·········· ···· ··· ········ ·· ··· ·· ····· ······ ··· ···· ···· ···· ····· ···· ·· ·· ······· ··· ····· ···· ············ ·············· ·· ·· ········ ······ 69
Figure 16: Fund flow for share purchase Kostianko ......... .. ...... ..... .. ... ......... ...... .... .. ...... .... .... .. .. ... 70
Figure 17 - Fund flow for share purchase by Nikitaeva, Zavarzin, Stepanets , Kostianko ,
Merkulov, Andriichuk, Petranko and Boiko in BS .......... .... ... ......... ....... ... .. ... .. .. ................ .. ... ... .. .. 71
Figure 18 - Fund flows used to fund Roseau transaction - illustration 1 (all values in millions) .. 76
Figure 19 - Fund flows used to fund Roseau transaction - illustration 2 (all values in thousands)
·········· ······ ··········· ······· ·················· ·· ······· ·· ··· ···· ······· ·········· ··· ···· ······· ·· ········· ··· ··· ···· ······ ······ ··· ······· ···· 77
Figure 20 : Diagram of treatment of other proceeds into the Core Laundering Mechanism .... ...... 92
Figure 21 : Example of match and exclusion of other receipts ....... .. .... ...... ........... ........ ....... ..... ... 97
Figure 22 : Example of other Receipts entering the Core Laundering Mechanism .......... ..... ... ... . 98
Figure 23 : Marked up bank statement (Margolux Construction SA) demonstrating application of
FIFO principle .. ........... ......... ..... .. ...... ...... ................. .......... ... ........ .. ...... ..... .................... .. .... ...... 100
Figure 24: Example of FIFO principle .... .......... .... ...... ... .. ....... .... ...... ...... ....... .. ..... .. .... .... .... ... ..... 101
Figure 25 : Example of onward tracing where funds were blended .. ..... .... ...... .. .... .. ... ... ..... ......... 102
Figure 26 : Example of exact match trace ....... ...... ... .. .............. ..... ... ............ ... ..... ... ......... .... ..... . 103

Figure 27 : Example of onward dissipation where the remaining amount to trace was less than
USO 3,000 ...... ... ..... .. ............... ...... ....... .. ......... ..... ........... ........ ........... .... .. ............... .. .......... ...... 104
Figure 28 : Example trace of where account balance was less than USO 3,000 prior to the inflow
of fraud funds ....... ..... ... .. ..... ... .......... ................ ... ...... ....... .... .. ............. .... ..... ... .. .... ..... .. ...... .. .. ... 104
Figure 29 : Example of discontinued trace falling below USO 50,000 .. .. ..... ... ............... ........ .... .. 105
Figure 30 : Example of laundering through other Moldovan banks (1) ..... .. .. ... ... ......... .. ... ......... . 108
Figure 31 : Example of laundering through other Moldovan banks (2) .. .. ...... ... ............. .. .... ... .... 109
Figure 32 : Example of laundering through other Moldovan banks (3) ........ ..... ... .... .......... ........ .. 110
Figure 33: Laundering of funds through Latvian banks (1) .... ... ..... ......... ...... ... ... ... ....... ......... ..... 112
Figure 34 : Laundering of funds through Latvian accounts (2) .. .. ............ .. ...... ... ... .... ... .. .. ....... .. ... 113
Figure 35 : Example of Estonian bank accounts used to dissipate funds to China , Turkey and back
to Latvia .. ...... ......... ... ... ... ......... ....... ....... ... ....... ...... .. .... .............. ........ .. ... ..... ............................... 115
Figure 36 : Example of laundering through Estonian accounts (2) ............... ..... .. ... ..... .......... .. .... 117
Figure 37 : Analysis of links between Estonian company accounts ........ ... ... .... ... ... .. ....... ......... ... 119
Figure 38 : Analysis of IP addresses - Estonian company accounts .. ...... ...... .... ...... ...... ........ ... .. 120
Figure 39: Example of what appears to be entry to further laundering through China .. ..... ........ 122
Figure 40 : Alef Bank and Metro bank scheme .......... ..... ..... .. ......... ........... ....... ...... .......... ....... .... 124
Figure 41 : USO 50 million loan to ICS Sisteme lnformationale Integrate .. ... .. ... ........ ... ... .... ....... 139
List of Figures and Tables

Table 1 - Glossary of definitions .. .. ... .. ............. .. ... ..... .... ... ........ ... ... ........... ....... ...... ... ... .. ... ........ ... 11
Table 2 - Shor Group companies originally defined by NBM at the time of the Scoping Phase
report ... ...... ... ..... .. ...... ... ...... ..... .. ...... .... .... ........ .... ..... ... ......... ............. .. ... ... ....... .. ...... ... ... ......... .... 15
Table 3 - Shor Group companies based on Kroll's additional analysis ..... ... .... .. ....... ................... 18
Table 4 - November 2014 BEM Board Meetings ...... .. .. .. ...... ........ .... .... ....... ....... ... .... ..... ... ........... 26
Table 5: Loans issued to Shor Group companies by the Three Moldovan Banks ........ ..... ....... .... 34
Table 6: BEM - Loans issued to Shor Group companies (USO million) .... .... ... ..... .... .. .. ...... ....... ... 34
Table 7: BS - Loans issued to Shor Group companies (USO millions) ..... ... ...... ......... .... ........ ...... 36
Table 8: UB - Loans issued to Shor Group companies (USO million) ... .. .. ...... ... ..... ............ ....... .. 38
Table 9: Summary of the initial destination of loan funds .. .. .. .. .. ... ... ..... .... ... ... ........ .... .. ................ 40
Table 1O: Amounts transferred to ABLV Core Laundering Accounts .. ........ .... ... ... .. ... ... .. ..... ... .. .... 40
Table 11 : Amounts transferred to Privatbank Core Laundering Accounts ......... ........... ........... ... .. 41
Table 12: Amounts transferred to ABLV Non-Core Laundering Accounts ..... .......................... ... ... 42
Table 13: Amounts paid to other Moldovan banks ......... ... ............ ......... ... .. .................... ............. 45
Table 14: Loan funds transferred to other jurisdictions .. ..... .......... .. .... .. ....... ..... ....... ...... ... ........ ... 47
Table 15 : Summary of interbank deposits to support the switch of the loan portfolios .. ........ ... ... 52

Table 16: Table of UB Shareholders funded by Shor Group company accounts at UB .............. .. 54
Table 17: Table of UB Shareholders funded from companies/ individuals linked to Shor with
accounts at Alef Bank and Metrobank .. .................... ........................................ .. ........ .. .... ........... 55
Table 18 UB Shareholders funded from Shor Group company accounts at other Moldovan banks
····················· ··· ········· ······ ···································· ········ ·· ·· ·· ·· ·· ··· ················ ····· ····· ················ ···· ··· ·· · 56
Table 19: Table of BS Shareholders funded from Shor Group companies at BS and UB ............. 65
Table 20: Table of BS shareholders funded from accounts held at Russian banks ............ ..... ..... 65
Table 21: Table of BS shareholders funded from accounts at Trasta Komercbanka ............. .. ... .. 66
Table 22 : Table of fund flows from the Three Moldovan Banks that were used for the Roseau
transaction ... ................... ..... ........ ... ..... ..... ....... ................. .... .. ..... .. ... .. ................. .. ....... .... ... ... .. ... 74
Table 23: Table of fund flows from Alef Bank which were used for the Roseau transaction ......... 75
Table 24: ABLV Core Laundering Accounts ...... .... ........... ................................ .. ... ... .. ........... ....... 80
Table 25 : Table of Privatbank Core Laundering Accounts ........................................ .................... 81
Table 26 : Details of corporate information for Core Laundering Accounts at Privatbank ............ 84
Table 27: Total credits to Core Laundering Accounts ...................... ..................... .... .................... 88
Table 28 : Credits received into the Core Laundering Accounts from the Three Moldovan Banks
which was not traced to loans .... .... ..... ... .... ... ......... .......................... ..... .. ..... ............... .............. .. 89
Table 29: Sources of other credits received into the Core Laundering Accounts .................. ... ... . 93
Table 30 Funds from accounts at other Moldovan banks into the Core Laundering Mechanism .. 94
Table 31: Transactions between Alef Bank, Metrobank and the Core Laundering accounts ...... 126
Table 32: Transactions between Alef Bank, Metrobank and other accounts at ABLV and
Privatbank ........ ............... ....................... ... .. ... ............. ............................................... ............... 126
Table 33: Transactions with BS and the two Russian banks ..................... ... .... ................ .......... 128
Table 34 : Transactions with UB and the two Russian banks ...................................................... 128
Table 35 : Destination of funds from loans issued to Timol lmpex which were not repaid at 31
December 2014 ........ ............ .... ......... ........... ......... ...... .... ..... ... .... .. .......... .... ..... ........ ... .............. 129
Table 36 : Overall effect of transactions with Alef Bank and Metrobank accounts .. .. ......... ......... 130
Table 37: Alef Bank accounts transacting with ABLV and Privatbank accounts - links to Shor
Group ........ ..... ... ........... ............................................. .............. ... .............. ... .............................. 132
Table 38 : Accounts at Alef Bank transacting with ABLV and Privatbank accounts - no links to Shor
Group identified ..... .. ........................ .. ........... ...... ....................... .. .......... ............... .. ..... .............. 132
Table 39: Accounts at Metrobank transacting with ABLV and Privatbank accounts - links to Shor
Group ................ ........ ... .... .... .. ...... .. .... ..... .. .. ... ... .......... .... .......... ...... .. .. ......... .... .... ... ... .... .... .... ... 133
Table 40 : Accounts at Metrobank transacting with accounts at ABLV and Privatbank - no links to
Shor Group ... ... ... .. ........ ............ ... .. ........ ............. ...... .................................... .. .. ........... ........... .. . 134
Table 41: Gazprom bank scheme ................. ...... .... .... .. ............... ... ............. ... .. ....... ................... 136
Table 42: BEM shareholder financing of subordinated loan agreements ................. ....... ... ........ 137
Table 43: Amounts paid to Gazprom bank accounts linked to BEM shareholders ....................... 141

Table 44: Link between Russian bank deposits and loans issued from BEM to Shor Group ... ... 143
Table 45: Amounts dissipated to Russia .... .. .......... .. .................................. .. .. .... .... ........ .. .......... 144
Table 46: Overview of bank account jurisdictions that received fraud funds ... ........ .. .. .. .......... ... 146
Table 47 : Moldovan banks that received fund flows ..................... .. .... .. ... .. ..... ..... ......... .. ........ .. 149
Table 48 : List of all custodians whose laptops were imaged by Kroll .. .. .. .. ................................. 151
Table 49 : List of custodians whose data was analysed and reviewed by Kroll .... .. .......... .. .... .. ... 152

I Kroll Project Tenor II - Detailed Report - Introduction to Detailed Report
1. Introduction to Detailed Report

This report Section - the "Detailed Report" provide more detailed analysis of the findings detailed
in the Summary Report, including specific examples of fund flows, details of methodology and
analysis of the specific nature of the events and processes which allowed the Three Moldovan
Banks to increase lending to Shor Group companies, to disguise these fund flows through the Core
Laundering Mechanism and other peripheral laundering mechanisms, and to transfer the funds to
a number of accounts in multiple jurisdictions.
The following Sections do not contain specific details of the recipients of the fraud funds, which will
be presented in a separate working paper to this report to the Moldovan Prosecutor.
The Detailed Report contains the following Sections:
• Glossary of definitions
• Shor Group companies
• Process of approval of loans at BEM
• Details of loans granted by the Three Moldovan Banks
• Detailed fund flows of the Switch of funds from BEM to BS in November 2014
• Fund flow analysis of Shareholding of the Three Moldovan Banks
• The Core Laundering Mechanism
• The forensic funds flow methodology
• Other laundering mechanisms
• The involvement of accounts at Russian Banks
• Detailed analysis of the destination of funds
• Inventory of electronic data collected and reviewed

I Kroll Project Tenor II - Detailed Report - Glossary of definitions
2. Glossary of definitions
Table 1 - Glossary of definit ions
Definition Meaning
The Scoping Phase Kroll's Scoping Phase Investigation, reported
on 2 April 2015
BEM Banca de Economii SA
BS Banca Sociala SA
UB Unibank SA
The Three Moldovan Banks BEM, BS and UB
The Shor Group llan Shor and companies and individuals
affiliated with him (as detailed in Section 2)
CBC Central Bank of Cyprus
The November Meeting The meeting held between the NBM, senior
members of the Moldovan government,
Moldovan prosecutorial authorities, Kroll and
Steptoe and Johnson in November 2017
The Consortium Kroll and Steptoe and Johnson
The Review Period The period under review - 1 January 2012 to
31 December 2014
The Laundering Mechanisms The transferring of funds through a number of
bank accounts which appeared to have no
commercial purpose other than to disguise the
flow of funds
The Board The Board of directors of the Three Moldovan
Banks
The Switch The transfer of the entire loan portfolio from
BEM to BS at the end of November 2014
The Roseau Transaction The cession agreement entered into in 2013
whereby the shareholders of BEM agreed that
as part of the terms of increasing the
shareholding by the minority shareholder
Sisteme lnformationale Integrate, that
approximately USO 80 million of existing loans
would be ceded to a company called Roseau
Alliance LLP

I Kroll Project Tenor II - Detailed Report - Glossary of definitions
Roseau Roseau Alliance LLP, the company to which the

non-performing loans from BEM were ceded in
2013.
The Core Laundering Mechanism A group of interconnected accounts held at two
Latvian banks which displayed signs of being
centrally controlled and which laundered the
loan proceeds of loans granted to Shor Group
companies by the Three Moldovan Banks.
The Core Laundering Accounts A series of accounts which made up the Core
Laundering Mechanism

I Kroll Project Tenor II - Detailed Report - The Shor Group
3"The Shor Group

Throughout the Summary Report and the Detailed Report, we refer to a group of related parties as
the "Shor Group This Section provides details of the companies that make up the Shor Group, and
the rationale for the classification as such.
The Scoping Phase report defined the Shor Group as "a list of companies identified by the NBM as
being owned or controlled by llan Shor, either directly, or as a result of information identified through
investigation indicating a likely affiliation." When the NBM began to monitor the loan exposure of
the Shor Group in September 2010, ten companies were considered part of the group. The number
of companies considered by the NBM to be part of the Shor Group grew to 39 by the end of October
2014 .
Since the Scoping Phase report, Kroll has verified a sample of connections made by NBM between
the Shor Group companies in the Scoping Phase to account opening documentation, public record
databases and to transaction flows .
The 39 Shor Group companies originally identified by NBM, and the reason for their affiliation, are
listed in Table 2 below. Kroll has conducted a sample review of the account opening records at the
three banks for these companies, and reviewed bank terminal installation notices and IP access
logs, which support the conclusions reached by NBM. Among the most obvious of the links between
the companies and Mr. Shor is that many of them at some point reported, in account opening KYC
records, str. Tighina 12 as their registered address and "022 22 80 27" as a contact telephone
number. Kroll has verified that this address and number was also reported in the account opening
records for SC Dufremol S.R.L and CA Klassika Asigurari SA, two companies that are publicly
associated with Mr. Shor.
Kroll's further analysis of the relevant fund flows from the Three Moldovan Banks in November
2014, additional independent research from NBM, and a review of companies either currently or
formerly 1 associated with Mr. Shor or his close associates lllona Shor2 , Tudor Negru 3 , and Mester
Moisei4, as well as additional companies that received loan funds and transferred them to the Core
Laundering Mechanism has expanded our definition of the Shor Group to 77 Moldovan companies.
' A search of historical records was conducted by the Moldovan corporate registry at the request of the NBM as this
information is not publicly accessible .
2
According to conflicting media reports she is either llan Shor's sister or step-mother. She is also the current
shareholder and administrator of SC Dufremol S.R.L.
3
A former minority shareholder of Unibank and described in some media sources as Sher's head of security.
• The shareholder and administrator of Moldclassica International, a company affiliated with Shor in the press, and well
as the administrator of two further Moldovan companies involved in the November 2014 transactions (Asigromex SRL
and Finprofilux SRL) .

Kroll Project Tenor II - Detailed Report - The Shor Group
These 77 companies, and the rationale for their classification as related parties, are detailed in
Table 3.

3.1 Moldovan Shor Group Companies identified by NBM in the Scoping Phase (39
Companies)
The table below lists the 39 Moldovan companies considered to be part of the Shor Group' by NBM in October 2014, and the reason for their
association with the group (Y=Yes).
Table 2 - Sho r Group companies originally defined by NBM at the time of the Scoping Phase report
# Company name Internet Banking Described as part of Account Contact Loan documentation
banking system Shor Group in BEM opening shows number in lost in "Klassika Force"
client accessed email registered account fire or transported by
installed at through IP correspondence address as opening the security company.
Tighina 12 addresses Tighina 12 provided as
178.168.82.200 022 22 80 27
or
178.168.82.169
1 Agercom Grup SRL y y y
2 Air Handling SRL y y
3 Alreda-Pro SRL y y y y y
4 Alutus Com SRL y y y y y y
5 Alvaro Grup SRL y y y y y
6 Apropo-com SRL y y y y
7 Asigromex SRL y y y y y y
8 Avantage SRL y y y
9 Biro Media SRL y y
CA Classica Air SRL
10 (Previously Nobil Air SRL) y y y y y

178.168.82.200 022 22 80 27
or
178.168.82.169
11 CA Klassika Asigurari SA y y y y
12 Caritas Group SRL y
13 Citadina-Mob SRL y y
14 Contrade SRL y y
15 Danmira SRL y
16 Dasler Con SRL y y y y y
17 Davema-com SRL y y y y y
18 Demicor SRL y y
19 Dracard SRL y y y y y
20 Elcomet-Prim SRL y y y y y
21 Ghermivali SRL y y y y y y
22 ICS Air Clasica S.R.L y y y y y y
23 ICS Grand lmobiliare SRL y y y
24 ICS Grand Petrol SRL y y y y
ICS Metal Trade Group
25 SRL y y y y
26 lnfoton-com SRL y y y y y
27 Lavima-lmpex SRL y y y y y
Megasoft International
28 SRL y y y y

178.168.82.200 022 22 80 27
or
178.168.82.169
Moldclassica International
29 SRL y y y y y y
30 Prosperarea Moldovei y y y
31 Provolirom SRL y y y y y
32 SC Dufremol S.R.L y y y y y y
33 SC Molint Grup S.R.L y y y y
34 Storad Group SRL y y y y y y
35 Talnes SRL y y y
36 Timol lmpex SRL y y
37 Univet Invest SRL y y y y y

38 Vascovprod SRL y y y y
39 Voximar-Com SRL y y y y y

I Krol l Project Tenor II - Detailed Report - The Shor Group
3.2 Moldovan Shor Group Companies identified to date (77 Companies)

The table below lists the 77 Moldovan companies currently considered to be part of the Shor Group and the reason for their association with
the Shor Group.
Table 3 - Shor Gro u p companies ba s ed o n Kroll's additio nal ana lys is
# Company Name Defined by NBM Defined by NBM Recipient of funds from the Administrator or shareholder also
as "Shor as "Shor Group" November 2014 Transactions/ administrator or shareholder of
Group" in in December 2015 recipient of funds also passed another Shor Group company or has
October 2014 through Latvian accounts another public record link with Shor
1 AA Activ Broker SRL y
Agentia De $tiri
Hosocnt-MollAOBa
(Novosti Moldova)
2 S.R.L y
3 Agercom Grup SRL y y y
4 Air Handling SRL y y
5 Alreda-Pro SRL y y y
6 Alutus Com SRL y y y y
7 Alvaro Grup SRL y y y
8 Ancar Lux SRL y
9 Apropo-com SRL y y y y
10 Asigromex SRL y y y
11 Avantage SRL y y y
12 Avia Invest SRL y
13 Biro Media SRL y y y
CA Classica Air SRL
(Previously Nobil Air
14 SRL) y y y

l Kroll Project Tenor II - Detailed Report - The Shor Group
as "Shor as "Shor Group" November 2014 Transactions I administrator or shareholder of
CA Klassika Asigurari
15 SA y y
16 Caravita Co SRL y
17 Caritas Group SRL y y y
18 Citadina-Mob SRL y y y y
CJSCB lpotechniy
19 Moldova y
20 Contrade SRL y y y
21 CPJ989-PRIM SRL y
22 D.F.I SRL y
23 Daliano-S SRL y
24 Danmira SRL y y y y
25 Dasler Con SRL y y y

26 Davema-com SRL y y y
27 Decfin Grup SRL y y

28 Demicor SRL y y y
29 DFM Prim SRL y
30 Dracard SRL y y y
31 Elcomet-Prim SRL y y y
32 Finprofilux SRL y y y
33 Firma BAS-Clasic S.R.L y y
34 Firma Diagras S.R.L y
35 Ghermivali SRL y y y
36 ICS Air Clasica S.R.L y y y

as "Shor as "Shor Group" November 2014 Transactions/ administrator or shareholder of
+ 37 ICS Bogdan & Co SRL

y
y
38 JCS Delmos-Grup S.R.L
JCS Grand lmobiliare
39 SRL y y y
40 JCS Grand Petrol SRL y y
·+ 41 JCS Kotinvest SRL y

JCS Metal Trade Group
42 SRL y y
JCS Semgroup-Systems
-+-
43 SRL y
44 JCS Splot-81 SRL y
-t
IM Airklassika Group
45 SRL y
46 Impact lmobil SRL y y
47 lnfoton-com SRL y y y
48 lnterprimcolect SRL y
49 Lavima-lmpex SRL y y y
50 Liceul Logica S.R.L y
51 Liramex-Com SRL y y
Maxiprof Consulting
52 SRL y
Megasoft International
53 SRL y y y
54 Meldava Grup y

Moldclassica
55 International SRL y y y
56 OP Klassica Force SRL y
57 Prosperarea Moldovei y y
58 Provolirom SRL y y y
59 Renastere SRL y
60 Riolit Sistem SRL y
\ 61 Saagton y
62 Samit Plus SRL y
SC Aeronord - Grup y
63 S.R.L
SC Classica Trading y
64 International S.R.L
65 SC Dufremol S.R.L y y y y
66 SC IDS Grup S.R.L y y
67 SC Molint Grup S.R.L y y y
68 Stal Petrol ICS y
69 SC Nander-Grup S.R.L y
70 Storad Group SRL y y y
71 Talnes SRL y y y
72 Timol lmpex SRL y y
73 Toast De Lux SRL y
74 Tradeway SRL y
75 Univet Invest SRL y y y

76 Vascovprod SRL y y y
77 Voximar-Com SRL y y y

l Kroll Project Tenor II - Detailed Report -Approval of loans at BEM
4 . Approval of loans at BEM

As summarised in Section 4 of the Summary Report, Kroll conducted a detailed analysis of the
loans issued between 1 and 24 November 2014 by the Three Moldovan Banl<s (mainly BEM during
this period) . In interviews with employees at BEM, Kroll was informed that a large amount of the
relevant documentation relating to these loans was suspiciously destroyed in a fire at the end of
November 2014. Kroll conducted a focused review of electronic documents to clarify the processes
which allowed such a high volume of high value loans to be issued by BEM in such a short period
of time and to identify any potential wrongdoing. Documents reviewed demonstrated that BEM
employees challenged the documentation submitted and raised concerns to the Board, which were
ultimately ignored. Specifically, this Section provides details of the following :
• The loan approval process - including that the instruction to process loans was
communicated orally by the senior management of BEM to the loan application
administrators. Senior administrators were required to produce written analysis to the
Board for each large loan applied for, but it appears that this was an administrative task
and that the decision to lend had already been made;
• The members of the Board who were responsible for approving the loans;
• Examples of Board meetings where such loans were approved , and the schedule that
demonstrates that Board meetings occurred on an almost daily basis in November 2014;
• Evidence that senior administrators repeatedly raised concerns to the Board (through their
written reports) regarding the creditworthiness of the loan applicant, the inter-connected
nature of loan applicants, the risk to the capital of the bank and the authenticity and validity
of documentation, which was provided to support the loan application.
., That administrators appeared to challenge documentation submitted by representatives of
the Shor Group, through a "shorholding.com" email address.
., Evidence that the two Moldovan Government representatives of the Board were not in
attendance at the meetings , and were not aware of the high volume of loans being issued
in November 2014;

l Kroll Project Tenor II - Detailed Report-Approval of loans at BEM
4.1 Process for issuing loans at BEM

From interviews with BEM employees, Kroll documented the process for approval of loans in
November 2014 as follows :5
1. BEM employees were verbally informed about the intention to grant a customer loan by
members of BEM's management. The BEM employees specifically named Mr. Viorel Birca
and Mr. Constantin Paladi as the two managers from whom they received these verbal
instructions.
2. There were four departments (Credit, Treasury, Foreign Operations and Accounting) that
were involved in the granting of new loans.
3. In order for a loan to be approved by BEM's Board, it was necessary that both the Credit
and Treasury departments produced written memorandums with their recommendations.
These recommendations included remarks about the viability of the loan issued, the risks
involved in such an operation and information about the customer requesting the loan.
Memorandums with such recommendations were also on occasion produced by the Foreign
Operations Department.
4. Once BEM employees were made aware of the instruction to grant a loan, the four
departments communicated the relevant details to each other to process such a loan. For
example, if the Credit department notified the Foreign Operations Department that the
management had decided to grant a loan for a given sum and that an equivalent sum was
expected to be placed on deposit (as a foreign currency) from a Russian bank (with which
BEM had previous agreements), the Foreign Operations Department was responsible for
drafting the necessary legal contract between BEM and the relevant bank for the provision
of the loan, which was then posted to Russia, signed by relevant representatives of the
bank providing the collateral and returned within a few days.
5. The departments produced a series of memoranda with their recommendations related to

the particular loan being granted. Kroll identified drafts of these documents during the
electronic data review.
6. The memoranda, together with additional relevant information produced and gathered by
the four main departments, were subsequently gathered in a package file and submitted to
5
No formal loan procedure was obtained - this information was obtained through discussions with relevant BEM
employees.

I Kroll Project Tenor II - Detailed Report -Approval of loans at BEM
Angela Osoianu , the secretary of the BEM Board, who passed it on to the Board. BEM
employees have confirmed that the Board secretary was their main point of contact through
which all documentation was conveyed to the Board. The Board secretary acted as an
intermediary in communications and messages from BEM employees to and from the Board
and the senior administrators did not present directly to the Board.
7. After all the necessary paperwork was passed on to the Board , the Board granted the loan
(apparently having considered the recommendations provided by the various departments) .
According to BEM employees , all the documentation was subsequently signed and
approved by all Board members .
4.2 Composition of BEM's Board during November 2014
Draft minutes identified from the electronic document review list the following participants as the
attendees for the meetings during the month of November 2014:
• Mr Shor (President of the Board);
• Ivan Ursu (Bank Advisor to the President on security issues);
• S. Budza (Member of the Board);
• Viorel Birca (BEM Interim President);
• Constantin Paladi (BEM Vice President) ; and
• Angela Osoianu (Board secretary) .
The heads of the Credit Department and the Treasury Department respectively were not, according
to the Board minutes reviewed , present at the Board meetings. However, their names were
mentioned in the relevant Sections of the minutes related to their specific items of competence (for
example, in some instances the head of the Credit Department was listed as the "reporter" for items
related to loans) . The members of management interviewed confirmed that they did not attend the
Board meetings. No other members of BEM management were listed as in attendance.
4.3 Regulator participants of the Board not in attendance
Kroll , in participation with the NBM, contacted the BEM Board members Elena Matveeva ("Ms.
Matveeva") and Octavian Calmic ("Mr. Calmic") who were appointed by the Moldovan government
as part of the supervision of BEM. The NBM received responses on 17 February 2016 and 29

Kroll Project Tenor II - Detailed Report-Approval of loans at BEM
February 2016 from Ms. Matveeva and Mr. Calmic, respectively. 6 Both Board members stated that
they had not been invited to any Board meetings in November 2014. Both Ms Matveeva and Mr
Calmic were listed as "absent" in the Board meeting minutes reviewed by Kroll.
In addition, they both stated that they were aware of several loans being issued during their tenure
as a BEM Board member, but were not aware of any loans being granted in November 2014. These
letters indicate that the remaining Board representatives deliberately bypassed the Government
Board representatives who were responsible for the supervision of BEM at that time.
4.4 Log of Board meetings of BEM in November _2014
Kroll's electronic document review identified a number of minutes of BEM Board meetings held in
November 2014 that related to the approval of loans to Shor group companies . A number of these
Board meetings also covered approval of operations to facilitate BEM's lending ability at the time
(such as interbank placements and deposits).
The original documents have been provided as Exhibit 4.2.
Table 4 - Novem ber 2014 BE M Bo ard Meetings
Board Meeting Date Loans granted to/other items

approved
03/11/2014 Agroindbank (Interbank deposit)
04/11/2014 Banca Sociala (interbank deposit)
05/11/2014 Voximar SRL / Russian Bank 1/
lnterprombank (interbank deposits)
06/11/2014 Voximar SRL/Dracard SRL
07/11/2014 Provolirom SRL / Unibank (interbank
deposit)
10/11/2014 Provolirom SRL / Unibank SRL (interbank
deposit)
11/11/2014 Voximar SRL
12/11/2014 Voximar SRL
17/11/2014 Provolirom SRL / lnterprombank
(interbank deposit)
17/11/2014 Provolirom SRL / lnterprombank
(interbank deposit)
19/11/2014 Provolirom SRL / Caritas SRL / Russian
Bank 1 / lnterprombank (interbank
deposits)
21/11/2014 Caritas SRL 7
24/11/2014 Caritas SRL / Provolirom SRL 8
6
See Exhibit 4.1 - Response from Ms. Matveeva and Mr Calmic relating to Board attendance in November 2014
7
Minutes for this Board Meeting are missing. The loan contract is mentioned in an e-mail dated 26 November 2014 (see
Exhibit 4.2)
8
Minutes for this Board Meeting are missing. The loan contract is mentioned in an e-mail dated 26 November 2014 (see
Exhibit 4.2)

~ Kroll Project Tenor II - Detailed Report -Approval of loans at BEM
24/11/2014 Caritas SRL 9
4.5 Example minutes of a BEM Board meeting
Kroll's review of electronic documentation identified minutes of a BEM Board meeting dated 7
November 2014. 10 According to this document, the meeting was attended by the following
participants: Mr. Shor (President of the Board), Ivan Ursu (Bank Advisor to the President on security
issues), S. Budza (member of the Board), Mr. Birca (BEM Interim President), Constantin Paladi
(BEM Vice President) and Angela Osoianu (Board secretary).
Figure 1 - Extract from BEM Board meeting minutes dated 7 November 2014
H A '\ I(" .!I. l!) f. If. ((: ((/> '-l t-,\~ 11 (t :-s • _l\ -.
Prnrl',ul-n·rh.il nr. l-'H

al ~cdintd Con~iliului U:incii
Oi nuil-mhric 201-' mun. Chi~in:iu
Ora lll.00
Au li>, I pro-:n\i mcmhrii Cnn,il iului: I. ~nr. 1. \ lrsn. S. llud,;1

A praiciat· I. )<'I'. l'r.:~cdintd,· C,111,iliulni
S,,:r,·t;1rul Cn11~iliul11i: A . Cbnianu
,\u li1•,i 1 I.. i\1a1,,·,-,·a. Cl Caln1k. mcmhrii l'nn,iliului
!m·i1a\i : V. llin:a . l'rc~,-t!int,· im,-rimar al C,,mit c:tului d,· ( \1nduc·,•r,; l

C. l'aladi . 1·i.:q>r,~cdintck l\1miti:1u\ui de (\,nducwc
Ol{l)l;\E:\ DE ZI:
I. C:11 pri,·iri.: l:1 ,1ira~l'1\.·a 1,.k•pf11itului in11t.·rl,a:1cm· Ii: krnh.:n tk· l;1 .-\1,11110111:pi lhlii Kn~l\t\.·p 1 11..·c:~uli half "
,,Ill 111 J'l 11'! J:vlb.-\111( ,, 1_·1ai.1>1,110,· a1,11m,11cp1111c ll<'!lll'<'l lll' I. llar,w1or: }'. /"iJ>it. )d l. 1Jrcef iii fr.·:or,!; ·1<'.
II. Cu prh·ir~ la c~;11ninar('a ,i h,,1/ir;ir~a r,•r,•rilnr la a,·nniar('a c·nmpani~i iTfif ·,RI. ;1 111111i <:r..:-tlit in tran~(' i11
,um;i ,k x.:!:-- __.,1~.{HJIJ cnpt ,nl~ d,,11;11~,i ~i ,,pt 111ili ,>a11(' 1r,·i ,11t,· 11,,uI1l~,-i ~i d1wi mii) \11'11. . p,· ttrm~n d,• _lr, hmi
p;..•1Hrll c,,mpkt;ir,::: m ij 1u:in.·1or \.'ireul;u\h..· (pn1'-:ura r . .·:t :nflrrurilun l?t1por tnr : ( J. ll1111111ru. ~,:t itrfl •ri111ar /Jin.T{J.r
( ';vd,te. .
------ ---------·-·-----------·-~--- - -- ----·~~---- ------ --------- - - -···~- -----·· -·----·-·'
According to the minutes, the following resolutions were approved unanimously by the Board:
1. To secure an interbank deposit with lnterprombank for the value of EUR 47 million;
2. To grant a loan valued at MDL 828,395,000 to Provolirom SRL;
3. To amend BEM risk management policies in order to increase the limits of correspondent
accounts balances, short-term placements and liabilities with counterparties in Russia;
9
Ibid .
10
See Exhibit 4.3 - Example of Board minute - 7 November 2014

Kroll Project Tenor II - Detailed Report -Approval of loans at BEM
4. To accept the request of BS to place MDL 140 million in overnight deposit at BEM for three
days (07.11.2014-10.11 .2014);
5. To accept the request of UB to place MDL 740 million in overnight deposit at BEM for three
days (07 .11 .2014-10.11.2014);
6. To accept certain real estate properties belonging to Decfin Grup SRL, Elcomet Prim SRL,
Liramex-Com SRL and Univet Invest SRL as collateral for BEM loans.
The topics above were presented based on information produced by Ms. Botnaru (Head of Credit),
Ms. Juk (Head of Foreign Operations) and Mr. Tipa (Head of Treasury). An email containing the
minutes was sent by Angela Osoianu (Board secretary) to all Board meeting participants on 17
November 2014. This email also contains all the relevant attachments and internal reports
discussed at the aforementioned meeting. 11
4.6 Examples of risks identified by senior employees
Kroll identified a number of communications between senior administrators and the Board, where
specific risks were highlighted to the Board. Despite these risks being highlighted, loans to the
companies were approved . Examples are given below:
Example 1 - identification of related parties and risk to BEM's capital
On 7 November 2014 , Ms Botnaru prepared a note on Provolirom SRL in relation to its request to
borrow MDL 828,395,000 (Credit Agreement NQ 06-06/1/58 dated 7 November 2014). This note
was discussed at the 7 November 2014 Board meeting described above. 12 In the memorandum,
Ms. Botnaru provided a brief summary of the company, which included items such as the company's
incorporation details, stated business purpose and tax identification number. The document also
listed BEM 's net exposure to Provolirom, amounting to EUR 3,250,000 at the time. The
memorandum stated that Provolirom, Danmira and Biro Media were companies acting in concert
and all had loans with BEM at the time. These loans were all guaranteed by deposits from
lnterprombank. A summary table of the loans discussed in this note is provided in Figure 2.
11
See Exhibit 4.4 - Email sent by Angela Osoianu (Board secretary) related to BEM Board meeting dated 7 November
2014 (plus attachments)
12
See Exhibit 4.5 - Memorandum by Ms.Botnaru on the company Provolirom SRL in relation to a loan request
(November 2014)

