Money Does Not Move Itself

The flow is the easy part. The hand on the valve is the work.

Last June, the U.S. Department of Justice unsealed a 22-count indictment against Iurii Gugnin, a Russian national living in Manhattan. Through his cryptocurrency payment company, Evita, he moved more than $530 million through the U.S. financial system on behalf of customers holding funds at sanctioned Russian banks, including Sberbank, VTB, and Tinkoff. The counterparties were scrubbed from more than 80 invoices. This April he pleaded guilty and agreed to forfeit over $1.2 million.

The transactions were always there to be seen. Crypto moves on a public ledger, and the flow of value through Evita was, in principle, traceable by anyone with the tools and the patience to follow it. Transparent ledgers are a genuine gift to investigators. But the ledger did not say that one man held the titles of President, Treasurer, and Compliance Officer at the same time, which meant the person responsible for catching the laundering was the person doing it. It did not say the money originated at sanctioned banks, and it did not name the people on the other end. Those facts were established by investigators who tied infrastructure to entities, and entities to a flesh-and-blood person in a $19,000-a-month apartment.

We even know what that person was worried about. According to the DOJ, Gugnin searched things like “how to know if there is an investigation against you” and “am I being investigated?” The ledger never showed his intentions to evade sanctions and launder money. This is the part of financial crime work that gets the least attention and matters most. Money does not move itself. Behind every transaction is a company, and behind every company is a person who decided to send it. Data and tracing carry you a long way, but they stop at the point where a flow has to be attached to someone who can be named, located, and held accountable.

This Was Never a Crypto Problem

It is tempting to treat the Gugnin case as a story about cryptocurrency, but it is not that easy. The same gap between visible flow and hidden control has defined money laundering and terrorist financing enforcement for decades, long before anyone had heard the name Satoshi Nakamoto.

Take 1MDB. Billions moved out of a Malaysian sovereign wealth fund through a maze of accounts and shell companies across multiple jurisdictions. The transactions were documented and processed by some of the largest financial institutions in the world, leaving a paper trail through the global banking system. What took years of investigative work was establishing that real, named individuals controlled those structures and directed the funds, above all Jho Low. The documents were never the hard part. Jho Low remains a fugitive today precisely because identifying the structure was achievable and locating the flesh-and-blood person who ran it was not.

Or Danske Bank’s Estonian branch, through which roughly 200 billion euros in suspicious transactions flowed. The activity was visible in the bank’s own systems. The failure was to connect non-resident accounts to their real beneficial owners rather than the shell structures named on the account-opening documents. The money was never hidden. The people behind it were.

The Problem the Leaks Exposed

When the Panama Papers broke in 2016, they made this visible at a scale the public could finally see. Millions of leaked records from a single offshore law firm revealed how routinely corporate structures are used to put distance between assets and the people who actually own them. Layered entities, nominee directors, and friendly jurisdictions turned beneficial ownership into something that existed on paper but pointed nowhere real.

The uncomfortable lesson is what came after. Panama was not a single event, it was the first in a series. The Paradise Papers, the Pandora Papers, and others that followed showed the same techniques still working, often through the same kinds of intermediaries, sometimes the very same ones. Each leak was treated as a scandal, but none of them ended the practice. Bad actors still hide behind these fronts because the fronts still function, and because the obscuring of ownership has become a normal, professionalized service rather than an exotic one. A corporate registry can tell you a company exists and who is nominally attached to it. It cannot, on its own, tell you who actually controls it, or which of them is sitting at a keyboard searching whether they are being investigated.

What This Means for the Work

There is a quiet assumption in some corners of financial intelligence that better data and better analytics will eventually solve the problem on their own. Or that AI slapped on top of all of this will produce magical results. Blockchain analytics, transaction monitoring, corporate registries, and beneficial ownership databases are all necessary. But having the pieces is not the same as solving the puzzle. You can own every piece on the table and still be left with the work of fitting them together into the picture of a sailboat, and that final assembly is where most of the value lives.

That work does not fit neatly into a dashboard, and reading corporate filings across jurisdictions can be boring and tedious. Mapping control structures, identifying nominees, connecting a company to the individual who actually directs it, and ultimately tying that individual to a real identity in a real place. It is open source intelligence and corporate intelligence layered on top of financial data, not in place of it.

The lesson of Gugnin, of 1MDB, of Danske, and of the leaks is the same lesson, repeated across decades and across technologies. The flow is the easy part. It exists on cryptocurrency ledgers, in SARs, in bank records, and in corporate registries. The transaction is visible almost by definition, because value usually has to move through systems that record it. What hides is the hand on the valve. Until a flow is tied to a person who can be named and located, an investigation has produced a map, not an outcome.

Meridian3 works at the intersection of OSINT, FININT, sanctions, and cryptocurrency investigation. Tying financial activity to the people behind it is the work we do.