Executive Summary and Exchange Overview
| Service type | Russia-focused crypto-fiat exchange: order-book spot, zero-commission P2P desk, physical cash desks, OTC/merchant rails; ruble-to-crypto on/off ramp |
| Legal entity | Rapira Group LLC Confirmed [UK FCDO RUS3605; Georgian registry] |
| Aliases / branding | Rapira; @rapira.team (Instagram); domains rapira.net / .io / .org / rapira24.ru / rapiras.ru |
| Entity registration jurisdiction | Georgia: registration code 412771852, registered 9 Nov 2022; assessed by Georgian MoF as purely formal (no assets, accounts, or offices) Confirmed |
| Infrastructure hosting jurisdiction | Russia: rapira.net via Russian registrar REG.RU; Moscow City offices. Secondary UK shell (Rapira Group Ltd, Liverpool) of disputed relevance Credible |
| Assessed operator location | Moscow, Russia (Moscow City offices; Russian-language interface; RUB-only fiat) Credible. Controlling beneficial owners behind the nominee structure unidentified Analyst Inference |
| Operational period | Domain created 16 Sep 2022; corporate registration 9 Nov 2022; active through Garantex-successor surge (Mar 2025); Georgian liquidation 13 May 2026; infrastructure partially live June 2026 |
| Volume (bilateral) | TRM: >$543M total bilateral, $375.6M with Grinex (May 2026). Elliptic: >$72M Rapira–Grinex direct (Feb 2026). Figures use different methods and windows; presented separately, not averaged Confirmed (metrics); Single Source each |
| Geographic footprint | Russia-centric: Russian-language only, RUB-only fiat, offices in Moscow, Kazan, Rostov-on-Don, Yekaterinburg; exclusively Russian clientele per Georgian MoF |
| UK designation | Designated 26 May 2026, Russia (Sanctions) (EU Exit) Regulations 2019, RUS3605; asset freeze plus four further measures Confirmed [UK FCDO] |
| OFAC designation | None as of June 2026 Confirmed (negative evidence) |
| EU designation | No entity-specific Rapira listing. EU 20th package (adopted 23 Apr 2026; crypto measures from 24 May 2026) bans EU transactions with Russian CASPs broadly Confirmed |
| Designated digital address | bc1q72ud4m6zf5g37jkhc2ty95zm5vel9ufdxquqpm (Bitcoin Bech32; UK RUS3605) Confirmed |
| State nexus tier | TOLERATED SAFE HARBOR; documented indicators toward PROBABLE COOPERATION; no DIRECT CONTROL evidence |
| Status | Sanctioned (UK); in Georgian liquidation; infrastructure partially operational; no named successor brand observed |
| Blockchain analytics coverage | TRM Labs (bilateral figures, May 2026); Elliptic (entity-specific, Feb 2026, updated Mar 2026); Chainalysis (A7 package coverage, May 2026) |
Lineage and Organizational Heritage
No Direct Predecessor; Garantex-Successor Absorber by Function
Evidentiary Pillars
| Pillar | Evidence | Confidence |
|---|---|---|
| No corporate predecessor | No source identifies a prior brand Rapira rebranded from. Domain rapira.net created 16 Sep 2022; Georgian entity registered 9 Nov 2022, with the domain preceding registration by roughly seven weeks. | CONFIRMED WHOIS; Georgian registry; negative evidence |
| Garantex / Grinex succession context | Garantex (OFAC 2022, disrupted Mar 2025) reconstituted as Grinex using the same on-chain fingerprint (TRM). Rapira absorbed displaced volume; TRM noted Rapira's volume "continued to grow" into April 2025 even as ABCeX dropped off. | CONFIRMED TRM Labs |
| A7 network membership | UK designation places Rapira within the A7 network, a centrally coordinated sanctions-evasion architecture the UK says moved over $90 billion in the prior year. TRM positions Rapira among the successor-exchange set (Rapira, Aifory Pro, Grinex.io, ABCex, A7, A7A5/Old Vector). | CONFIRMED UK FCDO; TRM Labs |
| No shared codebase / white-label evidence | No open report states Rapira runs a shared or white-labeled codebase with Garantex/Grinex or other peers. Software-level lineage is unknown. | UNKNOWN Negative evidence; investigative gap |
Operator Profiles
