No Direct Predecessor; Garantex-Successor Absorber by Function

Evidentiary Pillars

Operator Profiles

Confirmed Ilyas Ahaev (Ilias Ahaevi), British national: director and 100% owner of Rapira Group LLC (Georgian reg. 412771852), and liquidator as of May 2026. The Georgian Ministry of Finance assesses the company was "registered in Georgia formally, by proxy, by a British citizen," a nominee/power-of-attorney structure designed to establish legal presence without actual presence. Assessed location unknown; no indictment or arrest. The entity designation applies a director disqualification measure to Ahaev in his directorial capacity, but he is not individually SDN-listed. [Georgian MoF; Caucasus Watch; UK FCDO]

Credible Gashim Guseinov, Russian national resident in the UK (DOB Nov 1984): sole director and Person with Significant Control of Rapira Group Ltd (UK Companies House no. 16618607), incorporated in Liverpool on 31 July 2025 at 73 Sheil Road. Single Source Correction to the source draft: Companies House records list this entity's registered activities as electrical installation, plumbing/heat/air-conditioning, and other specialised construction, not financial services. The inference that the UK entity is a deliberate pre-positioned crypto-exchange shell is therefore weaker than the draft implies; the name match may be coincidental or the entity may be a separate nominee vehicle. Treat any Rapira-exchange linkage as CREDIBLE at best, not confirmed. [Companies House; Endole]

Credible Vagharshak Nersisyan: WHOIS registrant for rapira.net as of mid-2025, listed as "Private Person," registered via Russian registrar REG.RU (+7). The Russian registrar corroborates the assessment that the platform's true operational nexus is Russia despite Georgian registration. Identity and operational role not further documented. Single Source [WHOIS / Gridinsoft]

Disputed Assessments

Analyst Inference The source draft treats the Liverpool entity's July 2025 incorporation (weeks before the September 2025 Moscow raids and months before the UK designation) as evidence of deliberate infrastructure migration in anticipation of regulatory pressure. Given the construction SIC codes and the absence of any financial-services registration, this timing inference is unresolved: it is equally consistent with an unrelated company or a nominee vehicle with no exchange function. Flagged as a single-source inference, not a finding. [Analyst assessment]

Exchange Mechanics and Product Set

Credible Rapira operates a multi-channel Russian-market exchange: order-book spot trading in crypto-crypto and crypto-RUB pairs (BTC, ETH, USDT, TON); a zero-commission P2P desk supporting banks, payment systems, and physical cash; physical cash desks in Moscow (Moscow City / Federation area), Kazan, Rostov-on-Don, and Yekaterinburg with cash transactions reportedly from roughly 10,000 RUB, available 24/7; and an OTC/merchant component advertising "crypto merchant, auto-conversion and auto-payments." A documented API (rapira.apidog.io) indicates B2B/automated-trading infrastructure. [rapira.io; review sources; cdn.rapira.net]

KYC/AML Posture: Stated Policy vs Observed Behavior

Fiat Rails (Schema Rule: Must Be Addressed)

Credible Bank relationships: Per Ukrainian sanctions intelligence, Rapira integrated payment rails to OFAC-sanctioned Russian banks including Sberbank, VTB, Gazprombank, and Promsvyazbank, enabling direct card/transfer on-ramps for Russian retail users. These integrations are sourced to Ukrainian intelligence (Vlasiuk / Ukrinform), not to a primary OFAC or charging document, so the specific bank list carries single-strong-source confidence. Single Source [Ukrinform; MenaFN]

Confirmed Cash desk: Physical Moscow City offices accepted and dispensed cash; the September 2025 raids seized more than $10 million, 100 million rubles, and 200,000 euros at exchange offices in the Moscow City area, with Rapira and Mosca the primary targets. P2P: the P2P desk enables informal buyer-seller matching outside standard banking rails; no documented bank partner for P2P settlement. De-risking: after the September 2025 raids, withdrawals were suspended while the app remained operational; Belarus-based Cifra Markets terminated operations with Rapira post-UK designation. [Cryptopolitan; Binance Square; RBC]

Licensing and Regulatory Standing

Confirmed Rapira advertises license "№0110/587, Financial Service & Crypto Exchange." Georgian MoF investigators and independent review sources confirm this license corresponds to no recognized Georgian regulatory body, the stated regulator does not exist, and the company was not found in the registry of the National Bank of Georgia. The Georgian registration (412771852) is confirmed but assessed as purely formal, with no actual activity in Georgia. There is no Central Bank of Russia license and no FATF-aligned licensing in any documented jurisdiction. [Georgian MoF; review sources]

