This barrel bomb was different. This one sent up plumes of yellow vapor, a telltale sign of chlorine attack.
Dr. Abdullah Darwish had seen barrel bombs before. As the director of the hospital in Kafr Zeita, a town near Hama in Syria, he had treated many of their victims, their flesh torn by the scrap metal packed around the explosive core.
One of at least 150 victims of the attack on April 11, 2014, had a head injury, but most showed unusual symptoms. Civilians, including many children, streamed into the hospital, vomiting and screaming that they couldn’t breathe.
The attack on Kafr Zeita wasn’t a one-off. The Syrian air force has dropped nearly 70,000 barrel bombs from July 2012 through 2017, and the regime is known to have used chemical weapons at least 330 times between 2012 and 2019.
Barrel bombs and chlorine were the weapons of the cash-strapped regime. In the first years of the war, Syrian President Bashar Assad’s regime was running out of men, money, and materiel. Stocks of missiles had reportedly dwindled, forcing the air force to improvise. The size of the Syrian army fell from a pre-war high of 325,000 to an estimated 150,000 in 2014. Syria’s foreign exchange reserves halved, from US$18 billion to an estimated $5 billion to $10 billion, as the conflict reportedly cost the regime as much as $1 billion per month in 2012. Syria, once an oil exporter, also desperately needed fuel.
Damascus turned to Russia, Iran, and networks of expatriate Syrians who stepped in as fixers, quietly providing the pariah regime access to international markets.
One key network is led by an urbane Moscow-based Syrian-Russian financier, Mudalal Khouri.
The full extent of Khouri’s network activities is written across the pages of different sanction notices issued by the U.S. Treasury’s Office of Foreign Assets Control. OFAC has long accused him of attempting to purchase a chemical used in manufacturing explosives, and his associates of facilitating the purchase of fuel and hard currency.
A joint Global Witness-OCCRP investigation also supports allegations that Khouri Network members provided front companies for the sanctioned Syrian Scientific Research Centre (SSRC), which is responsible for Syria’s chemical weapons and ballistic missile programs.
But Khouri’s assistance to the regime was not just about weapons. When Assad’s family wanted to move $40 million into Moscow property, they turned to the Khouri Network for help.
More recently, a Russian financial institution partly controlled by Khouri through a network of proxy companies and business associates was sanctioned for assisting embargoed North Korean firms.
The full story of the Khouri Network can be found in the Global Witness report, “Assad’s Money Men in Moscow.”
For this article, Global Witness and OCCRP analyzed leaked bank documents to uncover how the Khouri Network appears to have received or processed money from a variety of frauds and received payments from key shell companies in other “laundromats.”
Laundromats are all-purpose financial fraud networks of banks and shell companies designed to move large amounts of money. They tumble and wash together money from legal businesses, private wealth, and organized crime to obscure its origins, avoid capital controls, or evade taxes.
Khouri Network companies interacted with three of these laundromats, dubbed by OCCRP the Proxy Platform, the Russian Laundromat, and the Troika Laundromat. Khouri’s companies also received or processed millions from the notorious $230 million Russian tax fraud exposed by Sergei Magnitsky, a Russian lawyer who subsequently died after severe mistreatment in prison. Companies controlled by the Khouri Network received or processed funds from companies linked to apparently fraudulent payments to Sergei Roldugin, a close friend of Russian President Vladimir Putin, and from a separate fuel scam at Moscow’s Sheremetyevo International Airport.
The Khouri Network is itself a small laundromat that tapped into other illicit financial networks. But this one attempted to help the Assad regime and, to the extent that it succeeded, indirectly enabled its repeated attacks on civilians using chemical and conventional weapons.
The Khouri Network consists of legitimate firms, shell companies, several banks, and other financial institutions.
Several Syrian and Russian businessmen have been sanctioned by the U.S. since 2014 for assisting the Assad regime. Many of the sanctioned individuals are Khouri’s employees, business associates, and family members. A decade ago, many of Khouri’s shell companies were registered at residential apartments on Gubkina Street, in a Moscow suburb. Now the Khouri Network operates from Progress Plaza, a business center in the southeast of the Russian capital.
This investigation links four shell companies — Balec Ventures, the sanctioned firm Argus Construction and, more tentatively, Tredwell Marketing and Armas Marketing — to the Khouri Network. Balec Ventures and Argus Construction both used a physical address on Gubkina Street, while Balec and Tredwell were registered at the same British Virgin Islands postal box. All four held accounts at Cyprus-based FBME Bank Ltd, owned by two of Khouri’s business associates, and each transacted with other shell companies in the Khouri Network.
The U.S. Treasury Department in 2014 accused FBME of allowing customers to use it for money laundering and terrorist financing, and alleged that one FBME customer was a front for SSRC, Syria’s chemical weapons program. The following year, the Central Bank of Cyprus took over management of the FBME branch there and eventually revoked its licence.
When approached for comment, the owner of FBME bank said that “at all times FBME Bank acted in compliance with all the EU and Cyprus Anti-Money Laundering directives, as corroborated by multiple third-party audits.” He added, “At the time those individuals opened their accounts they did not appear on any sanctions lists, and it should be noted that none of FinCEN’s allegations against FBME have been corroborated.”
