Emails and chat logs also suggest that former Trump Ambassador to Germany and Acting Director of National Intelligence Ric Grenell may have met Wirecard COO Jan Marsalek who has now allegedly fled to Russia.February 11, 2021 1:08 pm
A businessman charged with large-scale bank fraud appears to be a central figure in the international Wirecard investigation and was reported to Cypriot authorities in 2017 for alleged money laundering. Companies controlled by Hamid “Ray” Akhavan, were also repeatedly flagged in Suspicious Activity Reports (SARs) in the U.S. and elsewhere by banks concerned about fraud, money laundering, and other potential financial crimes.
Forensic News reported in July that Akhavan was connected to suspected wrongdoing in the case of the now-defunct FBME Bank which was designated by the US Treasury Department as having facilitated, “money laundering, terrorist financing, transnational organized crime, fraud schemes, sanctions evasion, weapons proliferation, corruption by politically exposed persons, and other financial crimes.”
Akhavan, according to a confidential report by the business intelligence firm Kroll acquired in June by Forensic News, was the “controller or UBO [Ultimate Beneficial Owner] of the wrongdoing,” at FBME Bank. Key portions of the Kroll report are substantiated by the SARs.
The Wall Street Journal also reported in July that investigators were looking into Akhavan regarding the miraculous downfall of Wirecard, the financial technology company that collapsed after a $2 billion hole in their accounting records was discovered. Wirecard’s former COO, Jan Marsalek, is suspected of plundering Wirecard for hundreds of millions of dollars and being a Russian military intelligence asset.
Forensic News can now reveal that Akhavan, his companies, and associates were the subject of 105 SARs filed by banks in the U.S. and elsewhere in the past decade. The SARs appear to be part of the reason why Akhavan and his brother were being investigated by the Cyprus Unit for Combating Money Laundering (MOKAS).
Additionally, Forensic News has reviewed a second confidential report by Kroll which details Akhavan’s business connections to Wirecard, talked with multiple sources who have confirmed Akhavan’s proximity to Marsalek, and corroborated German media reports that Akhavan’s friendship with Marsalek dates back at least a decade.
The information included in the SARs and Kroll reports also calls into question claims made by a lawyer in a legal threat to Forensic News sent after our report in June.
SARs are not proof of wrongdoing or criminal behavior. Many of these government reports are not followed with charges and the documents themselves should not be considered conclusive. Akhavan has only been charged with conspiracy to commit bank fraud in New York, not related to FBME Bank or Wirecard. He has not been charged or accused by authorities in any proceedings related to FBME Bank or Wirecard.
Suspicious Money Transfers
In May 2017, four days after the Tanzania-based FBME Bank had its banking license revoked in the African country, Cypriot authorities contacted the US Treasury Department looking for information on Ray Akhavan and related entities pursuant to their own money-laundering investigation into the Cyprus branch of FBME.
The Financial Crimes Enforcement Unit (FinCEN) responded in an official memorandum to MOKAS in Cyprus on May 9, 2017, saying in part, “Law enforcement research is positive. Financial database research returned 105 Suspicious Activity Reports (SARs).” The SARs document over a billion dollars worth of suspicious money transfers by Akhavan’s
Most of the companies under Akhavan’s control are in the business of online gambling and pornography. This association has led some to dub Akhavan, “the porn baron.”
One such SAR mentioning Akhavan by name was filed by JP Morgan Chase in 2012 for suspicious wire transfers and suspicious source of funds.
Forensic News is redacting the name of most Akhavan’s associates and business partners but naming Akhavan because of the public interest regarding his activities and the criminal indictment in New York on charges of conspiracy to commit bank fraud.
The Suspicious Activity Report filed by JP Morgan Chase goes on to list a series of suspects identified in connection to Akhavan and suspicious transfers of hundreds of thousands of dollars.