Domain Portfolio

Confirmed Support emails [email protected], [email protected], [email protected]. The presence of two Russian ccTLD domains alongside the .net/.io/.org portfolio is structurally consistent with a Russia-primary operation maintaining offshore domain coverage for resilience. [OpenSanctions; UK designation]

Apps, API, and Channels

Credible Rapira's Instagram (@rapira.team) references a mobile platform and app-based services. A documented API (rapira.apidog.io) supports automated order placement. No app-store removal event is documented as of June 2026, though the UK Internet Services Sanction may trigger removal requests for UK users. A Telegram presence is consistent with Russian-market norm but no specific channel identifier was documented. Single Source (Instagram only on social footprint) [Instagram; rapira.apidog.io]

Platform Architecture

Analyst Inference No independent documentation of white-label versus proprietary architecture, cold/hot wallet structure, or blockchain node configuration was found. The in-house AML tool (rapira.net/aml) suggests some internal blockchain-analysis capability, but its depth is unverified. [Inference from platform materials]

Designated Bitcoin Address

Confirmed The UK designation (RUS3605) lists one designated digital address: bc1q72ud4m6zf5g37jkhc2ty95zm5vel9ufdxquqpm (Bitcoin Bech32/SegWit). Any VASP or compliance team encountering this address should treat it as a designated-entity address subject to UK asset-freeze obligations and as a high-risk indicator elsewhere. No OFAC-designated Rapira wallet addresses exist. [UK FCDO RUS3605]

Resilience After Disruption

Confirmed Following the 26 May 2026 UK designation, rapira.io remained accessible. The five-domain portfolio provides resilience: if one domain is blocked or removed, others remain. The UK Internet Services Sanction requires UK-facing ISPs and app stores to take "reasonable steps" to block access, which does not produce immediate global domain takedown. No customer-migration messaging following the designation has been documented. [rapira.io; OpenSanctions]

Volume (Cite Source and Methodology; Do Not Average)

Three-Phase On-Chain Flow (Rapira as Node)

Phase 1: Receipt

Confirmed Primary inbound counterparty is Grinex ($375.6M TRM / $72M+ Elliptic). ABCeX sent $38.1M to Rapira (TRM); ABCeX is tied to Garantex co-founder Sergey Mendeleev and was Garantex's third-largest on-chain counterparty. Huobi/HTX is a persistent upstream source ($184M post-takedown). Indirect receipt via fiat on-ramps through sanctioned Russian banks is credible (Ukrainian intelligence). Credible Ransomware/darknet receipt is inferential: no Rapira-specific actor-level attribution has been published by TRM, Elliptic, or Chainalysis; the inference rests on Grinex/Garantex's documented clientele and Rapira's role as a primary Grinex counterparty. [TRM; Elliptic]

Phase 2: Layering

Credible RUB-to-crypto conversion via spot and P2P; funds enter USDT (TRON/Ethereum) and BTC. Single Source Analyst Inference Whether Rapira's specific flows transited the A7A5 ruble-pegged stablecoin (a primary network layering instrument; the UK cites A7A5 processing $9.3 billion in four months) versus standard stablecoin forms is not documented at the Rapira-cluster level. No mixing, chain-hopping, or coinjoin specific to Rapira wallet clusters is documented in reviewed reports. [TRM; UK FCDO]

Phase 3: Extraction

Confirmed Cash desks provided direct cash-out (estimated $10M+ in cash seized September 2025); the P2P desk enables OTC cash conversion. The Russian capital-flight investigation premise was that funds were moved to Dubai via crypto channels; Rapira denied a direct Dubai link, and the matter remained a procedural check (no criminal case opened as of late-2025 reporting). No specific downstream receiving exchange for Rapira-originating flows is documented. [Cryptopolitan; RBC; Binance Square]

Designated Addresses and Sanctions Summary

Crimeware Verticals by Evidence Tier

Geographic Patterns

Confirmed All documented activity is Russia-centric: Russian-language interface, RUB-only fiat, Russian bank integrations, physical offices exclusively in Russia, Russian-registrar domain, and Georgian registration confirmed as purely nominal with exclusively Russian clientele. No documented CIS exclusion or geo-IP restriction. [Georgian MoF; review sources]

High-Profile Flows

Confirmed (aggregate) No Rapira-specific, individually named criminal-actor flows with attributed dollar amounts have been published. The $375.6M Grinex flow and $543M total (TRM) are aggregate counterparty-level attribution, not individual actor attribution. This is a documented intelligence gap (Section 10). [TRM; Elliptic]