Fi gure 2 - Extract from a memorandum o n the company Pro vo liro m SRL prepared by Olga Botnaru in
No vember 201 4
Compania N( CIM SRL, Biro Media SRL ~i P11iJ111 ;RL sunt companii ce activeaza concertat avind in
vedere ca 3AO AKE «H HTEPOPO M6AHK » figureaza in calitate de de bitor gajist ~i garant pen tru cred itele
contractate de companiile respective la Banca de Economii SA, dup a rnm urmea za:
!}:p.; ner t- •
Comp .m i;. C. ci<· crNHt Sun~- l De-bit or g;;;i i!:t I O0;N•t:.,:l e litibi St.: m 2 l!J r.i::t:e ; I ri(-t~ .; b,-u:c:1
06-06 / 1/ 16
- SRL dint l.06.1-i lSS.200.00 0_c-!QL] 3.~0 AKi;_ - HHTE?flP9_ll6AH ,; ._ J De;,.9;;\ ·o.nes( lQ..300 .000E Uf: I 0.0l) c-l!)_L
06-06 ·1/ 13
5RL d:n 15.05.1-t 3,200.00 0 EUR I HO AKS • l1HTEFl1PO:-l5AH K, I G.r-ntie b,nc.r. 3.250.000 EUR I 3.200.000 EUR
8:,o :,l etii> SRL 06-06 / 1/ 23 ;AO .:..1-~b .. HHTE?nPO~tSAH f\ , I Dep oz:t !>:m~sc 13 .0 00 .000 £UR
ciin 02.0i .l-i I 170 ,000.000 c-!DL 0.00 :-lDL
06 -06 it / ?.6
din Oi. 07.H I 65.HO .OOO c-lDL I I I I 0.00 ~IDL
Bi ro ~ltci i• SRL O' 06 ·, / 7 9
o· / a • ' 00 0 01 0 USD
"' O•··- w·-·, npo,1-
"" .•.. ,t> • M l t.
....,
' " ·" "' '
D - I -
epozs ,.,,.,, ' 0' , 00 ' USO 000 '-toLJ '
I
ci:n 19.0S.1-i -· · l - · .. :> . u .:___:.__ j
- ------ -- ·--·-·---·-··--·- --···-·-----·---·-------·--·-·--·-·-·- - -- ----- ·-·--··-- ···-------- ---···~-------- - -----1
The memorandum also stated that in the event of the loan to Provolirom being approved, the total
net exposure of BEM to these companies would be 12.31 % of BEM's Total Normative Capital (in
Romanian "CNT") as per the latest financial information available at the time dated 30 September
2014. It was also noted that the total being borrowed would exceed BEM's Total Normative Capital
by 1.71 times.
Further remarks were made in relation to the viability of the loan to Provolirom SRL. In particular it
was noted that the company had failed to provide a business plan and financial forecasts for the
loan period: as such, it was not possible to assess the viability of the lending operation and whether
Provolirom SRL would be able to repay. In addition, the company had not provided commercial
contracts or other indicators that could explain how the repayment of the loan would be made, its
turnovers and account balances at other banks or any documents related to Provolirom SRL's
commercial activities.
Example 2 - Earlier identification (pre-November 2014) of companies acting as a group

related to Shor
A memorandum from A. Misov (the then Head of Credit at BEM) in November 2012 to BEM's Board
of directors highlighted that a number of companies were acting together as a group (Ghermivali
SRL, IM Moldclassica International SRL, SC Molint Grup SRL, ICS Metal Trade Grup SRL,
Asigromex SRL, Storad Grup SRL, SC Dufremol SRL and Alutus-Com SRL) . This document, titled
"Nota consiliu Sor.docx" was found on Ms. Botnaru's computer and contains a detailed summary
of BEM's exposure to the Shor Group companies at the time, together with details of guarantees
for the loans .13 This document shows that the Credit Department was informing the Board of BEM's
Shor Group exposure from at least 2012 onwards.
13
See Exhibit 4.1O - Memorandum from A. Misov in November 2012

Example 3 - Identification of late payment of loans by Shor Group companies
On 13 November 2014, lulian Sarivan ("Mr. Sarivan") (Credit Department - BEM Chisinau Branch)
sent an email to Ms. Golovcenco and Ms. Botnaru, informing them that certain Shor Group
companies were late in the repayment of their loans. On 20 November 2014 , Mr. Sarivan re-sent
the warning with a table showing at least seven loans as being late for repayment. On the same
day, both Ms. Botnaru and Ms. Golovcenco independently forwarded the email to Mr. Birca.14 The
email was also forwarded to Serghei Pinzari {Chief Economist, Credit Department) Diana Alea
(Chief Economist, Credit Department) and Ms. Mihalas (Deputy Head of Credit) on the following
days (21 and 24 November). 15
Example 4 - Lack of documentation for loan approval
On 19 May 2014, Ms. Botnaru (BEM Head of Credit) wrote a note to Mr. Birca informing him that
the Shor Group companies Voximar, Dasler Con , Dracard and Provolirom had failed to provide
several documents in relation to loans of EUR 3.1 million, EUR 2.9 million, EUR 2.8 million and
EUR 3.2 million respectively, received by these companies from BEM on 15 May 2014 .16
In particular, Ms. Botnaru noted that the companies had failed to produce the following documents:
• Business plans;
• Forecasts of revenue and cash flow for the entire duration of the loan ;
• Financial reports for the year 2014;
• Certificates from other banks on existing loan facilities;
• Certificates from other banks regarding turnovers on current accounts;
• Copies of pledge agreements from other banks; and
• Performance contracts for the period of validity of the credit.
"See Exhibit 4.8 - Emails dated 20 November 2014 to Viorel Birca from Ms. Golovchenco and Ms. Botnaru
15
See Exhibit 4.9 - Email dated 13 November 2014 from Mr. Sarivan
16
See Exhibit 4.5 - Memorandum from Ms . Botnaru to Mr. Birca dated 19 May 2014

Kroll Project Tenor II - Detailed Report-Approval of loans at BEM
4.7 Communication between Shor Group and senior

employees relating to loan documentation
Kroll identified during a review of electronic documents examples of communications between

employees at BEM and BS and individuals using an "@shorholding.com" e-mail address, which
demonstrates the Shor Group coordination of the loans being issued by BEM and BS and that
employees of the bank appeared to be challenging the documentation presented.
Correspondence from the Shor Group came mainly from the following two individuals:
• Rodica Diaconu ("Mr. Diaconu") - finance .r@shorholdinq.com

• Andrei Cojocari ("Mr. Cojocari") - acoiocari@shorholding .com
The website www.shorholding .com redirects to the website of the duty-free reseller company
Dufremol, one of Mr. Sher's principal businesses.
Individuals using "@shorholdinq .com " email addresses provided BEM and BS's Credit
Departments with loan application documentation and paperwork including documents such as
business plans, accounts, financial information , bank and personal guarantees, directors'
information and corporate extracts related to the borrowing compan ies, indicating that such
companies were directly managed by the Shor Group. The messages contained file attachments
with little written instruction or accompanying explanation. Kroll identified around 40 email
exchanges with the "@shorholding.com" email accounts.
Administrators at BEM / BS responded to the emails mainly to request amendments to

documentation or to challenge the information provided . The broad timeline of the exchanges
indicate that this process was on-going during 2014 period . Examples of email exchanges are given
below:
1) In an email dated 4 June 2014 to Mr. Cojocari (acoiocari@shorholdinq .com ), Ms. Botnaru
(BEM) asked to make a number of amendments to a business plan for Voximar.SRL;
2) On 27 May 2014 Ms. Botnaru commented on a previous business plan submitted by Mr.
Cojocari for the Shor Group company Dasler Con. Ms. Botnaru noted that although the loan
discussed had been granted for the purchasing of furniture, it was listed in the corresponding
underlying business plan, as for the purchase of building materials 17 submitted by the Shor Group
17
See Exhibit 4.11 - Amendments to Voximar business plan suggested by Ms . Botnaru

company Voximar. Ms. Botnaru suggested amendments in relation to certain costs that were not
correctly reflected in the business plan. 18
3) On 26 March 2013 Ecaterina Turcanu (BS Credit) sent to Mr. Cojocari 19 suggested edits for
a business plan presented by the company Molint Group SRL, a Shor Group company. In the
document, Turcanu points out that the business plan stated the name of Unibank, rather than Banca
Sociala, as the lender for the transaction.
18
See Exhibit 4.12 - Emails dated May 2014 related to Voximar
19
See Exhibit 4.13 - Email sent by Ecaterina Turcanu (BS Credit) to Mr. Cojocari (Shor Holdings) in March 2013

l Kroll Project Tenor II - Detailed Report -Analysis of loans
5. Analysis of loans
As summarised in Section 4.1 of the Summary Report, Kroll conducted an analysis of loans granted
by the Three Moldovan Banks to Shor Group companies between 1 January 2012 and 26 November
2014. This Section provides details of this analysis as follows:
• Methodology for loan analysis (Section 5.1);
• Details of loans granted to Shor Group (Section 5.2) ;
• Loans transferred to the Core Laundering Mechanism (Section 5.4;
• Loans paid to other accounts at ABLV and Privatbank (Section 5.5) ;
• Loans paid to other jurisdictions (Section 5.7) ; and ,
• Loans paid to Moldovan companies (Section 5.6) .
5.1 Methodology for loan analysis
5.1 .1 Creating a log of all loans issued by the Th ree Moldovan Banks
Kroll combined the loans statements into a log of all loans , which formed the basis of th is analysis .
New loans issued by BEM were identified from loan statements received from NBM , which referred
to a "contract de credit" . Each loan was identified by a "contract de credit" reference number in the
bank statements and loan statements. Loan statements provided were combined into a log of all
loans. New loans issued by BS and UB were identified from the bank statements provided by NBM .
The release of a loan into the current account was identified with a description "Eliberarea creditului"
(Issuing of credit). In most cases, a loan reference number was also included in the transaction
description .
5.1.2 Initial traces

The loan funds were traced in order to establish the jurisdiction to which funds were initially
dissipated (Latvia , Moldova, or other). Funds were traced on in the case of an exact match (where
the onward trace matched the initial loan amount) or conversion (initial loan amount was converted
to a different currency and transferred on), and classified according to the categories below. For
the purposes of this initial trace analysis, once an amount was traced to a jurisdiction outside
Moldova, no further trace was conducted. Where funds were mixed in the Moldovan accounts and
could not be traced further by exact matches , they were classified as "Remained in Moldova" . First-
in-first-out ("FIFO") tracing (as detailed in Section 9) was not conducted for the initial traces.
The results of these initial traces are detailed in Sections 5.4 to 5.6.

I Kroll Project Tenor II - Detailed Report -Analysis of loans
5.2 Details of loans granted

The Three Moldovan Banks issued new loans of approximately USO 2.9 billion between 1 January
2012 and 26 November 2014 to Shor Group companies, as shown in Table 5 below:
Table 5: Loans issued to Shor Group compan ies by t he Three Moldovan Banks
BEM BS UB Total
2012 (Jan to Dec)
24.7 37.1 76.3 138.1
2013 (Jan to Dec)
8.2 106.6 258.0 372.7
2014 (Jan to Oct) 164.7 163.5 175.5 503.7
2014 (Nov)
838.5 978.8 91 .9 1,909.2
TOTAL2°
1,036.0 1,286.0 601.7 2,923.7
Table 6: BEM - Loa n s issued to Shor Group companies (USO m illion)
SHOR GROUP ENTITY 2012 2013 Jan to Nov BEM

Oct 2014 Total2 1
2014
Agentia De Stiri - - - - 0
Agercom Grup SRL - - - - 0
Air Clasica ICS Sri 0.3 - - - 0.3
Alreda-Pro SRL - - - - 0
Alutus Com SRL 2.8 - - - 2.8
Alvaro Grup SRL - - 4.0 - 4
Apropro-Com SRL - - - - 0
Asigromex SRL 2.6 - - - 2.6
BAS Clasic SRL - - - - 0
Biro Media SRL - - 17.5 - 17.5
CA Classica Air SRL 0
Caravita Co SRL - - 1.6 - 1.6
Caritas Group ICS SRL - 25.0 230.8 255.8
Citadina-Mob SRL - 0.4 - - 0.4
Contrade - - - - -
20
Differences are due to rounding
21

l Kroll Project Tenor II - Detailed Report -Analysis of loans

Oct 2014 Total 21
2014
Daliano-S SRL - - - - -
Danmira SRL - - 13.2 - 13.2
Dasler-Con SRL - - 17.6 - 17.6
Davema-Com SRL - - - - -
Decfin Grup SRL - 3.6 - - 3.6
Demicor - - - - -
Diagaras - - - - -
Dracard - - 24.3 182.7 207
Dufremol SRL 1.3 - 6.5 - 7.8
Elcomet-Prim SRL - 0.8 2.5 - 3.3
Finprofilux SRL - 0.4 - - 0.4
Ghermivali SRL 1.7 - - - 1.7
Grand lmobiliare ICS SRL - - - - -
,, ) ICS Kotinvest SRL - - - - -
lnfoton-Com SRL 1.1 - - - 1.1
Lavima lmpex SRL - - - - -
Liramex-Com SRL - 2.8 1.0 - 3.8
Megasoft International SRL 5.2 - - - 5.2
Metal Trade Group ICS SRL 2.3 - - - 2.3
Moldclassica International SRL 3.8 - - - 3.8
Molint Grup SRL 1.3 - - - 1.3
NobilAir - - - - -
Provolirom SRL - - 4.3 222.9 227 .2
Riolit Sistem SRL - - - - -
SRL Impact lmobil - - - - -
'~ Saagton - - - - -
Meldava Grup - - - - -
Stal Petrol ICS SRL - - - - -
Storad Grup SRL 2.3 - - - 2.3
Talnes SRL - - 27.7 - 27 .7
Timol lmpex SRL - - - - -
1 ffoast de Lux SRL - - - - 0
Tradeway SRL - - 0.9 - 0.9
Univest Invest SRL - - 3.5 - 3.5

IKroll Project Tenor II - Detailed Report -Analysis of loans

Oct 2014 Total 21
2014
Vascovprod SRL - - - - 0
Voximar-Com SRL - - 15.2 203.1 218.3
TOTAL 24.7 8.2 164.7 838.5 1,036.0
Tab le 7 : BS - Loa ns iss ued to Shor Group compa n ies (USO m ill io ns)
2012 2013 Jan to Nov BS Total 22

Oct 2014
2014
Agentia De Stiri - - - - -
Agercom Grup SRL 9.0 - - 9
Air Clasica ICS Sri 2.4 - 2.0 - 4.4
Alreda-Pro SRL - 2.6 1.0 - 3.6
Alutus Com SRL 3.8 - 32.3 4.5 40.6
Alvaro Grup SRL - 8.0 - - -
Apropro-Com SRL - - - - -
Asigromex SRL 0.3 2.5 2.6 0.1 5.5
BAS Clasic SRL - - - - -
Biro Media SRL - 8.7 8.9 - 17.6
CA Classica Air SRL - - - - -
_j
Caravita Co SRL - - - - -
Caritas Group ICS SRL - - - 182.4 182.4
Citadina-Mob SRL - 3.1 2.3 - 5.4
Contrade - - 7.0 169.1 176.1
Daliano-S SRL 4.9 - - - 4.9
Danmira SRL - - - 214.9 214.9
Dasler-Con SRL - 1.8 3.8 - 5.6
Davema-Com SRL - 5.0 2.1 223.8 230.9
Decfin Grup SRL - - - - -
Demicor - 11 .2 - - 11 .2
Diagaras 3.1 - - - 3.1
Dracard - 4.7 0.5 - 5.2
22
Differences due to rounding

2012 2013 Jan to Nov BS Total 22

Oct 2014
2014
Dufremol SRL 5.0 5.9 8.3 - 19.2
Elcomet-Prim SRL - - 4.4 - 4.4
Finprofilux SRL - - - - -
Ghermivali SRL 0.6 0.9 0.9 - 2.4
Grand lmobiliare ICS SRL - - - - -
ICS Kotinvest SRL - - - - -
lnfoton-Com SRL 3.8 3.2 - 7
Lavima lmpex SRL - 6.4 0.4 - 6.8
Liramex-Com SRL - - - - -
Megasoft International SRL 2.4 - - - 2.4
Metal Trade Group ICS SRL 2.0 - - - 2
Moldclassica International SRL 1.6 3.5 4.2 - 9.3
Molint Grup SRL 4.8 - 35.6 15.3 55.7
NobilAir - 2.2 2.7 - 4.9
Provolirom SRL - 9.6 2.7 - 12.3
Riolit Sistem SRL - - - - -
SRL Impact lmobil - - - - -
Saagton - - - - -
Meldava Grup - - - - -
Stal Petrol ICS SRL - - - - -
Storad Grup SRL 2.3 - .8 4.6 7.7
Talnes SRL - 4.2 3.8 - 8
Timol lmpex SRL - - 16.4 - 16.4
Toast de Lux SRL - - - - -
Tradeway SRL - - - - -
Univest Invest SRL 6.5 7.0 13.5
Vascovprod SRL - 2.8 0.9 - 3.7
Voximar-Com SRL - 7.9 1.7 164.0 173.6
TOTAL 37.1 106.6 163.5 978.8 1,286.0

Kroll Project Tenor II - Detailed Report -Analysis of loans
Table 8: UB - Loans issued t o Sh o r Grn11p companies (USO milli o n)
2012 2013 Jan to Nov UB

Oct 2014 Total 23
2014
Agentia De Stiri - 1.9 - - 1.9
Agercom Grup SRL - 2.3 - - 2.3
Air Clasica ICS Sri 0.7 1.4 15.3 - 17.4
Alreda-Pro SRL - 2.3 0.4 - 2.8
Alutus Com SRL 6.4 2.6 1.3 - 10.3
Alvaro Grup SRL - 2.4 - - 2.4
Apropro-Com SRL - 15.9 4.2 69.1 89.2
Asigromex SRL 5.9 10.3 - - 16.2
BAS Clasic SRL - 20.3 - - 20.3
Biro Media SRL - 2.4 0.3 - 2.7
CA Classica Air SRL - 3.9 0.5 - 4.5
Caravita Co SRL - - - -
Caritas Group ICS SRL - 2.7 1.4 - 4.1
Citadina-Mob SRL - 2.4 - 2.4
Contrade - 1.4 42 .8 9.5 53.1
Daliano-S SRL 0.7 2.1 - - 2.8
Danmira SRL - - - - -
Dasler-Con SRL - 2.4 - - 2.4
Davema-Com SRL - 2.4 - - 2.4
Decfin Grup SRL - 8.0 4.5 - 12.5
Demicor - 2.2 - - 2.2
Diagaras - - - - -
Dracard - 2.3 - - 2.3
Dufremol SRL 14.0 30.6 11.8 - 56.3
Elcomet-Prim SRL - 2.4 - - 2.4
Finprofilux SRL - 5.5 9.8 - 15.3
Ghermivali SRL 3.4 10.2 0.3 - 14.0
Grand lmobiliare ICS SRL 1.5 4.8 - - 6.3
ICS Kotinvest SRL - 2.2 - - 2.2
lnfoton-Com SRL 12.6 4.6 0.9 - 18.1
Lavima lmpex SRL - 4.0 - - 4.0
23
Differences due to rounding

2012 2013 Jan to Nov UB

Oct 2014 Total 23
2014
Liramex-Com SRL - 3.4 - - 3.4
Megasoft International SRL 5.2 1.2 - - 6.4
Metal Trade Group ICS SRL 2.1 2.4 - - 4.5
Moldclassica International SRL 4.5 31 .8 4 .9 - 41.2
Molint Grup SRL 5.7 4.2 - - 9.9
Nobil Air - - - - -
Provolirom SRL - 4.8 - - 4.8
Riolit Sistem SRL 1.4 - - - 1.4
SRL Impact lmobil - 23.0 - - 23.0
Saagton 2.2 - - 2.2
Meldava Grup 1.8 - - - 1.8
Stal Petrol ICS SRL 1.4 - - - 1.4
Storad Grup SRL 8.6 3.2 36.0 12.4 60.2
Talnes SRL - 1.9 - - 1.9
Timol lmpex SRL - 16 .0 40.5 - 56.5
Toast de Lux SRL 0.3 0.4 - - 0.7
Tradeway SRL - - - 0.9 0.9
Univest Invest SRL 0.3 0.4 - - 0.7
Vascovprod SRL - 2.4 1.1 - 3.5
Voximar-Com SRL - 2.3 - 2.3
TOTAL 24 76.3 258.0 175.5 91.9 601.7
24

5.3 Initial destination of loan funds

A summary of the initial destination of the loan funds is set out in below:
Ta ble 9: Su mm ary of the i n itial dest ination of loan funds
Initial destination Amount Amounts Total Section

traced related to (USD reference
26
directly loans million)
from
loans 25
Core Laundering Accounts -ABLV 425 .0 22 .5 447.5 Table 10
Core Laundering Accounts - Privatbank 2,134.8 2,134.8 Table 11
Other accounts -ABLV 30.0 30.0 Table 12
Other accounts - Privatbank 5.6 5.6 Section 5.5
Amounts paid to Moldovan accounts - Three 104.2 104.2 Section
Moldovan Banks 5.6.1
Amounts paid to Moldovan accounts - accounts 114.5 114.5 Section
at other Moldovan banks 5.6.2
Amounts paid to accounts held at Russian 97.8 97.8 Section 5.7
banks
Amounts paid to accounts in other jurisdictions 8.4 8.4 Section 5.7
TOTAL 2,920.3 22.5 2,942.8
5.4Loan proceeds transferred to Core Laundering

Mechanism
The table below shows the totals of loan proceeds transferred to Core Laundering Accounts at
ABLV and Privatbank, according to the initial traces analysis described in Section 5.1.2
Table 10 : Amou nts transferred to ABLV Core Laundering Acco unts
Amount received (USD

ABLY Core LaunderinCJ Account million)
AR PLANE FORCE LIMITED 12.5
BELMONT UNITED LP 11.3
25
Initial traces of loans resulted in a leakage of USO 3.4 million compared to loans issued as detailed in Section 5.2.
This difference was mainly as a result of the difference in foreign exchange rates used by the Three Moldovan Banks
and the rate used by Kroll.
26
Analysis conducted by Kroll indicated a number of transfers that were made into ABL V and Privatbank accounts were
linked to loans issued by the Three Moldovan Banks. These amounts were included in the tables in Section 5.4.


ABLV Core Laundering Account million)
BLUEFONTEIN LP 10.7
DIVISION TOP LLP 57.2
EKOVOLD PROJECT LIMITED 15.8
ELMA UNION LLP 13.6
ELMINGTON LIMITED 13.1
FRANCES TRADING LP 23.3
GROUFORD INDUSTRIES LP 11.1
HAMILTERO COLOR LIMITED 55.7
HANLAY SOLUTIONS LLP 56.6
HARWOOD UNITED LLP 0.7
KLASSIKA INTERNATIONAL LIMITED 1
MALTBY SOLUTIONS LP 46.9
PANAROOM MANAGEMENT LLP 5.5
. PRIMOTEKS IMPORT LP 8.4
ROMANFORD SOLUTIONS LP 2.1
SUNBUROUGH INDUSTRIES LP 23.1
TORPROM UNIVERSAL LP 9.4
VEGWORK IMPEX LP 21 .9
VISSETI (PTY) LTD 25.8
WANG AND LEE LP 21.5
TOTAL27 447.5
Table 11 : Amounts transferred to Privatbank Core Laundering Accounts

Privatbank Core Launderin!'.:I Account million)
ARDOOKS LLP 26.9
BANNYSTER LLP 28.6
DANLEY IMPEX LP 164.6
DASTINGER LLP 65.8
EXPOVISION LOGISTICS LP 356.8
FIDAN PROPERTIES LLP 59.2
FORMISOLD LLP 29 .3
GENYRAL TRADE LP 54
HANSA INVESTMENT LP 183.8
HOSTAS LEVEL LLP 40.3
INVESTOS BUENOS LP 20.6
KALTEN HOUSE LP 4.3
NORD LP 200
ROYALPORT LIMITED 227.4
SPECTRA VENTURES LLP 228.8
27 Difference of USO 0.3 million as a result of rounding

Amount received (USO

Privatbank Core Laundering Account million)
UNITED TECHNOLOGIES LP 215.7
VERCELL SOLUTIONS LLP 184.6
WELENTAS LP 44
TOTAL 2,134.8
5.5 Loan proceeds transferred to other ABLV / Privatbank

accounts
Table 12: Amounts transferred to ABLV Non-Core Laundering Accounts
Amount received (USO

ABLV Non-Core Laundering Account million)
PARSELOT LTD 5.7
ROMFORD GROUP LIMITED 3.5
TOMTON TRADE CORPORATION 18.1
ZONITECH PROPERTIES LIMITED 2.7
Total 30.0
In addition to the transfers made to the Non-Core Laundering Accounts at ABLV, two Non-Core
Laundering accounts at Privatbank also received loan funds :
• Hezburg LLP received USO 1.6 million; and,
• Sunrise Cotton LP received USO 4 million.28
5.6 Loan proceeds transferred to Moldovan companies

A proportion of the loan funds that were issued to Shor Group companies by the Three Moldovan
Banks remained in Moldova. Tracing of the initial destination of funds has shown that amounts
remained at accounts held at the Three Moldovan Banks or were transferred to other Moldovan
banks, to pay down existing loan exposure or to fund what appears from the transaction description
to be trading activity. A proportion of the funds was mixed with other funds and was not traced
further.
Table 6 in Section 6.1 of the Summary Report shows that USO 218.7 million (or 7%) of loan funds
issued by the Three Moldovan Banks was transferred to accounts at Moldovan banks. USO 104.2
million of the USO 218.7 million was then transferred to accounts held at the Three Moldovan Banks
and was used to repay loans or fund other business activities. A portion of these funds was mixed
and could not be traced further (see Section 5.6.1). USO 114.6 million of the USO 218.7 million was
then transferred to accounts at other Moldovan banks (see Section 5.6.2) .
26
These figures are included in the "Paid to Latvian Bank 2" figure in Table 5 in the report .

Kroll Project Tenor II - Detailed Report -Analysis of loans
5.6.1 Proceeds of loans used to repay earlier loans at the Three Moldovan
Banks
Kroll's analysis identified a pattern of transactions that occurred during 2012 and 2013 whereby
loan funds issued to one of the Three Moldovan Banks were transferred to another of the Three
Moldovan Banks.
In the example below, proceeds from a number of smaller loans from UB were combined with MDL
10 million (approximately USD 800,000) received from the UB account of Milsami Football Club 29
and used to pay off two larger loans at BS (see below). In some instances, the loans were reissued
to the same company. For example, loan 502/2011 (Daliano-S) in the table below was repaid on 2
January 2012 (using the proceeds of the nine loans below) and on 23 January 2012 a new loan for
the same sum was issued to Daliano-S SRL.
29Mr. Shor is reportedly the president of Milsami FC - http://moldova24 .info/2015/05/ilan-shor-a-facut-din-milsami-

campioana-a-moldovei/

Figure 3: UB loans merged with other funds and used t o pay off loans at BS
~.7-1;.•: ,:-. -; : ...... ·; -,;-!;I;.:~- -~ ........ . J ··- c! • . - ... ~-- ·-i~:~ -:-•·.:.:!.•::·:-.•:d•:::: ;::_ '·t.: ::!;..- :::: 1-.: : •·•.!::-- .! :.:.:..l '•! --- -- - - =·- "-~...... ..__,- =-~-, ,:.:_
,:,..:- ::i:- --: -: -,:-:·l( -:- ,:~,.,~- -:. ,:-!'"t'I: -: - ,::-r.~
· .;
-:. : ., :-: "Y.: / ,:,.,:!"'Y.'. ·:- ,:-:-,,:~ ,: .:,:,:,(
"',,,,..
,:,.:: ,,:,: _
,,::,:.::· ~-, ..:,: •~c•:i : ::-::,-:,:·i-:::i: ,: i •:::-: ,.;:,:,:.::: -~.:: ·:-: ,.::,:-:,. :•1•,·: •1•: :,:
//
._ ~ ,·.:,: ,:i,: :i : :·2 ·C•: ,;;,:•: i :
.-···
.:, ,,:: -:;..::~-
_:---:·i .'X·· · •- • •-~_.( u. • , -== .::c,: ,,:,:r. . :- 1-:·;-_,;,:,: .;,::-.::: .-:-:: ,: ..::3-2-H_.:-:: .:: :: :•: ::,:,· • .:: p-::;• ,•
~ ., ///// __....--···
// ....·····
////
/ ..•
.:::_>,i•:.. i~'(.<······ .-, ,-· ~~.·z·
_,-.~,, ,,-.----------
'•!::: --.::: -~-.:-r. !'.....,, ""~ . , . :- - -. ,_,: .__ :-
,:·.; -, :•!"1( -: -- , ; !'l(
,,/·'
.-,, 1,-,•. ;t ,•; . ' ·:- 1 .-,:---,_•:(. '

'~",,,~: ,,
.,.,,.../.,.
:! ,! ..,:.•=.=-=--
.:.¾ .:? '.:•---'- -. ~:~!=c;~;;~~
""'""" ]" "' ; ., ,
:! ,! ... :-=-E"=--
:--· -::!: ·=- -:

5.6.2 Proceeds of loans transferred to other Moldovan Banks

Transfers of loan funds to other Moldovan Banks were made mainly to accounts at Victoriabank
and Moldindconbank. Kroll also identified transfers to accounts at Agriondbank, Comertbank,
Exima Banca, Mobias Banca and ProCredit Bani<. It is currently not clear whether these transfers
made up part of further laundering activity, or whether they represent an end destination of funds .
It appears however from analysis to date that Moldindconbank and Victoriabank also issued loans
to Shor Group companies which have been serviced and/or repaid by loans issued by the Three
Moldovan Banks. To date, Kroll has not reviewed any evidence which indicates complicity or
involvement of the management of these banks in any fraudulent activity. Further work is required
to clarify the nature of the potential involvement of these banks.
The involvement of accounts at Victoriabank and Moldindconbank in secondary laundering

mechanisms is detailed in Section 10.
Loan funds were transferred to accounts at seven Moldovan banks as detailed in Table 13:
Table 13: Amounts pa id to other Moldovan banks
Moldovan Bank Amount received

Comertbanl< 3.2
Enerqbank 1.1
Mobiasbanka 0.1
Moldindconbank 39.8
Moldova Aqroindbank 28.4
ProCredit Bank 0.2
Victoriabank 40.7
Not identified 1.1
30
TOTAL 114.6
5.6.2 .1 Loan proceeds used to repay loans at other Moldovan banks

It appears from analysis to date that loans issued by Moldindconbank and Victoriabank to Shor
Group companies were repaid using loan funds issued by the Three Moldovan Banks.
An example of funds from loans issued by BEM being used to repay a loan at Moldindconbank is
shown in the diagram below:
30
Difference of USD 0.1 million due to rounding

Figure 4: Loan funds used lo pay off loans at ot her Mo ldovan banks
Ii.Il l ~-! 1•;: o1 (I::-:,• ,11 I : r. 11 I!
l •:..iu ,: l:!'l nfi Ii' ✓ "! 11:: dl NJI!~,; , '. J .\i 111 ti1i:; l l$(1;!]1" h; •
•;SD l.8 -' 1-.;.-.

I ,:._;•,;i121Jl•l
liSD J ),;, .- ·'-'; ·,
<.•~: •,7,"NH •!':}i,!•'.)i,;.; 1,<if; 1,;-i ,----~--
,: l •u J:.:-i ,: ~
I $. [l\' :.- ,;,r:1 r_j, 11!) :::.r-:l 1,r.:; ;i:,:11un~)

,'\l: ~•·j.; !>re, :,H. ~\J{ I {l'';t;,::;::r}
IJ~J .l. l :u;._,., IJ!,;) J.\J.: 11:ioJ"'

IJ~◊ ).! 'i u...,,, l•~•J /..{.• ~.!-:,;-; l,:0.'U7.'l'•! ·l 1,2,.:,:;·?••1·1
,·,:it 11],)(11,; u/1v7f •1-;
@ U.. in: h:;-.•\'.(iJ:i,1,:,: !:1:I) <~u-: m,\·,ii, (ll',,,, : ,::wl) /\1·.·,I! •: (•1!.lp(H', ,li : 1::wl ~
,'\114,,~ta 11,c (':.c- 1G,r- c,;:oflt..1"I: ;;.:~c-1r t)
i<11Hra ,r nl of ),1,m 1.:: 1'.;;1,~ 1', iil d, 11.-.: 1 JB;'I O_litl:: \ I',!) l f,n,J,,.,11
1!~,f) i I ,:-...: ~
I I\!) ! t-.,; :1· ~ ; "
,:J:•.ii:,w:-; 1•1 l .\ ll/ ..~!l·~ 1,1.1 ,ll/.' l ( •ll
(9
l!r.-, ~r Ir.•:,. ,· : 1-1,·.:.: f'r,·,r,!,.Y,;.: 11 t.- 1 ,• i}
@ @
GhC'I mi.,._111 \ t-1 c,1d'n ccnl13n l. J ~~•)::111:
R~:, ~•,m,:,:i: o' ~::,-. t ❖,'t· ;:-t Pi. l .:;:,;,,.: ?(•.' 11;' 2(, IJ t.\·,,1t,: ( ,111ri (:-1-:,l:li:1: 11 111l.:11',: ,::,<;,111'.)
R~;;.a·.-~·.,:-r.t c/ lo"r. U::SiJ r.~:-:d /.01}.,'}.JIJ
il.l:lH):11•.'= •t d rc-; :1 !52:'1 i,_;,;:l':I 2N i•)/ 21113
In this example, a loan of USO 11.9 million was issued by BEM to Biro Media in July 2014. This
loan was paid in four tranches, and the purpose of the loan according to the bank account
description was for the purchase of construction and technological equipment. The loan proceeds
were transferred to two other related companies (Alreda Pro at UB and Agercom Grup at BS). The
amounts were traced to accounts at Moldindconbank, where they were used to repay loans
amounting to approximately USO 12 million: 31
• Univet Invest - USO 2.8 million used to repay loan cc 178/1 dated 20/12/2013;
• Ghermivali - USO 2.1 million used to repay loan cc 185/1 dated 20/02/2013;
• Alreda-Pro - USO 3.36 million used to repay loan cc 151/1 dated 28/10/2013; and
• Alvaro Grup - USO 3.64 million used to repay loan cc 152/1 dated 28/10/2013 .
Kroll does not yet have full visibility over how much of the transfers of loan proceeds from BEM,
BS and UB were used to repay loans at Victoriabank and Moldindconbank, and are thus also
connected to the fraud. However, this example suggests that the proceeds of the loans and the
resultant loss may have resulted from loans issued by Victoriabank and Moldindconbank as well
as by the Three Moldovan Banks. This also indicates that a proportion of the loss to the Three
Moldovan Banks arose from repaying loans at other Moldovan banks in an earlier period. Whether
these funds were used to fund legitimate business, or whether they represent an earlier theft of
funds that was disguised by these later loans, is unclear.
31
According to the payment description

l Kroll Project Tenor II - Detailed Report - Analysis of loans
5.7 Loan proceeds transferred to other jurisdictions

In addition to the transfers made to accounts at ABLV, Privatbanl< and Moldovan companies , a total
of USO 106.2 million in loan funds was transferred to other jurisdictions as detailed below:
• USO 97 .8 was transferred to accounts at Russian banks (predominantly accounts held at
Metrobank). An analysis of amounts transferred to Russian accounts is included in Section
11;
• USO 8.4 million was transferred to accounts in other jurisdictions. These payments are
summarised in Table 14.
Table 14: Loan funds transferred to other juris diction s
Company Transaction detail Analysis

receiving
loan funds
Denison USO 1.7 million I Denison Limited also received funds totalling USO 30
Limited originating from a loan to million from ABLV accounts Panaroom Management
(Belize) Provolirom SRL at UB LLP and Frances Trading LP in numerous
(Trasta was transferred on 2 July transactions in 2013 and 2014. It also paid funds into
Komercbanka , 2013. other ABLV accounts totalling USO 9.1 million to
Latvia) Elmington Limited and Torprom Universal LP between
February and November 2013. This company has
been linked in the media to an ongoing large scale
money laundering operation which was used to
launder money from Russia to purchase shares in
MAIB.
PR-Vert USO 1.8 million I PR-Vert Systems Limited has also been linked to the
Systems originating from a loan to same large scale money laundering operation as
Limited (UK) Dracard SRL at UB was Denison Limited . 32 ABLV account Rastel European
(Trasta transferred to PR-Vert Trade Corp (Panama) received USO 7.2 million from
Komercbanka , System Ltd on 2 July PR-Vert Systems Ltd in September 2013 . Another
Latvia) 2013. ABLV account, Longford Partners Ltd paid USO 5.0
million to PR-Vert Systems Ltd in July 2013 .
32
https://www .reportingproject.net/therussianlaundromatldocuments/russian-banks/P1 .pdf

Company Transaction detail Analysis

receiving
loan funds
Dufremol KG I USO 1.0 million I This appears to be related to the expansion of
LLC originating from a loan to Dufremol to Kyrgyzstan . No other transactions were
(Unknown Talnes SRL at BS was identified in relation to this entity.
Jurisdiction) transferred to Dufremol
KG LLC on 11 October
2013.
North Scale USO 1.3 million No other transactions identified relating to this
Enterprises originating from a loan to company.
Ltd Apropo-Com at UB was
(Seychelles) transferred on 13
(Amsterdam November 2014.
Trade Bank)
GEBR Two amounts totalling Gebr Heinemann is a German duty-free retailer and
Heineman USO 985 ,530 originating logistics manager. It is listed on the Dufremol website
(Germany) from loans to Dufremol as a partner of Dufremol and has numerous trading
(Berenberg from Unibank and Banca transactions with Dufremol in Moldova 33 . It has also
Bank Sociala were paid to transacted with Primoteks Import LP, Salvador Trade
Hamburg) GEBR Heineman LP, La Costa Trade LLP, through their ABLV accounts
in 2013 and 2014.
Cosmo Max I Three amounts totalling I No other transactions identified relating to this
Limited USO 0.9 were paid to company.
(Shanghai Cosmo Max at Shanghai
Pudong Pudong Bank. The
Development amounts originated from
Bank) loans granted to
Tradeway Sri (BEM)
Other Five transactions
transactions totalling USO 0.7 million
were paid to accounts in
other jurisdictions
outside Moldova.
33
It appears that Dufremol has in part used the loan funds as a "treasury account" for ordinary business activity.