“The rationale behind the activity is unknown and the source and use of funds is unclear. The relationships appear to be established in order to avoid transparency and add unnecessary layers to the movement of funds. The suspicious activity occurred between 01/04/2012 and 09/17/2012 totaling $520,621.54. All counterparties and transactions are suspicious…”
At the end of the SAR, the analyst at JP Morgan Chase notes that Akhavan and his brother, Ardeshir, were reported to Cypriot money laundering authorities.
Akhavan and companies in the business of affiliate marketing for online pornography websites connected to him and his brother were separately mentioned in a SAR filed by the Royal Bank of Canada (RBC).
The bank noted multiple examples of suspicious wires totaling over $20 million dollars involving Akhavan-connected company accounts. Incoming wires came from Canada, the U.S., Austria, and St. Kitts, whereas outgoing wires went to the U.K., Cyprus, the U.S., the Philippines, and Latvia.
Investigators often note that bank wires in numerous jurisdictions outside of a company’s domiciled country can be considered suspicious.
The companies also breached RBC’s cross-border account terms by engaging in online payment processing services, according to the SAR.
A third bank that found suspicious financial activity associated with Akhavan was Standard Chartered via its branch in New York.
The bank flagged eight transactions “with no apparent economic, business or lawful purpose,” between Akhavan’s Trade News Corporation and a company in the UK, Medina Networks Limited, that appeared to be a shell company, totaling over $1.7 million.
The bank filed the SAR in part because it could not establish a legitimate purpose for the large payments from Medina Networks, a potential shell company, to Trade News.
“The transactions reported in this narrative are considered suspicious because the unidentified originator appears to be a potential shell company with bank accounts in a high risk jurisdiction, outside of its country of domicile. Further, eight (8) large transactions, in round dollar amounts were conducted over a short period of time, which appears to reflect an activity burst followed by account dormancy. STANDARD CHARTERED BANK NY deemed these transactions as suspicious on 08/29/2016. The Branch has identified eight (8) transactions, received by TRADE NEWS and remitted by MEDINA NETWORKS, totaling $1,720,000.00, and the transactions specifically occurred from 07/19/2013 through 08/28/2013. The purpose of the transactions as stated in the Remittance References is “MEDINA TRANSFER.”
Shedding light on Medina Networks, featured in several SARs, is the aforementioned Kroll report on FBME Bank.
That report and all the SARs reviewed by Forensic News identified Medina Networks as an FBME Bank customer with close connections to Akhavan.
An email from an Akhavan associate to FBME Bank leadership cited by Kroll, said: “We are now using Medina fully as our new admin corporation in place of [another company].”
The Kroll report also said that Medina Networks was used by Akhavan to pay for business expenses such as private jet rentals.
A letter sent by attorney Anthony M. Glassman demanding the removal of the previous Forensic News article on Akhavan stated in part,
“The Kroll report also falsely accuses Mr. Akhavan of owning or having an affiliation with the following companies: CE Network, Internet Brand Group, Medina Network Limited, Hidalgo Limited, Broxon, Trading Limited, Vermillion Capital, and Fermoya Ltd. He neither owned those companies nor had a pecuniary interest in them.”
The Suspicious Activity Report between Trade News and Medina Networks suggests that this claim to be false.
The Kroll reports don’t come without their share of controversy, however. The investigators for the project, Alec Leighton and Nigel Brown, were sued by FBME bank owners after they were accused of breach of confidentiality for sharing their report not only with the owners who commissioned the reports but also with FinCEN in the U.S.
The judge overseeing the case found that Brown and Leighton breached confidentiality obligations by sharing the report with international regulators and that the reports were, in part, “premature and speculative.” Brown, however, told The Sunday Times that he is, “encouraged that our vindication may be on the horizon.”
Therefore, the Kroll reports should not be considered proof of wrongdoing.
Wirecard, Jan Marsalek, and Ray Akhavan
The SARs, interviews with people familiar with the situation, and German media reports also shed light on Akhavan’s connections to Wirecard – a line of inquiry that the F.B.I. and international investigators have been aggressively pursuing in recent months.