Confirmed Ilyas Ahaev (Ilias Ahaevi), British national: director and 100% owner of Rapira Group LLC (Georgian reg. 412771852), and liquidator as of May 2026. The Georgian Ministry of Finance assesses the company was "registered in Georgia formally, by proxy, by a British citizen," a nominee/power-of-attorney structure designed to establish legal presence without actual presence. Assessed location unknown; no indictment or arrest. The entity designation applies a director disqualification measure to Ahaev in his directorial capacity, but he is not individually SDN-listed. [Georgian MoF; Caucasus Watch; UK FCDO]
Credible Gashim Guseinov, Russian national resident in the UK (DOB Nov 1984): sole director and Person with Significant Control of Rapira Group Ltd (UK Companies House no. 16618607), incorporated in Liverpool on 31 July 2025 at 73 Sheil Road. Single Source Correction to the source draft: Companies House records list this entity's registered activities as electrical installation, plumbing/heat/air-conditioning, and other specialised construction, not financial services. The inference that the UK entity is a deliberate pre-positioned crypto-exchange shell is therefore weaker than the draft implies; the name match may be coincidental or the entity may be a separate nominee vehicle. Treat any Rapira-exchange linkage as CREDIBLE at best, not confirmed. [Companies House; Endole]
Credible Vagharshak Nersisyan: WHOIS registrant for rapira.net as of mid-2025, listed as "Private Person," registered via Russian registrar REG.RU (+7). The Russian registrar corroborates the assessment that the platform's true operational nexus is Russia despite Georgian registration. Identity and operational role not further documented. Single Source [WHOIS / Gridinsoft]
Disputed Assessments
Analyst Inference The source draft treats the Liverpool entity's July 2025 incorporation (weeks before the September 2025 Moscow raids and months before the UK designation) as evidence of deliberate infrastructure migration in anticipation of regulatory pressure. Given the construction SIC codes and the absence of any financial-services registration, this timing inference is unresolved: it is equally consistent with an unrelated company or a nominee vehicle with no exchange function. Flagged as a single-source inference, not a finding. [Analyst assessment]
Service Model and Business Operations
Exchange Mechanics and Product Set
Credible Rapira operates a multi-channel Russian-market exchange: order-book spot trading in crypto-crypto and crypto-RUB pairs (BTC, ETH, USDT, TON); a zero-commission P2P desk supporting banks, payment systems, and physical cash; physical cash desks in Moscow (Moscow City / Federation area), Kazan, Rostov-on-Don, and Yekaterinburg with cash transactions reportedly from roughly 10,000 RUB, available 24/7; and an OTC/merchant component advertising "crypto merchant, auto-conversion and auto-payments." A documented API (rapira.apidog.io) indicates B2B/automated-trading infrastructure. [rapira.io; review sources; cdn.rapira.net]
KYC/AML Posture: Stated Policy vs Observed Behavior
Observed behavior (sourced to LE/intelligence framing, not the exchange's claims): Ukrainian sanctions intelligence states Rapira "allows cryptocurrency exchange without mandatory verification" and "actively uses P2P and cash transactions." A non-KYC withdrawal threshold of roughly $10,000/day was documented in a 2023–2024 review, calibrated below standard Travel Rule triggers. No Travel Rule compliance, transaction-monitoring alerts, or enhanced due diligence is documented. The clearest observed failure is the acceptance of $72M–$375.6M (Elliptic / TRM) in flows with Grinex, a publicly flagged Garantex continuation, without documented EDD. The gap between a self-marketed AML tool and observed high-risk counterparty acceptance is the primary analytical finding. Confirmed [Ukrinform/Vlasiuk; Elliptic; TRM]
Fiat Rails (Schema Rule: Must Be Addressed)
Credible Bank relationships: Per Ukrainian sanctions intelligence, Rapira integrated payment rails to OFAC-sanctioned Russian banks including Sberbank, VTB, Gazprombank, and Promsvyazbank, enabling direct card/transfer on-ramps for Russian retail users. These integrations are sourced to Ukrainian intelligence (Vlasiuk / Ukrinform), not to a primary OFAC or charging document, so the specific bank list carries single-strong-source confidence. Single Source [Ukrinform; MenaFN]