I Kroll Project Tenor II - Detailed Report - The Switch
6. Switch of the entire loan portfolio on 25-26

November 2014 from BEM to BS
The Scoping Phase report identified that the entire loan portfolio that had been issued by BEM
during November 2014 , which itself had been used to redistribute the majority of Shor Group
exposure from BEM , BS and UB so that it was concentrated in BEM, was transferred to BS between
25 and 26 November 2014 ("the Switch").
This Section provides further details of the fund flows relating to the Switch that have been traced
through multiple Latvian bank accounts. Loans were issued by BS totalling USO 956 million on the
25 and 26 November 2014 to the following Shor Group companies Contrade SRL, Danmira SRL,
Davema SRL, Caritas Group and Voximar SRL. These loan funds were then transferred to the
Privatbank company accounts of Danley lmpex LP, United Technologies LP, Royalport Ltd, Vercell
Solutions LP and Expovision Logistics LP.
From these accounts, the funds were moved through a network of other Privatbank accounts, in an
attempt to disguise the fund flows. The Laundering Mechanism for the Switch transactions included
the simultaneous issuing and repayment of an overdraft facility with Privatbank (overdrafts issued
to Delta Management LP and Conversum Logistics LP, and repaid by Transmark Export LP and
Globus Corporation LP). The funds were then used to repay loans at BEM totalling USO 916.4
million for Dracard SRL, Caritas Group SRL, Voximar-com SRL and Provolirom SRL. In addition,
USO 39.2 million was transferred back to BS from an UK limited partnership called Tennant
Shipping LP. This sum was then transferred to Jasterport LP, at BS, before being transferred to the
BS account of Fortuna United LP, the company that was to purchase the entire loan portfolio of BS.
USO 2.4 million was transferred to an account in the name of Terios Systems, with a BEM account
number but with the reference "Victoriabank". A summary of the Switch fund flows is presented in
Figure 5. All values are in USO millions. 34
3
' At the end of 26 November 2014, a balance of USO 800k remained at Nord LP from the BS loans , which was
transferred to Jacklond Experts LP (a Privatbank account) on 1 December 2014

I Kroll Project Tenor II - Detailed Report - The Switch
Figure 5: Fund flows to switch the l oan p ortfolio from BEM to BS on 25 - 26 November 2014
LOAUS ISSUED (Banca Sociala )· USO 956.3 m Hion Fortu na Unit-ed LLP
(BS)
t
39.2 Transferr~d to Fortuna Unitec LLP
Ca ritas Group (BS) Oanrm a SRL (BS) Oaven,a com SRL (BS) Contrade SRL (BS } v o, imar SRL (BS)
I
I I I I I
184.6
I
215.7
l
227.~
l
Ir 164 .o
l
- ---·02
Ja1t •rpo,t LP (BS ) , • • ----
Vereensolutions LP
"'-.
•-101 .0 - - - - . .
,.,//
Europe Consulting LP
Globus Corporation LP Tr.msmark E., port LP - 3 . 7 ~
23.9
Overdra ft 387 .B Ov,erdraf t 166.9
I
Overdrcft l f6 .9
n ~
Hansa InvesttrP.nt LP M•Qo E>.1>orts LP Spectra Ventures LP
Overdraft 405.4
I
I
T\
LP
228.7
~ .4
~ ·
.
I
220. 5
T
M .:l":°,:,,_,n!_i t.-i ~1:,.t1 r[ :::n1
Pri'.'cltbank
Ur-Ii
·u
3,7
0. 9
111 \ Teno, System, 11

,,
'-\':lo :,·.,r1.1rn , .r~ LJ ..,, .:.11 ,1<;t:)_<ft!
·•■ (VJCtcria bank) ■~
Provo lrom SRL (BEM) / 1/oe.imar-COM SRL (SEM)
?.:--• 2.4
Dracard SRL (BEM)
:·:1-.- rN 1 :• ,J t ,;,k ·
Cant.ls Group SRL (SEMJ /
Lr-, ., :.:.vnYr.~ , r;,c;r, -f"!. LOAHS REPAID - BEM USO 916.4

Dava stra Copta l LP (BEM }
Prt.1atbank Pool
0\1£ 1: 'r;:ft
Dtho:r \: crat er

I Kroll Project Tenor Phase II Report - Detailed Report - The Switch
6.1 Fake Overdraft
The issuing of the loans in BS, that allowed the Switch to take place, was only made possible by
the manipulation of the accounting system within BS and the creation of a fake overdraft facility on
the BS correspondent bank account at Privatbank. This appears to have been carried out solely
within the books of BS. This was only possible because the fund flows all passed through the
correspondent account within a business day and did not therefore require a balance on the
correspondent bank account overnight, which would have been subject to daily clearing by
Privatbank.
Kroll reviewed a letter, originally addressed to the Special Administrator at BS, dated 24 March
2015, from Tatiana Seremet, 35 an employee of BS who was responsible for processing the
accounting entries relating to the loans issued by BS between 24 and 25 November 2014, which
were used to pay down the BEM loans through the Latvian accounts. The letter reveals that a fake
overdraft was opened with Privatbank in the accounting ledgers at BS, in order to create liquidity
in BS to issue new loans. According to communication from Privatbank to NBM, this was done
without the knowledge of Privatbank.
The letter states that Ms. Seremet, following instructions of the BS interim President Natalia
Rahuba, assisted with the creation of a false overdraft on the correspondent accounts held by BS
at Privatbank. This false overdraft was used to allow a series of loans to be issued to BS Shor
Group customers, who in turn could transfer funds to Latvian accounts and back to BEM . It appears
that once each loan had travelled through the cycle and paid down existing BEM loan exposure,
BEM could then place funds on deposit with BS, which allowed the bank to close the overdraft. It
appears that BS repeated this cycle several times within a two day period in order to redistribute
the entire loan portfolio from BEM to BS .
Kroll reviewed a confirmation received by NBM from Privatbank that there was no overdraft facility
on the correspondent account with BS . 36 It would appear, therefore, that this exercise was a
fraudulent accounting entry in order to allow the movement of funds out of BS that would not
otherwise have been possible or permitted. This has not to date been confirmed through review of
the entries made on the BS accounting system or with the individuals involved. We have not met
with Ms. Rahuba, to understand the basis on which she requested such fraudulent transactions to
be processed.
35
See Exhibit 6.2- Letter from Tatiana Seremet
36
See Exhibit 6.3- Letter from Privatbank regarding overdraft on the correspondent account at BS

I Kroll Project Tenor Phase II Report - Detailed Report - The Switch
6.2 Reallocation of interbank deposits
The interbank lending between BEM and BS was also reversed as part of the switch. Between 24
and 25 November 2014, the deposits that BS held with BEM were reduced from USO 173 million
to USO 19 million, then to nil on 26 November 2014. As the BEM loans were repaid by BS loans
through the network of Latvian accounts detailed in Figure 5, BEM simultaneously placed funds on
deposit at BS, to fund the next loan it issued. On 25 November 2014, BEM placed USO 285 million
on deposit at BS, which then increased to USO 742 million on 26 November 2014. On 25 November
2014, UB and BEM also deposited USO 50 million and USO 16 million respectively on the Nostro
account at BS. The table below summarises these movements:
Table 15 : Summary of interbank depos its to support the sw itch of the l oan portfol ios
Date BS cash BEM term BEM cash UB cash

(nostro) at BEM deposits at BS (nostro) at BS (nostro) at BS
USO million USO million USO million USO million
24 November 173
25 November 19 285 50
26 November 742 16 50
27 November 744 29 37

l Kroll Project Tenor Phase II Report - Detailed Report -Acquisition of shares
7. Fund flows relating to acquisition of shares in

the Three Moldovan Banks
This Section provides details of Kroll's analysis of fund flows relating to the acquisition of shares in
UB, BS and BEM in 2012 and 2013, and the further links which have been identified with respect
of the Roseau Agreement, which was part of the agreement to increase the shareholding of minority
shareholders in BEM . The examples demonstrate that the funds that were used to acquire shares
in the Three Moldovan Banks and to settle the cession agreement at BEM originated in part from
loans issued by the Three Moldovan Banks themselves. Analysis has also shown that in addition,
a proportion of the funds that were used to purchase the shares for apparently unrelated parties
can be linked to Shor Group accounts at other Moldovan banks, to accounts in the name of
individuals linked to the Shor Group in Russia, and to other Latvian Banks.
7.1 UB share acquisition

The Scoping Phase report identified that starting in August 2012, a group of 21 shareholders each
purchased between 4.5% and 4.99% stakes in UB from Vienna Capital Partners. The fact that each
of the stakes purchased was less than 5% was not a coincidence as, according to Moldovan
legislation at the time, a shareholder who held a stake in a bank of at least 5% was classified as a
significant shareholder, and therefore none of these new shareholders met this criteria, and were
able to avoid enhanced regulatory scrutiny by the NBM. The analysis in the Scoping Phase report
also identified that there were strong indications that the individuals and entities that acquired the
UB shares were related and potentially acting in concert, and that the acquisitions were financed
through loans from corporate entities, largely from Latvian Banks.
Further analysis has confirmed that the shareholders were not acting independently, as a number
of them funded their acquisition from the same source. The source of the funds , in all the examples
provided in this Section, was disguised through the movement of funds through a number of Latvian
bank accounts, many of them handling transfers for multiple shareholders, before being transferred
to the beneficiary. Kroll has also identified that the source of the funds for USO 16.3 million used
to acquire the shares could be traced to Shor Group accounts at UB , to accounts held at Russian
banks connected to the Shor Group , and to Shor Group companies at other Moldovan banks. Many
of the shareholders received funds from multiple sources, further demonstrating the coordination
of the fund flows. The Section below provides a summary of the fund flows from the three sources.
Following that, details of specific fund flows are presented in Figure 6 to Figure 12.

I Kroll Project Tenor Phase II Report - Detailed Report -Acquisition of shares
7.1.1 Funds from accounts at the Three Moldovan Banks

Table 16 provides a summary of USO 11.1 million used to purchase shares in UB in 2012 , the
source of which was traced to Shor Group company accounts at UB. For example, nine of the
transactions used to fund the acquisition of shares were traced to a loan for MDL 30.8 million (USO
2.5 million) from UB to Shor Group company Dufremol on 29 November 2012. This loan was then
repaid through the issuing of new loans at a later date. Similarly, funds from the account of
Airklassika Group at UB were traced to funds transferred to the shareholders Nani Abashidze and
Lilya Pleskachevskaya.
Tab le 16 : Table of UB Sh areholders funded by Shor Group company accounts at UB
Source of Bank Shareholder funded Amount linked Figure

funds to share
acquisition (USO
equivalent -
million)
Dufremol UB Jet - Tech Industries 0.2 Figure 6
Dufremol UB Pace Global Energy Ltd 0.2 Figure 6
Dufremol UB Reynosa Management Ltd 0.2 Figure 6
Dufremol UB Dixon Corporation 0.2 Figure 6
Dufremol UB Veaceslav Lupov 0.2 Figure 6
Dufremol UB Lerson Ltd 0.2 Figure 6
Dufremol UB Tudor Negru 0.2 Figure 6
Dufremol UB Lilya Pleskachevskaya 0.2 Figure 6
Dufremol us Marina Tauber 0.2 Figure 6
Roseau Alliance UB Rita Tvic 0.4 Figure 7
Roseau Alliance us Nani Abashidze 0.4 Figure 7
Moldclassica us Pace Global Energy 0.4 Figure 7
International Limited
Moldclassica UB Lilya Pleskachevskaya 0.3 Figure 7
International
lnfoton-Com UB Veaceslav Lupov 0.5 Figure 8
Airklassika UB Nani Abashidze 0.9 Figure 8
Group
Airklassika UB Vladimir Novosadiuc 0.9 Figure 8

Group
Airklassika us Lilya Pleskachevskaya 0.9 Figure 8
Group
Airklassika us Reynosa Management Ltd 0.9 Figure 8
Group
Meldava Group us Petru Lucinschi 0.9 Figure 9
Meldava Group us Pace Global Energy 0.9 Figure 9
Limited
Storad Group UB Reghina Apostolova 0.6 Figure 9

Kroll Project Tenor Phase II Report - Detailed Report -Acquisition of shares

funds to share
acquisition (USO
equivalent-
million)
Megasoft UB Reghina Apostolova 0.3 Figure 9
International
Storad Group UB Tudor Negru 1.0 Figure 9
TOTAL 11.1
7.1.2 Funds from Russian accounts

Funds used to fund share purchases at UB totalling USO 3.1 million which originated from accounts
at Alef Bank and Metro bank in Russia are detailed in Table 17. The accounts held at these two
Russian banks were held in the names of entities or individuals connected to the Shor Group.
Analysis has also shown that these funds appear to have been repaid through the issuing of loans
from the Three Moldovan Banks, and therefore are part of the fraudulent funds. Further details are
provided in Section 11. A summary of the UB shareholders funded from accounts at the Russian
banks are provided in the table below.
Tab le 17: Tab le of UB Sha rehol ders fu nded from compa nies/ individuals li nked to Shor w ith accounts
at Alef Bank and Metrobank

funds to share
acquisition (USO
equivalent -
million)
Maria Gutuleac Alef Bank Veaceslav Lupov 0.4 Figure 8
Alexandr Alef Bank Viorel Melnic 0.9 Figure 10
Maclovici
Alexandr Alef Bank Marina Tauber 0.9 Figure 10
Maclovici
Mester Moisei Alef Bank Olga Bondarciuc 0.6 Figure 11
Eagle Industry Alef Bank Rita Tvic 0.2 Figure 12
ICS Caritas Metrobank Marina Tauber 0.1 Figure 6
Group SRL
TOTAL 3.1
7.1.3 Funds from Shor Group accounts at other Moldovan banks

Kroll has identified USO 2.1 million of funds that originated from Shor Group accounts at other
Moldovan banks and used to acquire shares in UB, summarised in Table 18.

I Kroll Project Tenor Phase II Report - Detailed Report-Acquisition of shares
Table 18 UB Shareholders funded from Shor Group company accC11111ts at other Moldovan banks

funds to share
acquisition (USD
equivalent -
million)
Dufremol Moldindconbank Apostolova Reghina 0,2 Fiqure 6
Dufremol Moldindconbank Nani Abashidze 0.2 Figure 6
Dufremol Moldindconbank Roman Grinco 0.2 Figure 6
Dufremol Moldindconbank Viorel Melnic 0.2 Figure 6
Dufremol Moldindconbank Aurel Marinescu 0,2 Figure 6
Dufremol Moldindconbank Olga Bondarciuc 0.2 Figure 6
Dufremol Moldindconbank Vladimir Novosadiuc 0.3 Figure 6
Dufremol Moldindconbank Rita Tvic 0.2 Figure 6
Dufremol Moldindconbank Petru Lucinschi 0.2 Figure 6
Moldclassica Comertbank Olga Bondarciuc 0.2 Figure 8
International
TOTAL 2.1

I Kro 11 Project Tenor Phase II Report - Detailed Report -Acquisition of shares
7.1.4 Fund flows to fund shareholdings in UB
Figure 6 : Fund flow for share purchase by Reghina, Abashidze, Grinco, Melnic , Marinsecu , Bondarciuc, Novosadiuc, Tvic , Lucinschi. Jet-Tech
Industries, Pace Global Energy Limited . Reynosa Management Limited , Dixon Corporation , Veaceslav, Lerson Limited , Negru , Pleskachevskaya and
Tauber in UB.
~'-:-::u J •.fU~! , . !.; :..1 - .:\ 1.Jl., ll ::,i ••

1v•11..1,._: ._.... ,.c ,.. ,...i: 1'! 1 ;~ ~· 1IJ111'. :
,,,.,.-
: IJ,' : ; ."); \ •' •
·,
':l~•J .' , :•;J .~, !: •.•1: . 1_1.::: :",, .U:
,/
I
.'Hl•.·::.i•.lcO...".
',. ,/
-11 ~;1 , ;,.v ,. ,, ...., :h,)'o.l"'• ' ll l '
:.1~ . ...-1 __.,.. •• •'4! 1. 't :
_ _ _ .>.f,;: r.•~:: _ _ _ _ _ _. -
>,,:·:,,,-.: o)-,! n ~1
,:.--11:1:•.:
,:.~ .·,.
-~,. ·.··
-
. ~~-./ •.:1-.:.~ii·~~ ; l : :• • - - -.; ,1:.. ~ ;;_ .
,u,~,- - - - ~--
'-.
'-.
.:l'!": ; _•.•;J: .'.
·,
u:.L, . ~-ct-t
:0.:,:: •..._::• . 1.\·.;· :, ::. ----'···········- - - - -- •
• ·,, ! :): ~.
, l.:""_·~··
1.=..; .' !~
''\• ' ••
., ,.,- •·· ··· • • -~L :; ••·-.
'·
..... \ .'I.. , ¥
_,,,. , ~! :!;N.. - - - -,:,; .... . ; ,:. - -- u~• •"-!(:;

~,,, ' _ ...-
.·'! •: :.,.~:·.:
1:rJJ.·~·
•.t. i:- .~11 .,.S:1:'14 - - - -
~---- ~
-- ---~ -
=--.
·.r,:..,1': .....
.. -
~ ·,,J,:•,:.-.:·•·· , - - -- -; " " "- n,' -r'o ~~~:1;',:/\)
---
..-->:.\ ·:ot:r: .:.1.-..1:u- ,.~;., ;~-. faro
!l• : : :: : :.'.
i.:,:· ---~
-;,,, ,e, !~ :-..:n ·• •-·
_ :1 1::,.•:•1J .
1_'!..f :;!
: 1·elo :!.i1•.; ;,,-,.,0 •· "- l r c r : , 1' :n:O,·,:: ..:• ,. •
•i• - · . "·"• . .:.!'•--, __.- ;.:.:-.·., 1,,:;_.J -:·~ l•:~" ·-:to!t: ~'r..l
:.i.:-:• 1 . ..;,.•• •1..:..r,
,:,1•a , •. : :,:,; :.,. !l:.'
l.l•. !• ; o:i ......
.--·· 1·., ·l.. 1t ... :
..!:Y: :::: l,· ~ ..... • I ••' '•

. . . ...,:..· ··•··
_
.. /~l.- .._~ ~-
!,. './; ,•.'· • 1.:,7,.::;
:,~ f ,-~• :,-:.:••t<, ...
,:!1-1t.11 , : ----
___ce;:~:.,::;.,.1:.:. :~:: .-e. 1: ,.; 1: ~. :::-.·: : -~·..:: . · 1.J:lJ . • 11
.-·· .-.:..• :: •.•::.:-.1.t:.!: :',!1 J:, :::.•::. ·:.:+,·:·~··
~- .,..,.,-···· ""j""'
/_.,.. ·-~
- : :J.<.: ·u:• i ~i' ·lr, :'l:: !1·t.u111'. tl' c ·
•.....,... · ,_-,. ::.1 ·
:•,, ,•;. 1e.., :,- ,:, .-. ! i:.l •sr " "l...l ''!.t;lc.-.;•~, ,.,,· ! :.:.: :'.l;"'. •: : ;.:.:-:.·,
1\.t 1,n ·, ,,.,, t:1,•.: ,):-.. \'~
/'
~ .;: •.•::
:1:.r, i 1:
.. I
::•:: ::::1 :. I
/
\\~
/
\\
/ .••·•·•:n•-:: ,..,. ,u,
'. l',h'.! '! t; • .
/
I
_.....,; i:~:•:.•. .-~:: ::;•. ::. ,7. ,!'. •. •::.'. .. .
.•~:;: ,; :
.;~) ;),
-~' 1: .~'. ·1: .' .'I', •;:: •.,,.,. ! .\ ~ ;:. · :-::.
1.:•.1 ..~~ 1.:f ,'.:li .,'.\ ::. ::•:: ::~•-·.'~ ::~•-• -•.• : 1.::.:: ,'. '!I 1.:,.J .! . :
,., l.'!-. ).•I :,,
l
j '\.,
,: : :: /.''. :.'
.f, !.J ) U
l
\' nn " d • • Au ,.- !'1.:1 I!>< . £.• ~ • 1.••: : 1.1!u·• :,l: .i.;v ~ ~~ a .,,..•.,.. ·,h:;;'nu l\••• ~..._.: _. 1,.,:,, •., ••,_
t.t.~:,,..t•:n .J.t •t.1 1, ,. - ·• ~ i ' •:.,.'l lr_.,.,.~,~:
.1.n:.,.: :u - ~1- ...1o. : ·.-• i!oi4.: ,:~• l,r J. ; 11J , l <1 .Oi lt.l ~ - \ ! :!
J.tl:c,;..t • U-t.0 11 '
._., ...._,, ... ; 'J Jat .. :

Kroll Project Tenor Phase II Report - Detailed Report - Acquisition of shares
Figure 7 - Fund flow for share purchase by Pace Global Energy Limited , Abashidze , Tvic and Pleskachevskaya in UB
.,,r.,
-.1,· • •, .....:, • ·.• -1,~:1.,,, .
c• r.
... ··• . ·ri
. ~-•; I ,:''.'I!
·""f"': "i'-'( !)
r:.~.-. ,~ ;,.. \v, . .,,-r ' T.~• ! Ir,

, .:.it :.·,
•'.! ' : , , -...
I ·,...
_
/ -·
•:·:'; rtr :.:·-~-,: -; ~ , ....... !~~~t;,~g.
__ _ _ _ _ _ :~ •: : •:';'J ~) . _ _ _ __ '• ..-
/ ' Ut'\W
- ..e:.: 1~:-:
I_,_.,,,,,.
r:;: •'.
:":.•:..•a11S.. , ,, •., 11: . .. .... c , .•
. : i:··",~~:::;,s,c': : ~ ~~~
1L!: •.·,
.c•:,s•,,,"; C ••
__
1
-:~r~.:~r·· -- - - - - -- -\~f/~~~1 _ ____ ~-
-~ .....·"
. . .... . 1- •. -..
r ~~l •.·:
1·
•:~ ,:.;--..:
'·'7"-y~'.- ''' " ,- ~
,: ......
-
_/
•• ~:.~·r. , .• ,. tr
:r• ,·,,::,:·,-
0-. •~, · , .. tJ ,,_
;~ ,, ,J· •:
I
: T· ~: ,: .: :! . 1, 1~ ::: -: i ' . l!': • I .::~,::. ;..
I
0
• .>":•?·-:. - ~~- ;;=~ .• f : • 1H "'· ·• ._.. , - ,,,.l 1«.l
Fj'- : -~ ...,,..:.., .. , •._.,, .•
":~~1:'D'· //
,/
... ,; .•_, .:..1., "" •• r ;;.,,- 7 ··••~..J --'·' ' .
1.c.!1·.· : T • ,,.,'.s{"" ·• '" :r--,..~:11 :1••·,
I I
, ., . •••• •• • :!I.
·"('' ",yw ll.'~ 1; : : ! J .

!.i;:: , ;:-:;
·£0 ~J.1
~•t ·., ..~-u
·.-.~1 "
H·
J,.; , ,., I .
r., ;,., ,· ,~: v

..., .!'":-,,..·•~:-:,,. ., : ..--.:.,·,•.:
1, -_, 7 • • ~--=: .,, .:. -1... -,.
:r-•, .•::,~,,- ,
" 'i lt\;
1 ·~ , r.,,.· •· ,·, x-,.,

, _,..:u ·... ,

t Kroll Project Tenor Phase II Report - Detailed Report -Acquisition of shares
Figure 8 - Fund flow for share purchase by Veaceslav, A bashidze, Novosad iuc, Pleskachevskaya and Reynosa Managem e nt Limite d in U B
r - - - - - - - - - - - - - - - - - - - - - - - - - - - - -- - -H.V8'lDl.: : .t:: -,"_\ J•M- - - - - - - - - - - - - - - - - - -- - - - - - - - - - - - - - - - - - - - - - -- - -- - - - - --~
;- 0-"<X!...~1C!, ! nt:.-·q,._. t,;a:1._•J t:s-i !:>-:.:L

0
:,St(:';l'l l l-::".• :::E!. ~--:~ n,J C"(Jii.:'•; ..~t !J",·n .: m,cs ::ll.~1p .:t 1~1~I wnn~,:-J
;C:.:r)t•,H~.:r-J·.~ 1:um:,.~•-J..; ;:._1e L'-!n ►.) \l'-:·on::..t• •.~•L'....':''• }
'"' I !l•/ 1.'ltJ L!: :J'.::,L1 !•.1
-" ~ "']"~'"
- - HJ,'B,IJfJ l.:'. : ll~(l 10:'.:•-----......., 11,l !'.C.:-t: ( ,:;.~,
{l>'iet u :-J.;) ~ ,rt,;t:,h Protx-:t :c:-, t. :1:.!..:1J Gi-:t-.,1p
Or,:n~~ LLJJ ~IJSO.xtmwt l _ ~ ~ l ~~:i!,,.I.J
(.1~',' j t'..:r·t\lr1i. '
\ . , , ,.,, L
t "rct~~t1~;1 t l ;·
t~~l\!l'I•-~
Pr•JIJ< tr~ ir.xi~ LU'

I
7"=•
1:J:13'.!1.il~ V.iil- 1. JJ.
• l.}'S!.~ •••. / ( :i.!_l.1.\'/
W,' /J.!0~1: LI.SO J. f()(; .;:1s,.·_,{H~ · vs.:, ! .ti!,,(l
~
/ Jf&.t..:C-1 ..'. · U~D :,:::!,()
I t: /S/ _>o 12· V~".) 1.ti ~JJ
s ;:;.;~O! l· tJS.J !! t>

I
•J.1 i:'21.'!!. . i.r_~r_) -1•;
-'l'V-"'"J.," J, /l!.C
//(
,'
- - - _!C:irnf:'2DJ .' - - - - --·n;,:x 1:2. : ir.:.o ti-t.:·-~ - - -~ .-':'!1J20!1 . l.lSV ')L"J ..'..' l'Ji! U !.! : US.D !.~:; :, l Ji'./i.O il . ;)SQ •J.' :
1.1$:)•l.8-; . - -
,:&w.!._,, ;,;~r.:_;
(riry.i tt ...:.1 1!]
r1.::1~:n~1 ;.~:.!
i' 'i w.!:t'-lJ' ~.; \ ,.._ _ _ _ ___ 'JJar:oil: lbO 'JJ ~

it;,:·11.11: · ~~ ( Oft' (IJSt: .l((1;Vn! )
1nv~·(I J?: usu

_/ ~~v1 \..____,_ '.H>~- ---· !T'
:....~ ! ~:11: / <:,cl'.'\': ;t..~L! .!{'.(00:,:,; .\.l.'.i->l i11<• t a:nc(t.Uf.: ,!•.t.• :...1' !)
i•~ B..v:.
!, ur',l'll lt,!O(" (1,.,:~) /!.~·i;, ;
i;..!._t:..\'i
/,' ll/ 2\H ~· l..St~l::f/) l,'llf.!Ot:j SIS[' Elil .:/:.t;.,:;_ ;~ : · USD ') .:I
; :)Jt.S,::?o !~· •JS) ·H}

:1~t r.!(l,."'.t, :-.~•.~ U1 S:.r.11n,:0..'>U"'1 LU> !..~o."ft'.,!>..-:" !..l11 1!..!J ~ .:1..(.·;..,1·:.,
(P· t·n tw,1.1,) l fi'rr.i-i ~ul'l.) (P:t•, .:i~:,·l, ;
3)[7/l(''I
I
,o,sn1"- •JH U,!J 8 <,<) lj/ ~2,l_lJ..!.; L~D i-;-..-~, / /ll'O') !0 USD HM r./f / :.:n.1; u:>:.~~}.! J
1
Id
R,v.'IC>'~ i'-1~i-..:...-o,-.:."'ll'O:•rt ;.!d 'ri~.XCSl.;:-,1 L!!~-..:;,( \>\X!n·,, r,'O\v....,c,:.r.:. r; ~:·11 .:.t..:stll(1.:1.: !,.1\-".! Pr•_°!,l~f.,,_..,~;,..yl'.,:
{U1 i~¥ ►, ) (Lll'lt..l\J~,J (U-nt:\:l:.J.J (i.J n.l\::r: I.~ H.!: ut...::d,}

t Kroll Project Tenor Phase II Report - Detailed Report - Acquisition of shares
Figure 9 - Fund flow for share purchase by Luchinschi. Pace Global Energy Lim ited, Reghina and Negru in US
Sto:-i!d G ro:.;p Mo?qa~-0ft Inter ,ia t tOf'-ir! Meldava Group

tUnib ,:)t'~:) ~ Un•bank ) ~Un iC'1nk )
I
"'"""(0'·"·' "'
JO/ fi/ 2012:
•JSO l. ~
1(,;'$/ .2012:
USD !.903
E !n,H"lqton L td
- -~J/8;2012:~
~ISO 1.2'<'< E! n-hl Un,,)r, LLP
{,\BLV ) ~ _,...-__.-- u,ocv, .
Iuso ;,sss
,...._ _ _ _ _ _ _ _ _ _ 13/8/201 2 : _ _ _ _ _ _ _ _ _ _""'\
1 $/ S.12012:
I
./_____________ ~s~:/:~
zor, 1tt<~ Pro::•ert1es
·uso
25
1 2~ _ _ _ _ _ _ _ _ _ _ _ _
2 84
\ ....
~
Unitrilcle ;,ssoc ,;:,tion ~
""
( .'\.BLV) (l\O LV )
l(,/S.'2012: / 15/8/ 2012: 16/ $ / 2012': t5 i 8 ! 2012:
~
. - -USO 940
us7-
USO 284 - Zon11.ech Pro,:,ert,es
Elm,r,qton L ,m ,ted
USD 9 1 7
~
USO 9 1 1-----------
----------
__, --- I
P.oss:lyc Trc)de LLP !·!ar-.·.:ood Ur. fte-d L U') \"lmf!:far rn /\!lii>nc~ LU' rau !~l~C L L!'
( ABLV} ( N3LV) (ABLV) { /\B L\'~
"''""I I
USO""'
l5/S/20l r
I US D 930 "''""I I
USO ' " "l'''"I
I
U<D",
"
Pet: u Lucnshch • ,"\1,:..::,st_,:')Jtivoe."1 Reqhint: Pa-.:e G!obill Cr.e,gy L td Tudor No?-::ru
{Ur.1bi:1n~:) (Unib2: 11 ~~) ( Un1bani-~ ) (Un 1b-.)n~. )

I Kroll Project Tenor Phase II Report - Detailed Report - Acquisition of shares
Fig ure 10 - Fund flow for share pu rchase by Tauber, Meln ic in UB
- - - - - - H /8/2012: USD u or,-- - - - -

/\1t.:X.:md1 Mddovic..1 Tom ton i rdd~ CtJrt> ( USD account )
(Al,;( i:!ank) {l:..liLV}
I /
'3/S/,O"f'"/ '"'" '"
H /S/ 20 12:
- - - - - - H /8/20 12: USO 90,:r- - - - - - - - - - ~US0 903~ - - - -
l omton l rdOe Coi o (EUR account) I S/S/ 20 12: USD 90 1 Urtttrade t\s.soc1a t.ion La Costa LLP
{f,8LV ) (i\6LV) ( A!;LV)
16/ S/20 ! 2:
I
H /08i 20 12:
USD 90 1 USO 903
l
Pondnia rsll LP \11orei Meln!t
( A6LV) (Unibank)
l ti/8/ 20 12:
IJSD 90 !
Ma,111a ldULv.:r
(Urn llank)

Figure 11 - Fund flow for share purchase by Bonclarc iuc in UB
t1l)ld(h1~!'lt-J ~ ~:,.:· n..::.:. :,i..:,-

( ( 0 ·,- _,::·\t)<) n;, ~
'J1S•: C1: 2
I S~-' SOO
I
500
Mc-., ttr t' o i~,j

(Ncf 3.Y\J..)
13/08/20: 2:
. _!Se : ,3-t~
c::- l
Tt-i···,ttn i ..tll.! c Cor j)
(A8l \ ~
I
10/8/2"2 r(• 2.00, " " ' "' rso '"
:--,
-=- 1
· · 12 ·o··
u;r;;~ ;\ ;s
- 7
c-
E m:ro:on Ltd Un ·J\!6t: .-; _.~_:.,rxi.(l t1c~-
(A!ll.V) (Ml-LV;
, ; 121~0 1~:
.. ; D S~ 3
--1
Ha ·,. : ng Lf'
l}!&/ 20 12 :
L5Cr BG 2
0 U:'! (:,,,;....,,: il"t..l .r.:

·iU'tibun •..~

I Krol I Project Tenor Phase II Report - Detailed Report -Acquisition of shares
Figure 12 - Fund flow for share purchase by Rita T vic in UB
~
;.:.~. r-
. :~
.
Ctha- r rl;ng C<her r a\ng
14/05/201[' USD 365
r,;;
f
- H /8/2012: allll
!..::~ , usO 355
iJr<<i!\' !rrtest LLP EaQ~ !r.dus!!y Urtitrade /1.s.s«icltion La Ccsta LlP
C<her r atn;i (Ar V) (Nef r-.ark) (I\BLV} (/16LV)
I
14/6/2011 USO 323
I
1.:.;/6/2012: USO 36S
10/0o/ZOr USD 50 13/9/2022: IJSO 1S7
- allll'J ~
H/SJ2012 :_ -
USD 355
I
!"fo/20!2: L~ ~ --
:::---.._ ;..;;0s12c1;. ~ D!'ens..\:1 ll.J") ,::-u ... Tomton Tri!de Coi-p
1..:lll'~ P"we,
(MlLY) ----
,,.-------L'SD 5,o-· {P,t•,a;;;,,:~f""'nt) [ABt.V}
Orcf\sf.erll.F (USD a::cc:.m:)

(Prr'iatbank)
I
L
i ~O
1.:,/8j2012:
Trade-n-·.ark~t N~!works UP
(Privarbank)
I
1-i/8,12022::
LT 7S
I,
Rita Tv<
(Uni!xlnll.)

7.28S share acquisition

Before May 2013, BS was principally controlled by three groups, 37 with a large number of minority
shareholders making up the remainder of the ownership. The Scoping Phase report identified that
between 8 and 15 May 2013, a group of nine individuals (with Moldovan, Russian or Ukrainian
nationalities) acquired more than 50% of the bank's capital, in stakes of between 4.12% and 4.98%,
which allowed them to avoid further regulatory scrutiny, as with the UB share purchases. In addition,
five Moldovan corporates acquired stakes in the bank of between 3.11 % and 4.96% on 20 May
2013. A further two Moldovan entities acquired stakes of 4% and 4.75% on 1 November 2013.
Kroll has traced a total of USO 17.7 million that was used to purchase the shares in BS in the
names of these new shareholders, and has identified that, similar to the UB share acquisition, the
funds originated at least in part from Shor Group accounts at UB and BS and from Shor Group
linked companies at Russian banks. Further funding for the share purchases was traced to an
account at Trasta Kommercbanka, a Latvian bank that was not part of the Core Laundering
Mechanism detailed in Section 8. Funds from accounts at the Three Moldovan Banks
Kroll has traced USO 11.6 million which appeared to fund the acquisition of shares back to accounts
of Shor Group Companies at the Three Moldovan Banks. As is demonstrated in Table 19 and the
subsequent detailed fund flows, the purchase of shares for multiple shareholders was in a number
of cases funded from the same source, which further demonstrates the coordination of the process.
Further details of the fund flows are provided in the figures referenced in the table.
37
These three groups (according to data provided by NBM and detailed in the Scoping Phase report) are detailed as
follows: members of the Crivceanschi family and their related corporate entities held a combined stake of 43.45% ,
Vladimir Suetnov and connected family members held a further combined stake of 6.35% and Vladimir Jardan and his
related corporate entities held a combined stake of 5.28% . According to Bloomberg, an individual by the name of Ivan
Crivceanschi is the president of BEM .