Multiple sources with direct knowledge of the situation confirmed to Forensic News that Akhavan and Marsalek have a relationship that dates back over a decade. According to these sources, Akhavan is a key figure in untangling Wirecard’s business operations with 3rd parties in the U.S. and elsewhere.
The close relationship between Akhavan and Marsalek is confirmed by reporting in the German outlet Stern, which obtained internal Wirecard emails.
“Marsalek and [Akhavan] called each other ‘Love’ and ‘Darling’ in their emails,” according to Stern. “In March 2014, the Wirecard manager also praised [Akhavan] as one of his ‘closest friends’; he is ‘the most honest and honorable person I know.’”
Kroll investigators, commissioned in 2015 and 2016 to provide corporate intelligence on FBME Bank in Cyprus, found that Akhavan’s “CE Network” of dozens of shell companies were integral in financial wrongdoing committed by the bank. Senior executives at the bank, “provided assistance to facilitate irregular financial transactions by Ray Akhavan, his associates and associated network of companies.”
One section of the Kroll report notes that, in 2012, the CE Network attempted to move some of their bank accounts from Wirecard to FBME.
Kroll quoted 2012 emails from an Akhavan associate (whose name is being redacted as he is not considered the mastermind of the network), stating that “we [the CE Network] would like to open up FBME bank accounts for companies we currently have at Wirecard.”
The emails prove that prior to 2012, Akhavan’s CE Network banked at Wirecard. Though the emails suggest that the network attempted to move “a significant component of its business” from Wirecard to FBME, other records indicate that many Akhavan companies continued to bank at Wirecard.
In 2012, a later email from an Akhavan associate asked Akhavan to contact his “darling Jan” in an attempt to find a different correspondent bank to clear the money flowing from various business accounts.
From the Kroll report, it is clear that multiple companies under the control of Akhavan continued to do business with Wirecard to the tune of many millions of dollars after 2012.
For example, the aforementioned Medina Networks continued to bank with Wirecard until at least 2014. Kroll said that Medina was used by Akhavan and associates for numerous purposes and that it had a balance of over $1 million dollars at Wirecard Bank as of mid-2014.
Other companies connected to Akhavan, such as Magnoliafield Limited, had over $1 million dollars at Wirecard Bank during the same time period.
Another tie to Wirecard lies with Akhavan’s co-defendant in the aforementioned bank fraud case in New York. Ruben Weigand, a German national who was charged alongside Akhavan, received $150,000 towards his bond and a letter of support from Markus Fuchs, a then-senior executive at Wirecard.
On his LinkedIn profile, Fuchs lists Wirecard as his employer for more than 13 years, most recently serving as VP of Global Sales.
Lawyers for Akhavan, including Glassman, did not respond to multiple invitations for comment.
DOJ Meeting and US Contacts
German media reported that in April 2016, Akhavan made contact with former CIA officialin order to potentially provide assistance to Akhavan and Marsalek after Wirecard’s offices were raided at the behest of the US Department of Justice.
Contacted by phone, Bernsten confirmed that he had discussions with Akhavan and Marsalek. “Ray made contact with me,” he said, “and asked to set up a meeting between Ray, Jan, and the US government.”
When asked to provide more information on his relationship with Akhavan, Bernsten declined, citing a Non-Disclosure-Agreement.
He did, however, confirm to Forensic News that a meeting took place between Akhavan, Marsalek, and DOJ officials. Berntsen also suggested that other agencies also had meetings with the two businessmen. The ex-CIA official stressed that he never attended any meetings, but simply used his contacts to facilitate discussions between Marsalek, Akhavan, and U.S. government officials.
The meetings, according to Berntsen, took place “many months” after the April 2016 emails. It is unclear if these meetings happened under the Obama Administration or the Trump Administration, though Marsalek and Berntsen both supported Trump and, at one point, Berntsen was labeled a surrogate for the Trump campaign. “I’m a surrogate for the campaign on this, and I’m working with their policy shop,” he said in July 2016.