Confirmed Cash desk: Physical Moscow City offices accepted and dispensed cash; the September 2025 raids seized more than $10 million, 100 million rubles, and 200,000 euros at exchange offices in the Moscow City area, with Rapira and Mosca the primary targets. P2P: the P2P desk enables informal buyer-seller matching outside standard banking rails; no documented bank partner for P2P settlement. De-risking: after the September 2025 raids, withdrawals were suspended while the app remained operational; Belarus-based Cifra Markets terminated operations with Rapira post-UK designation. [Cryptopolitan; Binance Square; RBC]
Licensing and Regulatory Standing
Confirmed Rapira advertises license "№0110/587, Financial Service & Crypto Exchange." Georgian MoF investigators and independent review sources confirm this license corresponds to no recognized Georgian regulatory body, the stated regulator does not exist, and the company was not found in the registry of the National Bank of Georgia. The Georgian registration (412771852) is confirmed but assessed as purely formal, with no actual activity in Georgia. There is no Central Bank of Russia license and no FATF-aligned licensing in any documented jurisdiction. [Georgian MoF; review sources]
Technical Infrastructure and Platform Footprint
Domain Portfolio
| Domain | Notes |
|---|---|
| rapira.net | REG.RU LLC (Russian registrar); created 16 Sep 2022; registrant Vagharshak Nersisyan |
| rapira.io | Active as of June 2026; listed in UK designation |
| rapira.org | Listed in UK designation; contact mail@rapira.org |
| rapira24.ru | Russian ccTLD; listed in UK designation |
| rapiras.ru | Russian ccTLD; listed in UK designation |
Confirmed Support emails support@rapira.net, support@rapira.org, mail@rapira.org. The presence of two Russian ccTLD domains alongside the .net/.io/.org portfolio is structurally consistent with a Russia-primary operation maintaining offshore domain coverage for resilience. [OpenSanctions; UK designation]
Apps, API, and Channels
Credible Rapira's Instagram (@rapira.team) references a mobile platform and app-based services. A documented API (rapira.apidog.io) supports automated order placement. No app-store removal event is documented as of June 2026, though the UK Internet Services Sanction may trigger removal requests for UK users. A Telegram presence is consistent with Russian-market norm but no specific channel identifier was documented. Single Source (Instagram only on social footprint) [Instagram; rapira.apidog.io]
Platform Architecture
Analyst Inference No independent documentation of white-label versus proprietary architecture, cold/hot wallet structure, or blockchain node configuration was found. The in-house AML tool (rapira.net/aml) suggests some internal blockchain-analysis capability, but its depth is unverified. [Inference from platform materials]
Designated Bitcoin Address
Confirmed The UK designation (RUS3605) lists one designated digital address: bc1q72ud4m6zf5g37jkhc2ty95zm5vel9ufdxquqpm (Bitcoin Bech32/SegWit). Any VASP or compliance team encountering this address should treat it as a designated-entity address subject to UK asset-freeze obligations and as a high-risk indicator elsewhere. No OFAC-designated Rapira wallet addresses exist. [UK FCDO RUS3605]
Resilience After Disruption
Confirmed Following the 26 May 2026 UK designation, rapira.io remained accessible. The five-domain portfolio provides resilience: if one domain is blocked or removed, others remain. The UK Internet Services Sanction requires UK-facing ISPs and app stores to take "reasonable steps" to block access, which does not produce immediate global domain takedown. No customer-migration messaging following the designation has been documented. [rapira.io; OpenSanctions]
Financial Intelligence and On-Chain Analysis
Volume (Cite Source and Methodology; Do Not Average)
TRM Labs (May 2026): Huobi (HTX) flows to Rapira grew from $30M (26 months pre-takedown) to $184M (14 months post-takedown).
Elliptic (Feb 2026, updated Mar 2026): >$72M in direct Rapira–Grinex flows.
ABCeX → Rapira (TRM): $38.1M. Aifory Pro ↔ Rapira (TRM): $2.9M.
These figures cover different windows and wallet-cluster thresholds and are presented separately, not combined or averaged.