Table 19: Table of BS Shareholders f unded from Shor Group companies at BS and UB
Source of funds Bank Shareholder funded Amount Figure

linked to
share
acquisition
(USD
equivalent
- million)
Moldclassica International UB Veaceslav Jardan (Ancor 1.1 Figure 13
Sri Lux)
Dufremol SRL 38 BS Veaceslav Jardan (Ancor 0.6 Figure 13
Lux)
Dufremol SRL UB Samit Plus Sri - Natalia 1.1 Figure 14
Gojina
, Saagton Sri UB Diafan Sri - 1.9 Figure 15
Arina Corsicova
_ Saagton Sri UB Rominserv Sri - Veronica 0.2 Figure 15
GorQos
Kotvinvest Sri UB Rominserv Sri - Veronica 1.0 Figure 15
GorQos
-~ Kotvinvest Sri UB Trivetpro - Elena Marinova 0.4 Figure 15
Alvaro Grup Sri UB Trivetpro - Elena Marinova 1.3 Figure 15
Alvaro Grup Sri UB Tonimar Sri - Cazac Alla 0.9 Figure 15
Voximar Com Sri UB Tonimar Sri -Cazac Alla 1.0 Figure 15
Voximar Com Sri UB Velcris-Plus Sri - Anton 1.2 Figure 15
Hariton
lnfoton-Com Sri UB Ivan Kostianko 0.9 Figure 16
TOTAL 11.6
7 .2.1 Funds from accounts at Russian banks

Kroll has traced USD 0.9 million used to fund BS shareholder Sergey Merl<ulov and USO 0.2 million
that was used to fund BS shareholder Sergii Andriichuk to the account of Liramex-Com SRL at
Metrobank.
Table 20 : Table of BS shareholders funded from accounts held at Russian banks
Source of funds Bank Shareholder Amount linked to Figure

funded share acquisition
(USD equivalent -
million)
Liramex-Com SRL Metrobank Sergii Andriichuk 0.2 Figure 17
Liramex-Com SRL Metrobank Sergey Merkulov 0.9 Figure 17
TOTAL 1.1
38
Dufremol SC SRL according to the BS bank statements

7.2.2 Funds from account at Trasta Komercbanka

Kroll has traced amounts paid to the UB accounts of six BS shareholders (totalling USD 5 million)
through a series of transfers through accounts at ABLV and Latvijas Pasta Banka, to a transfer from
an account at Latvijas Pasta Banka in the name of Caldon Holdings Limited, a company with a
registered address as 69 Brunswick Street, Edinburgh, Scotland , which is the same registered
address of a number of the companies that held Core Laundering Accounts. As detailed in Figure
17, the funds that could be traced back to Caldon Holdings Limited were transferred through a
series of companies that were part of the Core Laundering Mechanism that demonstrates that these
shareholders were also part of a coordinated share purchase, disguised by nominees, to gain
control of BS.
Table 21 : Table of BS shareho lders fundud from accounts at Trasta Kornercbank a
Source of funds Bank Shareholder Amount linked to Figure

funded share acquisition
(USD equivalent
million) 39
Caldon Holdings Trasta Tetiana Boiko 0.9 Figure 17
Limited Komercbanka
Caldon Holdings Trasta Olga Nikitaeva 0.9 Figure 17
Limited Komercbanka
Caldon Holdings Trasta Alexandr Zavarzin 0.9 Figure 17
Limited Komercbanka
Caldon Holdings Trasta Oleh Stepanets 0.9 Figure 17
Limited Komercbanka
Caldon Holdings Trasta Sergii Andriichuk 0.7 Figure 17
Limited Komercbanka
Caldon Holdings Trasta Svetlana Petrenko 0.9 Figure 17
Limited Komercbanka
TOTAL 5
39
Amounts are rounded to the nearest million. Total funded by Caldon Holdings Limited is USO 5,027,400.

Figure 13 - Fund flow for share purchase by Jardan in BS
t-10IucI: ss1cr: !nt::rn.3tIr...~ al ~r D _frer.ttD! ~RL

.,_ ~r,~; \.B::1'v.a $D el:! ,3}
I
::.;: !lfltl :3 v a;t) ~.77D ! 9/ '.!{~0Ul
I l};;!) l.] jlJ
1
0 M S'0'1 1® LLP HE 1lav ~ 1Ut10"\$ lL•·
!J~,Dl.1.') U\Dl 1s1;1
n,ur,o "tI~'",.no ,w _.,,,., "" '·"'

1
Branch Ma~~£:tlnQ llruiitcd
(i\!ll\'_) ·•
I
;!~,.' l l}llHJ
1£1) b!>!> fro:n Han".3•/ So _t,or,; LP
IJSD 1, 1 lO rrom D:, ls.on 1(/.) LU'
l
H~a1Ilte1u i::i) l.11 u m:tw
,:Aol4,')
I
2<:{ l l / :l0t3 : Lf~l) : ,7:, 7
I
c,; r.1ra1~ UmlteJJ
(Prlva~r~)
I
::;.,,r11 r20:3 IBL> : .C>l}b
1
AllC'IH Ll!IC ~ L ·
':e::u:.e:;_=-1, .:,:3rd~:.i
(B~)

Figure 14- Fund flow fo r sha re purchase by Goj i na in B S
Dufiemol SC Sri
(UB)
I
ll/H/2013 USD 1,420
(Ar
Hanla1' Soluti::rns LLP
12/ 11/2013 USD 1,'20
1
Branch Marketino Limiied
(,'\BLV) '"
I
12/11/2013
USD 407 frcrn ou,er funding
US[) 1,045 from Han!ay Sc-lutic,ns LLP
1
Indygc- Group
(ABLV)
I
12/il/2013 USD 1,'52
1
Samit Plus Sri - Natalia Gojina
(BS}

Figure 15 -- Fund flow for share purchase by Cors icova , Gorgos, Marinova, Alla and Hariton in BS
5.1~-: ::::, ! ·: t>:~,,.. ..,._ •. . 11.',·mc: .:.r.ip Srt ·,•c.).i,ar (c,-n !,rl
H1s,,o:3j'~'''·"''
~ ~ ,:,
I
,·!.:~l
,.,,;o,)urI se,.1 i-'

(l,~}
.:.:: ~f2:; J!:

Iu~o .2.1.:= r
04.'~'2" : 3:! LCL> 2.;,)S
l
:.,-.;v::: : !'rc;ea !.::r,i:~!! ::.:.~ o:J.:h .!-~ ::"1!-S l! .I' !:<t l."n<; n!U:-,!tt-=:J' t--:~~IC.cS =l~~ i; Llr.•~!C
{/.!1!.Vf (.', ~:.~•-,' (f•~·-•:,
I
l-li~.r.::.u: ?: •.:S~11. ·•? 1
I
z..:.:,i'.?ll13 : l tSlJ2.?f!..=.
I
.!7/~•'!!l: 3: i.:$L':l ,Hffl 111,,.~ ,,\,,.,,.,,
. -· l
--=-~~
/ //' . / '''""°(;:'it;)-=":-~:--.=~ -~---==-:-:::::~
-. .--...., ..__l ----- - - - -- --- -
! ---- ·-
I
LS C> l.Sl'!
-''.'S,•.::C:.3
e>o·.r "'l<:tt.r.,,:e, 1.F
..;!.} u.~
;.::,.;-/~?l':
5'~':"C'~;h ! ~c:.r.ries !.!.! 1
i..~ D ~.:.: , £~.01.~C IT,: je~ !.i:Tn:e;
ia--~/.!!)~3:
:11:!flie::i: Unl!dU' l.15!."ll .n .:.
~,!Jn:)'Jt~ h JnC:.:Wl!!S" W..I' • UW ? l '.j
1-fl'!r.o:e!
:\.~T,r..-it
l E!t!iliO:J :
1r~;:a Lrn:td · U5!l 994
t.'nl;',:,.: U ' · !.SU tf~
,r.,,c,, I"'' "< rne:
•,y .. ,,,y ;,.
!..!~1. ::!l
!
j !
l'n:':'l ~C ,".!:lll':tf' S f ,_ .-,~·~J., C::,:n!TI!:~: ~ ~ • Olirs.v In:::.,~ !.!;r~1 .?:: ~:..:-.,,:.-,,:: '! r;i,: ttu:"n:t t~ w-~m~~ lr.tt• C'ef;
{AS!.'i) (' 2"'' ) [t.f:W } {R !..V} {0-!:!.'w)
..
i
1
! i I
~·,IS·.'..: , ..,,..l ,..:..io .., ,.··n>
.. ~ J; Oi3\'-''!.J..: : . .:so .W !:"!.'!V! ! : ?.&.::~ .~ ,
l
'
.?3.'~/::;;>1'.:: _U5!J; !,e-;.1
'"'"""("'.,.,
1 l
!>Jfon !-:I ~ 'l:"•~ (.::.,'!-!~~ l:.D1Tir ! ~-· Sri · Vc -::n-2 (;~9e! l t';\·~ t !:I • : ,er~ M?.rtn.)'rl i Cl'l r.il:r 5rt • ::.a.."!': ;.t,,> Vcl:r!! l'M ~1 ...."l';On h;: ri'!:e'I
(~ \
(:51 l:'·5) (l!S) <~I

Fi gure 16: Fund flow for share purchase Kostianko
Jnlof.m t Cum SK,

u.,:!;n ,m .:uu 1l 14 217S'.;Gl}) ll3
Lo:1n rc"i il !J 51.'13
(MDL 12 mill kJn)
( Unib,mk)
0~05/00>r SD
I 9~
l nfoi.m t ( ,Jm SRL

( Un iburik)
I
Cl2i05i20 13: IJSD 98t;
l
To mlun Trmlc Corp
(ABLV)
I
0 2/05/201r t_.SD .S73
~ :vrnur,~ AG
. I .
(Pilc,1.,J 6'Jnl<.;i )
{12/ 05/ 2013 : L SD .S73
1
Ivuri KO"'.:ii.im1lw
(Pu:; l,:i Surtkil )
I
2/ 5/201 3: USD li73
1
iVilrl KlY~fainko
(Unibu nk)

Figure 17 - Fund flow fo r share purchase by Nik ita eva , Zavarzin , Stepanets, Kostianko , Merkulov, Andrii c huk, Petranko and Bo i ko in BS
:;,~,. "r·~ .,. ,

•~~J-; ur. ~ $•-V,~ 1.Jf•,r.:::
""'"'''f ""',o,;'
I I _, ,. ':.'.i,~:~·
~.~
=
_ . -rr.:•'::!:'J·J!J ; ·J~C,t;f.> !- --~~:T-~;::'C•!:! : Uirt ~6! -- r - ~.'!-,';ti!::S · I\~ !
'-\::,::~·, :1r:J!l11· ~!..! !'.-tltl-:'1' :-'~ ~-U:c', ~;..-~- ~~ ;:~h"'
: ?t~! ~ U,1an•~~ \ ::'H~ e ¼" -'0:ll/ HJr, ~.1;'11,:)
er
, , , , .r:;>/
.".$:; r ai~ ; (Tl.'.-; ~:r~r.~-= , ./
(11.!-tVi ,,·
, , ~T""
~-:C--\15:~'l:l:3: L•~-~ ~::l
,:.,.,.,.,,,l ,,, .._, /
-
',' .t-:cr,•n;!'(l;r,_.!::::,µ
;r,b l;I Sdt"l<.l,'
rfn·h"r;! v1 ' :.Jn·ct'i!l
'T' 14.-=\ II .::ci1•.r..,, ·-

- " IT~'<':l
- - - -,
__ J{~~~?~i·- -t-- - - - - - .l
lJ;,
.- ·,1cc•,·, ,·s
I
02/c!~:'::'•: D
. ,. , , T""'' ''""'"UCO""
AS ~~•) , ,$.PJ'''• " ~~:im
'"' """'"' . ,f""

l.'!:-0 :?OD r,~n· r-~.·t!Oll T(-C- l U'
~
,,,,a,;,•,:1,,,,,,,.,
l
n>'O, " ' " " "
- - - - - -Y.1;·~":"~·J\J;U'.iD:!,l?l- _
T.,;:-~11! !!-: Uu
iru:.: f',i ".•1
l~'tl~:•
Cl~•~,J Tfi;;>;,
(l'i ,:,i
~nc:e~-
lfl v:
:1r..i. Lnr.:--: U P
,.r,
r ,mJ hY.:n':'-°:l! t.i)'.,,'ill~ : U P
z ::~li~acn T1u :►.:-1t1:!;! ~:~

,.T:
t,·0 1:, 1;11: LU' llrt i ,~1-CQll !.Jt..
('·l~:100<1",:,
,. ,. ,1;, l,,, ..,. ,,,?.,,, e,-, , 77

,.-.5"'."J
I
""'"'T".,,
t•~.'0~;?.013. <J'_j = t> ?=i
~,,,,,,,j"·'""" ,;;-/::•Sl;t•!3:lf:i0a 7:l
!
fl':l~!et'c!H:-
·:-•u~ N 'l. t il:!",il
:Pi!!.:i, £H11t! j
-
·,'IC.'i!!!. •-~ ~!~Llri:'i::I
:r~~!.t, r nl::)
- 1
!:":~1'!vp,i!t \.'-ttr::.1,0,; L,r l:..,.J
F 'it::.? ~ .,.a J
- I
it W ,-i{; ,:U::,C:0,).1
,·:-:,;tl;E'.~!kiH
,'.='-if: n: .'-'.~ N:t1·"1~ Uni:,:.:j
i ~ !-::lea·,•.:t1
I
(;Jur.-H•'- )
1
,.,,,oc,,I,,"' ..,
''""'"!"',"'
.,, ....1U . 70 I
0,/Cl.'CCl "'""'' .;,..- ~,eel ,.'° m
(\~~ ~.: ..uta

:'.Jf~":-l J.-i
."JH<ll'.:!r;:3•,=:1 ~
:P.b13 r <!n-.J)
1
t:l i'," '.j:-.t,,Jr.-=:::,
i•t~ IE.!-r...~;
~t ~
- (-fl;;'1 0:/11.-.
rrar2 i i'>1u:,
~·.1'.Wl.!"~J,;-: -NJ
( ; L! ::! ( i!>f.. Ji
,,,,..,,e,,v,;oe,v ~·''"""1"'·"'"'
''''"'"]"'" '"' "''''"I'-'''"'
~:..r.:. Nt:."i:..: lrj • S••tC,t,i,f"!-:r'!O I O

,·,1-::,. ;,,·t_, ;:~•.'!.!;'. ~ Gf'!'" ~-:-:-uar:-!::.~ ll'' ilw ,1.;
-'. U11i:.!- t1'I.! (l'.-itu r.t-.; 1l"'. litnl. /

7.3BEM fund flows

As set out in the Scoping Phase report, BEM was also subjected to a share restructure in 2013 .
Between December 2012 and June 2013, seven new shareholders were registered . On 2 August
2013 BEM underwent a closed supplementary share issue which was taken up wholly by an existing
shareholder, ICS Sisteme lnformationale Integrate SRL ("Sisteme lnformationale Integrate". Other
shareholders that acquired minority stakes in BEM during 2012 and 2013 included Carmondean
Development Ltd; Tintel Project Ltd; 000 Garant-Grupp; Wall Trend Limited; SRL Calteco Prim ;
SRO Vladox Group and CA Klassika Asigurari.
The minority shareholders, as part of the terms of the supplementary share issue, in which Sisteme
lnformationale Integrate increased its stake from 9.78% to 33.73% of the shares, were required to
issue a subordinated loan to BEM for USO 50 million. This was partly funded by an account in the
name of Constant LLC at Gazprombank.
The funds used to make the subordinated loan to BEM through the minority shareholder accounts
originated from accounts in the name of 000 SKIF and 000 Transtur at Gazprombank. More
detail on the fund flows for these transactions is included in Section 11.
7.3.1 Funds from Russian accounts used to fund shareholders

As detailed above, the shareholding of Sisteme lnformationale Integrate in BEM increased from
9.78% on 31 August 2013 to 33.73% on 30 September 2013. Kroll's analysis has identified an
amount of USO 4.5 million transferred into the BEM account of Sisteme lnformationale Integrate
from a Gazprombank account in the name of Constant LLC on 20 August 2013 . This amount was
converted to MDL and transferred to a BEM account (#223420049880001) with the description "for
purchase of shares". 40
7.3.2 Roseau Cession agreement

In addition to the change in shareholding, a cession agreement was agreed with a UK registered
LLP called Roseau Alliance LLP ("Roseau"). Under this agreement, Roseau acquired approximately
USO 80 million in non-performing loans from BEM , which allowed BEM to exchange these non-
performing assets for cash, increasing its liquidity.
Tracing of the funds used to fund the cession of the loans to Roseau has identified that USO 21 .1
million of funds originated from accounts at the Three Moldovan banks, mainly from a number of
Shor Group company accounts. In addition, a further USO 58.5 million originated from a number of
40
This is the translated and summarised transaction description .

Kroll Project Tenor Phase II Repo1t - Detailed Report -Acquisition of shares
accounts held at Alef Bank, Russia, in the names of individuals linked to the Shor Group. These
accounts also provided funding for the share acquisition at UB and BS . As detailed in Section 11 ,
it appears that the transfers that originated from the Russian banks were later repaid through the
issuing of loans by the Three Moldovan Banks , and therefore were integral to the fraud . The funds
were transferred through a series of bank accounts atABLV bank in Latvia, before being transferred
to an account in the name of BEM at the Bank of New York Melon (USA), Raiffeisen Bank (Austria) ,
or through Roseau's account at UB to BEM.

Table 22 : Table of fund flows from the Three Moldovan Banks that were used for the Roseau
t ransactio n
Source of funds Bank Shareholder funded Amount Figure

linked to
cession
agreement
Sisteme lnformationale BEM Banca de Economii (Bank of 2.1 Figure 18
lnteqrate SRL NY Mellon)
Davema Com BS Banca de Economii 4.6 Figure 18
(Raiffeisen Bank
International)
Alreda Pro BS Banca de Economii 2.6 Figure 18
(Raiffeisen Bank
International)
Vascoprovod SRL BS Banca de Economii 0.5 Figure 18
(Raiffeisen Bank
International)
Agercom Grup SRL UB Banca de Economii 1.3 Figure 18
(Raiffeisen Bank
International)
Grand lmmobiliaire SRL UB Roseau Alliance 0.9
Fiqure 19
Storad Group SRL UB Roseau Alliance 2.7
Fiqure 19
lnfoton-Com SRL UB Roseau Alliance 0.3
Fiqure 19
Dufremol SRL BS Roseau Alliance 1.2
Figure 19
Agenti De Stiri Novosti UB Roseau Alliance 0.9
Moldova SRL
Figure 19
Moda Prestij UB Roseau Alliance 0.9
Figure 19
\ ~/ Toast de Lux SRL UB Roseau Alliance 0.4
I,
Figure 19
Metal Trade Group ICS UB Roseau Alliance 0.9
Fiqure 19
ICS Clasica UB Roseau Alliance 0.9
Fiqure 19
Daliano SRL UB Roseau Alliance 0.9
Fiqure 19
TOTAL 21.1

Ta ble 23 : Table of f und flow s from Alef Bank whi<.:h we re used for the Roseau tran saction
Source of funds Account funded Amount Figure

linked to
cession
agreement
Olga Nosaci Banca de Economii (Bank of NY 4.7 Figure 18
Mellon)
Nino Ciubinasvili Banca de Economii (Raiffeisen 5.1 Figure 18
Bank International)
Aliona Steflea Banca de Economii (Raiffeisen 6.7 Figure 18
Bank International)
Eugeniu Rusu Banca de Economii (Raiffeisen 5.1 Figure 18
Bank International)
lrinia Ciascevavia Banca de Economii (Raiffeisen 5.2 Figure 18
Bank International)
Svetlana Silicova Banca de Economii (Raiffeisen 5.1 Figure 18
Bank International)
Anatolie Severin Banca de Economii (Raiffeisen 3.4 Figure 18
Bank International)
lurie Fotescu Banca de Economii (Raiffeisen 2.7 Figure 18
Bank International)
Vladimir Pahiliuk Banca de Economii (Raiffeisen 5.6 Figure 18
Bank International)
Elena Smolei Banca de Economii (Raiffeisen 5.1 Figure 18
Bank International)
Haceatur Ambarean Banca de Economii (Raiffeisen 2.4 Figure 18
Bank International)
Marina Tauber Banca de Economii (Raiffeisen 2.1 Figure 18
Bank International)
Kristina Halter Banca de Economii (Raiffeisen 5.3 Figure 18
Bank International)
TOTAL 58.5

l Kroll Project Tenor Phase II Report - Detailed Report - Acqu isition of shares
Figure 18 - Fund flows use d to fu n d Roseau transaction - illustration 1 (all value s i n m illions)
I
............
...._., ,
.~--· '.,•· · .
-~··,~-·~ ·[·· . . .I
. ... 1.. .
:"J.• >1 1! .-. .

.: ~-: .
f-' \!
·,.1.,_•,,·., . :•.• 1·-_,... .. ,. ~ :• ~
:--- . ·-. ,·,-.,.--- -
;. _
~ "'
_, , : .. r · ,
'C
•··.;·::;:-'.·:·,
··· ·· •: ···'\.,_
, ~....
. :• r · ,-~ -,
~--.··_._.... ! .... ,.~ ',
~
,,/ / ' •"· · •.- .
-
·.,•- •.,....,
· i ·..- !. ~'
,/
>
", ;?<___ ..............................
---·-=:::·--: ;;; /:: ':~~.:: ,~.- ~ :· ~--=:i
..... :.:
,f... _ _ ;::-J
" ' ' ,. .,. ,:."/ ,..... :.::.;-:.·--·-.· .-,.-
~-- ·:, :• -----::::'.;:.;•-.:-•.-- ~~\// ,.~·_;,;; :::,'. ...,
/___,,..,,.---~
''.':1/;·;,7·:::\\ .. •, •,
,/ \ / -~,
_._,,.,_ :• , : ."•: :,,, _•.,J !,:.-•, - _: : ....... -.,- · • l1 • ~
-~-,.
r , ,.~, .-_ .,, • , <- '
-•::.·. -·~--·. '
l / -,':>
···r· //'" ."-
...... _._. . ..•.,

,
.• ;. - .! , : -
:. - - , :- - • ❖ '
...... ,·..-~ .-.--:•,:_
···-···•···
. i,·, ,,i
.., • . !.• • ·
"
1, •••• • • ,

Figure 19 - Fund flows used to fund Roseau transaction - illustration 2 (all values in thousands)
b;
D\.' n~)n lim t l!t!
w
su.-r.:-d G·1>.i:i ~t
~
Gra1xJ f,n::,ot_•l.! :t St: :.
( h •,!o ► .o,,..,cl" " '·' l ~ w..-:..:i..: n-.: t U"llJ.:n,.} :.~-.... :
_____,z~
, k/~~-----
, ~! nl.O--• •( ,::ir., $Rl.
!\.hl' ~~.ir. ~.i
• l rl!i'Jc C.:r:-
\ /;tY. '/';.
2~0 120 : >·
L'S'~ J SlfI / u,t, ,:r,/
l.~)'~ '!.~' J/ "!.G!3: 2~.:./'J/ J1)IJ ·
,c,,,,.,.,,.•
f
1•:.:J, 20 11 : use: ~ -. ·:oo
r··,-,- :
1R'J.'l 0!.? . Ll!'.D !,. ~'t'.Q
_ ll! f j-f)<:, . . ;:--:J

Lt$02 CJC;
(j:t J.11-Q':On l,Jn !c(.! Ar ::1 :c.:t· (M i) '.. )
I
~ (J:.,,~,1'.:
{;..SlV ) (U,.,.!.:..: •;;. )
I 1
~
\;f'\?!,!<Jt.: ~ :'ot'. ctlcrl t.!11
!>lx.'I)
.!5!JtZD:} :
USO~
1:>/ J.f1(lt 3. !..-" xi l,'500
26/J i:?Ol ) : ;J:-{\ :!.7L')
!
l.!'. /J/.?0 ! 1: USD :)l.)'J I
J5-i 3,' JOJJ· US{, ~;J(.'Q
1S: J l20 l:S: U5.0 ~. ...-c:J
Ii,.~ - - - - -•••·" • .. :_
,,.,., ,._o,·1 ~•• ______ ,•.-,,,.... , ,~v11,'' :· _ _ _ _ _ _~
______ -
, -, ____ ' " JJ>' 1 ...·.•~
. ut. .,.,..,., - . v, I- - • - - - - --• ~•'•
' ( fl• "lfl t ) ,ttr- r ~ - - - - - ~
.u.w,,'~ · .J
O'SD :, :.i.lJ IJSD : .J•J ) _.-1 ~8/J!Z0 l 3. ~i .100 ~ :!S/Jf:!◊D '.JSD ~- .100 la
,,.,
/1/ \\~
L'i\1::e-1..-:. SRL ::..,/.(J PU.Jof.:,)U A' ' :m,. ,: LP RO"-C.!U ,.:. f i..:r•~•~ L='
~ ""''·'-"' ~""""''""' "''
r, !.i'
~
(f.S } (:O!.XV,; ~ ~.'," {U "\-~-.'T\.' i
/ (Al\L'.')
: s ,J6, JJ
•~SQ1
~I
/ ~
~ - - - - -2s , 3;: IJ:J _,-~ "8/Jlit•l ' , S/J f;,J!, ! llJJUO U ,Si.e !OL<· 21'/JIZOIJ
( ~!•:·1•,j
c-sc, 900 n!:... , L'' .,,,,,,,u,o,w / L&> . .:x, ..,,.., 9<.Y.' uso 900\ us1.1 "'-~
,:t.13\.'/ ) / "'
1
r":' 1~ 1-~ lt llf,X)C.: u, ::"tv\. l( V l ?: o;,t~ c:. L!d P.:n ,1:-:;l'.Jl'ti Y.J~ L,.ncn: UP .;R r ~,.-.: F-orc,~ !..!J.J 0 .•.•,~1 1~, l t.P
i.~L\' ) :,:.,,SLV) (A!il\':: (.;Dl V) (;.!JL\.'J
'28.!.31.?0:]: ,.,s,t,oo
;:SJl,!JU lJ:
i
'! ~✓J/20?3· 2'8/ J/W: 3:
t
l S/ J./.!lH:;:
t,r;--t) '}C(.: V-;O ~'ll~J !JSO 'Jl10 USO 900
I I I I
r-~OfJ.J Pn..-:-tiJ To,..~ de l:J t $P.L Mt..'t.!l 1r" Je Gi ouo !CS u·o;; a~, D..:l~n o SRL
{l.':"11'~ -,,;..,) (LJniD.!_n q {Vn-lt.\m\.} 'rl i;.;t>..:..,i,J {U!MO..:n l.)

I Kroll Project Tenor Phase II Report - Detailed Report - The Core Laundering Mechanism
8. The Core Laundering Mechanism

As set out in Section 6.1 of the Summary Report, a total of USO 2,617 .9 million (or 89%) of the
loan proceeds issued to Shor Group Companies by the Three Moldovan Banks during the Review
Period was transferred to a group of accounts at ABLV and Privatbank in Latvia ("the Core
Laundering Accounts"). This Section provides additional detail around the Core Laundering
Accounts, and the assumptions used to determine that these accounts were linked and controlled
in a coordinated manner. Kroll's analysis identified a number of common characteristics that led to
a group of companies that exhibited many of these characteristics in ABLV and Privatbank being
classified as part of the Core Laundering Mechanism. This list of companies is included in Section
8.2.
Kroll has identified that between January 2012 and April 2014, accounts at ABLV bank were used
to launder the funds from fraudulent loans issued by the Three Moldovan Banks. From May 2014
to the end of November 2014, the main Core Laundering Mechanism switched to accounts at
Privatbank in Latvia. As one of the core objectives of the investigation is to develop an
understanding of the final destination of funds, Kroll approached the Core Laundering Accounts as
one linked entity, as demonstrated in Figure 7 of the Summary Report.
In addition to the Core Laundering Mechanism, which appears to have been established solely for
the purpose of laundering the fraudulent loan funds , Kroll has also identified additional peripheral
laundering mechanisms in Moldova, Estonia, other Latvian banks , Russia and China. These
mechanisms are detailed in Sections 10 and 11.
8.1 Common characteristics of transactions

Kroll identified accounts used in the Core Laundering Mechanism : from January 2012 to April 2014
funds were primarily held at ABLV, and following that funds were laundered through Privatbank
accounts.
The movement of funds into and through accounts at these banks exhibit the key characteristics of
money laundering as follows :
• Placement stage - This was the movement of cash from its source into the Core
Laundering Mechanism. In this instance the placement involved the transfer of loan funds
from Moldovan companies to accounts held at ABLV / Privatbank.
• Layering stage - the purpose of this stage in the laundering was to disguise and blur the
flows of funds from the source. In this instance, this was achieved at ABLV and Privatbank
by subjecting the funds to multiple layering between accounts, mixing and splitting of funds,

Kroll Project Tenor Phase II Report - Detailed Report - The Core Laundering Mechanism
rapid transfers of funds between multiple accounts and apparently arbitrary foreign
exchange conversions. This had the result of obscuring the onward destination and
severing the link with the original source of the funds (a fraudulent loan).
• Integ ration stage - the integration stage gathered the funds from the layering stage , and
transferred them back to give the impression that they have been obtained through
legitimate business activity. In this case , it was represented by both the repaying of earlier
loans at the Three Moldovan Banks (and other Moldovan banks) , to give the impression
that the loans were valid and functioning, as well as the dissipation of funds to other
jurisdictions to purchase goods, services and assets.
Common characteristics of transactions leading to the classification of a group of company

accounts being included as Core Laundering Accounts:
• Multiple internal transfers to linked accounts - The funds received from the Three Moldovan
Banks were transferred , usually on the same day, to multiple accounts held at Privatbank /
ABLV, with no apparent business rationale . The descriptions of the transactions in the
statements were lacking in detail and were altered during a transaction flow. For example ,
on 13 November 2014 , the proceeds of a loan of EUR 2.5 million to Apropo-COM SRL were
transferred to Fidan Properties LP at Privatbank in Latvia with the description "Prepayment
for Accessories". The funds were then transferred from the Fidan Properties LP account at
Privatbank to an account in the name of Dastinger LP (also at Privatbank) for
"nEPEPACnPEAEnEHl/1E CPEACTB" (Reallocation) . The funds were then transferred to
the Shor Group company account Ai r Classica SRL at Unibank, with the description
"Payment for Computers". All of these transactions occurred on the same day and were
identical in value. This demonstrates that the various transaction descriptions had no link
to the stated business purpose and that the original loan issue by BEM to Apropo-COM
SRL was misrepresented as to its purpose;
• Splitting of funds between multiple accounts , then later merging together with sums from
other loans;
• Multiple foreign exchange transactions - the funds were often transferred into different
currencies without any obvious rationale ;
• The use of an overdraft facility (in Privatbank only) - Kroll noted frequent instances whereby
one shell company with a Latvian account was granted an overdraft from Privatbank for an
amount that was simultaneously repaid by another shell company account with the
description "repayment of overdraft". There was no indication prior to this that the company
repaying the overdraft either had any agreement for this or had incurred any previous liability.

I Krol I Project Tenor Phase II Report - Detailed Report - The Core Laundering Mechanism
8.2 Accounts classified as Core Laundering Accounts

The 54 accounts at ABLV in the below table were classified as Core Laundering Accounts
according to the criteria detailed in Section 8.1.
Ta ble 24: ABLV Co re L auncierinH Acco u nts
AR Plane Force Limited Grouford Industries LP Pondmarsh LLP

Armadale Business Services Hamiltero Color Limited Primoteks Import LP
LLP
Atlanta Traders Ltd Hanlay Solutions LLP Regional Group Ltd
Belmont United LP Harrogate Consulting LP Roldon Capital Corp
Bluefontein LP Harwood United LLP Romanford Solutions LP
Branch Marketing Ltd Ilona Sor Roseau Alliance LLP
Carmondean Development Ltd lndygo Group Ltd Rosslyn Trade LP
Dallington International Ion Cojocaru Salvador Trade LP
Limited
Daniell Invest Ltd IT Log Alliance LLP Sunburough Industries LP
Division Top LLP Klassika International Limited TB Team Management LLP
Eden Alliance LP La Costa Trade LLP Torprom Universal LP
Ekovold Project Limited Maltby Solutions LP Treport Trade Corp
Elma Union LLP Novland Ltd Trimms Green Limited
Elmington Limited Octagon Enterprises Ltd Unitrade Association Ltd
Eurosell Assets Ltd Olympia United Ltd Vegwork lmpex LP
Fairmac LLP Panaroom Management LLP Visseti (Pty) Ltd
Fenbrow Trading Inc Pioneer Assets Ltd Wang and Lee LP
Frances Trading LP Plus Operations Ltd Wester Alliance LLP
In addition to the ABLV accounts listed above, Kroll identified a number of ancillary accounts at
ABLV that transacted frequently with Core Laundering Accounts. Th is list of ancillary accounts
includes :
• Tomton Trade Corp;

• Zonitech Properties Limited;
• Longford Partners Ltd ;
• Parselot Ltd ; and,
• Romford Group Limited .

The 27 companies in the below tables were classified as Core Laundering Accounts at Privatbank,
Latvia, according to the criteria detailed in Section 8.1.
Table 25 : Ta ble of Privatbank Core Laun dering Accounts
Ardooks LLP Formisold LLP Royalport Ltd

Bannyster LLP Genyral Trade LP Spectra Ventures LLP
Conversum Logistics LP Globus Corporation LP Tennant Shipping LP
Danley lmpex LP Hansa Investment LP Transmark Export LP
Dastinger LLP Hostas Level LLP United Technologies LP
Delta Management LP lnvestos Buenos LP Vercell Solutions LLP
Europe Consulting LP Kalten House LP Welentas LP
Expovision Logistics LP Nord LP Westland Alliance LP
Fidan Properties LLP Overseas Commerce LP Zenit Management LP
8.3 Shor Group links to Core Laundering Accounts
In addition to the links between Mr Shor and the Moldovan companies detailed in Section 3, Kroll
obtained bank account opening records for a sample of the companies with accounts at Privatbank
that received the proceeds of the loans issued to the Three Moldovan Banks , and identified that
they also had links with Mr Shor and his associates. Limited account opening documentation has
been obtained for the ABLV accounts, so it was not possible to conclude on the full extent of the
Shor Group's involvement in the establishment and running of those accounts.
As detailed in Table 25 , Kroll identified 27 compan ies with accounts at Privatbank, Latvia, whose
accounts appear to have been opened for the sole purpose of receiving the loans issued to the
Moldovan Shor Group companies; to disguise the source of funds; to remit funds back to repay
loans for other Moldovan companies; and to channel funds to other destinations (the "Privatbank
Core Laundering Accounts").
Kroll has reviewed Privatbank account opening records for 24 of the 27 of the Privatbank Core
Laundering Accounts . Of these, 23 directly mention Mr Shor in records kept by the bank, in a
document detailing links between the Shor related companies. The remaining company which was
reviewed , Fidan Properties LLP, appears to be linked as it has the same disclosed beneficiary,
Sergey Avilov, as three other companies for which there are records in the account opening
documentation that specifically reference Mr Shor: Ardooks LLP ; Bannyster LLP; and Dastinger
LLP.