Jurisdictional Separation (Schema Rule: Three Jurisdictions)

State Nexus Tier: TOLERATED SAFE HARBOR (indicators toward PROBABLE COOPERATION)

Negative Evidence (Expected if Higher Nexus Existed)

If Rapira were under PROBABLE COOPERATION or DIRECT CONTROL, one would expect documented Rosfinmonitoring or FSB operational links, communications or coordination with Russian intelligence, or explicit state protection signaling. None are present. The September 2025 raid is the strongest single piece of evidence against the higher tiers. The assessment therefore holds at TOLERATED SAFE HARBOR, with the coordination and state-bank-integration indicators logged as escalation signals to monitor. Analyst Inference

UK Designation (Primary Action)

Five measures imposed: Asset Freeze; Correspondent Banking Sanctions and processing payments (Regulation 17A); Internet Services Sanctions; Director Disqualification Sanction; and Trust Services Sanctions. Designated digital address: bc1q72ud4m6zf5g37jkhc2ty95zm5vel9ufdxquqpm. The Regulation 17A measure prohibits UK credit/financial institutions from maintaining correspondent relationships with Rapira and from processing any payment where Rapira appears anywhere in the chain, transforming UK VASP compliance from name-screening to full transaction-chain tracing. Confirmed [UK Sanctions List; Elliptic]

Sanctions and Enforcement Summary

Timeline

Post-Sanction Reconstitution Assessment (Schema Rule)

Market Position and Volume Trends

Confirmed Rapira grew from a minor Russia-market exchange into one of the leading ruble-to-crypto venues absorbing the post-Garantex vacuum. TRM's $543M total bilateral attribution, Huobi inflows growing $30M→$184M, and Grinex flows beginning within three days of its launch indicate a rapid, deliberate capacity build-up. [TRM]

Disruption Impact

Reconstitution Status

Brand: Sanctioned and liquidating, infrastructure partially live. Georgian liquidation since 13 May 2026; rapira.io accessible as of late June 2026; no named successor brand observed. Confirmed

Pre-positioning: Mixed. Liquidation timing two weeks ahead of designation is a credible hedging signal; the Liverpool entity's relevance is disputed (construction SIC codes). Credible / Single Source

Future risk: Continuity over clean reconstitution. With no seizure, no arrests, and a Russia-resident operation, the service can persist for non-UK users; displaced volume most likely routes to undesignated OTC brokers, Telegram P2P, and the A7A5 ecosystem. Credible

Intelligence Gaps

[26 May 2026] UK FCDO designates Rapira Group LLC (RUS3605) and 17 other entities/individuals in the A7/crypto package; TRM publishes accompanying analysis attributing >$543M bilateral and $375.6M with Grinex to Rapira, and Huobi→Rapira growth of $30M to $184M. [UK FCDO; TRM]

[26 May 2026] Georgia's MoF Investigation Service confirms Rapira was registered formally by proxy by a British citizen, served only Russian citizens, and had no Georgian financial activity or assets. [Georgian MoF; Caucasus Watch]

[13 May 2026] Rapira enters Georgian liquidation (Ilyas Ahaev owner and liquidator), two weeks before the UK designation. [Georgian registry]

[23 Apr 2026] EU adopts its 20th sanctions package; crypto measures (broad ban on EU transactions with Russian CASPs; A7A5/RUBx/digital ruble added to Annex LIII) apply from 24 May 2026. No entity-specific Rapira listing. [Council of the EU; TRM; Chainalysis]

[21 Feb 2026, updated 3 Mar 2026] Elliptic names Rapira among Russia-linked sanctions-evasion exchanges: >$72M direct Rapira–Grinex flows; Moscow office raided over suspected Dubai capital flight. [Elliptic]

[Sep–Oct 2025] Russian security forces raid Moscow City crypto offices (Rapira and Mosca primary targets); cash and hardware seized; operations resume within days. [Cryptopolitan; RBC; Binance Square]