Three-Phase On-Chain Flow (Rapira as Node)
Phase 1: Receipt
Confirmed Primary inbound counterparty is Grinex ($375.6M TRM / $72M+ Elliptic). ABCeX sent $38.1M to Rapira (TRM); ABCeX is tied to Garantex co-founder Sergey Mendeleev and was Garantex's third-largest on-chain counterparty. Huobi/HTX is a persistent upstream source ($184M post-takedown). Indirect receipt via fiat on-ramps through sanctioned Russian banks is credible (Ukrainian intelligence). Credible Ransomware/darknet receipt is inferential: no Rapira-specific actor-level attribution has been published by TRM, Elliptic, or Chainalysis; the inference rests on Grinex/Garantex's documented clientele and Rapira's role as a primary Grinex counterparty. [TRM; Elliptic]
Phase 2: Layering
Credible RUB-to-crypto conversion via spot and P2P; funds enter USDT (TRON/Ethereum) and BTC. Single Source Analyst Inference Whether Rapira's specific flows transited the A7A5 ruble-pegged stablecoin (a primary network layering instrument; the UK cites A7A5 processing $9.3 billion in four months) versus standard stablecoin forms is not documented at the Rapira-cluster level. No mixing, chain-hopping, or coinjoin specific to Rapira wallet clusters is documented in reviewed reports. [TRM; UK FCDO]
Phase 3: Extraction
Confirmed Cash desks provided direct cash-out (estimated $10M+ in cash seized September 2025); the P2P desk enables OTC cash conversion. The Russian capital-flight investigation premise was that funds were moved to Dubai via crypto channels; Rapira denied a direct Dubai link, and the matter remained a procedural check (no criminal case opened as of late-2025 reporting). No specific downstream receiving exchange for Rapira-originating flows is documented. [Cryptopolitan; RBC; Binance Square]
Designated Addresses and Sanctions Summary
| Authority | Action | Date / Status |
|---|---|---|
| UK FCDO (RUS3605) | Asset freeze; Reg. 17A correspondent banking/payment ban; Internet Services; Director Disqualification; Trust Services. Designated BTC address bc1q72ud4m6zf5g37jkhc2ty95zm5vel9ufdxquqpm | 26 May 2026; active |
| OFAC | No designation | Not designated as of June 2026 |
| EU | No entity-specific Rapira listing; 20th package bans EU transactions with Russian CASPs broadly (A7A5/RUBx/digital ruble in Annex LIII) | Adopted 23 Apr 2026; crypto measures from 24 May 2026 |
| FATF | No FATF-specific Rapira listing; Georgia is the registration jurisdiction | N/A |
Client Profile and Criminal Use
Crimeware Verticals by Evidence Tier
| Actor type | Evidence | Confidence |
|---|---|---|
| Russia sanctions-evasion entities | Direct on-chain flows with Grinex ($72M–$375.6M); ABCeX $38.1M; Huobi $184M; integration with OFAC-sanctioned Russian banks; UK designation language. | CONFIRMED |
| Russian capital flight (individual/corporate) | September 2025 Moscow raid context; Dubai-transfer investigation; physical cash-desk operations. | CONFIRMED |
| A7 network participants | UK designation places Rapira within the A7 network; TRM positions it in the successor-exchange set. | CONFIRMED |
| Ransomware proceeds (indirect) | Role as primary Grinex counterparty; Garantex/Grinex's documented ransomware clientele (Conti, Black Basta, LockBit, NetWalker, Ryuk). No Rapira-specific ransomware-flow attribution published. | CREDIBLE |
| Darknet market proceeds (indirect) | Same inferential chain; Garantex served darknet markets as top clients; Rapira inherits the risk profile as a Grinex counterparty. No Rapira-specific DNM attribution published. | CREDIBLE |
| Illicit Chinese-trade intermediation | Moscow raid investigation referenced crypto payments to Chinese factories for drone/military components; no Rapira-specific attribution to this sub-category. | POSSIBLE (INFERENCE) |
Geographic Patterns
Confirmed All documented activity is Russia-centric: Russian-language interface, RUB-only fiat, Russian bank integrations, physical offices exclusively in Russia, Russian-registrar domain, and Georgian registration confirmed as purely nominal with exclusively Russian clientele. No documented CIS exclusion or geo-IP restriction. [Georgian MoF; review sources]
High-Profile Flows
Confirmed (aggregate) No Rapira-specific, individually named criminal-actor flows with attributed dollar amounts have been published. The $375.6M Grinex flow and $543M total (TRM) are aggregate counterparty-level attribution, not individual actor attribution. This is a documented intelligence gap (Section 10). [TRM; Elliptic]
State Nexus Assessment
Jurisdictional Separation (Schema Rule: Three Jurisdictions)
| Jurisdiction type | Assessment | Confidence |