I Kroll · Project Tenor Phase II Report - Detailed Report - The Core Laundering Mechanism
Many of the bank accounts held by UK LLPs at Privatbank were also found to be associated with
the Shor Group. Account opening records held by Privatbank state that Mr. Shor introduced the
ultimate beneficiaries of these companies as his "business partners" to the Corporate Clients
department of the bank. Mr. Shor was identified in account opening records as the beneficiary of
one of the companies that received funds from the Three Moldovan Banks, Wester Alliance LLP.41
Kroll has reviewed a note of a meeting between Mr. Shor and Privatbank's senior management, on
30 September 2014. 42 A copy of this letter was contained in the account opening records for many
of the companies which were used to launder the proceeds of fraudulent loans through Privatbank,
confirming that Mr. Shor was linked to the fund flows through the Privatbank accounts.
The note records that Mr. Shor described projects in which his "partners" intended to make large
trading and intermediary transactions in the following areas:
• Purchase of various products, such as clothes, footwear and accessories, in Europe and
China, with a view to reselling them via retail chains in Moldova and Russia;
• Purchase of electronic products made by international manufacturers with a view to reselling

them in Moldova and neighboring countries as well as using them to equip a data center in
Kirgizia;
• Purchase of construction materials in Europe and China to be used in various construction

projects in Moldova, Russia and Ukraine. "
According to this note, Mr. Shor's partners required accounts at Privatbanl< for currency and
clearing operations. The note states that Mr. Shor "recommended some of his business partners
for business cooperation ." Mr. Shor also mentioned that "financing from Moldovan banks, e.g.
Banca de Economii SA, will be raised for the purposes of the afore-mentioned business projects.
[However], due to the unstable political and economic situation in Moldova during the pre-election
period, the partners' refinancing in other Moldovan banks cannot be ruled out for the purposes of
minimizing the risks." According to the meeting note, Mr. Shor confi rmed that a number of UK
companies that already had accounts with Privatbank were his business partners. These included
lnvestos Buenos LP, Dastinger LLP, Genyral Trade LP, and Spectra Ventures LLP. Additional
business partners were then recommended and specified by Mr. Shor.
Account opening documents for the Privatbank accounts also included "Information Memos".
Examples of these can be found in Exhibit 8.3. Such memos for companies Genyral Trade LP,
Bannyster LLP, Hostas Level LLP, Fidan Properties LLP, Ardool<s LLP, and Dastinger LLP were
41
See Exhibit 8.1 - PB account opening
42
See Exhibit 8.2 for a copy of this meeting note

dated 4 April 2014, which indicates that these companies opened accounts at Privatbank before
they were formally disclosed by Mr. Shor as his business partners. However, the record of the
meeting with Mr. Shor from September were subsequently included in the client files for each of
these companies, with the exception of Fidan Properties LLP.
A number of the account opening documents for the Privatbank Core Laundering Accounts also
included an additional memo that references Mr. Shor. 43 The memo, dated 12 December 2014 (i.e.
after the closure of the Three Moldovan Banks), recorded that following a meeting with Mr. Shor,
the bank obtained documents that established the identity of Mr. Shor's business partners and lists
the relevant companies and their owners. This memo also notes that meetings with the
representatives of these UK-based companies were held in Kiev and Moscow between 11 October
and 8 December 2014.
Although the companies that were transiting funds through the Latvian accounts were registered in
the UK, their commercial addresses were all stated in the account opening documentation as being
at various locations in Moscow, Russia. Further, almost all the beneficial owners and
representatives of the companies are Russian citizens. A small number of the companies have
Ukrainian nationals listed as beneficial owners .
43
See Exhibit 8.3 - Example of Information memo referencing Mr. Shor
Privifeged and Confidential 83

Ta ble 26 : Deta ils of corporate information for Core Laundering Accounts at Privatbank
IJt Name Jurisdic Mention of ID.# Reg. Date Legal Address Commercial Address Beneficiary Sharehold Shareholder/ Jurisdictio
tion Shor in (From account (Nationality er /Partner Partner 2 n of
account opening 1 (Jurisdiction) partners
ooenina documentation)
1 Ardooks LLP UK Yes OC391150 14/02/2014 Suite 4048, 10 Great Moscow, UI. Sergey Delait Tucpain Belize
Russell Street, Krasnoproletarskaya Avilov Secretaries Limited
London, England, 16, Str. 2, 2nd Floor, (Russian) Limited
WC1B 3BQ Office 208, Russia
12 Bannyster UK Yes OC391154 14/02/2014 Suite 4049 , 10 Great Moscow, UI. Sergey Delait Tucpain Belize
LLP Russell Street, Krasnoproletarskaya Avilov Secretaries Limited
3 Conversum UK Yes SL017956 K)9/09/2014 45 Rosehaugh Road, 127051, Moscow, Nikolay lntercorpor Financium Belize
Logistics Inverness, Inverness- Tsvetnoy Bulvar 25, lvashov ate Group Limited
L.P . Shire, IV3 SSW, Str. 1, Office 36, (Russian) Ltd
Scotland, UK Russia
~ Danley UK ale docs not SL18639 k:3/11/2014 Summit House, 4-5 ale docs not reviewed Elena Voxpoint Goldstein AG Dominica
lmpex L.P . reviewed Mitchell Street, Alekseeva Inc
Edinburgh (nationality
not clear\ 44
15 Dastinger UK Yes OC391153 14/02/2014 Suite 4069, 10 Great Moscow, UI. Sergey Delait Tucpain Belize
LLP Russell Street, Krasnoproletarskaya Avilov Secretaries Limited
6 Delta UK Yes SL017963 K}9/09/2014 45 Rosehaugh Road, 11726, Moscow, Aleksey I ntercorpor Financium Belize
Management Inverness, Inverness- Nauchnyy Proezd Zolotarev ate Group Limited
L.P . Shire, IV3 SSW, 14A, Office 31, Russia (Russian) Ltd
Scotland, UK
17 Europe UK Yes SL017962 b9to9I2014 45 Rosehaugh Road, 129110, Moscow, UI. Anastasi ya lntercorpor Financium Belize
Consulting Inverness, Inverness- Shchepkina 51/4, Glinkina ate Group Limited
L.P . Shire, IV3 SSW, Karp . 2, Office 24 , (Russian) Ltd
Scotland, UK Russia
8 Expovision UK Yes SL 18533 128/10/2014 12 South Bridge, Suite Volkhonka Street, Sergey Project Laverton Not stated
Logistics 1, Edinburgh, House 5/6, Flat 706, Grechikhin Services Consulting Ltd on co house
L.P . Scotland, EH 1 1DD Moscow 119019 (Russian) Group Ltd (Bountakidis)
(P.
Georqiou)
44
Name was noted in documentation provided by Latvian Bank 2 relating to transaction monitoring

# Name Jurisdic Mention of ID.# Reg. Date Legal Address Commercial Address Beneficiary Sharehold Shareholder/ Jurisdictio
openinq documentation)
~ Fidan UK No, but OC388727 24/10/2014 Suite 7026 , 43 Bedford Moscow, UI. Sergey Gateno Viala Trade Belize
Properties companies Street, London, WC2E Krasnoproletarskaya Avilov Ventures Limited
LLP with same 9HA 16, Str. 2, 2nd Floor, (Russian) Inc.
beneficiary Office 208, Russia
do contain
Shor link
10 Formisold UK Yes OC391156 14/2/2014 Suite 4066 , 10 Great Vavilova Street 69 , Aleksandr Delait Tucpain Belize
LLP Russell Street, Office 1034, Moscow Cherpakov Secretaries Limited
London, England, (Ukrainian) Limited
WC1B 3BQ
11 Genyral UK Yes SL015745 13/02/2014 Suite 1435, 111 West Moscow, Vavilova 69, Aleksandr Delait Tucpain Belize
Trade LP George Street, Office 1034, Russia Cherpakov Secretaries Limited
Glasgow, G2 1QX, UK (Ukrainian) Limited
12 Globus UK Yes SL017964 09/09/2014 45 Rosehaugh Road , 127051 , Moscow, Nikolay lntercorpor Financium Belize
Corporation Inverness, Inverness- Tsvetnoy Bulvar 25 , lvashov ate Group Limited
L.P . Shire, IV3 8SW, Str. 1, Office 36, (Russian) Ltd
Scotland, UK Russia
13 Hansa UK Yes SL 17965 09/09/2014 45 Rosehaugh Road , Prospekt Michurinsky, Dimitrij lntercorpor Financium Belize
Investment Inverness, Inverness- Passage 34- 142, Alatov ate Group Limited
L.P . Shire, IV3 8SW, Moscow Ltd
Scotland , UK
14 Hostas Level UK Yes OC391011 10/02/2014 Suite 7096, 43 Bedford Moscow, UI. Anna Delait Tucpain Belize
LLP Street, London , Novoalekseevskaya lvanova Secretaries Limited
England, WC2E 9HA 19, k.2, Office 5 (Russian) Limited
15 lnvestos UK Yes SL 1574845 13/02/2014 Suite 1438, 111 West Mironovskaya Street, Anna Delait Tucpain Belize
Buenos LP George Street, 18-35 Moscow lvanova Secretaries Limited
Glasgow G2 1QX, UK (Russian) Limited
16 Kalten UK Yes SL15747 13/02/2014 Suite 1437, 111 West Moscow, UI. Anna Delait Tucpain Belize
House L.P . George Street, Novoalekseevskaya lvanova Secretaries Limited
Glasgow, G2 1QX, UK 19, k.2, Office 5 (Russian) Limited
17 Nord L.P. UK ale docs not SL 18201 03/10/2014 45 Rosehaugh Road , ACCOUNT OPENING Corporate Capital Seychelles
reviewed Inverness, Inverness- DOCUMENTATION NOT REVIEWED Manageme Consortium Ltd
Shire, IV3 SSW, nt Ltd
Scotland , UK (S .G. Cox)
45
This company was not found on UK Companies House - this number was found in the account opening documentation

I Krol l Project Tenor Phase II Report - Detailed Report - The Core Laundering Mechanism
# Name Jurisdic Mention of ID.# ~eg. Date Legal Address Commercial Address Beneficiary Share hold Shareholder/ Jurisdictio
opening documentation)
18 Overseas UK Yes SL017959 09/09/2014 45 Rosehaugh Road, 129110, Moscow, UI. Anastasiya lntercorpor Financium Belize
Commerce Inverness, Inverness- Shchepkina 51 /4, Glinkina ate Group Limited
L.P . Shire, IV3 8SW, Korp. 2, Office 24 , (Russian) Ltd
Scotland, UK Russia
19 Royalport UK Yes SL 18201 03/10/2014 Office 1010, Miarmar Osenniy Bulevard 23 , Zafar Corporate Capital Seychelles
Limited Tower, 132 Nathan Office 401, Moscoa Dzhumaev Manageme Consortium Ltd
Road, Kowloon, Hong (Russian) nt Ltd (S .G. Cox)
Kong n(S.G.
Cox)
20 Spectra UK Yes NC001181 28/05/2014 21 Botanic Avenue, 11726, Moscow, Anna Laverton Project Marshall
Ventures Suite 15, Belfast, Nauchnyy Proezd 19, Bakhaeva Consulting Services Islands
LLP Northern Ireland, UK, Office 41, Russia (Russian) Ltd Group Ltd
BT? 1JJ
21 Tennant UK a/c docs not SL 17645 18/08/2014 12 South Bridge , Suite ACCOUNT OPENING Headway Loyalty Not stated
Shipping reviewed 1, Edinburgh, DOCUMENTATION NOT REVIEWED Invest Ltd Services on
L.P . Scotland , EH1 1 DD (Sandra (Jannette St companies
Caesar) Luce) house
?2 Transmark UK Yes SL017960 09/09/2014 45 Rosehaugh Road , 11726, Moscow, Aleksey lntercorpor Financium Belize
Export L.P. Inverness, Inverness- Nauchnyy Proezd Zolotarev ate Group Limited
Shire, IV3 8SW, 14A, Office 31, Russia (Russian) Ltd
Scotland, UK
23 United UK Yes SL17961 09/09/2014 45 Rosehaugh Road , Pervomajskaja Street Sergej lntercorpor Financium Belize
Technologie Inverness, Inverness- 5, Flat 59, Poselok Komatkov ate Group Limited
s L.P. Shire, IV3 8SW, Druzhba, Ramensky (Russian) Ltd
Scotland, UK District, Moscow
Region
24 Vercell UK Yes NC001183 28/05/2014 21 Botanic Avenue, Mayka Lunna Street 3, Terane Neptune Alliance Marshall
Solutions Suite 15, Belfast, 35, Balashikha (name Babaeva Overseas Management Islands
LLP Northern Ireland, UK, of town) (Russian) Ltd Team Ltd
BT? 1JJ
25 Welentas LP UK Yes SL215911 13/02/2014 Suite 1436, 111 West Marshal Savitskogo Elina Delait Tucpain Belize
', George Street, G2 Street 18, 2, Flat Andrusenko Secretaries Limited
1QX, UK 106, Moscow (Ukrainian) Limited

'# Name Jurisdic Mention of ID.# IReg. Date Legal Address Commercial Address Beneficiary Sharehold Shareholder/ Jurisdictio
opening documentation)
26 Westland UK Yes SL 17958 09/09/2014 45 Rosehaugh Road , Moskovskoe Shosse Denis Ganin lntercorpor Financium Belize
Alliance L.P. Inverness, Inverness- 55 , Flat 208 , (Russian) ate Group Limited
Shire, IV3 SSW, Dolgoprudnij (name of Ltd
Scotland, UK town), Moscow Region
~7 Zenit UK Yes SL018229 03/10/2014 45 Rosehaugh Road , 109316, Moscow, Evgeniy Corporate Capital Seychelles
Management Inverness, Inverness- Volgogradskiy Du nets Manageme Consortium Ltd
L.P . Shire, IV3 8SW, Prospekt 43, korp. 3, (Russian) nt Ltd
Scotland , UK pomesh. 257

I KrolI Project Tenor Phase II Report - Detailed Report - The Core Laundering Mechanism
8.4 Credits received into the Core Laundering Accounts

Total Credits received on the Core Laundering Accounts are shown in Table 27:
Tabie 27 : Total credits to Core Launde r ing Ac.counts
Source of credit ABLV (USO Privatbank - Total - (USO Note-

millions) (USD millions) millions) Section
reference
Credits from new loans 447.5 2,134.8 2,582.3 8.4.1

issued
Credits from Shor group 88.6 8.9 97.5 8.4.2

companies that could not
be directly linked to loans
Less amounts on - (101.0) (101.0) 8.4 .3

Moldovan statements that
did not appear on the
Latvian Bank 2 accounts
TOTAL CREDITS to 536.1 2,042.7 2,578.8

ABLV / Privatbank from
BEM / UB / BS from
Shor companies
Alef Bank (Russia) 108.2 - 108.2 8.4.4
11
Metrobank (Russia) 84.8 5.4 90.2 8.4.4
11
Other credits 174.9 126.5 301.4 8.4.4
TOTAL OTHER CREDITS 367.9 131.9 499.8

(not from BEM / BS /
UB)
Less credits traced out (89.5) (81.9) (171.4) 8.4.4
TOTAL CREDITS TO 814.5 2,092.7 2,907.2

TRACE OUT OF THE
CORE LAUNDERING
MECHANISM

8.4.1 Credits received into Core Laundering Accounts from new loans issued
As shown in Section 6.1 and Table 8 of the Summary Report, Kroll traced a total of USD 2,617.9
million that were transferred direct from Shor Group accounts at the Three Moldovan Banks that
received loans , to accounts at ABLV and Privatbank. Of this, USD 2,582.2 million (99%) was
transferred to accounts held by the group of companies classified as the Core Laundering Accounts,
as detailed in Table 27.
The amounts transferred to other accounts at ABLV and Privatbank are detailed further in Section
5, which summarises the first destination of the loan funds issued to Shor Group companies.
8.4.2 Credits received from the Three Moldovan Banks not arising directly
from loans
As noted in Section 6.2 of the Summary Report, a proportion of the funds that was transferred from
Shor Group companies to accounts held at Privatbank / ABLV could not be directly linked to new
loans issued.
As the analysis in Table 28 below demonstrates, the source of these funds is predominantly from
Russian accounts and accounts in the name of entities linked to the Shor Group. As the majority of
these came through the Three Moldovan Banks into the Latvian accounts and were mixed with
funds that could be directly traced to the fraud these values were treated as being linked to the
fraud .
Details of this is provided in the table below:
Table 28 : Credits received into the Core Laundering Accounts from the Three Moldovan Banks which
was not traced to loans
Bank Funds from Shor Group Analysis

be linked directly to loans
(USD millions)
BEM 53.5 The amount comes from an account in the name of
Sisteme lnformationale Integrate, which was linked to the
acquisition of shares of BEM in 2013, and the
subordinated loans granted by the shareholders. The
funds originate predominantly from a company called
"REGIONALNAYA FINANSOVAYA COMPANIYA" in
Yaraslav Region, Uglich City, Russia. (Total USD 50
million) . A further USD 3.5 million originates from a

Bank Funds from Shor Group Analysis

be linked directly to loans
(USD millions)
company called Constant 000 from a Russian account.
No further information is currently available about the
rationale of this financing or source of these funds .
BS 3.6 This amount comes from two Shor Group companies,
Dufremol and lnfoton-com . The origins of the proceeds is
not currently clear but has been treated as linked to the
fraud.
UB 31 .9 This comes from Shor Group companies including
Roseau (USO 6.3 million) , Dufremol (USO 4.1 million),
Moldclassica International (5.5 million) , Airklassika (USO
7.6 million), Avantage SRL (USO 1.5 million) and Moda
Prestij (USO 2.2 million)
46
TOTAL 88.6
Amounts transferred to Privatbank Core Laundering Accounts from the Three Moldovan Banks that
could not be tied to loans amounted to USO 8.9 million (or approximately 0.4% of the total received
from accounts at the Three Moldovan Banks by Privatbank Core Laundering Accounts). The amount
comprised of 11 transfers , mainly from non Shor Group accounts at BEM and UB.
8.4.3 Discrepancies between Moldovan and Latvian statements

Three transfers totalling USO 101. 0 million were shown as being transferred to Privatbank accounts
from Moldovan bank accounts but did not appear on the Privatbank statements. As all of these
transactions occurred at the end of November 2014, it appears that these amounts may have been
falsified on Moldovan statements in order to disguise the transfer of the funds to another destination.
Two transfers of USO 50 million each made to Spectra Ventures LLP and Nord LP were connected
with the funds transfers to Gazprombank. As detailed further in Section 11, these transactions
appear to have been in the internal records of BEM made to balance BEM's Nostro account with
Gazprombank. The destination of the USO 1 million transfer made from Apropro-com SRL was not
clear.
These amounts are summarised below:
46
Difference is due to rounding

• 24 November 2014 - USO 50 .0 million from a loan issued to Caritas Group SRL (BEM) was
shown on the current account statements as being transferred to a Core Laundering
Account in the name of Spectra Ventures LLP with an account at Privatbank Latvia . This
did not appear on the statements of Spectra Ventures LLP.
• 24 November 2014 - USO 50.0 million was shown on the statements of Provolirom SRL's
account at BEM as being transferred to Core Laundering Account Nord LP at Privatbank,
Latvia. This transaction did not appear on the statements of Nord LP that were reviewed by
Kroll.
• 18 November 2014 - USO 1 million from Apropro-com SRL (UB) to Core Laundering
Account Fidan Properties LLP.
8.4.4 Russian account analysis

Kroll identified USO 198.4 million that entered the Core Laundering Mechanism from accounts at
two Russian banks, Alef Bank (USO 108.2 million) and Metrobank (USO 90 .2 million). The funds
that were transferred from these Russian banks were used partly for the acquisition of UB and BS
and the settling of a cession agreement related to the change in shareholding structure of BEM
(see Section 7). Analysis of the amounts and the source of the funds indicates that the funds appear
to be a series of loans that were repaid at a later date, as detailed in Section 11.
8.5 Treatment of other credits received into the Core

Laundering Mechanism
As noted above, the Core Laundering Accounts were classified as such as Kroll's analysis indicates
that their primary purpose was to disguise and launder the funds that originated from loans at the
Three Moldovan Banks. In addition to the funds that were received into the Core Laundering
Mechanism from the Three Moldovan Banks, there were some receipts on the accounts from other
sources, from bank accounts outside of Latvia, including from Russia, Estonia and Cyprus, and
from other company accounts held at Privatbank and ABLV that have not been classified as Core
Laundering Accounts. Kroll analysed these amounts with the view to excluding them from the
analysis where possible in order to focus on funds that could be directly traced from fraudulent
loans. These were individually traced and if the final destination of the funds was clear, both the
receipt and the outflow were excluded. The diagram below summarises this treatment of other
credits:

Fi gure 20 : D iagram of treatm ent of oth er p r oceeds into t he Core L a un dering M ec ha nis m
Funds from Moldovan loans =

Other credits (mixed with loan proceeds)
Other credits that can

ID lii\ll!ANK
be traced out of the
Core Laundering
--i Core Laundering

~BANCA
:II: DEHOIIONII
I Accounts
!
Other credits

In a number of cases, funds that were received on the accounts were mixed with funds that
originated from Moldovan Banks, and transferred through the same laundering mechanism,
inseparable from funds obtained from loans issued by the Three Moldovan Banks. For these items,
the funds were not excluded as they could not be differentiated from loan funds. Furthermore,
many of the receipts derived from companies that were part of the Shor Group, or were linked to
Shor Group companies , which indicates that they were part of the same highly coordinated fraud.
Therefore, the mixed funds have been treated in this analysis as funds relevant to the fraud .
The assumptions used in treating these sums as mixed funds , are detailed in Section 9. The
amounts of other sums received and traced and excluded are detailed below:
Table 29 : Sources of other credits received into the Core Laundering Accounts
Source of funds ABLV- (USD Privatbank - (USD Total - (USD

millions) millions) millions)
Alef Bank (Russia) 108.2 - 108.2
Metrobank (Russia) 84.8 5.4 90.2
Moldova Other 81.3 71.4 152.7
Latvia other47 62.1 38 .0 100.1
Other credits 31.5 17.1 48.6
TOTAL OTHER CREDITS (not 367.9 131.9 499.8

from BEM / BS / UB)
TOTAL OTHER CREDITS 174.9 126.5 301.4

(excluding amounts received
from Russian banks)
Less sums traced out and (75.9) (81.9) (157.8)

excluded (not mixed) -
(excluding amounts received
from Russia)
Other sums mixed 99 44.6 143.6
47
Includes amounts paid from non- Core Laundering Accounts at ABLY/ Privatbank
Private and Confidential 93

8.5.1 Summary of other credits received into the Core Laundering Mechanism
8 .5.1.1 Analysis of funds received into the Core Laundering Mechanism from
other Moldovan banks
The majority of other funds that came into the Core Laundering Mechanism from other Moldovan
banks originated predominantly from Moldindconbank and Victoriabank. This indicates that
accounts at these two banks were significantly used in the fraud, particularly in the earlier periods.
Loans issued to companies with accounts at these banks were also paid off with funds originating
from the Three Moldovan Banks, which indicates that the actual dissipation of these funds may
have been earlier than 2012. For further examples see Section 6.1.2 in the Summary Report, and
Section 5. The funds received from other Moldovan Banks are detailed in the table below:
Table 30 Funds from accounts at other Moldovan banks i nto the Core Laundering Mechan ism
Bank ABLV Privatbank Details

(USD (USD
millions) millions)
Moldindconbank 51.7 - USO 49.5 million originates from Shor Group companies
-Agercom (2.5), Alreda Pro (3.6), Alvaro Grup (3.9),
Dufremol (7.0) , Ghermivali (9.8), Moldclassica (4.2),
Molint Group (8.4) and Splot - Bl (10.2). The remainder
originates from a company called Valemont Properties
Ltd, which has been linked to a previous large scale
Russian money laundering case.48
Victoriabank 28.7 71.4 For both ABLV and Privatbank, the majority of these
funds arise from Shor Group companies. Shor Group
Victoriabank accounts have been used as deposit
accounts as part of the Moldovan element of the
laundering mechan ism.
Comertbank 0.8 - The entirety of these amounts originate from Ghermivali,
a Shor Group company.
TOTAL 81.3 71.4
Kroll has not to date been able to assess the involvement and possible complicity of these banks ,
but for the purposes of developing a clear asset recovery strategy, the amounts from other
Moldovan banks which can be linked to other aspects of the fraud were treated as fraudulent funds .
48
https://www. reporting project .net/therussianlaund romat/russian-laundromat. php

8.5.1.2 Analysis of other funds received from Latvia
USO 100.1 million of other funds came from Latvian accounts outside of the Core Laundering
Accounts. These accounts included accounts at ABLV and Privatbank, as well as accounts at other
Latvian banks.
The other funds that originated from accounts held at ABLV / Privatbank, which were not included
in the Core Laundering Accounts as they did not meet all of the criteria in Section 8.1 amounted to
USO 75.6 million. As these accounts transacted frequently with the Core Laundering Accounts that
were laundering the loan funds, it is likely that a proportion of the funds originated from the loan
funds themselves.
8.5.2 Other funds traced out
All of the other funds received into the Core Laundering Mechanism, with the exception of the
Russian funds, 49 was analysed in detail and was excluded from further tracing analysis where
possible.50 In total Kroll excluded USO 157.8 million of the USO 301.4 million of receipts that could
not be linked directly to loan funds from the Three Moldovan Banks.
8.5.3 Other funds mixed

Other sums that could not be excluded from the Core Laundering Mechanism were mixed with fraud
funds and treated as such. As detailed above, the mixed funds amounts to approximately 5% of
total receipts into the Core Laundering Mechanism. In addition, as detailed above in Sections 8.5.1,
a large proportion of this sum (although not traced directly from proceeds of loan funds) is
connected to the fraud at the Three Moldovan Banks. The combined mixed funds were traced in
order to identify the ultimate end destination of all of the funds that were at least in part derived
from fraudulent loans from the Three Moldovan Banks.
•• Amounts received from Russian accounts are detailed in Section 11 .

5
°For detailed methodology for the exclusion of Other Receipts see Section 8.5.

Kroll Project Tenor Phase II Report - Detailed Report - Detailed methodology for tracing funds
9. Detailed methodology for tracing funds

9.1 Overview
This Section provides detail of the methodology applied by Kroll to identify the end destination of
the proceeds of fraudulent funds from the Three Moldovan Banks. The methodology was devised
in order to allow for a consistent and transparent approach for tracing and to facilitate the formation
and initiation of a priority asset recovery strategy.
Analysis of the transfers of loan proceeds to the Core Laundering Mechanisms and beyond has
shown that the funds were frequently blended with funds which were not directly linked to the fraud.
To the extent possible, these amounts were excluded from further analysis. However, in cases
when transfers not originating from funds originating from the fraud were blended with those linked
to the fraud, the whole amount of onward transfer was treated as tainted by fraud funds as it was
not possible to separate between fraud and other funds not directly linked to the fraud.
9.2 Other funds paid into Core Laundering Accounts

As highlighted in Section 6.1 of the Summary Report, and detailed further in Section 5.3 , the
analysis of the initial dissipation of loans from the Three Moldovan Banks identified that the majority
of the loan funds were transferred to a group of connected accounts at ABLV and Privatbank (the
"Core Laundering Accounts"). The mechanism of the laundering process through these Core
Laundering Accounts , and the list of accounts included in the analysis are detailed further in Section
8.
However, analysis also identified USO 301.4 million (approximately 12 % of the total funds received
into the Core Laundering Accounts) was received into Core Laundering Accounts from sources that
could not directly be linked to the fraud at the Three Moldovan Banks ("Other Receipts"). This
Section details the treatment which Kroll applied in the case of these Other Receipts .
Kroll analysed these amounts from other sources with the view to excluding them from the analysis,
where possible, in order to focus the attention on funds originating from fraudulent loans. These
were individually traced and if the final destination of the funds was clear, both the transfers in and
out were excluded from further analysis.
9.2.1 Exact match trace
In certain instances, the Other Receipts that were received into the Core Laundering Accounts were
transferred directly out of the Core Laundering Accounts . An example of this is given below.

I Kroll Project Tenor Phase II Report - Detailed Report - Detailed methodology for tracing funds
Figure 21: Example of match and exclusion of other receipts
Gebr Heinemann SE Co KG
{Comerzbank AG)
Non Coie Laundering account
I
17/01{201~
USD OJ million
Primoteks Import LP
(ABLV)
Core Laundlng account
20iOli2•Jl4
usri OJ
miliion
20/01/201-1 _ _ _ _.._ £ ~ - - - - - - 20/01/20 14 - - - - - - - -

USDO.Smillion C- USDO.Bmiluon
Brand, Marl,etina Ltd Frances Trading LP Metalforum LP
(ABLV) • {ABLV) (Prive thank)
Core Laundering account Core: Laundering account Non Core Laundering account
In this example, USO 0.8 million received into the Core Laundering Mechanism from Gebr
Heinemann SE Co KG (Comerzbank AG) was transferred through a series of Core Laundering
Accounts at ABLV, before it was transferred out of the Core Laundering Mechanism to Metalforum
LP at Privatbank (Metalforum LP was not included in the list of Core Laundering Accounts detailed
in Section 8). This amount was excluded from further analysis.
9.2.2 Blended funds

In cases when the funds which were not linked to the fraud could not be directly traced out and
were blended with those funds which could be traced to the fraud, the entire amount of the onward
movement of funds was traced on, as it was not possible to differentiate which funds were from the
fraud and which were not. An example of receipts from another source being blended with funds
from the Three Moldovan Banks is shown below.

F igure 22 : Ex.imple of Ottier Rer.eipts entering I.he Core Laundering MP.c hanism
0,.:., ·,
X 11.~:'I Lw:1:-_-c
! 11~l.l N:,111,.:1du111-..!;
sc, , Cc,,c
1
:!.,': J,''-'l!: J
t.!SJ.! n)lll.:,;•
'""'-iCJt'l
i u~:.111 U:.i\'C'~.::1~ •
tAl!LV;
/._,,...-• 'h~\'-'[1~,:;rll LJ I
'"" '""'7' .,,"''"'"' l '.Jl!:/;_'fjJJ _.,.. ,.,,..,,._.,,...,.. t,:,.11(: Li,l_~.,;..;:,i•r,i .C., .~~lf.
~T•l.!:i111il~.J6
:~.'l: :l/it::J I UN0~ /H 1! 11..
~--~" -'~"~'-"'_·'·-~-·----,,,....,-----~~~~~!
l\L1r101tru 01 l u~~I
.........------
;......-..~ U:~·...:11M.:.:k.ct11:J i.!..:l ....... ___ •
Jti:: J:1:0~1_.,..-.,,. ~ : <\Jl1.: u.,,):l;~ f<UJt.Jll: ·······-. .•••.•______ __ .,
_...~--:,;::,lW-✓-:~.,/
USIHJ.21111l::11;../ / - / '"' ··1:,l:'1:i.!J~J
USO
.,,/"' 1:-iso Q.LI 1r"•J~1w·
/
I I • ' ·
', 2 .S ,··,.,.,,,.·····-•••••••• .
,/_,-·~/:~mi_..,-, Il 1 ~' " " ' '

use Co. 1
< ,_.-/"
: ,,.,, .•..-· i..lS!.1 C•.! nn'lk)u I 1111::run
Ll'.'1•·1'.Xll'-11:ll.,;: U'
'.U/!J/lOI) ··, , ;.CU,.\' J
_.
f.:1,1:~C)o 1f.to:111,1L!' u:;o >t:.1 111f :J' 1 "-, (t,:11,;L_.u;rJ~Ul'iA!,.'. \J.J"r\
r.e.u.v >
L'.:ll•.!l.'..1.JIILl':lf,Y ,t~C.,•.Jlf.
I I
:::1 : 1/.ll:JJ " "
w,Q"'"'' l rc~.u:l 11.JC.:CnjJ

;,Ul,V
H:.11: C:'.IJ!.: l..J-.J1 1:k:•r~
\'l;;.:~olflC!..C".:t.!'
:1..:,1..\')
U.~ Ci...J.J'IUClll~,., ,:_u,,1• \I.
In this example an amount of USO 2 million from Denison Limited at Trasta Komercbanl<a was
transferred to Torprom Universal LP, an ABLV Core Laundering Account. The funds were blended
with funds from Vegwork lmpex LP in the account of Branch Marketing Ltd before they were
transferred onwards in a number of transactions to three other Core Laundering Accounts at ABLV,
and one non-Core Laundering Account, also at ABLV. The blended Other Receipts and loan funds
were dissipated over a number of transactions which were then traced on a 'first in , first out' ("FIFO")
basis.
9.3 Tracing of funds paid out of Core Laundering

Accounts - further traces
Funds originating from the fraud, combined with Other Receipts which was inseparable from these
funds were laundered through the Core Laundering Accounts, before being transferred to bank
accounts in a number of different jurisdictions, as detailed below. A large proportion of these funds
were transferred to other accounts in Latvia, Estonia and Moldova, and were subjected to additional
laundering mechanisms to further blur the destination of funds (see Section 10). Through analysis
of documents obtained with the assistance regulatory bodies in Moldova, Estonia and Latvia, Kroll

has to the maximum extent possible traced these funds onwards to accounts in jurisdictions outside
of these three countries. As the fraud funds were laundered through these accounts, they were in
a number of cases mixed at each stage with other funds which were not directly linked to the fraud
(see example in Section 9.4.1 below). In order to prioritise the large transfers, fund flows onwards
out of the Core Laundering Accounts which were less than USD 200,000 or equivalent were
excluded from onward tracing. This allowed for tracing onwards of approximately 90% of the funds
out of the Core Laundering Accounts.
9.4 First in, first out ("FIFO")

As detailed above, transfers from Core Laundering Accounts that were linked to fraud funds were
frequently blended with other funds. As shown in Figure 22, it was frequently not possible to
separate the fraud funds from these other funds . Kroll has applied the FIFO principle to further
traces, which works on the assumption that the first amounts paid in to a bank account are the first
amounts paid out. This means that amounts paid out are made firstly from the earliest funds
received and then from subsequent payments into the bank account.
Application of the FIFO principle determines that in the absence of an exact match being found
(see assumptions around exact matches in Section 9.4.2.1 below) , the account balance
immediately prior to the inflow of funds must be taken into account. Debits immediately after the
credit were used to deplete the balance already in the account. After the pre-credit account balance
was depleted , debits were attributed to the first cred it coming into the account and were traced on
accordingly. The example in Figure 23 below illustrates this principle, through the onward trace for
a payment from Nord LP to Margolux Construction SA of USO 1,667 ,047.44 on 18 November 2014 .
Extract of the bank statement of Margolux Construction SA, with calculated running balance:

Figure 23 : M arked up hank statement (Maryolux Constructio11 SA) demonstratin g appl icat ion of FIFO
p r i n c i pl e
Datums 01rijum11 Doc i,o KorespondCj ohls k ont s Descrip1.lon Debets Kr edits Balance
numun;
Fr: m :.;:..:.: :: !r!:l? ? ?~C1 C:ltlCCi 1,','(E.51::~FE!.D I 1r.!:';~O !.l.i=

.:.CLL E. 111 33:,a
1?11 .CZ: 1.! 1~11 111 ~1..: Jt.v;~:;r;-r::1~1:::::c:: 1n:i 2_.'D FFCE 11 .!? 3ED i'O?.J Si?.!E.i ?/'3 3,1.0ll~OH::' 0;1.!E.!lX ~ ?21.":1: .7!
!IX
~r rO il. 3l!~~CZI~ U.:.7: ~!..:. !..S : U1iE"t'K3L:l1.!.'1~ DD 1~it:;•1..:
7..:!.C7 1.?7
1311 .2;;:1..: w o1.. : 11 1~=::n ; l!,_v::rrmc2:~c2.2c:2:::, fr; rn 110?.C LP. T: u .:.:woLLL\'. COil STi=il'CiOll S /... F:r FO~ 1.-S.;7.:1! 7.!!
I, l3t.o_p; m =gu:=1.1::,r:- C:ml 31F'•Cc_, PJ ' c;;~;, . : 2."-1C.1H~1 1a
r,: 11 .2:: , .: .::.o,.:.L:11, ;;;c::! c,,.7..:!s-:
Lv s;r~n c: ~oc3!..:221n CUMR:II CY ~\ CH.' H3E \'.;TiH ~.... , : 1.: ,:21
1, 2.=nocJ • ,o OJ =-u:: ;.
t1s:.-:: u~ 12.'!2 us::: 12.: 2 2..: rn.,c: 1;
_.:.o.:.L: 111:;:003 :' r-:m t,.! .:. ;.::;::i!..l!X cm ISir.UCTI:IH S."- . 1":: CJ:., !..DI G1:J11
1;n ...::c1.:: 1.: ~ILv: :;:r1n c..:::; c 1:! t: 10: cc S'( Si: US L!.. = :' : r rn; ~ti!!. Owl::: ;m1;:u : 1r, ClriR.: r.Jc.,·1.::_ "-:1.C:l :U:::
, PP .,c . :;=-i1.: v;o. 1c:-.1: 1b
f r J::"I :.:L.~30!..UX COIIS7,:1U:TOII S /.. 7: KL=i.!.: 1,10
.-:.0"-!..: 1119;:co3
1i 11 201.: 1.::J ILVO ~Hrr.:::2::0211.!c:c.0:: HO!..:'.»IGS CO~ r : r f : r t..U'iO Sr',.:,RE ?,'.?."i"S Cn~r.F:x,-:: 1. 11 :::v :o.o::
-1-+ ~.11.111201.: 1.:2:-.?:a; .1: Ib
1;-. 11.2c 1.: ..:. :c cr:!in; 1: ue-:i.:n; . c ;: Ref. ! 11Hil 217 1:11~. s:::: ~t~t
3R!!..E11~:"J .: ~ 1v .:1 11;n czv ILV':CHIT7CJ7?S?-: occ.: ca 1:..: 2:.c:: 1 u ~: .731 .B
.!.i..l.1.12..!l ~ttri ,- \
0 !..SVE: 1120;:::cJ CUR=t: IICY EXCH.'-llG: ~-.•rrr! R'-i: 1 ..:-: ~;i us:.-:: u;; : .: 2 usu.:
20 11.201! 71Lv,;;:irri0:-?::::3:.:mc1 :..22 U:!;.77!:!i
lz 1 "J 5,J7i;~ COELl=t
OLSV:: 11 2c;:::ic.: CU.l~11c·{ ~XCHAU3E r , rr!-! ;tt..,E 1.:i:Z:?7 LISI:...:. l tR : .?2 !.•S:> .:
20.11.2::1.: ~ I L '✓ ~? i= rfiitl?•? O:::: :.:m c 1
1.2=... 1 cc:: • ~ca'"u~
:.~2 1.3?!.i-:!.!!
20 , 1 20g f'D.LL::1120?::cc ICAi .: ;.5-1 L·;;~;:mo:u;:: 3;..:22201 CUR~:, 1cv EXCH.Lri:::;: WTTH ;:t..:.TI 1..2:!i llSI;:':. UR :.:i USJi ,S. !2
~ co :u~ 1.?.?,!,7';2 2:
2::1,.201.:: OLSI/Ei120;:ocs CUK~ r1c·, EXCH.:. riG :: 1·~17H R.:.r:: 1 2-::1 LIS::.-: u ~ : .12 USJi
:i l!..Va;;:irn"C: eoc 3:.: 222c1 -:. 12
1 n"nco• '" co :u~ U -?S.7!!.~1
0L SVE11 20: ::c:. Fr.:m IJ.4;:i,GO!.UX CO:&STiW::"ilOll S..:. i': c.:.u I ~0 :1
2C 11201.: E .:ILV!:Ht7TC2::c 1:::1c: oo S"/ Si!IJS L!.;: fer FD ?. 3 U~- Ct lG ::ouru::m CIITN C:.:i1:.-'1 .:. 2C,C:lD .:lC
1 PD "C:"Q:=IJ.: , .~:.. 1!:.; 1 1b
OLsv: 112:,;:co:?: Fr:m LIA.=tGO!..U.X C011S"T"RUCTDH s.,.:.. 7: 0 KU0 K:>
20.11.2~ 1.: 1~:? ILV1!;:;:rrnn.:so2:: ~ n:::: COUUERCE LTD Fe r for t:'JH::,, ; rr.aterra:, c:.: nlr. c 1.:= .11H,"3C· : 1.;,01,:,::0
1 ~~ .12..11.2::1:. 1. ?2-:y:iUll C
OLSV::1120::cc: Frcm IJA~G O!..UX COH~ UCiQII S,L. i : K:'...;J..: IJ O
2:: 11.201.: 1:: 1Lvo: ;:;rn-c2-:-:c-21; ~::2::o ii OL DJIGS eo;.,;: fc: F: r A!.170 S?L.R£ ?.:.;:r,5 Cn!r.FD1<.•":1 1-11 1!:u 2::.o::
li:i: 11.:11~01; : 1: .a~3.?1 IC
2C 11 201.:: O!..SV: 112c;:ci:i : 1~i lLV1c.:mo:t: : c21; 30::cc
Fr~m l.f.LA30!..l•X COU~!JCTIOII S..:... T: s ..;,.i l lG IL 5 .&-. F: r 1!2.1?::.oc
lo fer t leciri;-al '"'r i ;J '"l)*r.s H1;::1.: ,:: 1!:;' 1i:1:. ne.:20.0: IC
.L.LKL..: 1120;:coo f rem.ASTOII Ku ~:rt 1.r.1rr::c T: !,l'-;:l:GOLUX :0 11 ~ u: 1:011
2c11.2c 1.: 93ILV!.2;: R'i"T::2~:. 021 ~;-.:: cc 222.•l O.CO
s _.:... ~er F::.r t::.11~ ~, ; rr.11:uiMs c.., tr.\·:lg2J 1.:t 1:.. e~ 1: 1~;_:,.:
.:6) !-e.;1
2-' .11...20 1! 3;;,r. ::1 12!.D"'--:;.:. Iv"- 11 2!. CJHJ ILv,;o;:;rn-c:.; ?;;:o::c : co l~"-~~~r~~
1
;}:,:~~r~:~· !JS ~er. :.11 2:. 11211 1; 71;, s;::i !a!e 1:..00:i.c~
0:1~1: B 1
01.12.20 1"- S11I: 12J1F:'.:CC.! 1l lv3;;:;rrre :~co:1:.!222c 1
CUil=t.:JICY ~XCH..:,,JIG': r rr.H .t.47: 1 2;; ; us:;:.: ll ~ -: .2:! US!):·
s .ll
u~~ -::.u~ ::1.1:" ;..: 3
Frcm f.tA.~G0!..1.1.'< C011Si";:WC7()fl S.,!.. I : K.:...::u.: !JD
01.12.2C I.! s1;1:12:i1POoc: I 11a lLVJ ~i:mc2-;:.0211:102 :::i :-! O!.O;i.1:::;s : o~~ Fe~ fe r AUiO SF:.:..iE i=IL. ITTS Cntr.ft!X.'::1- 11 ::c:.9cc.c:,
,+ -I ~u..:. :z ;;_j!i_l7
Fr cm 1.v; 3c3 3;:i_ 11 21c 1.::000 1::Kl'i.:i::IT~ SL.!..: 5 L? , 11 i:,: sT
G: ::i;;.::;: ST"'"OC:Ei". surr : 12: ? :. ~ s.Gm''- m: 1 Q.x.
:: 112 .1 01: Slt l::12012107,:I: I 112~;01:;;JLV!7~~TTC l 31?J COC.:.: JJ 2~1 1: :i.c::
sc-: rrt.~11D.G3,":33:(:!.V"L2 r: r f o ; 3tl!.t'~l::i : O!.I PU':HI
::r8, 7 '0 -1201.::; 2'" ~o z~;;;m .: 1?.C0?.0: "
As per the "Balance" column in the extract of the bank statement above, the running account
balance was USO 743,071 .37 immediately prior to the payment from Nord LP was received (a) .
Based on the FIFO principle, tracing has been applied as follows:
• Debit of USD 40,000 to Calington Systems LLP was attributable to the existing balance
prior to (a) and not traced on (see (b)) ;
• Debit of USO 500,750 to Karlemo Holdings Corp. was attributable to the existing balance
and not traced on (see (b)) ;
• Bank charges were not taken into account;
• Debit of USD 20,000 to Calington Systems LLP was attributable to the existing balance and
not traced on (see (b));
• Debit of USO 539,078 to Orinoko Commerce Ltd . was partially attributable to the existing
balance 51 (USD 182,321 .37) and partially attributable to the payment from Nord 52 (USO
356 ,756 .63) and therefore traced on in its entirety (see (c)) ;
51
Calculated as 743,071 .37 - 40,000 - 500 ,750 - 20,000
52
Calculated as 539,076 - 182 ,32 1.37