One email from May 2018 that was quoted by Stern, said that Akhavan called Marsalek and Gary Berntsen, “my Dear Uncles,” before mentioning an attempt to move the Austrian Embassy in Israel from Tel Aviv to Jerusalem, shortly after President Trump had done so for the American outpost. Akhavan noted that this should be explored within the context of “business opportunities.”
Berntsen was allegedly not the only U.S. intelligence-connected contact of Marsalek’s. German outlet Capital reported that Marsalek met at least one time with then-US Ambassador to Germany, Richard ‘Ric’ Grenell. Telegram chat logs and emails obtained by the outlet show that “in mid-February 2020, [Marsalek] allegedly had a coffee meeting with the then US ambassador to Germany, Richard Grenell, who was appointed by Trump.”
Die Zeit, another German outlet reporting on the Wirecard scandal, obtained more contemporaneous messages from Marsalek’s telegram channel: “when a member of the supervisory board asked [Marsalek] for a phone appointment in January 2020, he had better things to do,” Die Zeit reported. “I’m having coffee with the American ambassador [at] Bayerischer Hof [a Munich hotel]. “This is Richard Grenell, Donald Trump’s envoy in Berlin.”
Chat logs from February 20, 2020, in Marsalek’s confidential Telegram channel shared with Forensic News by Stern and Capital prove that Marsalek told a senior Wirecard executive that he met Grenell. Forensic News is redacting the name of the Wirecard executive as he/she is not the focus of this investigation.
The chat log also shows that the Wirecard executive speculated that Grenell’s alleged meeting with Marsalek was somehow connected to Grenell’s appointment by President Trump to Acting Director of National Intelligence on February 19.
“As soon as he meets you he is recalled [from Ambassador to Germany]…” the senior Wirecard executive wrote, “and now [he] coordinates secret services…”
Capital reported on further contacts between Wirecard executives and Grenell: “Wirecard board members were indeed invited to exclusive rounds with Grenell again and again – for example in September 2018 via the lobby association Deutsches Aktieninstitut, in March 2019 at a conference at Tegernsee or in June 2020 for a zoom call from investor Christian Angermayer.”
Though it cannot be confirmed that Grenell had direct contact with Wirecard executives at those events, there is some evidence that supports the reporting. At the 2019 conference, where Wirecard was a key sponsor, Grenell was featured as a key speaker.
After publication, Grenell took to Twitter and denied ever meeting Marsalek, calling this report “fake news.”
Wirecard had many business dealings with Russian oligarchs and politicians close to the Kremlin.
Oil and gas oligarch Dmitry Firtash, who according to U.S. authorities is connected to Russian organized crime and the Russian government, opened multiple accounts at Wirecard Bank with the help of Marsalek in 2019 and 2020. According to the reports, Firtash was listed on the so-called “Marsalek list” of clients for Wirecard for whom the ex-COO of Wirecard personally vouched.
Firtash, who lives in Austria, was charged in the United States in 2013 with bribery, money laundering, and other illicit activities. He is currently appealing his extradition.
Other Wirecard customers, including politicians with offices in Moscow, have yet to be fully explored by journalists, though Forensic News continues to research the topic.
Berntsen, the former CIA official, previously appeared on Russian state television, Russia Today, though he denied to Forensic News that he spoke with any Russians in relation to Marsalek or Akhavan.
According to a bombshell report by Bellingcat, Marsalek began to visit Russia regularly in 2016. Over 16 trips to Russia were documented by Bellingcat, a “near-monthly pattern of visits; usually on weekdays and typically very short.”
In 2017, Marsalek was detained by the Russian intelligence agency FSB. Bellingcat wrote that the detention “may have been a turning-point, during which he may have been blackmailed through compromising material, or incentivized, into collaboration. A third explanation for the monitoring may be preexisting collaboration between him and a competing security agency – such as the GRU – the international activities of which the FSB may have been interested in monitoring.”
By mid-2020, shortly after the collapse of Wirecard, Marsalek fled Germany. Multiple reports, citing sources familiar with the matter, said that Marsalek is living in a Russian military intelligence safe-house in Moscow. He is currently on Interpol’s Most Wanted list.