|---|---|---|
| 1. Entity registration | Georgia: Rapira Group LLC, reg. 412771852, registered 9 Nov 2022. Assessed by Georgian MoF as purely nominal (no assets, accounts, or offices). | CONFIRMED |
| 2. Infrastructure hosting | Russia: rapira.net via Russian registrar REG.RU; Moscow City offices. Secondary UK shell (Rapira Group Ltd, Liverpool) of disputed relevance (construction SIC codes). | CREDIBLE (Russia) / DISPUTED (UK shell) |
| 3. Assessed operator location | Moscow, Russia: Moscow City offices; legal firm Mushailov, Uzdensky, Rybakov & Partners represented owners during the raids. Controlling beneficial owners behind the nominee unidentified. | CREDIBLE (Moscow) / UNKNOWN (beneficial owners) |
State Nexus Tier: TOLERATED SAFE HARBOR (indicators toward PROBABLE COOPERATION)
Indicators toward Probable Cooperation: Rapira began absorbing Garantex/Grinex volume within three days of the March 2025 takedown, suggesting advance knowledge or coordination; integration with state-controlled/linked banks (Sberbank, VTB, Gazprombank, Promsvyazbank) ties it to the state financial sector; and membership in the A7 network (which the UK valued at roughly half of Russia's annual military budget) is implausible at scale without state awareness.
Evidence against Direct Control: no documented state ownership, operational control, or FSB/Rosfinmonitoring officer assignment; deliberate jurisdictional obscuration (Georgian nominal registration, British nominee owner) is inconsistent with a state-operated entity; and Russian security forces did raid Rapira (the state does not typically raid itself).
Negative Evidence (Expected if Higher Nexus Existed)
If Rapira were under PROBABLE COOPERATION or DIRECT CONTROL, one would expect documented Rosfinmonitoring or FSB operational links, communications or coordination with Russian intelligence, or explicit state protection signaling. None are present. The September 2025 raid is the strongest single piece of evidence against the higher tiers. The assessment therefore holds at TOLERATED SAFE HARBOR, with the coordination and state-bank-integration indicators logged as escalation signals to monitor. Analyst Inference
Law Enforcement and Regulatory Response
UK Designation (Primary Action)
Five measures imposed: Asset Freeze; Correspondent Banking Sanctions and processing payments (Regulation 17A); Internet Services Sanctions; Director Disqualification Sanction; and Trust Services Sanctions. Designated digital address: bc1q72ud4m6zf5g37jkhc2ty95zm5vel9ufdxquqpm. The Regulation 17A measure prohibits UK credit/financial institutions from maintaining correspondent relationships with Rapira and from processing any payment where Rapira appears anywhere in the chain, transforming UK VASP compliance from name-screening to full transaction-chain tracing. Confirmed [UK Sanctions List; Elliptic]
Sanctions and Enforcement Summary
| Authority | Action | Status |
|---|---|---|
| UK (FCDO / OFSI) | RUS3605, 26 May 2026; five measures; within 18-entity A7/crypto package (incl. Huobi/HTX, Exmo, Bitpapa, Aifory, ABCeX/Nueva Cryptologia). | CONFIRMED (asset freeze in force) |
| Russia (FSB-adjacent) | September 2025 Moscow City raids; Rapira and Mosca primary targets; cash, hardware, documents seized; capital-flight/Dubai investigation; procedural check, no criminal case as of reporting. | CONFIRMED (raid); operations resumed |
| Georgia (MoF Investigation Service) | 26 May 2026: ongoing investigation; determined Rapira registered formally by proxy by a British citizen, served only Russian citizens, no Georgian financial activity, no assets or offices. Co-designated Georgian entities (Aifory, Arvix/Arvira) produced criminal convictions; no parallel Rapira-specific conviction documented. | CONFIRMED |
| OFAC (U.S.) | No designation of Rapira. OFAC's March 2025 action targeted Garantex; subsequent Russia actions focused on Grinex and stablecoin infrastructure. | CONFIRMED (negative evidence) |
| EU | No entity-specific Rapira listing. 20th package (adopted 23 Apr 2026; crypto measures from 24 May 2026) bans EU transactions with Russia-based CASPs broadly. | CONFIRMED (no individual listing) |
| FinCEN / DOJ | No Section 311 action, advisory, indictment, or criminal complaint naming Rapira located in open sources. | CONFIRMED (negative evidence) |
Timeline
Post-Sanction Reconstitution Assessment (Schema Rule)
Post-designation status: rapira.io remained accessible as of late June 2026; the five-domain portfolio and the non-immediate nature of Internet Services Sanctions sustain access for non-UK users.