I Kro 11 Project Tenor Phase II Report - Detailed Report - Detailed methodology for tracing funds
• Debit of USD 750 ,820 was attributable to the payment from Nord LP and traced on (see
(c)) ; and
• Debit of USD 752 ,180 was partially attributable (USD 559 ,471.11 , of which) to the payment
from Nord LP and traced on (see (c)) .
The total amount traced on from the USD 1.7 million transfer from Nord LP to Margolux Construction
SA amounts to USD 2.04 million, as the funds attributable to the USD 1.7 million could not be
separated from those which are not attributed . This is summarised in the following figure :
Figure 24 : Exam ple of FIFO principle
Orinoko Commerce Ltd

{Priva thank)
20111/2 0/
18/ 11 / 20 14
/ "'·'" 20/ 11/ 2014
USD 750,820 - - ~ -
USD 1,667,047.44
Nord LP Margolux Construction Karlemo Hoidings Corp
[Priva tbank) (Priv a tbank) (Priv a tbank}
~ ;,u2014_
USD752, l 8 ~
Satuoil SA
(Privathank}
9.4.1 Mixed fu nds - mixing of fraud transfers out of the Core Laundering
Accounts with Other Receipts
As detailed in Section 9.2.2 above , funds that were transferred from Core Laundering Accounts
through secondary laundering processes in Latvian and Estonian banks were frequently mixed with
other funds. As a result, it was not possible to apportion an amount of a transfer traced to an end
jurisdiction to fraud funds. Kroll therefore accounted for the full amount as being tainted with fraud
funds in onward tracing. An example of th is, as funds were transferred through the secondary
laundering mechanism, is shown in Figure 25:

Figure 25: Exampl e of o nward t racing where funds were blended

L:;:,$.",JJlU
l,11 : .:,:1;~,~;rit;~-1 i1.,1J :-t':2
u:·,c.1:i;:.~'<, (;...-.!::.r.Nr-...,1.., 1
1'.:lf~t f:Oi~l~
u.:-0::.~ .!-·,c, • U:'.:t• ¼-,;.J:Q
(l._!,:• ~-'l ,:'i-<1•t!r1!, :,~._. ,:,- -
:,r,.' 1!:~!.ll
-{t f,~, •l\)s~1~!;;,~~~'l.l.~-.~- llllr
.'d lf• .~ ,, rl·J J 1-.,:~ -· ~ t..~,t ·..11 :,.,I::~ LL~
j~• i,•J! J.111• ~ {~•r.,l,sh...,._1u/•.:C:.,.-,;...1\
-r;t1-~~it5----•:: £., T. C);.,·i:,.~ °$ 1

(l❖JJn.w:H·i :
~f;;~t:~~'-
· 1•;,::i~, C•1J~~:.H . ...., ,J-.,.,~
H,•..,_,._ ;/ ~.11:,v::-~ :1~·•
~t;t~t~~- --:.,~::~,.~A;
~
G,,:i: __
. •J:.•.~ ~O ~J::G' -:,-~.,..,-~ :',,J ',',t: 1\-:,)
u:.c.1 h~m~ . ci.. ~ )1.'.'..:•J
~r.• :?,r2;1:
- - -~ . ;~~-i t
U1,l:,:i,Je/,•.•-,:_ ,.-;r.:r1
(,'.!.'l.~i
,.....:ii!~.,_ -- ---~::~~~:; '-~;~ ";,.: ,:,~·.~,, "'"··IL~,,,~ c,,,
rf." '-: : ,~...;.: ,~,:·~·,
n..r,:.Gtt.c.r.r.1!:L: ;,~-..~-1
L , _;;,:, i~_)'.:,l .:,_,;._
~----·"'_.,_J -;;,~7;::;,,.
l,;j) ':t..1).,xt,
U:iO t:!O.W.1 1ti1112C: l
· ·-·-----·---
W:(li t t.:- ~-.::~.~IV,1,\J,!1 Li,J
j '. f.O l\t~
n ,t, :,::; ~lat..1:t.
U;'.{.>:,i, i!l•O.R~). :•))
... -~ - tlf."-0 1 , ..~~:.-1 tJ•!J.!..L,:1:1 .., ..
1::i)tn•;tJ
--; ·--- :ft,;:~i.~;~- - - -- - -
~ -J I\ l!>--;,~1~:. J.! O·.a t , ~~~~::.U .! -- ,~ :.:wor-.!.l(.l'.r: tw
::,C!.:, ! !:a·...: '. t.OLV~
RS l l:~
-~~i'.(?~:;--- ---------· --··. - ~

:.-,·e·1:-.,, 1 Gr.,11 i1 .t:Ir-..i ~.r...~~
(!J r1•.1i>:B."1" 1:.:1 C,,'-:te-•J )
tJ".,{.1 , ~.-..~
- - - 1)1,,\}J.'?-;:)
8r~,.-ic11. ,.n::.
t1 , : r 101:·I.)
U~ • i .OB
,)).'C:·.:•)!} _ _ _ __
Ui.r,, 1:...:1:..J
\f.{1 1,.'~]
i,:;:,:,.o.x,
•l/\.'C. ::.:"1 ! J
'.-=-.;.,:·,· -~•.t..i ~!:!
,:1.ci·~~
In this example, a transfer out of the Core Laundering Accounts of USO 1,224,800 was made from
Unitrade Association 's ABLV account to Tomton Trade Corp's ABLV account. The following stages
from the above example, whereby funds were blended , are summarised below:
• The funds were transferred to five accounts across eight transfers, including th ree transfers
to Tomton Trade Corp's ABLV Euro account.
• In a USO 650,000 transaction , USO 44,276 of the USO 1,224,800 was transferred by
Tomton Trade Corp's ABLV account to Bosco Solutions SA's ABLV account on 28
December 2012.
• On the same date, Bosco Solutions SA transferred the USO 650,000 in one transaction
(which contained the USO 44,276 attributable to Core Laundering Mechanism funds) to
Brain Logistics Ltd's ABLV account.
• Brain Logistics Ltd transferred the funds across seven transactions which totalled USO
658,741.

As detailed in Figure 25, funds transferred out of the Core Laundering Mechanism were initially
blended with other funds in the account of Tomton Trade Corp. Once transferred onwards, these
funds were again blended with other funds in the accounts of Bosco Solutions SA, Brain Logistics
Ltd and Tomton Trade Corp (EUR) before they were transferred on. Due to the blending of funds at
multiple stages of the transaction, it was not possible to identify the proportion of the amount traced
to the end that relates to the initial transfer out of the Core Laundering Mechanism.
9.4.2 Assumptions
9.4.2.1 Exact match criteria

As detailed in Section 9.2 .2, fraud funds were frequently blended with other funds and traced
onwards . In certain instances, review of the bank statements identified transfers which appear to
be related ; inward and outward transfers were exact or near exact amounts, and were transferred
onwards within a few days of the receipt of funds . As these amounts appear to be related, there is
a rationale for tracing the exact match rather than using the FIFO methodology. Kroll has treated
any onward transfer where the value of an onward debit was +/-1 % or+/- USO 3,000 of the crediting
amount (whichever the greater), as an exact match, as demonstrated in the example below:
Figure 26: Example of exact match trace
_ _ _ _ 16/ 10/20 14 - - - -~ _ _ _ _ 16/ 10 /20 14 - - - -

USD 730, 500 c::'"' USD 730, 000
A\/ Transcarqo LP Intr atex Sales LP JSC Grodno Tobacco Factory
(Privatbank) (Privatbank) (Belaru sbank)
In this example, the amount of USO 730,500 from the account of AV Transcargo LP (at Privatbank)
was transferred to lntratex Sales LP (also at Privatbank) on 16 October 2014. This amount was
immediately transferred through lntratex Sales LP's account to the account of JSC Grodno Tobacco
Factory, at Belarusbank [sic]. The residual balance of USO 500 which remained to be traced was
not traced further. In this example, USO 500 is both within 1% and less than USO 3,000. The USO
730,000 was considered to be an exact match.
9 .4.2.2 Nil balances fo r residual fun ds of less th an USD 3,000

As detailed in Section 9.4, the FIFO principle required use of a running statement balance in the
apportionment of transfers to be selected for onward tracing. However, a threshold was applied to
traces of funds where i) having traced the substantive amount of funds onwards, the remaining
amount to be traced was less than USO 3,000 or ii) where the balance in the bank account was
less than USO 3,000 .
An example of this in application is given below:

Fig u re 27: Example of onward d issi p ation w here th e rema ini ng amount to trace was less than USD
3,000
,,?' Su Sona Mei

/ (Bank of China)
7/11/20 1-'l
USD90,097
- - - 7/ il/ 2014
/
LISD 197,3 73 ~
Vicori Invest Vicori I nvest "-..__
·verso bank) (Privatbank) ~
7/ 11/ 20 14
USD 106 , 324
~
Wu Chao Chi
(China Construction Bank)
In this example, a payment of USD 197,373 from an account at Versobank, Estonia in the name of
Vicori Invest was made to an account in the name of Vicori Invest at Privatbank, Latvia. From here,
Vicori Invest transferred USD 196,421 to an account held at the Bank of China (Wenzhou), in the
name of Su Song Mei and an account held at China Construction Bank (Wenzhou) in the name of
Wu Chao Chi. Following these payments, USD 951 of the USD 197,373 remained to be dissipated.
As this was below the USD 3,000 threshold, the USD 951 was not traced on.
Bank accoaErut balances of less than USD 3,00!0 pdor fo me hri'kJW of fraud
funds
The same USD 3,000 threshold was applied in the instance where the balance brought forward ,
prior to the credits of fraudulent or tainted funds, was less than USD 3,000. In such a case, tracing
was commenced as if the statement balance was nil. The full onward debit was attributed to the
credit of fraudulent funds . An example of this is given below:
Fig u re 28: Examp le trace of w he re acc ou nt bala n ce was les s than USD 3,000 p rior to the inflow of
fraud fu nds
·., - - - 29/ 11!20 12 ~ · - ::J _ _ 30/ 11/20 12 ~

::'. la USD 500,000 C-- USD 4 19 ,000
Ghermivali SRL Zonited, Properties Limited AR Plane Force Limited
(\/ictoriabank) {AB L\/) (AB LV)
In this example, Ghermivali SRL's Victoriabank account (Moldova) had a balance brought forward
before the credit of USD 500,000 of USD 91.43. As this amount was less than USD 3,000, the

l Kroll Project Tenor Phase II Report - Detailed Report - Detailed methodology for tracing funds
balance brought forward was not considered and the full onward debit of USO 419 ,000 to AR Place
Force Limited's ABLV account (Latvia) was attributed to the credit of USD 500,000.
9.4. 2,3 USD 50,000 threshold for onward traces

Kroll prioritised larger sums for the further tracing exercise and applied a secondary threshold of
USD 50,000 to all further traces. Onward traces were discontinued if the value of the onward trace
was less than or equal to USD 50 ,000 or equivalent. Debits below this amount were documented
but not traced on . An example of this is given below:
Figure 29: Example of d iscontinued t race falling below US O 50 ,000
17/09 / 20 14 -------:i,, 1s /09 / 20 14 ----,i,,, lllor;

- - USO 510, 000 ~ ~ USO 27, 570
Oastinger LLP Avex Komento LLP Accent Tehno
In this example, the USO 510,000 transfer was traced further. USO 27,570 of the USO 510,000
transfer from Dastinger LLP (Privatbank) to Avex Komento (Privatbank) could be traced to an
account in the name of Accent Tehno, at Moldindconbank. As this onward transfer was below the
USD 50 ,000 threshold, no further tracing was performed .

Kroll Project Tenor II - Detailed Report - Other laundering mechanisms
10. Other laundering mechanisms identified

The Core Laundering Mechanism which is described in the Summary Report and in Section 8 of
this Detailed Report provided the initial layer of laundering of funds which originated from fraudulent
loans issued to Shor Group companies by the Three Moldovan Banks. In addition, Kroll has
identified the following mechanisms which appear to also be part of a further coordinated money
laundering process:
• Laundering of funds through other Moldovan banks (detailed in Section 10.1 of this Detailed
Report): Analysis has identified multiple transfers between accounts at the Three Moldovan
Banks, Core Laundering Accounts, and accounts at other Moldovan banks, which had no
obvious business rationale and appeared to serve no purpose other than to add a further
layer between the source and the destination of the funds.
• Laundering of funds through accounts at Estonian and Latvian banks (detailed in Section
10.2 of this Detailed Report) : Further tracing of fraud funds revealed a large number of
transfers to accounts at Latvian and Estonian banks. The Latvian banks which contained
the accounts that made up the Core Laundering Mechanism also appeared to have further
large scale laundering mechanisms which absorbed a large proportion of the funds.
Similarly, following the Core Laundering Mechanism, accounts at banks in Estonia were
also used as part of what appeared to be a coordinated money laundering scheme. In many
cases, the funds which were transferred into these accounts were blended with funds which
did not originate from the fraud . According to the tracing methodology (detailed further in
Section 9), the blended funds were treated as being tainted with fraud funds and included
in amounts traced onwards;
• In addition, although currently unconfirmed, Kroll identified significant fund flows to other
destinations which indicate further organised money laundering schemes. The fund flows
identified appear to indicate layering of funds in accounts at banks in China, Hong Kong
and Cyprus.
In addition to the mechanisms detailed above, Kroll also identified the involvement of accounts at
a number of Russian banks which were used to disguise fraud funds, although these did not appear
to be part of such a complex coordinated money laundering scheme. The involvement of these
accounts in the fraud is detailed in Section 11 .

t Kroll Project Tenor II - Detailed Report - Other laundering mechanisms
10.1 Laundering of funds through accounts at other

Moldovan banks
Kroll's tracing of fund flows has identified a number of accounts at Moldovan banks other than the
Three Moldovan Banks, particularly Victoriabank and Moldindconbank, that had a high volume of
transactions with Shor Group companies at the Three Moldovan Banks and also sent funds to and
received funds from the Core Laundering Accounts. These transactions in many instances had no
obvious commercial purpose and appeared to have been initiated only with the intention to disguise
the flow of funds . Many of these accounts at Victoriabank and Moldindconbank were in name of
Shor Group companies which also held accounts at the Three Moldovan Banks.
Two examples of funds transferred through other Moldovan banks are provided below:
10.1.1 Example of layering through accounts at Victoriabank (1)

In the example represented in Figure 30, funds totalling EUR 3.8 million (USO 5.0 million) were
transferred out of the Core Laundering (from Eden Alliance LP, ABLV) to Dufremol SRL's EUR
account at UB on 14 June 2013. These funds were then split, with EUR 1.25 million (USO 1.6
million) being returned to the Core Laundering Mechanism (Hanlay Solutions LLP's account at
ABLV). The remainder was converted to MDL and transferred to Dufremol SRL's MDL account at
Victoriabank. From here , it was re-converted to EUR and transferred back to the Core Laundering
Mechanism (Hanlay Solutions LLP at ABLV) . This succession of transfers was made in a matter of
four days . There is no obvious rationale for these transactions other than to further disguise the
onward flow of funds .

Figure 30 : Example of laundering through other Moldovan banks {1)
Eden Alliance (EUR)

(ABLV)
I
14/6/2013
EUR 3.8 million
i
Dufremol {US) (EUR)
17/6)2013 ~
l
EUR 2.5 million (MDL 41 million) 14/6/2013
EUR 1.25 million
~
Dufremol (US) (MDL)
Hanlay Solutions (EUR)
I
17/6/2013
{ASLV)
/
MDL41 million
t
17/6/2013
Dufremol ('C✓)
(MDL) EUR 2.5 million
17/6/2013
EUR 2.1 million
Dllfremol (VIC) (EUR)
10.1.2 Example of layering through accounts at Victoriabank (2)

In this example, illustrated in Figure 31, the laundering through Moldovan accounts occurred prior
to the entry into the Core Laundering Mechanism . On 29 October 2013, four loans totalling MDL
105 million (USD 8.4 million) were issued to SC Dufremol by UB. This amount was then split, with
MDL 95 million (USD 7.6 million) being transferred to SC Dufremol's account at Victoriabank, and
the remainder being transferred to Dufremol's USD account at UB . Part of this MDL 95 million was
then converted to USD and transferred to Dufremol's USD account at UB.
On 30 October 2013, there was a debit on the Dufremol USD account at UB for the amount of USO
4.0 million to the Core Laundering Mechanism (to Hanlay Solutions LLP, ABLV), but this appears
to have been returned, as it never appeared on the ABLV account statement of Hanlay Solutions
LLP. There is a corresponding credit (from Standard Chartered Bank) for the same amount on the
same day. This amount was then converted to EUR and combined with the remainder of the MDL
95 million which had been transferred back to Dufremol's EUR account at UB. The final stage in
this mechanism was the transfer of the total amount to the Core Laundering Mechanism (Hanlay
Solutions LLP at ABLV).

I Kroll Project Tenor II - Detailed Report - Other laundering mechanisms
This succession of transfers was made in a matter of days (between 29 October 2013 and 31
October 2013) . These transfers (particularly the transfer to SC Dufremol's Victoriabank account)
served to disguise the source of the transfer from SC Dufremol (UB) to the Core Laundering
Mechanism as having originated from a UB loan .
Fi gure 31 : Example of laundering through other Moldovan banks (2)
~ ,1, l
IJB
I
29 / 10/2013
Loans 140, 142, 143, 144
MDL 105 million
!
,~-
01emol (UB) (MDL) ~
29 / 10/2013 29/10 / 201 3 30'10i 201 3

MDL 95 million MDL 10 million (USO SOOI:) 1
r-------• USO I '
4.0 million
• -------►
1
~ ~-,
I \
/ I
':'J/ 29 / 10/ 2013 I \
, , ■ ---MDL 41.3 million (USO 3.2 million) _____. \I

I '
Dufremol (VIC) (MDL) Oufremol (UB) (USO) Haniay Solutions (USO)
\ :~~
I
29 / 10/ 2013
I
\
31/1 0/ 2013
/
:
USD4. 0 million ( Returned from Standard chartered)
MDL 53.5 million (EIJR 3 million)
l
~ 31 / 10/ 2013
Ou fremol (VIC) (EUR) USO 4.o million ·> EUR 2.9 million
I
29 / 10/ 2013
EUR 3.1 million
29/ 10/2013 - EUR 3.0 million _ _ _ _ _

----31/10/2013 - EUR 2.9 million -
Oufremol (UB ) (EUR) Hanlay Solutions (EUR)
(ABLV)
10.1.3 Example of loan recycling th rough accounts at Moldindconbank

In the example detailed in Figure 32, funds are transferred from the Core Laundering Accounts,
through a Moldindconbank account and finally transferred to the UB account of Viorel Melnic (a
shareholder of UB).

An amount of EUR 0.3 million was transferred from the Core Laundering Mechanism (Division Top
LLP at ABLV) to the Moldindconbank account of Alvaro Grup, where it was converted to MDL 4.6
million . From here the amount was transferred to the Alvaro Grup account at UB, before it was
finally transferred to the UB account of UB shareholder Viorel Melnic. All the transfers were made
on the same day.
Fig u re 32 : Example of la u nderin g thro ugh other Moldovan banks (3)
Qi-.-,:~(Y.1 Tr.;> l l.P
(.T. i
15/ ll /2C lJ
wr
,-.;\-:;10 Grur, {Ell Rj
(1,,,,·,,,.,,(""''"'')
EuR O.J r
l!i,' J l/2013
'10L , .6
' ■ ---- 1 ~'.~~t~;~?- il~'.i ---- '~'..hi~

:~~}____. -~
t.k,"O G:uri {MDL ) ,'lt·~aio Grup V-IC'i 1t?l r,:""rr.1c
\ Z.:c::l:·i!Jconl\il11,;) (IJ[I J (U O)
10.2 Laundering of funds through accounts at Estonian

and other Latvian banks
Through co-operation with the FSA in Estonia and the FCMC in Latvia in accordance with the
respective Memoranda of Understanding, the NBM has obtained numerous bank account
statements from Estonian and Latvian accounts. Kroll's analysis of the corporate accounts that
were recipients of fraudulent funds once they had passed through the Core Laundering Mechanism
indicates that a number were linked and were part of a coordinated approach to further blur the
dissipation of funds. The indications that the Latvian and Estonian accounts were used as a further
layer of laundering of the fraudulent funds include:
• the splitting of funds between multiple accounts (layering);
• vague and inconsistent descriptions for goods;
• control of multiple accounts by one person, or nominee;
• multiple changes in currency without any apparent rationale ; and,

I Krol I Project Tenor II - Detailed Report - other laundering mechanisms
• large volumes of interrelated transactions often netting to zero at the end of each day.
10.2.1 Laundering of funds through Latvian accounts

Analysis of the account statements for Latvian accounts obtained to date indicate that fraud funds
transferred to Latvian accounts were frequently blended with funds that were not be directly derived
from the fraud funds . In addition, transfers between accounts at Latvian banks frequently exhibited
characteristics of laundering of funds detailed in Section 8.1, including splitting of funds, frequent
exchange rate conversions for no apparent reason, and transaction descriptions that did not appear
to be consistent throughout a transfer.
A number of examples of funds laundered through Latvian accounts are detailed below:
10.2.1 .1 Laundering of funds through Latvian accounts - Example 1

The example shown in Figure 33 below demonstrates that funds totalling USD 0.5 million were
transferred from a Core Laundering Account through a series of other accounts at Privatbank and
other Latvian banks (Norvik Banka and Regionala lnvesticiju Banka). 53 A portion of the funds were
ultimately dissipated to accounts in Cyprus and China.
These transfers took place within two days.
53
As detailed in Section 3.2 of the Report, due to the large volume of statements requested and received, we have not
received all the statements that were requested to date . The funds in the Latvian accounts were not traced further at
date of writing as these statements were not yet received by Kroll.

F ig ure 33 : Laundering ot tu n ds through Latvian banks (1)
:: il l :.?!.i l-1_ _ _ _ _ __ _~ •
;r.; :i n.·, ~
~.:.:11:·..:l1,;t1 lr,11.! ~· lll'
( F:•.-;; :,r'i;!:, Jn-.•,)1..:'_1(J .I C.:tr"i,) I
11/ :1 / ] ;114
VSU IJ,J ·I.
0r,•., nr:L11•• !r r
(l'u;i,,,.,._:. U,w l.1
··- - --·z: ,,,.,,-, ..1

... ~- u:-.o n o~· l--
~o.-.,,.:•.:• (; •1:.111 Ll•J
!Pfi-',l'h.:t,•,l }
CORE
LAUNDERING ~'ii~.~/;'.i,~---- --------1.
l'" ,1l!f.-,."l,11lun.; It ri
1___ ~ . l .11; 11,11 01.:. ___ ~--- --,. ll ;il l,:f.ll ~ (H;>!J.•l',l.· P.•m'.:}
t t;!'; i) (j_lj use, o.~
lft~~:-.!:;~\1 P I 1-i>!~,T'-~ H:>1-: r.i.;;s t c·o
(F1i·1l :b.~•~)
f \:>!)'J Jm·~~:.md":.s In<
(::1!\·,~:t~·1k~
l.V : 1U!J H
IJ WO l
Uc1\"/~:~,r: lril:!C !no;
(ll~<",.,~ iJ.:!1'1 1..3)
:t~b-i\!~--- - ------- ~
XllJ•G:,;i ~1..~rJ h:1 ,~ lntcr nt tr.n:al Ir.:-:!~ t o l l:!
(a.> rl. of (l•.J'\J·1
10.2.1 .2 Laundering of funds through Latvian accounts - Example 2

The example shown in Figure 34 shows that funds that were transferred to accounts at Latvian
banks other than ABLV and Privatbank were transferred back to accounts at Privatbank, blended
with other funds and then dissipated onwards. The additional layers of laundering and the blending
of funds disguised the link between the outflow from the Core Laundering Mechanism and the
subsequent dissipation.
In this example, USO 0:5 million in funds was transferred from the Core Laundering Mechanism
(Genyral Trade LP at Privatbank) to an account at Trastakomercbanka (Simpex Ltd) . From here,
the funds were transferred to a non-Core Laundering Account at Privatbank (Avex Komento). The
funds were blended with other funds and a portion of the funds were dissipated to jurisdictions
including China, USA Italy and Hong Kong . The remainder of the funds were subject to an additional
layer of laundering through Privatbank accounts before they were dissipated . One portion of the
funds (less than USD 50 ,000) was transferred to an account at Versobank, Estonia (Pitstone Trade
LP). The amount was below the threshold 54 for onward tracing according to the forensic funds
tracing methodology (detailed in Section 9) .
5
' As the amount was below the threshold for onward tracing, the bank statements for this account have not been
requested .

Figure 34 : Laundering of funds throt19h Latvian accounts (2)
;';;_
;;·;:;:-----GF.
,:-::,;m, h; .• f' !.ni-:1,-,:1.-ld
,~.-.:-~~~:.-r-.=--~-,-~-, - -~ Lc-111:.:t:I'
:;n e.-..:
: ... 1ro-e,·~1
:~·;.~-~~~-----i=]
h.r;.r--i.t.1·!!. t\l":1
~lr.l?:~'1
1-----~~~~f,J:,- ~
:~• I t ,: {11:
,.. :..:,: Jr, Wft~(l l,: •.;,,rr.:
J?""fr,'.:.n •>,td,ft!11, ( :\''.!:~~~-----~
~=_:, J.;;
l.1..-i:tL.tlil
"' rJnwr!crt.•, ,rn:)
~t~~::~~~- - - - -la ;;,·i:.:.n~.;
Ut:..1
l:tX l »t-;•4 '\::-•a.·,· ;J,L~k!
\t'!tns::nw u"': 1;::;·~~11, ;;i:---~~;;:-~;~ -
·1-...r,zv! ~ ·:-"'ll' k::1\t ::•:,:.
11u.·,uw:·•; •Jl,•:-1-,..w, ,.
;,•·-~~;;~ii~
4
Iii .l~tl'.J1t.:
,... ,.,.~ ii;!
:....,•.l!i,c: 1:~ ...-1 n:x., :~ 11 'itot1 &..·n d ': ~1:,;--: ,
W:>:::l. l"t.!1 11, l:.nu :~n,._--.~'tlrii.C"
4 C,,. ...:b::Otl
~';:~-~.fLI~ - u ll'rn'tt:.cr., ;
..,.t l!,,r,1tti ~-.11.:.....

~ :,,n,,1::.:
:!,11 J 1.ti:,~u.,r~ {:lil ':ll t i WI];
Li
.. , ,m 1·~~ r t ,.:.·c•1C :J'.&.
1'.lo (!.'.'!'I t ~
, l!Jl. :'I.:~ ~)-v.<.J lll'. l
:,,::•ilrJ ' - ~
11.Ul : t'-t.•·+.ll't<t,..; hL U"
:1':t,-i:l!,d; l.'l':: r:_; : :
uwr,:
:',1:,.Y1: -: i- -!1:•1;\,:• __ _ _!
·u
t.ut" :tl tu • ~•
- ""--~J ·11r 1!.:-•lJ Nrl!..-.l.r lt ;

:J.1.11,cc:1>..iu~,
lf'ITMl.ll:'-1 :thil ~.rt. :.ci•:
.¥, f•r...,.r.-.n! l tltl
!l'.t/d:::itti:
I
if\'! :.,:::,
t!l:': ...i , 1ui. : .1
CORE :~;~·~:J- - - - -~ -----------1r--:~;;;-';~:.- ~

~ l t ls:.;:;r; ~.11
, :.~Tl.!!c
..
;1·.-ttu-, 1 {"'4 ,l c-; :i~>j,:
LAUNDERING ,,,-1..~•:,orn, 1)'1,,' ; :_,:;:, _ _ _ _ _ - j
(,. .l:tl.1'1• 1
•l~ IHI \'~ =
V..i. t'.•(i~ ,,r•oJ,.
.• :1: !•!IT; l ~ . l'Jr...r-w
t.',C ll l
~ ~· '!<,:
____u,;,:g;;~~'---- l,t:~!;•~'.~~---:E!
l.~t~ : - - - - ~ ·,::t'..::l!.nH!.:.
11!in.lJ'.l,., ni- : ..
l~l h;ut !r :;:;~•~-~ :
1;- ~itl~:- ~
1
;r--ctu-..f
hn;frn l 'l ? b1 r."; 1...: Lr.•.~ U:.
l::UJOt-1'.,m_(rc-r-.-:W l11 -..~t J,-_.:
.;.,:·,n·r....... 1:
tr- ._,.btl,;
:.1h.1U:.
;1wt.1)!;1n .:-:-:.r , .1'. ~~:;;! r.:- 1u u:.,
!._..,_tt (~h:1 !
l~ h l:,1, ~
:..-.·.hr·•/
~ ~-~.;:;~~~-----G:i ~
J •·t•i :ih.nd:.OC 111:hl l h l • ~
r 1::,r.• 11=-,, 1-,.,,u.1.:i1.
:,t.tcl ::.•:~•:1"11 ' /tU : ou.,;·:n.1»'1.1
Ll•'U::;: l ,.1.~o :1h
!.!.:it• ~
: :.•: :. ::ri:
'·"""--------[:
J.' 1•-'=JW\11
(t• "rfh•1(I
~·-·~·.,r:::1
1.:.:.i 11t:
-~
"l.h.1·:-:r1 1r
''\~'~:"
'. l).J~l:1,-J ; (l' -;r....,:
~
O:M.l•V,-1 ll t
(t'~,:,/'l..... i,.)
IJ'-..tt•ri)
~~i'.{i:- - - - -1:il
0t1';/!.r.' ~ tnJ>;1 !t-u~ l.:r ,,: l h.f,::
:1ac;c••• >
·•-i.:·N'fti
'."tl'd:a•I:
:~·;';~~;;- - - - -~
I. -.:;¥:• F-..r:~~,..._-,.~.-, ~,.
l~U.. t ~,:. •
?;:~·::\!: ____ ,Cii

'J,nu.ll.:;•:..;:;tt:.!
,~..-.. ,1 ,:u1,:
:::·~t~~~' -----E
1, .-,.l1-t.,,..-o .. :
tJ!,c-.,;U tw1\
:.:,1 1,·.u:: --
, .t,;:J •.~:•, <! •:rt.'lu i
Privileged and Confidential

113
I Kroll Project Tenor II - Detailed Report - other laundering mechanisms
10.2.2 Laundering of funds through Estonian banks
Analysis of the account statements for the Estonian accounts obtained to date indicate that a
proportion of the funds which were transferred to Estonia were transferred back to other Latvian
accounts, before being further laundered and then dissipated.
• The examples below (illustrated in Figure 35 and Figure 36) indicate that accounts at
Versobank were used as a secondary laundering mechanism of funds in Estonia. Additional
analysis also shows that accounts at Danske Bank, and Tallinn Business Bank, have been
used as a secondary laundering mechanism/receiver of funds within Estonia. These
examples are detailed further in Sections 10.2.2.1 and 10.2.2.2; and,
• Through analysis of account data for these Estonian accounts Kroll has identified a number
of links between these accounts which indicate that they may have been controlled
centrally. This analysis is documented in Section 10.2.2 .3.
10.2.2.1 Example of layering through accounts at Versobank (1)

The example illustrated in Figure 35 shows fraud funds transferred through Core Laundering
Accounts , and subsequently transferred to several accounts Versobank in Estonia. From here, a
portion of the funds was transferred to accounts at Privatbank in Latvia (to accounts other than
Core Laundering Accounts) before they were transferred to accounts in Turkey and China.
Additional detailed descriptions follow below. The descriptions on the bank statements are shown
in brackets beneath the transfer details .