1. UK Sanctions List: RAPIRA GROUP LLC, designation RUS3605 (26 May 2026; asset freeze, Reg. 17A correspondent banking, internet services, director disqualification, trust services; designated BTC address)
2. UK Government: List of Russia sanctions designations, 26 May 2026 (18-entity A7/crypto package incl. Rapira Group LLC)
3. UK FCDO: UK cracks down on backdoor Russian sanctions evasion with tough new measures (26 May 2026; A7 network ~$90B/year)
4. TRM Labs: UK Designates Huobi, Exmo, Bitpapa, and 11 Other Entities (Rapira: >$543M bilateral, $375.6M Grinex from 10 Mar 2025, Huobi $30M→$184M) : 26 May 2026
5. Elliptic: Russia-linked cryptocurrency services and sanctions evasion (Rapira: Georgia-incorporated, Moscow office, >$72M Rapira–Grinex, Dubai capital-flight raid) : 21 Feb 2026 (upd. 3 Mar 2026)
6. Elliptic: UK designates cryptoasset exchanges including HTX in sweeping new sanctions package (Regulation 17A extended to crypto; full-chain tracing) : 26 May 2026
7. Chainalysis: UK Sanctions Crypto Companies With Russia Ties (A7 Network; Grinex direct Garantex successor) : May 2026
8. CryptoPotato: UK Sanctions 18 Crypto Firms Tied to Russia's $90B War Network (Rapira $543M / $375.6M Grinex) : May 2026
9. UK Companies House: RAPIRA GROUP LTD (16618607), Liverpool, incorporated 31 Jul 2025; registered activities construction/plumbing; director Gashim Guseinov
10. UK Companies House: RAPIRA GROUP LTD officers (Guseinov, Gashim; Russian national, resident UK; DOB Nov 1984; 73 Sheil Road, Liverpool)
11. Caucasus Watch: The UK Sanctions Georgian Companies (Rapira registered through a proxy by a British citizen; Ilias Ahaevi)
12. Business Insider Georgia: Georgian MoF Investigation Service (Rapira registered formally by proxy; served only Russian citizens; no Georgian activity)
13. Georgia MoF Investigation Service: Statement on Rapira, Aifory, Arvix investigations
14. Cryptopolitan: Russia raids crypto exchange offices in Moscow City (Rapira and Mosca; capital flight to Dubai; cash seized) : Sep 2025
15. Cryptopolitan: Raided Russian crypto exchanges resume operations (Mosca immediately; Rapira app operating, withdrawals inactive) : Oct 2025
16. RBC: Rapira responds to reports of security-forces raids (denies Dubai-transfer link) : 27 Sep 2025
17. Ukrinform (Vlasiuk): New British sanctions shut down key Russian crypto channels (Rapira no mandatory verification; Sberbank/VTB/Gazprombank/Promsvyazbank rails)
18. TRM Labs: EU adopts 20th sanctions package (broad ban on EU transactions with Russian/Belarusian CASPs; A7A5/RUBx/digital ruble in Annex LIII; crypto measures from 24 May 2026)
19. OpenSanctions: RAPIRA (UK FCDO RUS3605; domain portfolio rapira.net/.io/.org/rapira24.ru/rapiras.ru; support emails)
20. Gridinsoft: rapira.net trust signals (WHOIS registrant Vagharshak Nersisyan; REG.RU; created 16 Sep 2022)
21. TRM Labs: Grinex Emerges as Likely Garantex Rebrand (shared on-chain fingerprint)
22. ICIJ: Firm related to sanctioned crypto exchange Garantex (Garantex/Grinex ecosystem; ransomware and darknet clientele context)

Profile produced using open-source intelligence. Confidence labels applied per schema: CONFIRMED (multiple independent sources), CREDIBLE (single strong source or multiple weaker sources), ANALYST INFERENCE (logical extrapolation from confirmed facts). Volume figures cited with source and methodology; figures from different vendors and authorities are presented separately, not averaged (TRM >$543M total and $375.6M Grinex; Elliptic >$72M Rapira–Grinex; TRM Huobi $30M→$184M; ABCeX→Rapira $38.1M; Aifory↔Rapira $2.9M). Two-tier connected-entity model applied throughout Section 09 (Tier 1 transaction confidence plus Tier 2 facilitation assessment). Three jurisdictions documented separately per schema (registration Georgia, nominal; hosting Russia; operator location Moscow, beneficial owners unknown). Key corrections vs source draft: (1) Rapira Group Ltd (Liverpool) lists construction/plumbing registered activities, not financial services, weakening the deliberate-shell inference; (2) the UK package imposes five measures including a Trust Services Sanction. Status: Sanctioned (UK FCDO 26 May 2026, RUS3605); not OFAC-designated; in Georgian liquidation; infrastructure partially operational; assessed state nexus TOLERATED SAFE HARBOR with indicators toward PROBABLE COOPERATION.