Displaced-funds trajectory: No named successor brand or customer-migration message is documented. Given the Garantex→Grinex precedent and the A7 architecture, displaced Rapira volume would be expected to shift to remaining venues, most of the named A7 set having been co-designated, leaving undesignated lower-profile Russia-market OTC brokers, Telegram-based P2P channels, and the A7A5 stablecoin ecosystem as the most probable near-term absorbers. Credible [UK FCDO; TRM]
Connected Entities and Ecosystem Relationships
Tier 2, Facilitation assessment: an analytical characterization of Rapira's role: Active facilitation, Structural enablement, or Incidental processing. The two tiers are independent and never collapsed.
| Entity | Tier 1: Transaction confidence | Tier 2: Facilitation | Vendor coverage |
|---|---|---|---|
| Grinex Garantex successor (disrupted/hacked Apr 2026) |
CONFIRMED $375.6M (TRM) / $72M+ (Elliptic); flows began 10 Mar 2025, three days post-Grinex launch. |
Active facilitation Beginning flows with a newly launched entity carrying Garantex's on-chain fingerprint three days after launch implies a knowing relationship, not incidental processing. |
Corroborating: TRM, Elliptic, Chainalysis. None disagreeing. |
| A7 network / A7 LLC / A7A5 Co-designated evasion architecture |
CONFIRMED UK designation places Rapira in the A7 network and successor-exchange set; on-chain flows with A7-ecosystem entities documented by TRM. |
Structural enablement RUB-only fiat, no KYC, P2P + cash desk, and sanctioned-bank integrations are structurally designed to enable A7-style ruble-to-crypto conversion at scale. Active facilitation is plausible but the Rapira-specific A7A5 transit is unquantified. |
Corroborating: UK FCDO, TRM, Elliptic. No Rapira-specific A7A5 figure published. |
| ABCeX / Nueva Cryptologia Co-designated Russia-based exchange |
CONFIRMED $38.1M from ABCeX to Rapira (TRM). Both co-designated in the same UK package. |
Structural enablement Mutual high-risk counterparty relationship; no evidence of joint operations specific to Rapira. |
Corroborating: TRM; UK FCDO. None disagreeing. |
| Huobi / HTX Co-designated global exchange |
CONFIRMED TRM: Huobi flows to Rapira grew from $30M to $184M pre vs post Garantex takedown. |
Structural enablement Large-exchange liquidity source upstream of Rapira; no evidence of direct operator coordination. |
Corroborating: TRM. Huobi/HTX publicly disputes that the sanctioned entity equals its operating brand. |
| Aifory Pro Co-designated ruble-to-crypto onramp |
CONFIRMED TRM: $2.9M bilateral Aifory↔Rapira (small relative to Aifory's ABCeX flows). |
Incidental processing Low-value bilateral exposure; no evidence of knowing per-actor coordination at this scale. |
Corroborating: TRM. None disagreeing. |
| Garantex (pre-disruption) OFAC-sanctioned exchange (disrupted Mar 2025) |
CREDIBLE TRM identified Rapira as a primary post-disruption volume absorber; no specific pre-Mar 2025 direct Garantex→Rapira figure documented. |
Structural enablement Absorbed former Garantex customers via Grinex succession; no evidence of knowing pre-disruption coordination with Garantex operators. |
Corroborating: TRM. No direct bilateral figure published. |
| Sanctioned Russian banks Sberbank, VTB, Gazprombank, Promsvyazbank |
CREDIBLE Ukrainian sanctions intelligence reports integrated payment rails; no primary OFAC or charging-document corroboration. Single Source |
Structural enablement Fiat on-ramps through these banks predictably enable Russia-market evasion at scale; from the banks' standpoint, processing is incidental. |
Corroborating: Ukrinform/Vlasiuk. No vendor on-chain confirmation of the specific bank list. |