l Kroll Project Tenor II - Detailed Report - other laundering mechanisms
Fig ure 35 : Example of Estonian bank accounts used to d issipate funds to China , Turkey and back to
L atvi a
-I - - -- - -- .I
Sl«~CG«llc>
1-ri>..l
-
27j!r'Ji'20 1-t
- -EU1. 1.o- . - _
Fu dotw,, I
I
-
)
·,·;eienw ~ ;
,.,.,
I
I
CORE
1
, «\;:r~)
2'J:0f20H
LAUNDERI NG
I
1tr,ato16.itnOl:Ml 1
Prt;afbln\: I
27!10f20H
BSI J.:
I
23,i:<i/20 1-4
I
I
ForOOthhg fl.llO.l
(Fllf cy 1e11i
- Co-.\'ffllllwkelS Ll P
/ ' :::c
0ut,r,oc,"L?
~r.·albn:)
I
,- - - _, - · - - - - - - - - ..J I
28/lliiXIH
Nl. 0. 2
['k@ca b;:,n)
,,/ ~0'.1n tj/T~wh,)
I I
_/ 1- - -US00.-\- - -- lS/t-0;'201-l
_ __ H.:~Oi20t-t_ _ _ ~ ~~~;~ /
2 1;11J1N l ◄
~ 7
~Clfluti:u )
I roi ~
{Prlvatt>.J.J '
:t\.Al ELR:.! Pd.,.,= . ,k • :f~c,e,~a.ndAcccuores) O... fr ctr.al "°" USO 2, )
"'°"'ieho:d ~u.:iu;
s:ut:1 1.oonGb!)a' ~
r.-.,,.1,0~
' Tlo.'l".El .t lOR TitAC'E l P
(•rftobarlt)
1 ';Prt11lblri:.j ~bank)
,,/ 2~ ;1oi201-t_,,, I
I I / uscio.? 23_i l0/2ill"
I /./ ,,)'FOi ln tltS: :J=~~:u)
I 27/ l!l,'201-4
I a.R l.! ->US0 2. l
I :For'91 clCOWl9e)
I
,___ _ _ _ _ --- - -- - ✓--- 1
,,,,
=
!~
- ! - - -- -tJS:>O.
lll,'l!liNl-1
~ - - -·-
I I 2"1U;l\i l➔ ~ Hil'l/10 1-1 /
/
/ I
I
EJW I H:.IIR GMMS:.11.TIC.i\.S
!:-zn',ri:(<io"ttoe)
_.
~IJt.tA:.. PRCO'JCTSLTO
o:,,r.·11 1 11>Nr.j ~
:t'at 1haei~ WBIZHOUYlQWIGSHOEllO"JSlltY CO l Tt>
(Aq-ictJull FM+.of Chne)
- - - -USCll- - - - - -- Us.:> l,J - - -- /

~ l LP {FO'~Bj W~l a,t,P ~:,) {,:O,rtds lrbu be>tlj ln,t,lOSBua'ol:i.P~i \ ~ 2 3/ !0/l'OH
1a; 10,20l..i 2ef10/ 20H usoo.1
(Prt,·att,ri! ;?n•·•l!Nn:i (Pl'i,·1tb,ri,,j tJSO(i •.l
'Ftf 1.ul:tu} USO
:t'Clf 1.0
le.:tu,; ~OI
• .i,ou l
• ~
I
~---------- --- - --- ----- ------ ------- --- -' ✓
\
till
USUJTEl(s.lLG10.il6SAH.\'ETIC.U tl ·,;'EtlriCUC,qt:..ISH05COlll,
ilctiriltr.'MI !ChN Cnntltucb,5ari:)
:,>nv1lhril
On 27 and 28 October 2014, loans were issued to Storad Group SRL from UB totalling USO 5
million.55 According to loan documentation obtained through forensic analysis of electronic data
captured from UB , the purpose of the loans was to purchase clothing for trade. From the USO 5
million, EUR 3.1 million (USO 4.1 million) was transferred to an account held by a UK limited
partnership, Formisold LLP. A contract identified in the electronic data which has been forensically
imaged from the Three Moldovan Banks was, according to the contract between Storad Group SRL
and Formisold LLP, for the purchase of goods, to be delivered to Bremerhaven in Germany. The
contract contained a breakdown of the goods apparently being ordered, which were approximately
320 luxury fur coats, ranging in price from EUR 8,059 to EUR 63 ,080.
Review of electronic data which was recovered from the Three Moldovan Banks also revealed a
Business Plan for Storad Group SRL, which was submitted in support of the loan application. This
included a header of "Molint Group SRL," 56 another Shor Group company which was also involved
in the fraud . The business plan states that the company was established to trade in goods, mainly
55
See Exhibit 10.1 - Loan agreement and sale and purchase contract between Storad Group and Formisold LLP . The
loans to Storad on the 27 October 2014 were issued in MDL and totalled MDL 72 million. This amounted to
approximately USO 5 million at that time .
56 See Exhibit 10.2 - Business plan for Storad Group (extract)

shoes and construction materials. It also states that the company plans to attract funding through
loans from UB totalling USO 16.2 million, and 24 million MDL. During 2014, UB in fact provided
loans to Storad of USO 17 million, EUR 4.1 million and MDL 369 million .
The funds from Storad Group SRL were in quick succession transferred through four Latvian bank
accounts, with a proportion being transferred to another linked company, Dufremol SRL. From the
initial loan funds transferred to Formisold LLP and Welentas LP, USO 2.3 million was transferred
on the same day to the account of Coweroll Markets LLP (UK) at Versobank, Estonia. The
description for this transfer was "for household appliances", which is inconsistent with the original
documentation which was provided for the issuing of the loan.
The funds were immediately transferred on to the account of Blue Moon Global Holdings Ltd, before
being split between three bank accounts. Of the USO 2.3 million which was transferred to Estonia,
USO 1.0 million was returned to another Latvian account at Privatbank in the name of Milara
Products Ltd. From here, the funds were again split, with a proportion going to another Privatbank
account in the name of Vicori Invest LP. The remainder was transferred to accounts in China and
Turkey, purportedly for the purchase of "shoes."
The inconsistencies in description, the transferring of fund through multiple accounts without any
apparent business rationale and the implausible descriptions of the goods initially being purchased
suggests that the main purpose of this account activity in both the Latvian and Estonian accounts
was to dissipate the funds originating from UB and to disguise the onward trace of funds.
10.2.2.2 Example of layering though accounts at Versoban k (2)

In the example illustrated in Figure 36 , a loan issued to Caritas Group at BEM of EUR 55 million
(USO 73 .1 million) was transferred through a series of Core Laundering Accounts and accounts at
Victoriabank, before the funds were transferred through a series of accounts at Versobank, Estonia.
The funds were then transferred to accounts in a number of other jurisdictions including accounts
in China, USA and Latvia.

Figure 36 : Example of laundering through Estonian accounts (2)
r - - - -= I
I
- - --- ;;.•:,=:;:- --:-~-.-:-:- ~:: : ;;;;;_'.':, ' ... .•:,.'l'h ,•' f
I . ....
·/ ",;','~~'
:i,1.• :· ......... ~.-:,- · 1:f
, 1 ·•. :~•;; ;: :~
'~::;'.';;;•~;•::~/',:'~ : ,:~:,;\;~.,,,,,,,, ".~';~:\:~,,. I ···,,·•"

. i-.' ': ..; r- I. ill /,/ ,
...--··
~~
r~i-, ·v• ,,., :, ~·, ·· . I·•J: i " :1;:,;;·;·:~~---- 1..-.~-

l tt : " ~· ~:-t -:-~·.; .I•
. --- -,;;~~:,;\:;.
-•~=_.,.
.~ :::___~:~.~,:/;;~,--.-
···.,s,·•:o I
:-t·(;;r 1. 1·-t u : ,, !'.:.., , :,• /. (.
· ·.:.1.•.'···· · •·
·-... \' i •;:.: : · ,··
r - - - I
:::.r ,,.-,,1:.
1:. :, i•.t.li
..... .....•..
, , I
I -
. I IJ~ l .; r ·llL•
·,.,., ,.·r
1, !,', . !',: ~
I L --:=- - - - - ... _/
-
·, : : .J~<r~(r1~.:, l·
c:•!aG·t ./~-'f:::::?~.-u:~:- II
1IJH1 .•~1. ::::::.,
CORE
~::ir.: ~· -~
(; .,\ ~·,, : ; , ... :!!!!!
,:,,;,~: ~:. - ~, 1,~t, t : 'l\1J: r.~ a:
I I t , ;.:.~ f 'i m L..,-,
LAUNDERI NG ';.~•, ,,f l:,.,. •• ~ n •,-,.· •·
,;,:.. h, ·: t !•"
I .~t .'/ ,:.. I \

I J. t ,._,,,,...,.,
I '"·\:";;:~"·' ::·,~,,~:•"
. ->ti
i••,)~~:-,
•
· ,: ¥: ;. r::i:-:i
l •~1'i)';. , : 1; •,•;-~•.; , ;•.•.: t:•
1: ~- · : ·, 1-•:,· l r •.-., ·.
I_ - -
In this example, loan funds totalling USO 85 million were transferred by BEM to Caritas SRL on 20
November 2014. Of this, EUR 55 million (USO 73 .1 million) was transferred to an account at
Privatbank in Latvia in the name of Spectra Ventures LLP. The descriptions on the transfer were
for "Furniture" (EUR 27 million - USO 35.2 million) and for "Building Materials" (EUR 28 million -
USO 37.2 million) .
Forensic review of electronic data identified pro forma contracts between Caritas Group and
Spectra Ventures LLP amounting to EUR 45 million (USO 59.8 million), dated 19 and 20 November
2014.57 The contracts provide no detail regarding the proposed market for the apparent purchases .
As with the previous example, the prices appear to be inflated , and the volumes appear to have
been calculated solely in order to get to a round number of the total contract value. For example
the furniture order includes approximately 2,500 three piece suites from various manufacturers and
2,200 bookcases. The building material order includes 3.1 million kilos of cement, 48 tonnes of
"Instant Repair" for rooves and 65,000 square meters of paving slabs.
Of the EUR 55 million (USO 73 .1 million) that was transferred to Spectra Ventures LLP,
EUR 32.5 million (USO 43.2 million) was transferred onwards to another account Privatbank in the
name of Conversum Logistics LP. This was then used to repay an "overdraft", which was then
simultaneously issued to another company, Globus Corporation LP. Globus Corporation LP then
transferred the EUR 32.5 million (USO 43 .2 million) to Zenit Management LP. According to the Zenit
Management account statement, of this EUR 32 .5 million (USO 43.2 million), EUR 13.6 million
(USO 18.1 million) was transferred back to Moldova, to Terios Holdings at Victoriabank, also on 20
November 2014. The account statement of Terios Holdings at Victoriabank indicates that this
57
See Exhibit 10.3 - contract between Caritas Group and Spectra Ventures LLP

transfer actually arrived in the account on 27 November 2014. The reason for this delay is unclear.
This amount was then transferred back to Zenit Management LP on 12 December 2014. From this
EUR 13.6 million (USD 18.1 million), EUR 10.8 million was converted into USO 13.5 million and
from this, USO 3.2 million was transferred to Jerdor Business Group LLP (Panama) at Versobank.
The amount was then split between numerous recipients . As in the previous example, a proportion
(USO 0.2 million) was transferred back to Latvia, a proportion (USD 1.5 million) was transferred to
accounts in China, and USO 1.2 million was transferred to other accounts at Versobank, held by
Verneer LLP (UK) (USO 0.5 million) and Bold Finance Holdings AG (Panama) (USO 0.7 million) .
The funds were then further split and transferred out of Bold Finance Holdings AG, to Semmelar
LP (USD 0.5 million), Taylenforg (USO 0.1 million) and to an account in the name of OB Invest, in
the USA (USO 50,000) .
10.2.2.3 Links between Estonian accounts
Preliminary analysis of the accounts at Versobank and Danske Bank which received funds
originating from the Moldovan fraud has revealed numerous connections and similarities between
them, which indicate that they are working in concert in a coordinated money laundering operation .
Addresses and UBOs
Many of the UK limited partnerships which held accounts at Versobank and Danske bank and which
received fraud funds have the same address, indicating that they have been incorporated by the
same company set up agent. Seven companies, which first transacted in August/ September 2013,
all have the registered address at 43 Bedford Street, London. One of the companies identified
(Luxora Global LP) has the registered address 45 Rosehaugh Road, Inverness, Scotland, which is
shared with many of the LLPs which held Latvian bank accounts that were designated as Core
Laundering Accounts, or that transacted frequently with Core Laundering Accounts. Another
(Wallen LP) also shares an address with numerous other LLPs in which had high volumes of
transactions in Latvia (78 Montgomery Street, Edinburgh).
A number of the companies with accounts at Versobank and Danske Bani< have different registered
addresses but share a common UBO . Figure 37 summarises these initial links identified:

Krol l Project Tenor II - Detailed Report - Other laundering mechanisms
Figure 37: Analysis of links between Estonian company ac counts
,. ,.
/-'l \"" Armae:n AJcbkhan•,ar,
------------------ _...----~ 811

M,hran Btll'•n ~
'Cl~
1/ ",~ ----~ \ "-~
Moonla• t ~ Bezynsan -
'?l_
U - -:::-~
{jLLP '-. ';?tJ ~ '_,.o,j - ., .:lj \
--•• ._,, -,,_,1 -
. . . . _____
, ec;
U U
1
\\
LLP KitelotTeam LLP 'Blue Moon Holdings Inc
I
/
l
"r----..._
------
..
--......___
----------~
\ ···• /
/
1
••rneer Jerdor Bu 0ine<s Corp
1----:...__ • Semmelar LP'---. •;•·••"_:::..-.----- Lurno u ,uuo, er Valliant Company LLP Hayteko "'soft LLP Co•..-.·eroll Markets LLP
\\ I/.
\ //
-------~ ----
\///.--------
+::...----- ~
~
Delait Securitie~ Limi; d~ nd Tucpain Umired

/ •·
50th Street, Global Plaza Tower, Panama CilV
78 Montgomery Street, Edinburgh Botanic Avenue, Belfast 43 Bedford Street, London
45 Rosehauc;h Road, Inverness, Scc-tianci

Analys is of Internet Prnfoco! addiresses
Investigations have also included an analysis of the Internet Protocol ("IP") addresses that were
used to initiate the transactions through the Estonian bank accounts. The transactions for each
company appear to have been initiated using a "proxy" IP address to disguise the actual location
of the initiator of the transaction, as the log-on appears to be from multiple jurisdictions in quick
succession . In total, the companies analysed used 1950 individual IP addresses . The majority of
these could be linked to companies in various jurisdictions, which operate a "proxy" service.
Analysis of these service providers indicate that many of the compan ies used IP addresses linked
to a small number of service providers, which indicates that the online banking transactions for
various companies were coordinated and managed centrally, which provides further evidence that
that the main purpose of the accounts was to launder the proceeds of fraud.
The diagram in Figure 38 shows an analysis of the companies which appeared to be using the
same IP "proxy" providers:
F igure 38 : Analysis of IP addresses •· Esto nian company accounts
r· .J II
.. "'.:'.. :,~--... ~~t'. , ,- ~. ~-

...
-'• "!, ~- ~ '
't, :E'.-
·1
I:
I;
''·.j'.
10.3 Other laundering schemes
As shown in Section 6.2.4 of the Summary Report and shown in the examples in Section 10.2,
following the laundering through the Core Laundering Accounts and additional laundering through
Estonia and other Latvian accounts, a significant proportion of the funds were paid to bank accounts
in China, Hong Kong, Turkey and Cyprus. These transactions have descriptions which indicate that
they related to trade purchases, for example for construction materials, textiles or for fur. Additional
details of the funds dissipated to accounts in these and other jurisdictions is included in Section
12.

It is not clear whether these transactions represent actual purchases, or whether they represent
the entry point to another layer of money laundering , as Kroll has not had access to the account
statement data for these accounts.
None of the companies on the list have been identified as being involved in the fraud, but the
mechanisms appear to have similar characteristics No detailed source documentation which
corroborates the validity of the purchases has been reviewed. Further detailed analysis of
documents relating to the transactions by the respective banks would be required to assess
whether the transactions can be corroborated and to determine the end destination of the goods if
the purchases are genuine.

Fig u re 39 : Ex amplH uf what appe<1rs to be P. ntry to t urther la un d erin g t hrou gh Ch ina
~~~~t!\H, _________
...c:- r-..· ( ,. r ;ic·,~ li"liitc:..:
L:1.-,fJ:-; CcJ.ly :rJr: :~
te.l~.clCf0:1,,1)
Q3~-it~~~;:a.:c......_ _ _ _ __ __
C.1:X:• •;~ :, , r'.:•,•,,_ • J-;1\~.~;•~;~~~~;7ria:k C:,-·:•J·,)· U-;1.·.::i:
f.).11~! :?0M _ _ _ _ _ _ _ _ __
USD :i.1
0-:- ;:di..:.):i,.-n.ivi Fu::. C~,my L::--w :..:;
{Sh.ird•.1:,;1 Ji .. ;:.- Pvl:n; r,:u-.:il C."':Jl,'Ct'~-....! i!;.~i1:;
!'.'i;;.~~' i;a
~11;f.i-; rc:ritf R:..t:- :'1,.1 C.,v.:-p.::,1 ~mr..:c
:chi:-~ C.otl)>:n.1<.-:10.-n !1;:'f.)
I - 03/:2/lO!..:
W Jl.C _ I
_____,,l'.:~-~:i_~◄,___ _ _ _I
Z•:ri·t r-t.i - ~ c.-t1•~r : lJ' W:: ',.t':!:.lt.!'·,·)tt:r.-iUJ C,1:,--/1.,r;i1Tr.?:\: l.LJ'l
:.;e:.v;
0
:r r.\lulb.J:-,.: (1.SLVJ
OJ~-~~-~~•~.:- - - - - - - - - [;.
Gucn:....,i,1 H... ~n1:.. f -. r Co-:lt)ivli1t1':c...1
(Ag:'<~.,3 :.Jr.ll Ek-.1, -:I C"·.r,~)
~ - - -~--=~g~\·'-'- - -- - - - -
w~c: h•. e..a· n;:::;,._ Lt:n :C!!
(lfang S:l'IJJ B~"II. UW.cd1
~ - -- -"
CJi:~:::_o;.c.
'' - - - - - - -- -- - - - - - - -- -- -~
IJ:ic.JC.~
5,·1.:1Kic·, CJ1.::-:i,;,n C•. :,,i~ ',',\::r.\:O C:r·:i..:t\~ Li:u ~i.'I!
~f,;r,cu!t:.r~l l!.r~ 11' ,J,i~ J )

I Kroll Project Tenor II - Detailed Report - Involvement of accounts at Russian banks
11. Involvement of accounts at Russian banks

As demonstrated in a number of Sections in the Summary Report, Kroll's analysis has identified
fund flows through accounts held at Russian banks which were linked to the fraud at the Three
Moldovan Banks. This Section provides additional detail on these fund flows and other areas which
appear to have involved Russian bank accounts. The Section focusses on the following areas:
• Fund flows with Alef Bank and Metrobank accounts linked to the Shor Group;
• Loans from Gazprombank linked to BEM shareholders; and,
• Questionable bank deposits.
11.1 Fund flows with accounts at Alef Bank and Metrobank
Kroll's analysis has identified that in addition to the funds which originated from loans given by the
Three Moldovan Banks being transferred into the Core Laundering Mechanism , funds were also
received from accounts held at Alef Bank and Metrobank, in Russia. Analysis of these fund flows
has identified a number of links between the named account holders and Shor Group companies
or individuals connected with the Shor Group, or other high profile individuals in Moldova. It appears
that the purpose of the fund flows through these accounts was to provide another layer of blurring
of the source and destination of the fraudulently obtained funds. It appears from Kroll 's analysis
that a series of loans were issued by Alef Bank and Metrobank, Russia, to individuals and entities
connected to the Shor Group or other Moldovan individuals , which were laundered through the
Core Laundering Mechanism and dissipated to repay loans at Moldovan Banks, or as part of the
funding for share acquisitions. The funds were then subsequently repaid from funds from the
fraudulent loans issued by the Three Moldovan Banks.
Although it has not been possible to corroborate the fund flows through the Russian accounts with
source documentation from Russia, as no documentation has been available for review, the fund
flows to and from accounts at Alef Bank and Metrobank have been treated as part of the fraud, for
the reasons highlighted below.
11.1.1 Loans from Russian banks repaid using loans issued by the Th ree
Moldovan Banks
Analysis of the Core Laundering Mechanism identified a series of fund flows from accounts held at
Alef Bank and Metrobank, Russia, which were channelled through the Core Laundering Mechanism
to other destinations, including to provide finance for the acquisition of shares for new shareholders
of UB and BS , to repay existing loans at the Three Moldovan Banks and other Moldovan banks,

Kroll Project Tenor II - Detailed Report - Involvement of accounts at Russian banks
and to other destinations. There then followed payments made to accounts at Alef Bank and
Metrobank from the Core Laundering Mechanism , from funds which originated from fraudulent
loans at the Three Moldovan Banks, which appear to be repayments of the original funds paid into
the Core Laundering Mechanism .
This mechanism is summarised in the figure below:
Figu re 40: A lef Ba nk and Metrobank sche m e
INCOME FROM RUSSIA DISSIPATED
~~~~--'.
------
MOLDOVAN LOANS
fl
11.1.2 Overview of fund flows
11.1 .2.1 Transactions with accounts at ABLV and Privatbank
Transactions wm1 Core Laundering accoum~s

I Krol l Project Tenor II - Detailed Report - Involvement of accounts at Russian banks
Table 31 summarises the movements between accounts classified as part of the Core Laundering
Mechanism and accounts at the two Russian banks. This table shows that the amounts paid to the
Core Laundering accounts from the two Russian banks was to a large extent repaid to these two
banks. There was a net inflow of USO 4.7 million (2% of the total) into the Core Laundering Scheme.
Given the apparent pattern of the funds received and repaid from the two Russian banks, and the
fact that the accounts which were transacting could be linked to the Shor Group, the fund flows
have been treated as part of the fraud funds and have been traced onwards - details of end
destinations can be found in Section 12.

ti Kroll Project Tenor II - Detailed Report - Involvement of accounts at Russian banks
Table 31 : T ransac t io ns betwee n Alef Bank, Met ro ban k and t he Core l aundering acco unt s
Alef Bank Metrobank

Core Amount paid Amount received Amount paid Amount received Net paid to/
Laundering to Russia from Russia to Russia from Russia (received
accounts (USO million) (USO million) (USO million) (USO million) from) Russia
ABLV Core
Launderinq 5.2 108.2 70.6 84.8 (117.2)
Privatbank
Core
Laundering 107.4 0 10.5 5.4 112.5
TOTAL 112.6 108.2 81.1 90.2 (4 .7)
Transacfocrns w n'i:h peri pheral a.ccoaHits at ABLV f Privatbank

In addition to the transactions between Alef Bank and Metrobank accounts and the Core Laundering
accounts, Kroll also identified a number of transactions with accounts at ABLV and Privatbank that
transacted frequently with Core Laundering accounts , detailed in Table 32: The payments were
made from Russian accounts at Alef Bank in the name of Maria Gutuleac and Alexandr Maclovici
to ABLV accounts in the name of Zonitech Properties Limited and Tomton Trade Corp. As detailed
in Section 8, both Zonitech Properties Limited and Tomton Trade Corp transacted frequently with
Core Laundering accounts and are treated as peripheral laundering accounts for the purposes of
this analysis .
Ta b le 32 : Transac t ions betwee11 Alef Bank , Metro ba nk an d ot her ac cou nts at AB LV and Pri vathank
Alef Bani< Metrobank

Amount paid Amount received Amount paid Amount received Net paid to/
to Russia from Russia to Russia from Russia (received
(USO million) (USO million) (USO million) (USO million) from) Russia
ABLV 1.3 7.6 - - (6.3)
Privatbank - - - - -
TOTAL - 7.6 - - (6.3)
Treatment of trnnsacUons w nh ABl.V and IP'rivai ba!ri k acco unts

The net effect of the transactions with Core Laundering accounts (USO 4.7 million) and peripheral
accounts at ABLV and Privatbank (USO 6.3 million) is a net inflow of USO 11 million (which
comprises approximately 6% of the total inflow from Russian accounts).
As detailed further below, the majority of the accounts at Alef Bank and Metrobank that were
transacting frequently with accounts ABLV and Privatbank were held in the names of individuals or
companies connected to the fraud at the Three Moldovan Banks, either through links to
shareholders by way of providing funding to shareholder accounts or being held by companies with

~ Kroll Project Tenor II - Detailed Report - Involvement of accounts at Russian banks
the same names as Moldovan registered Shor Group companies. Funds from accounts at Alef Bank
with links to Shor Group or other prominent Moldovan individuals comprised 86% of the total funds
from Alef Bank accounts into ABLV and Privatbank accounts. Funds from accounts at Metrobank
with links to Shor Group comprised 83% of the total funds from Metrobank accounts into ABLV and
Privatbank accounts. In addition, the movement of funds through these accounts appears to have
been a circular flow of funds, with a net intflow of approximately 6% of the funds from the Russian
accounts. Because of the large volumes of transactions and the complexity of the laundering of
these funds that took place as they were transferred through the Core Laundering and peripheral
accounts, Kroll has treated these accounts as being part of a wider money laundering scheme, the
purpose of which was to disguise the source of funds used for the funding of shareholders and
other funds .
For these reasons , the amounts paid into the Core Laundering Accounts from these Russian
accounts were excluded from the analysis of Other Receipts paid into Core Laundering mechanism ,
as detailed in Section 8 of this Detailed Report.
11.1 .2.2 Other fund flows
BS fund flows
Kroll also analysed the flow of funds between Alef Bank and Metrobank accounts 58 and Shor Group
accounts at the Three Moldovan Banks. A similar mechanism to that detailed above was identified
at BS , where funds paid to and from accounts netted to nil. This is summarised in Table 33
58 No transactions between Alef Bani< accounts and Shor Group accounts were identified. Transactions were identified
w ith accounts at Metrobank , and accounts at a Russian bank that was not identifiable from the bank statement
information . Account details for accounts at this Russian bank have similarities with Metrobank accounts.

Table 33 : Transactions w ith BS and the two Russ ian banks
Metrobank Russian bank 59
Amount
received
Amount paid to Amount received Amount paid from Russia Net paid to I
Russia (USD from Russia to Russia (USD (received from)
BS accounts millions) (USD millions) (USD millions) millions) Russia
Timol lmpex 4.7 16.4 11.7 0 -
UB accounts
At UB, amounts were paid from Shor Group companies to a number of accounts at Metrobank.
Approximately a third of these funds were then returned, as summarised in Table 34, resulting in a
net outflow from UB Shor Group company accounts to the Russian Banks of USO 57.8 million,
mainly from loans issued to Timol lmpex SRL (net outflow of USO 35.9 million), BAS Clasica SRL
(net outflow of USO 17.6 million) and Finprofilux SRL (net outflow of USO 5.5 million).
Tahlc 34 : Transactions w ith UB and the two Russian banks
Metrobank
Net paid to I (received
Amount paid to Russia Amount received from from) Russia (USD
UB accounts (USD millions) Russia (USD millions) millions)
BAS CLASIC SRL 19.3 1.7 17.6
FINPROFILUX SRL 5.5 0 5.5
Klassika International Limited 0 0.7 -0.7
MOLDCLASSICA INTERNATIONAL
SRLI.M. 0 0.5 -0.5
TIMOL IMPEX SRL 65.5 29.6 35.9
TOTAL 90.3 32.5 57.8
Timol lmpex SRL
Unibank issued loans 60 to Timol lrnpex totalling USO 56 .5 million between 30 December 2013 and
1 September 2014. These loans were transferred to various companies, registered in Russ ia,
Kazakhstan, Cyprus and USA with accounts at Metrobank, Russia, Of the USO 56.5 million, USO
20.6 million was repaid within a day, which suggests that the purpose of these fund flows may have
been to further disguise the source and destination of fund flows.
59
The name of the Russian bank was not clearly documented, but the account number appeared to be a Russian
account number, with similar characteristics to other Metrobank accounts.
60
Of the USO 65.5 million transferred from Timol lmpex SRL to Metrobank accounts , only USO 56 .6 million was a direct
transfer of loan funds. The source of the remaining USO 8.9 million paid out was from funds returned from Russian
accounts at Metrobank. Th is is detailed further below.

The remainder of the loans issued to Timol lmpex (totalling USO 35.9 million) were not repaid at
the time of the collapse of UB. The destination of loan funds transferred to corporate accounts that
remained outstanding at 31 December 2014 is summarised in Table 35 :
Table 35 : Destination of funds from loans issued to Timol lm pex w hich were not repaid at 31
December 2014
Company name Jurisdiction Amount of loan transferred

by Timol lmpex which
remained outstanding at 31
December 2014 (USD
million)
Quantas Consulting Cyprus 12.2
Prodline Russia 9.5
Melor Russia 6.5
Hippernol Construction Cyprus 4.9
Finnitex Inc USA 1.5
Stormstroy Kazakhstan 1.3
TOTAL 35.9
Analysis of the Privatbank, ABLV and other accounts found no other links or fund flows involving
the accounts listed in the table above.
BAS Clasic SRL

BAS Clasic SRL received USO 19.3 million in loan funds from UB during December 2013, which
were transferred to the Metrobank account of Elitar Group. Elitar Group also transacted with
accounts at ABLV and Privatbank (see 11 .1.3 below). Kroll did not identify any links between Elitar
Group and the Shor Group apart from the transactional link noted. USO 1.7 million of the BAS
Clasic SRL loan was repaid .
Finprofilux SRL
UB issued a loan to Finprofilux SRL totalling USO 5.5 million on 30 December 2013. This loan was
transferred to the Metrobank account of RU-Project LLC . RU Project LLC also received USO 2.2
from the account of Eden Alliance LLP (an ABLV Core Laundering Account).
11.1. 2.3 Overall effect of transactions with Alef Bank and Metrobank
As summarised in Table 36 , the overall effect of transactions with Alef Bank and Metrobank
accounts involving the Shor Group accounts and the Core Laundering Accounts resulted in a net
outflow to accounts at the two Russian banks of USO 46 .8 million . This net outflow is included in

the analysis of amounts paid to other jurisdictions in Section 7 of the Summary Report, and in
Section 12 of this Detailed Report.
Table 36 : Overall effect of transactions with Alef Bank and Mctroban~ accounts
Alef Bank Metrobank TOTAL

Amount Amount Net Amount Amount Net amount Net paid to/
paid to received amount paid to received paid to/ (received
Russia from paid to/ Russia from (received from) Russia
(USO Russia (received (USO Russia from) Russia
million) (USO from) million) (USO
million) Russia million)
Core Laundering 112.6 108.2 4.4 81.1 90.2 (9.1) (4 .7)
accounts
Peripheral 1.3 7.6 (6 .3) - - - (6.3)
accounts
BS 4.7 16.4 - 11.7 - - -
UB - - - 90.3 32.5 57.8 57.8
TOTAL (1.9) 48.7 46.8
Reconc.rnation of ftmds paid to Metrnbank

In total, approximately 92% of the funds paid from accounts at BS and UB were linked to loan
funds. Amounts paid from accounts at the Three Moldovan Banks to accounts at Metrobank61 per
the tables above totalled USO 106. 7 million during the Review Period. There is a difference between
this amount, and the amount of USO 97.8 million that was transferred to Russian accounts from
loan funds (detailed in Section 11 of this Detailed Report) . This difference of USD 8.9 million is
because 2 transactions from Timol lmpex to Metrobank accounts totalling USO 8.9 million were not
linked directly back to loan funds.
11.1.3 Links to Shor Group companies and other Moldovan individuals

Kroll identified a number of links between the accounts at Alef Bank and Metrobank that were used
to transact with the accounts at ABLV and Privatbank. This analysis highlighted the following:
• Alef Bank accounts: 86% of the total funds received by ABLV and Privatbank accounts
detailed in Section 11.1.2.1 was received from accounts with links to the Shor Group
(detailed in Table 37). The accounts for which no links to the Shor Group could be identified
(detailed in Table 38) were used to fund the BEM Non-performing loans cession agreement
with Roseau Alliance LP, detailed further in Section 7, which provides a strong indication,
given the other fund flow patterns identified relating to the purchase of these loans, that
they were part of the same coordinated scheme.
61
Including accounts at Russian Bank that are likely to be accounts held at Metrobank (Table 33)

I Kro 11 Project Tenor II - Detailed Report - Involvement of accounts at Russian banks
• Metrobank accounts: 83% of the amounts received by ABLV and Privatbank accounts
detailed in Section 11.1.2.1 was received from accounts with links to the Shor Group
(detailed in Table 39). The transactions with accounts for which no Shor Group links were
identified (see Table 40) resulted in a net outflow to Russia of only USO 2.5 million
(approximately 2% of the total outflow to Russia from the ABLV and Privatbank accounts.
In addition, a number of transactional links were identified between the companies with no
identified links to Shor and other accounts involved in the fraud at the Three Moldovan
Banks, indicating that these accounts are also likely part of the same used to disguise flow
of funds. These links are summarised in Table 40
The following factors indicate that the beneficial owners or controllers of the Russian accounts were
an integral part of the fraud and were working in concert to provide loan funds into the schemes
which would later be repaid from loans from the Three Moldovan Banks:
• Many of the accounts were held in the names of individuals who were directors of Shor
Group companies which received loans from the Three Moldovan Banks, or were identified
as having some other link to llan Shor or other senior Moldovan officials;
• Many of the accounts made only a small number of large payments to the Core Laundering
Accounts and recorded no receipts , which indicates that these accounts were established
to layer a larger transfer of funds which was used to take ownership of the Three Banks
(see Section 7 and Section 11.1 .2.1 ).
• The descriptions on the payments into the Core Laundering Accounts do not include any
detail and have many similarities - many of them contain the description "payment by
agreement" or "purchase of real estate" without any further detail.
Analysis of the links between these accounts and the Shor Group or other high profile Moldovan
individuals is summarised as follows :

Table 37 : Alef Bank accounts tran sactin g with ABLV and Privatbank accounts - links to Shor Group
Amount paid to Amount Net amount Links Description

Russian received from paid to/ to
account (USO Russian (received from) Shor
million) account (USO Russian Group
Account name (Alef Bank) million) account IY/Ol•2
Accounts in the name of individuals linked to Shor Group 1.5 82 .8 (81.3)
or other prominent Moldovan individuals - this will be
presented separately to the Moldovan Prosecutor
29.0 3.9 25.1 y Same name as a Moldovan registered Shor Group company
Dasler Con LLC
31.3 11.7 19.6 y Same name as a Moldovan registered Shor Group company
Liramex-Com SRL
22.7 - 22.7 y Same name as a Moldovan registered Shor Group company
Aaercom Grup SRL
Citadina-Mob LLC
Elcomet-Prim SRL
113.9 98.4 15.6
TOTAL
Table 38 : Accounts at Alef Bank transacting with ABLV and Privatbank accounts - no links to Shor Group identified
Amount paid to Amount received from Net amount paid to Description

Russian account Russian account (USO / (received from)
Account name IAlef Bank} (USO million) million) Russian account
Accounts in the name of individual not linked to Shor - 17.8 (17 .8) Funds from account used to fund BEM Roseau transaction
Group
Further details will be provided in the submission to
the Moldovan Proseuctor
TOTAL - 17.8 (17.8)
62
Y - Linked to Shor Group, O - linked to other Moldovan individuals,

t Kroll Project Tenor II - Detailed Report - Involvement of accounts at Russian banks
Table 39 : Accounts at Metrobank t ransacting w ith ABLV and Privatbank accounts - l inks to Sho r Grou p
Amount Amount Net Links Description

paid to received amount to
Russian from paid to/ Shor
account Russian (received Group
(USO account from) (Y)
Account name million) (USO Russian
(Metro bank) million} account
2.4 2.3 0.1 y Account in same name as Moldovan registered Shor Group company
Agercom Grup SRL
13.8 13.0 0.8 y Account in same name as Moldovan registered Shor Group company
Caritas Group
6.6 15.7 (9.1) y Account in same name as Moldovan registered Shor Group company
Oanmira
2.2 13.0 (10.8) y Account in same name as Moldovan registered Shor Group company
El comet-Prim
Klassika 6.3 1.7 4.6 y Account in same name as Moldovan registered Shor Group company
International Limited
Liramex-Com SRL63
14.1 14.1 - y Account in same name as Moldovan registered Shor Group company
2.2 - 2.2 y This company account also received USO 5.5 million from Finprofilux SRL, Shor
RU Proiect LLC Group companv.
12.8 12.3 0.5 y Account in same name as Moldovan registered Shor Group company65
Victoria Trade 64
63.3 75.0 (11.7)
TOTAL
63 Liramex-Com SRL received a total of USO 14.1 million from Core Laundering accounts, and it repaid the same amount to Core Laundering accounts . Th is resulted in a net
inflow of USO nil.
64 Victoria Trade received USO 12.3 million from Core Laundering accounts, and paid USO 12.3 million to the Core Laundering accounts, resulting in a net outflow of USO 0.5
million.
65 Victoria Trade is 100% owned by Moldclassica International and is operating in the duty free market in Russian according to media sources.

Table 40 : Accounts at Metrobank transacting w ith accounts at ABLV and Privatbank - no l i nks to S h or Group
Amount Amount Net Description

paid to received amount
Russian from paid to/
account Russian (received
(USD account from)
Account name million) (USD Russian
(Metro bank) million) account
4.5 - 4.5 A company by the name of Constant LLC was the named counterparty to the
subordinated loan agreement between BEM shareholder ICS Sisteme lnformationale
Constant LLC lnteQrate and BEM (see Section 11.2.2.1)
16.1 15.9 0.2 BAS Classic (a Shor Group company) received USO 19.3 million in loans from UB,
which were also transferred to Elitar Group (see Section 11 .1.2.2) . USO 1.7 million of
66
Elitar Grouo these loans were reoaid .
"INN7719843490" - 2.2 (2.2)
LLC
17.7 15.2 2.5
TOTAL
66
Elitar Group received a total of USO 16.1 million from Core Laundering accounts, and paid a total of USO 15.9 million to the Core Laundering accounts. This resulted in a net
inflow of USO 0.2 million .