| Ransomware groups (Conti, LockBit, Black Basta, et al.) Via Grinex/Garantex chain |
ANALYST INFERENCE No Rapira-specific attribution of named ransomware-actor flows in any published analytics report. Single Source on the underlying Garantex clientele claim (ICIJ/virtual-routes). |
Structural enablement KYC/AML failures predictably enabled processing of funds from actors who previously used Garantex/Grinex; no evidence of knowing coordination with specific groups. |
Corroborating (underlying Garantex clientele): TRM, Elliptic, ICIJ. No Rapira-specific actor attribution published. |
Trajectory Assessment
Market Position and Volume Trends
Confirmed Rapira grew from a minor Russia-market exchange into one of the leading ruble-to-crypto venues absorbing the post-Garantex vacuum. TRM's $543M total bilateral attribution, Huobi inflows growing $30M→$184M, and Grinex flows beginning within three days of its launch indicate a rapid, deliberate capacity build-up. [TRM]
Disruption Impact
Reconstitution Status
Brand: Sanctioned and liquidating, infrastructure partially live. Georgian liquidation since 13 May 2026; rapira.io accessible as of late June 2026; no named successor brand observed. Confirmed
Pre-positioning: Mixed. Liquidation timing two weeks ahead of designation is a credible hedging signal; the Liverpool entity's relevance is disputed (construction SIC codes). Credible / Single Source
Future risk: Continuity over clean reconstitution. With no seizure, no arrests, and a Russia-resident operation, the service can persist for non-UK users; displaced volume most likely routes to undesignated OTC brokers, Telegram P2P, and the A7A5 ecosystem. Credible
Intelligence Gaps
Recent Reporting
[26 May 2026] UK FCDO designates Rapira Group LLC (RUS3605) and 17 other entities/individuals in the A7/crypto package; TRM publishes accompanying analysis attributing >$543M bilateral and $375.6M with Grinex to Rapira, and Huobi→Rapira growth of $30M to $184M. [UK FCDO; TRM]
[26 May 2026] Georgia's MoF Investigation Service confirms Rapira was registered formally by proxy by a British citizen, served only Russian citizens, and had no Georgian financial activity or assets. [Georgian MoF; Caucasus Watch]
[13 May 2026] Rapira enters Georgian liquidation (Ilyas Ahaev owner and liquidator), two weeks before the UK designation. [Georgian registry]
[23 Apr 2026] EU adopts its 20th sanctions package; crypto measures (broad ban on EU transactions with Russian CASPs; A7A5/RUBx/digital ruble added to Annex LIII) apply from 24 May 2026. No entity-specific Rapira listing. [Council of the EU; TRM; Chainalysis]
[21 Feb 2026, updated 3 Mar 2026] Elliptic names Rapira among Russia-linked sanctions-evasion exchanges: >$72M direct Rapira–Grinex flows; Moscow office raided over suspected Dubai capital flight. [Elliptic]
[Sep–Oct 2025] Russian security forces raid Moscow City crypto offices (Rapira and Mosca primary targets); cash and hardware seized; operations resume within days. [Cryptopolitan; RBC; Binance Square]
Sources
- UK Sanctions List: RAPIRA GROUP LLC, designation RUS3605 (26 May 2026; asset freeze, Reg. 17A correspondent banking, internet services, director disqualification, trust services; designated BTC address)
- UK Government: List of Russia sanctions designations, 26 May 2026 (18-entity A7/crypto package incl. Rapira Group LLC)
- UK FCDO: UK cracks down on backdoor Russian sanctions evasion with tough new measures (26 May 2026; A7 network ~$90B/year)
- TRM Labs: UK Designates Huobi, Exmo, Bitpapa, and 11 Other Entities (Rapira: >$543M bilateral, $375.6M Grinex from 10 Mar 2025, Huobi $30M→$184M) : 26 May 2026