11.2 Loans from Gazprombank
11.2.1 Overview
Documents reviewed by Kroll indicate that fund flows originating from company accounts held at
Gazprombank were used by BEM as part of a further scheme to overstate the liquidity at BEM
during the latter part of 2014.
Funds were received from Gazprombank accounts in two main tranches. The first related to loans
provided by BEM's shareholders to BEM as part of an agreement reached by the shareholders of
BEM in August 2013. The second appears to be funding which related to the purchase of shares
by Sisteme lnformationale Integrate, which increased its shareholding in BEM in August 2013.
Documents reviewed by Kroll identified inconsistencies between the dates which these loans were
repaid according to SWIFT messages, and the internal entries made in BEM's accounting system
and represented to the NBM. The SWIFT messages reviewed show that funds totalling USO 100
million were repaid to Gazprombank accounts on 10 September 2014, whereas in the nostro
account, BEM maintained that it held these cash deposits until November 2014. These
discrepancies appear to indicate a further example of misrepresentation of the liquidity position of
BEM during October and November 2014. Further details are provided below:
Funds were provided by Gazprombank totalling USO 100 million (made in two separate groups of
payments of USO 50 million each) in August and September 2013, and were repaid in September
2014 according to SWIFT messages reviewed by Kroll. According to the bank statements of
Sisteme lnformationale Integrate, the funds were transferred to the bank accounts of BEM
shareholders, who were required to issue BEM with subordinated loan funding after the change in
shareholding (detailed further in Section 7).
These transfers above from accounts at Gazprombank coincided with the placement of an overnight
deposit of USO 100 million from BEM at Gazprombank in September 2013, which was then rolled
over according to the nostro account/ balance sheets of BEM until November 2014. According to
SWIFT messages reviewed by Kroll, the loans from Gazprombank to BEM were repaid in
September 2014 from the accounts to which the loans were originally issued . However, review of
the Sisteme lnformationale Integrate account showed that USO 50 million of cash received from
Gazprombank in August 2013 was transferred out to the Core Laundering Mechanism. USO 6
million of the USO 50 million which appeared to relate to the subordinated loan agreement was
transferred to a company called Constant LLC, which was listed as a counterparty to such loan
agreements.

The discrepancy between what was recorded in the internal records of BEM and the SWIFT
messages suggests a further scheme to overstate the current liquidity of BEM in both September
and October 2014. The amount was finally cleared in November 2014.
In addition, USD 840,000 was paid to accounts at Gazprombank linked to shareholders of BEM
from ABLV Core Laundering Accounts.
Overall, in addition to the artificial increase in liquidity from the overnight deposits (see Section
11.2.3), this scheme resulted in a net inflow of USD 3.7 million (see 11.2.4) from accounts at
Gazprombank.
Table 41 : Gazprombank scheme
Description Payments to Funds from Section

Gazprombank (USD Gazprombank reference
millions) banks (USO
millions)
Funding of Subordinated 50 50 11.2.2.1

loan agreements
Funding of ICS Sisteme 50 50 11.2.2.2

lnformationale Integrate
Other amounts paid to 0.8 11.2.4

Gazprombank accounts
Funding of share purchase 4.5
TOTAL 100.8 104.5
Net (inflow) from

accounts at (3.7)
Gazprom bank
11.2.2 Loans to BEM shareholder accounts
11 .2.2 .1 BEM shareholders' subordinated loans funded by BEM accounts

The Scoping Phase report stated that in September 2013, BEM's minority shareholders signed
agreements with BEM and agreed to provide BEM with funding totalling USD 50 million in the form

of subordinated loans ,67 as detailed in Table 42. The funding was received from two Russian
companies (SKIF Ltd and Transtur Ltd) which , according to data provided by NBM, both have the
same shareholder: Russian registered ElitStroylnvest.
Ta ble 42 : BEM shareholder financing of suhord inat ed loan agreements
BEM Amount Funds Total of Date of Subordinated loan counterparty

shareholder received received subordinated signature
(USD) from loan
agreement
with BEM
ICS Sisteme 6,600 ,000 SKIF Ltd 6,000,500 10/09/2013 000 Konstanta (Shareholder of
lnformationale ICS Sisteme lnformationale
Integrate Integrate)
Calteco Prim 9,200,000 SKIF Ltd 9,199,900 10/09/2013 Ayden Management Ltd
SRL (Shareholder of Calteco)
Vlad ox Group 7,800 ,000 SKIF 7,799,900 20/09/2013 Owen Trading Ltd (Shareholder of
SRL LT1d Vladox)
Carmondean 8,200 ,000 Transtur 8,199,900 10/09/2013 Carmondean Development Ltd
Development Ltd Ltd
Wall Trend Ltd 7,100,000 Transtur 7,099,900 10/09/201 3 Wall Trend Ltd
Ltd
Tintel Project Ltd 11,700,000 Transtur 11,699,900 10/09/2013 Tintel Project Ltd
Ltd
TOTAL 50,600,000 50,000,000
The ICS Sisteme lnformationale Integrate bank statement shows that the USO 6 million received
from SKIF LLC was transferred to the BEM account of Constant LLC (the named subordinated loan
counterparty in Table 42) . Kroll has not confirmed the onward fund flow from Constant LLC.
According to SWIFT messages reviewed by Kroll , the amounts noted in Table 42 were repaid on
10 September 2014 (approximately a year later) from the same accounts that received the initial
transfer of the loan. However, the USO 6 million repayment from ICS Sisteme lnformationale
Integrate to SKIF LLC's account at Gazprombank is not shown on the ICS Sisteme lnformationale
Integrate statements obtained from BEM.
11.2. 2. 2 Add itional shareholder loan

In addition to the USO 50 million subordinated loans detailed in Section 11 .2.2.1 above , on 2 August
2013, a transfer of USO 50 million was received into the BEM account of Sisteme lnformationale
Integrate from the Gazprombank account of another Russian company, Regionalnaya Finansovaya
67
By way of example, Kroll reviewed the signed loan agreement between BEM and Tintel Project Ltd, which was for a six
year loan totalling USO 11,699,900.

Companiya , (Regional Finance Company) according to the transaction reference, in Yarolsav

Region, Uglich City. It is unclear to date what the rationale for this transfer was, or the link between
Sisteme lnformationale Integrate and the Russian company, although the dates coincide with the
increase of the proportion of shares that Sisteme Informational Integrate held at BEM .
According to further tracing conducted by Kroll, the USO 50 million was transferred to three Core
Laundering accounts (Armadale Business Services LP, Sunburough Industries LP and Wang and
Lee LP) from where the funds were transferred to a number of other Core Laundering Accounts
and blended with other fraud funds and transferred through the laundering mechanism . The fund
flows are summarised in Figure 41:

Figu re 41 : USO 50 million loan t o ICS Sist eme lnformationale Integrate
R~1,-;~1.~;~~~;~~:~·:~~~l~~1·.p:mv
(,;..r.,-;
.!:':!..",!,::1:
' ISO !O.!J
1m:20u - u:;c: ,:; ..: lS,t:::f ,!U:.J • U~L1 J ..; {:UI< .1..~: 1:_,/J::/::Ol~ · ::UH L5
...,__tl:8:.!DU · !.J~.0 L 't_ _ '.J0,'8,1. '. 0lJ • U!.;Li L! (f:UR :: .~: '!I .:1~ver::01~ - :uR ..'..!>,_ _ _ _ _--+
• .!.'S/!01"; · L~D .!.!> :t V:~~ ;?.b'1 - - · ... Iii.- . l/9/,:!t!: ::. - ~11~ !b
~.'8.'::'ti !~ · 'JS0 .'X•
:,nw.1:,!iJ? 5:.f.n~ ~r•,•.::.5 LV'
(,~.BL1,-·;,
lC.· ~~;'!~ff'! 1.-~01rr!f•;-..;i1-: ! nt:t]r2t= ~~F.L
l~~M ;
~D;~,'itJJ~ • U~D J.9 (!:lm 3.U; ~~ ~ue~1,-f:rr.=t::.~; Jm!?'~r.:1tc ~m.,::uH> llJ/!.lj.:!:.HJ • :VI·'. ;,u :,;_ntiL-rr,- -;n tn.J ~"i~ ,e; !.I' 1: u;:: :
:;,: !)i1'1
.
I
i:i:~:.'l !~; ;i · tl~D ':-.~
lt't.'tl.',W!3 ·tJ::iD!.U '' •i
.!l:cl:.!ll!j. J!il' =-=-
'
c:.•~:!(l: J . i.:.:.:o: LY
'·
.•:.(:•..::.m~1 . u~:: :i .1.~
"'·""}"" ,, Sl!r.t>~r,:ufh :~;~~.l~:-i! LI ' (U~L':

. .,., ,
t:f,'1:::.'ZOU • LlSC -::-.f. ' .
IJ.'~.·J:.'1]. uso -:: = '-
iU:i:l:.:'.IJ: .! E.r .t. U.#
I
:3::Y;,?e:J. • Li!:D Li.:,,_
- ~~~/liJ::! · L~ !) :.u !~t:!.' .!O:J. · !.15:• tl.b
.;_: ~l/ ,!•J !j :;up LJ ••,
f:1,:; •Jr, •:n UP ci:i.:~•..;pl:!:·:::;cn::, Ud! ~-D; :~/ :!;',W:J · I:~!> l:i.l w.m;, ;me L* i..P 1U!;:•) !
:~,r:!,l,l\,l :J -L':$!,>t:3 (ASi.'•.'f
i.'•.::LV; (.·-:.HL''\'·:
l:li8/..W:J • L~·JJ :.•.~
,. .-·····
·' . '\ .
,'/ H/~/J\: !~ - IJ~ll .(1/, ' ·~~·,
·-.
•tJ:~• :r,, ~ · ll'~tl.-1
!:i,'.:!!.!U:.:. !:: IJF.
2.,•~-·l.tiJ:. •
:11:<:.=.•1,.1 : ::- ~u;•, .H•
I
I
i
I
~ ~
::u1-: 2.o
Ro ,~en -:..;.ip,t:::! -~/ 6;'2:.:E · V~D Lt. ./ •;!:UR·~ .:~ ; If '

:Cl€:., .,._T!;~f',: ~ :.Y :U!'D,' (ii.SL•.· : :3/:!;lO:J · U!:O I.U b ( !:UR IJ.IL.: :
::,t~~V) ;__1,•t;:l:.i!:..~. !;~l) •:: ..:. :~;,.:;_: ::,:; ,: ~ - IJ!_;!) lU 1_EVJ:. -::.O!:)
I t
:"T:t!:.!•J:'.!I - L~J~ -~-::
:S"/:1/b):'.:' · l 1!::J :·,_:; ~.:::.~~~:~~~ ;::-'
! 2:"~!~•J:! · L=~ ::U
l!1~,ct: r1;,11;e11~:: :u~;o ;
U~!Sl\'l .
!6.'S,'.:'.l}!j - t l!il"t •:t.,: (!.J>t ll.l ~ · • •
..
.
- _.,
__ , .
1..;_t!!: 2'lJ::! · l '!.:.')tl. ~

;:i:u t;pe-;::on:. ~!:!JI-:;
' l.!.'S.'.!tiH • USU !..1
,. ', •)il!LV;•
'
!b/l-::'.! :·B-IJ!;;!)::J
,· -, ~
h ·3r,tt-S i m,rng LP I_IJ!:L.l!
(,'\3!.'.·:,
P·, m<>L=.f,! !rrpmt !.!• - 11J:.OD) ~~!.-:i-;o:11.:::1·ouo :..t..: tlJ!.il')
] ,",f:ILV) -;:.et v·1
P:>r,;;1·,:cm fl':,n:?Qer.:-E-: 11y_;;;,)

IA~lvl .

As with the subordinated loans detailed above, this amount was, according to SWIFT messages
reviewed by Kroll (and apparently stamped by Gazprombank) repaid to the Gazprombank account
of Regional Naya Finansovaya Companiya on 10 September 2014. However, this repayment was
not recorded in the BEM statements of ICS Sisteme lnformationale Integrate.
11.2.3 Overnight deposits from BEM to Gazprom bank -August 2013 to October
2014
From Kroll's analysis of BEM's month end balance sheet reporting submitted to the NBM and BEM's
Nostro account (internal clearing account showing transactions between BEM and other banks) it
appears that BEM deposited USD 100 million received from its shareholders in August and
September 2013 (detailed in Sections 11.2.2.1 and 11.2.2.2) to place a series of overnight deposits
at Gazprombank. It appears that the loans issued were repaid (as detailed above) in September
2014. The overnight deposit, which was initially placed on deposit in September 2013, remained
on the nostro account until November 2014.
11.2.3.1 Placement of Overnight deposits

On 30 August 2013, BEM placed USD 50 million as an overnight deposit at Gazprombank in Russia.
This was included in the "Overnight Deposits" Section of BEM's month end balance sheet liquidity
reporting at the end of August 2013. At the next month end, this amount was doubled to USD 100
million. These deposits coincide with the shareholder funds received in August and September
2013 that were detailed in Sections 11 .2.2.1 and 11 .2.2 .2 above . According to the balance sheet
reporting submitted to the NBM and BEM's Nostro account, the USD 100 million was rolled over
monthly between September 2013 and August 2014, and reported under the liquid assets Section
of BEM's balance sheet.
Acco rding to the Nostro account of BEM, the USD 100 million was returned for the last time on 29
August 2014 and kept in BEM's Nostro account with Gazprombank, for the months of September
2014, October 2014 and part of November 2014. This amount was included in the recorded liquid
assets on the balance sheet of BEM as part of its month end reporting to the NBM.
The recording of the USD 100 million as month-end overnight deposits would have led to increased
liquidity in the balance sheet of BEM as unencumbered overnight deposits are regarded as liquid
assets by the National Bank of Moldova's Regulation 68 on bank's liquidity.
68 http://www . bn m. org/en/ conte nt/reg ulatio 11-ba nk s-li q u idity-a pproved-d ca-nb m-no 2 8-auq us t-08-1 997

KrolI Project Tenor II - Detailed Report- Involvement of accounts at Russian banks
11 .2.3.2 Clearing of Overnight deposits

Kroll reviewed a BEM internal audit report conducted on these transactions, which stated that the
balances recorded in the Gazprombank Nostro account in BEM, and the BEM Nostro account in
Gazprombank, did not match for the entire period .
On 24 November 2014, two payments totalling USD 100 million were recorded in the BEM Nostro
account as being made to accounts at Privatbank (USD 50 million paid from Caritas Group SRL at
BEM to Spectra Ventures LLP and USD 50 million paid from Provolirom SRL at BEM to Nord LP) .
The corresponding receipts for these payments are not shown in the Privatbank account statements
of Spectra Ventures LLP or Nord LP. It appears that these payments were recorded to clear out the
overnight deposits returned in 11.2.3.1 above while the actual cash movement was used to repay
the loans to the accounts at Gazprombank on 10 September 2014 (see repayment of the loans
detailed in Section 11.2.2.1.
This had the effect of artificially increasing the liquidity on the balance sheet of BEM by USD 100
million for the months of September and October 2014 (allowing the bank to make more loans
during this time) as the amount in the Nostro account was included in the asset Section 1032, 1034,
1035 in the Annex 2 month end reporting to the NBM for September 2014 and October 2014. In
summary, an increase in BEM's liquid assets would have improved BEMS' liquidity ratio and
allowed the Bank to increase its lending. The effects of higher liquidity on the balance sheet and
the bank's operations are detailed further in Section 4.2 of the Summary Report.
11.2.4 Other transactions with Gazprom bank accounts

USD 843,507 was paid from two Core Laundering Accounts at ABLV in the name of Primoteks
Import and Carmondean Development to two accounts at Gazprombank held by Garant 000 and
Transtur LLC . As shown in Section 11.2.2.1, Transtur LLC provided funding for the subordinated
loans of BEM shareholders Tintel Project Ltd , Carmondean Development Ltd and Wall Trend
Limited. Garant 000 may be related to 000 Garant-Grup, a shareholder of BEM with a 4.62%
share in BEM. The rationale for these payments is not clear from the description on the ABLV bank
statements. The amounts paid to these companies are shown in Table 43 :
Tabl e 43 : Amounts paid to Gazpromba nk accounts linked to BEM shareholders
Amount paid to
Russian account receiving Russia (USD
funds Funds paid from E<1uivalent) Date Currency
Garan!OOO Primoteks Import 225,000 24/05/2013 RUB

Garan!OOO Primoteks !moor! 225,000 17/06/2013 RUB
Garan!OOO Primoteks Import 105,000 11/0212014 RUB

Garant 000 Primoteks Import 105,000 19/02/2014 RUB
TRANSTUR LLC Carmondean Development 24,000 25/09/2013 USD
TRANSTUR LLC Carmondean Development 159,507 28/02/2014 USO

TOTAL 843,507
In addition to the above, an amount of USO 4.5 million was received from the account of Constant
LLC at Gazprombank. This amount was paid to ICS Sisteme lnformationale Integrate and,
according to the payment description on the bank statement, was used to purchase shares in BEM.
11.3 Questionable Russian bank deposits

As set out in Sections 4.1 and 4.2 of the Summary Report, from 1 - 24 November 2014, BEM was
able to issue new loans to the value of USO 838.5 million to Shor Group companies, secured by
apparent collateral provided by Russian banks of USO 876 million. According to the balance sheet
of BEM, this cash was put on deposit at the same Russian bank, which allowed BEM to present
the illusion that the Three Moldovan Banks had sufficient liquidity to make new loans and meet the
NBM liquidity requirements.
As set out in Section 4.2.2.4 of the Summary Report, there was a lack of evidence to support these
recorded Russian bank deposits, which suggests that the collateral provided by the Russian loans
from 1 - 24 November 2014 did not exist other than in the internal accounting records of the Three
Moldovan Banks. These transactions were subsequently reversed by 28 November 2014 (as
detailed in Section 11.3.2.
11.3.1 Links between Russian interbank movements and loans granted

As set out in Section 4.2.2.3 of the Summary Report, Kroll's analysis of interbank deposits in
November 2014 identified links between these movements and loans granted by the Three
Moldovan Banl<s during the same period. This analysis showed correlation between the Russian
deposits and loans originated by BEM.
11.3.1.1 BEM
Links between collateral provided by the Russian banks, and loans granted by BEM are shown in
Table 44 :

Table 44 : Link between Russian bank deposits and loans issued from BEM to Shor Group
Date Deposit to increase liquidity, Value of USD Issued to

recorded as being provided collateral million
by (USD (Loans)
million)
5-Nov Gazprombank 73 71 .0 Dracard SRL,
Voximar-Com SRL
6-Nov Gazprombank 68 68 .8 Dracard SRL,
Voximar-Com SRL
7-Nov lnterprombank 61 58 .0 Provolirom SRL
10-Nov lnterprombank 90 84 .2 Provolirom SRL
11-Nov Alef Bank 4 3.6 Voximar-Com SRL
12-Nov Alef Bank 122 117.2 Voximar-Com SRL
13-Nov Alef Bank 84 80.0 Dracard SRL,
Gazprombank Voximar-Com SRL
lnterprombank
17-Nov lnterprombank 5 5.3 Provolirom SRL
18-Nov Alef Bank 2 2.1 Provolirom SRL
Gazprom bank
lnterprombank
19-Nov Alef Bank 52 36 .6 Provolirom SRL,
Gazprom bank Caritas Group SRL
lnterprombank
20-Nov Alef Bank 78 85.2 Caritas Group SRL
21-Nov Alef Bank 75 70.0 Caritas Group SRL
24-Nov Alef Bank 162 156.5 Provolirom SRL,

Gazprombank Caritas Group SRL,
lnterprombank Dracard SRL
TOTAL Increase in liquidity/ loans 876 838.5

granted
11.3.1.2 BS and UB
As detailed in Section 4.2.2.3 , there was only one increase in liquidity provided by lnterprombank
to BS amounting to USO 14.4 million on 6 November 2014. Within two days, two separate loans
amounting to USO 14 million were issued by BS to SC Molint Grup SRL.
11.3.2 Reversal of questionable Russian bank deposits

As the loan balance was transferred from BEM to BS at the end of November 2014, the
questionable Russian bank deposits detailed above were removed from the balance sheet of BEM,
along with the equivalent cash deposits by BEM at the Russian banks for the same amount. On 28
November 2014 , BEM's asset balance of USO 777 million was comprised entirely of a deposit at
BS.

11.4 Overview of amounts dissipated to Russia

Analysis of the scheme to disguise the flow of funds through Alef Bank and Metrobank indicates
that not all funds transferred to Russia are in fact the end dissipation of fraud funds, as many of
these funds were in fact repayments of amounts originally received from Russian accounts.
However, Kroll's analysis has identified that there was a net outflow of funds paid or received
directly from the Core Laundering Accounts and the Three Moldovan Banks of USO 46 .8 million .
Analysis of the scheme involving Gazprombank identified a net inflow of USO 3.7 million from
accounts in Russia, used for the purchase of shares in BEM (see Section 11.2).
The further tracing exercise, set out in Section 6.3 of the Summary Report revealed an additional
USO 37.1 million identified through forensic funds tracing that was paid to banks in Russia.
Further tracing of amounts paid to ABLV non-Core Laundering Accounts (set out in Section 6.1 .2.1
of the Summary Report) identified USO 0.4 paid to an account at Sberbank (Russia) .
As shown in Table 45, this amounted to a net outflow of USO 80.6 million to accounts held by banks
in Russia.
Table 45: A mounts dis sipated to Russ ia
Source of funds Russian Bank(s) Net amount paid to

/(received from) Russian
accounts
(USO million)
Accounts at ABLV and Privatbank, Alef Bank, 46.8
Three Moldovan Banks Metro bank
BEM Gazprom bank (3 .7)
Further tracing (amounts Several Russian banks 37 .1
originally 69 dissipated to Latvia,
Estonia and Moldova)
Ends from amounts paid to non- Sberbank 0.4
Core Laundering Accounts at
ABLV
Total funds related to the fraud 80.6
which have been traced to
Russian accounts

l Kroll Project Tenor II - Detailed Report - Overview of destination of fund flows
12. Overview of destination of fund flows
As set out in the Summary Report, loan funds totaling approximately USO 2.6 billion were
transferred to the Core Laundering Mechanism which involved two Latvian banks and 81 accounts
held in the names of a series of UK based LLPs and other companies registered in offshore
jurisdictions. Kroll identified that approximately USO 2.0 billion was returned to the Three Moldovan
Banks to repay existing loans. The remaining USO 600 million was traced using the fund flow
methodology which is detailed in Section 9. In addition, funds totaling approximately USO 300
million were traced directly from loans issued to Shor Group companies to Moldova and other
destinations. The total amount traced to current end destinations is significantly more than this due
to the fact that as the funds were traced on, fraud funds were combined in some instances with
funds which could not be directly linked to the fraud. In these cases, the entire amount was traced
on as the funds originating from the fraud were a small proportion of the total funds transferred to
the Core Laundering Mechanism and could not be separated from those other funds.
The tracing has identified that more than 75% of the current ends were traced to only six
jurisdictions. As detailed in Section 10, this may indicate that there are further laundering
mechanisms in place involving these accounts . However, there are a number of accounts in other
jurisdictions which received funds which could indicate the transfer of funds to the benefit of
individuals or for the purchase of assets. Further disclosure and investigative work will be required
to clarify these. A summary of fund flows to the jurisdictions which received the majority of the funds
is provided in Table 46 below. Additional details of specific accounts which received funds of more
than USO 0.5 million in aggregate are detailed in the Sections that follow.

Kroll Project Tenor II - Detailed Report - Overview of destination of fund flows
Table 46 : Overview of bank account jurisdidiuns that ret:eived trauct funds
Jurisdiction Number Number of Total Note

of transactions value
account (USD
holders million)
Latvia 302 .1 See 12.1 .1
Moldova (other 169.3 See12 .1. 2
banks)
Cyprus 93 283 112.4 A number of high value transfers
were identified. USO 104.5 was
paid to 34 accounts that received
more than USO 0.5 million in
aggregate.
China 583 816 83.3 Many transfers were made to
Chinese trading companies that
appeared (from their names) to be
acting in the fur, clothing, shoe and
textile industry. A total of USO 25.7
million was paid to companies that
received more than USO 0.5
million.
Moldova (BEM / UB / 82.9 See12 .1.3
BS)
Russia 80 .6 See 12.1.4
Austria 24 44 56.1 USO 52.1 million relates to the
financing of the acquisition of the
non -performing loans portfolio at
BEM by Roseau Alliance LLP
(detailed in Section 7) .
Estonia 51.4 See below
Switzerland 71 120 42 .8 USO 37 .1 million was paid to 12
entities that received more than
USO 0.5 million each .
USA 133 241 25 .5 USO 15.2 of the amounts paid to
entities with accounts at USA
banks related to the purchase of

I Kroll Project Tenor II - Detailed Report - Overview of destination of fund flows
Jurisdiction Number INumber of ITotal Note

account (USD
holders million)
non-performing loans at BEM
(detailed in Section 6).
Hong Kong 232 307 22.6 Many transfers were made to
Hong Kong trading companies.
USO 3.9 million was paid to
entities that received more than
USO 0.5 million in aggregate.
Italy 173 225 16.8 Approximately USO 8 million of
this amount relates to a single
payment made to an individual,
which, according to the transaction
description on the bank statement,
relates to the purchase of a
property.
Romania 26 68 15.8 USO 12.1 million was paid to one
entity in a series of 23
transactions . Accounts in the
name of this entity were also
identified at banks in Cyprus.
Germany 129 168 11.1 USO 1.8 million was paid to an
entity that transacted with the Core
Laundering Accounts.
Turkey 101 127 10.4 Similarly to China , a large number
of transfers were made to a large
number of entities that appeared
(from their names) to be trading in
the textile, clothing and shoes
industry. Payments to entities
trading in other industries were
also identified .
Netherlands 36 51 8.6 A total of USO 4.6 million was paid
to two entities (they received USO
2.3 million each) . The remainder
was paid to 34 other entities.

Jurisdiction Number Number of Total Note

account (USO
holders million)
United Arab Emirates 42 66 6.8 Two entities each received more
("UAE") than USO 0.5 million . The
remainder was paid to 40 other
entities.
Other jurisdictions 46.0 See below
70
TOTAL 1,144.6
12.1 Additional detail on jurisdictions that received large

transfers of funds
Additional details of transfers relating to Latvia, Moldova, Estonia and Russia are detailed below:
12.1.1 Latvia {USD 302.1 million)

A significant portion of the amounts traced to Latvia have been ended there as the statement
requests are pending at date of writing .
• USO 65.6 million was below the threshold defined for onward traces , according to the
tracing methodology, which was formulated with the focus on prioritizing the larger sums
for potential asset recovery. Further details can be found in Section 9.
• USO 230 million related to traces to accounts for which statements have been requested
but not yet received.
The remainder of the amount related to amounts that could not be traced to transfers out of the
Latvian accounts; either as a result of the funds being used for complicated foreign exchange
contracts, or as the funds had not left the account as at the latest statement date.
12.1.2 Moldova {other Moldovan banks) (USD 169.3 million)

Kroll's analysis has identified that accounts at other Moldovan banks (particularly Victoriabank and
Moldindconbank) have some involvement in the transfer of fraud funds. Section 10 detailed the
involvement of Victoriabank and Moldindconbank in a secondary laundering mechanism, and
70
Difference is due to rounding

I Kroll Project Tenor II - Detailed Report - Overview of destination of fund flows
Section 5 showed that in some cases, fraud funds from loans issued to the Three Moldovan Banks
were paid to accounts at Victoriabank and Moldindconbank as loan repayments.
The amounts which were paid to other Moldovan banks were as in the Table below:
Table 47: Moldovan banks that received fund flows
Moldovan Bank Amount received

Victoriabank 107
Moldindconbank 51.1
Comertbank 5.4
CJSC Agroprombank Moldova 2.2
-
Romanian Commercial Bank Chisinau 0.8
Eximbank 0.3
Energbank 0.2
Moldovan State Treasury (TREZMD2X) 0.3
Other 2
TOTAL 169.3
The involvement of Victoriabank and Moldindconbank and the extent to which payments made to
these two banks were for loan repayments cannot be fully quantified to date, as a large number of
bank statements are pending request (USO 63 .6 million). However, to date, Kroll has been able to
classify the following as loan repayments:
• USO 43.7 million paid to accounts at Victoriabank were for loan repayments; and,
• USO 23 .9 million paid to accounts at Moldindconbank were for loan repayments .
12.1.3 Moldova (Three Moldovan Banks) (USD 82.9 million)

USO 82.9 million was returned to accounts at the Three Moldovan Banks. These transfers were
identified from further traces, and do not include any amounts paid from the Core Laundering
Mechanism (detailed in Section 7 of the Detailed Report). USO 26.4 million of this could not be
traced to completion as the statement request is currently pending. USO 40 million was paid to 17
accounts in the name of Shor Group companies.
12.1.4 Russia (USD 80.6 million)

An overview of amounts dissipated to Russia excluding the amounts from further traces detailed
below is provided in Section 11. USO 37.1 million dissipated to Russia is from further traces of
amounts originally dissipated from the Core Laundering Mechanism to Latvia, Estonia and
Moldova.

Many of the transfers were made to accounts at Russian banks that were not involved in the transfer
of the circular flow of funds detailed in Section 11 (Alef Bank and Metrobank).
USO 14.2 million was received by one entity, which had accounts at Russian banks. USO 10.9
million was received into an account held by an individual. Apart from two transfers made to this
individual, accounts were held at Russian banks other than the Russian banks named in Section
10 of the Detailed Report (Alef Bank, Metrobank and Gazprombank).
12.1.5 Estonia (USD 51.4 million)

As detailed in Section 6.2 of the Summary Report. approximately USO 58 million was transferred
to accounts in Estonia directly from the Core Laundering Mechanism. Amounts paid to accounts
were traced onwards according to the tracing methodology detailed in Section 9 with the assistance
of a Memorandum of Understanding between the NBM and the Estonian regulatory authority.
Section 10 detailed a secondary laundering mechanism that was identified in the Estonian banks .
The USO 51.4 million that remains in Estonia is mainly due to two factors:
• Funds transferred to accounts where document requests are pending; and,
., Funds transferred to accounts that were blended with other funds in such a way that they
could not be traced onwards in accordance with the tracing methodology. By way of
example, in a number of cases, funds were traced partially to a rolling foreign exchange
contract that was renewed every few days and where it was not possible to determine an
onward trace.
12.1.6 Payments to accounts in other jurisdictions

Amounts totaling USD 46 million were paid to 63 other jurisdictions. None of these jurisdictions
received more than USO 5 million in total. The following jurisdictions received between USD 1
million and USO 5 million in total: Singapore, Liechtenstein, India, Great Britain, Poland, France,
Luxembourg, Czech Republic, Ukraine, Vietnam, Brazil, Ireland, Monaco, Andorra, South Korea,
Taiwan and Spain. USO 1.5 million was paid to accounts where the jurisdiction was not clearly
identifiable from the bank statement.

Kroll Project Tenor II - Detailed Report - Inventory of electronic data collected and reviewed
13. Inventory of electronic data collected and

reviewed
The following table lists all the custodians for which laptops were collected and imaged by NBM ,
and secured forensically by Kroll.
Table 48 : List of air custodians whose laptops were imaged by Kroll
Name of Custodian Role Bank

Bargueva Irina Head Accountant BEM
Birca Viorel President BEM
Botnaru Olga Deputy-Head Credits BEM
Burlacu Corina Vice President BEM
Head of Household, receipts and
Buruiana lurie protocol BEM
Crijeu Vladimir Deputy-Head Lawyer BEM
Frunze Lilian Member of Credit Committee BEM
Golovcenco Elena Head Branch n.1 BEM
Gromov Tatiana Secretary to Viorel Birca BEM
Head Foreign Operations and
Juk Tatiana External Relations BEM
Mihalas Tatiana Deputy-Head Credits BEM
Osoianu Angela Head of Secretary & Protocol BEM
Paladi Constantin Vice President BEM
Railean Vlad Deputy Head Accountant BEM
Timu~ Alexei Ion Chief of Security BEM
Economist principal, Risks
Bezbabcenko Sfetlana identification and evaluation BS
Economist, Credits Section
CTlcic (Arnaut) Tatiana Central Branch nr.1 BS
Inspector superior, Economic
Jaloba Valeriu Security Section BS
Mocanu Liliana Member of Credit Committee BS
Turcanu Ecaterina Member of Credit Committee BS

Kroll Project Tenor II - Detailed Report - Inventory of electronic data collected and reviewed
Veselovski Serghei Member of Credit Committee BS

Veselovski Serghei Member of Credit Committee BS
Hvorostovscaia Victoria Vice President UB
lovv Alexandr Deputy-head of treasury division UB
Malai A. Not identified UB

Paladean Irina Head of Liquidity Section UB
Sevcenco Ala Head of Monitorisation Section UB
Sevciuc Dmitrii Head of Credits Section UB
Tuguliskii Dumitru President UB
Of the ones listed above, Kroll has reviewed and analysed data pertaining to the following
custodians :
Table 49: List of custodians whos e da t a was analysed and reviewed by Kroll
Name of Custodian Role Bank

Birca Viorel President BEM
Botnaru Olga Deputy-Head Credits BEM
Golovcenco Elena Head Branch n.1 BEM
Gromov Tatiana Secretary to Viorel Birca BEM
Head Foreign Operations and
Juk Tatiana External Relations BEM
Mihalas Tatiana Deputy-Head Credits BEM
Turcanu Ecaterina Member of Credit Committee BS
Paladean Irina Head of Liquidity Section UB
Tuguliskii Dumitru President UB

WO:>"IIOJ)I

Kroll 2 3

Diunggah oleh

Informasi Dokumen

Judul Asli

Hak Cipta

Format Tersedia

Bagikan dokumen Ini

Bagikan atau Tanam Dokumen

Opsi Berbagi

Apakah menurut Anda dokumen ini bermanfaat?

Apakah konten ini tidak pantas?

Hak Cipta:

Format Tersedia

Kroll 2 3

Diunggah oleh

Hak Cipta:

Format Tersedia

I Kroll

Project Tenor 11 - Detailed

The National Bank of Moldova

Nexus Place, 25 Farringdon Street

Privileged and Confidential

Privileged & Confidential

Privileged and Confidential 2

Privileged and Confidential 3

7.3.1 Funds from Russian accounts used to fund shareholders .. .... 72

8.5.3 Other funds mixed......... ...... .. ... . ........ .. ....... ..... 95

9.2.1 Exact match trace .. ...... ......... .. ....... .. .. .... 96

9.2.2 Blended funds .......... ........... ..... ...... ... .. 97

10. Other laundering mechanisms identified .. ................................................. .......... :......... 106

10.1.3 Example ofloan recycling through accounts at Moldindconbank .. ..................... .. . .. .. 109

Privileged and Confidential 4

11. Involvement of accounts at Russian banks ... .. .. .. .......................................................... 123

12. Overview of destination of fund flows ............................................................................ 145

12.1.1 Latvia (USO 302. 1 million) ........ .. .. 148

12.1.6 Payments to accounts in other jurisdictions ................. ............................................................ .. .... . 150

13. Inventory of electronic data collected and reviewed ..................................................... 151

Privileged and Confidential 5

List of Figures and Tables

Privileged and Confidential 6

List of Figures and Tables

Privileged and Confidential 7

Privileged and Confidential 8

Privileged and Confidential 9

1. Introduction to Detailed Report

The Detailed Report contains the following Sections:

• Shor Group companies

• Process of approval of loans at BEM

• Details of loans granted by the Three Moldovan Banks

• Fund flow analysis of Shareholding of the Three Moldovan Banks

• The Core Laundering Mechanism

• The forensic funds flow methodology

• Other laundering mechanisms

• The involvement of accounts at Russian Banks

• Detailed analysis of the destination of funds

• Inventory of electronic data collected and reviewed

Privileged and Confidential 10

Privileged and Confidential 11

Roseau Roseau Alliance LLP, the company to which the

Privileged and Confidential 12

3"The Shor Group

Privileged and Confidential 13

Privileged and Confidential 14

Privileged and Confidential 15

Privileged and Confidential 16

37 Univet Invest SRL y y y y y

Privileged and Confidential 17

3.2 Moldovan Shor Group Companies identified to date (77 Companies)

Privileged and Confidential 18

25 Dasler Con SRL y y y

27 Decfin Grup SRL y y

29 DFM Prim SRL y

34 Firma Diagras S.R.L y

Privileged and Confidential 19

+ 37 ICS Bogdan & Co SRL

·+ 41 JCS Kotinvest SRL y

Privileged and Confidential 20

60 Riolit Sistem SRL y

62 Samit Plus SRL y

66 SC IDS Grup S.R.L y y