- Elliptic: Russia-linked cryptocurrency services and sanctions evasion (Rapira: Georgia-incorporated, Moscow office, >$72M Rapira–Grinex, Dubai capital-flight raid) : 21 Feb 2026 (upd. 3 Mar 2026)
- Elliptic: UK designates cryptoasset exchanges including HTX in sweeping new sanctions package (Regulation 17A extended to crypto; full-chain tracing) : 26 May 2026
- Chainalysis: UK Sanctions Crypto Companies With Russia Ties (A7 Network; Grinex direct Garantex successor) : May 2026
- CryptoPotato: UK Sanctions 18 Crypto Firms Tied to Russia's $90B War Network (Rapira $543M / $375.6M Grinex) : May 2026
- UK Companies House: RAPIRA GROUP LTD (16618607), Liverpool, incorporated 31 Jul 2025; registered activities construction/plumbing; director Gashim Guseinov
- UK Companies House: RAPIRA GROUP LTD officers (Guseinov, Gashim; Russian national, resident UK; DOB Nov 1984; 73 Sheil Road, Liverpool)
- Caucasus Watch: The UK Sanctions Georgian Companies (Rapira registered through a proxy by a British citizen; Ilias Ahaevi)
- Business Insider Georgia: Georgian MoF Investigation Service (Rapira registered formally by proxy; served only Russian citizens; no Georgian activity)
- Georgia MoF Investigation Service: Statement on Rapira, Aifory, Arvix investigations
- Cryptopolitan: Russia raids crypto exchange offices in Moscow City (Rapira and Mosca; capital flight to Dubai; cash seized) : Sep 2025
- Cryptopolitan: Raided Russian crypto exchanges resume operations (Mosca immediately; Rapira app operating, withdrawals inactive) : Oct 2025
- RBC: Rapira responds to reports of security-forces raids (denies Dubai-transfer link) : 27 Sep 2025
- Ukrinform (Vlasiuk): New British sanctions shut down key Russian crypto channels (Rapira no mandatory verification; Sberbank/VTB/Gazprombank/Promsvyazbank rails)
- TRM Labs: EU adopts 20th sanctions package (broad ban on EU transactions with Russian/Belarusian CASPs; A7A5/RUBx/digital ruble in Annex LIII; crypto measures from 24 May 2026)
- OpenSanctions: RAPIRA (UK FCDO RUS3605; domain portfolio rapira.net/.io/.org/rapira24.ru/rapiras.ru; support emails)
- Gridinsoft: rapira.net trust signals (WHOIS registrant Vagharshak Nersisyan; REG.RU; created 16 Sep 2022)
- TRM Labs: Grinex Emerges as Likely Garantex Rebrand (shared on-chain fingerprint)
- ICIJ: Firm related to sanctioned crypto exchange Garantex (Garantex/Grinex ecosystem; ransomware and darknet clientele context)
Profile produced using open-source intelligence. Confidence labels applied per schema: CONFIRMED (multiple independent sources), CREDIBLE (single strong source or multiple weaker sources), ANALYST INFERENCE (logical extrapolation from confirmed facts). Volume figures cited with source and methodology; figures from different vendors and authorities are presented separately, not averaged (TRM >$543M total and $375.6M Grinex; Elliptic >$72M Rapira–Grinex; TRM Huobi $30M→$184M; ABCeX→Rapira $38.1M; Aifory↔Rapira $2.9M). Two-tier connected-entity model applied throughout Section 09 (Tier 1 transaction confidence plus Tier 2 facilitation assessment). Three jurisdictions documented separately per schema (registration Georgia, nominal; hosting Russia; operator location Moscow, beneficial owners unknown). Key corrections vs source draft: (1) Rapira Group Ltd (Liverpool) lists construction/plumbing registered activities, not financial services, weakening the deliberate-shell inference; (2) the UK package imposes five measures including a Trust Services Sanction. Status: Sanctioned (UK FCDO 26 May 2026, RUS3605); not OFAC-designated; in Georgian liquidation; infrastructure partially operational; assessed state nexus TOLERATED SAFE HARBOR with indicators toward PROBABLE COOPERATION.