According to FBME records, first analyzed by Cyprus Business Mail and BuzzFeed News, Balec Ventures and Argus Construction were owned by Issa al-Zeydi, an 81-year-old Syrian-Russian translator who worked for the Khouri Network at Progress Plaza. Tredwell and Armas Marketing were owned and directed by two friends of Khouri’s nephew, Toni Khouri. One of those friends once worked for Mudalal Khouri. When contacted, both of Toni’s friends denied any knowledge of Tredwell or Armas Marketing, raising the possibility that their names were used in corporate records without their consent.
In 2014 the U.S. sanctioned Zeydi for his directorship of two Cypriot front companies described as “illicit procurement agents” for the Central Bank of Syria and the SSRC. He has denied any connection to chemical weapons, but in an interview admitted to helping the Syrian regime buy banknotes. According to the U.S. government, one of Zeydi’s Cypriot companies and Tempbank, a Russian bank where the Khouri brothers were minority shareholders, helped the Syrian Central Bank obtain the hard currency from a Russian printer.
The chief executive of Tempbank said that these operations were to shore up the currency or for humanitarian reasons, and denies any involvement of Tempbank in chemical weapons or ballistic missile procurement.
The two blacklisted Cypriot companies were not the only Khouri Network entities suspected of links to the SSRC. When FBME bank was raided, Central Bank of Cyprus officials left behind a note indicating that they suspected Tredwell Marketing of being an SSRC front, according to a leaked Ernst and Young report. Also, Tredwell Marketing was named as an SSRC front in academic research on financial networks behind chemical weapons proliferation, based on conversations with a western government official.
If Tredwell was an SSRC front, it’s likely the Khouri Network was responsible.
Mudalal Khouri was personally sanctioned by the U.S. in late 2015 for attempting to help the Syrian regime buy ammonium nitrate, a chemical compound used in fertilizers and in explosives — munitions like those packed in barrels and dropped on Kafr Zeita.
According to a 2016 U.S. sanctions notice, Argus Construction also provided support to Wael Abdulkarim, a Syrian from a different business group who was sanctioned for buying aviation fuel on behalf of the regime. The European Union also placed sanctions on Abdulkarim but lifted them after he appealed.
Another Khouri Network employee, a Russian named Yelizaveta Sosedova, also appears to have helped the Assad family buy property in Moscow.
A Global Witness investigation revealed that Assad’s cousins, the Makhlouf family, bought offices and apartments worth $40 million in a prestigious Moscow skyscraper. One cousin, Hafez Makhlouf, is a former senior intelligence officer accused by the European Union of violence against civilian protests.
Some of this property was bought under their own name, others through Russian-registered companies. In Russia, company directors can name a “trusted individual” to liaise with the tax authorities or file documents on their behalf. Russian corporate records show Sosedova as the “trusted individual” for several Makhlouf property companies.
Moving money in Moscow on behalf of the Syrian state is tricky without political protection, which was likely provided through Khouri’s links to the SVR, Russia’s foreign intelligence service. Khouri had a long-term business relationship with an SVR agent.
The Cyprus Mail and BuzzFeed News have previously reported that Balec Ventures received $2.2 million from the Russian tax fraud exposed by Sergei Magnitsky. However, the connections between the companies, which laundered the proceeds of the fraud, and the Khouri Network are both more extensive than previously known and also predate the $230 million tax theft.
Alexander Perepilichny’s shell companies were used to launder the fraud proceeds. He later confessed and became a whistleblower, exposing the scheme. Another company belonging to Perepilichny, PF Realty, sent at least $1.1 million to Balec Ventures’ FBME bank account on December 4, 2006, as soon as the account was opened. The transaction shows the Khouri Network and Perepilichny had a relationship a year before the Russian tax fraud took place.
When laundering the tax fraud’s proceeds, Perepilichny’s Quartell Trading sent $2 million to Balec Ventures in late January and early February 2008, while $234,000 came to Balec via Nomirex Trading, a Proxy Platform laundromat company.
A company controlled by Dmitry Klyuev, the alleged mastermind of the $230 million fraud, may also have sent $750,000 in May 2008 to Tredwell Marketing via an intermediary shell company.
A long-standing Khouri business associate was chief executive of an investment company part-owned by Alexander Perepilichny, later named in the Deutsche Bank and Danske Bank mirror trading scandals.
One of the Khouri Network’s investment companies, Orient Finance, was founded in 2006 by Mudalal Khouri’s brother, Imad Khouri, together with a long-term business associate, Moscow businessman Pavel Abramov.
The New Yorker reported that IC Financial Bridge used the Deutsche Bank scheme. Similarly, the Estonian branch of Danske Bank involved in a 200 billion euro money-laundering scandal also reportedly executed mirror trades on behalf of intermediaries without knowing who the end customers were. According to the Danish newspaper Berlingske, IC Financial Bridge was likely one of those intermediaries. Russian authorities revoked the company’s license in August 2013 for repeatedly violating securities and money laundering laws.
Russian cellist Sergei Roldugin, one of Vladimir Putin’s closest friends, gained unexplained wealth through control of offshore companies such as International Media Overseas. Core companies in the Troika Laundromat, such as Quantus Division, sent at least $69 million to firms linked to Roldugin from 2008 to 2010.
Notably, one of those payments was made on the same day as a transfer to Tredwell Marketing. On June 11, 2008, the people controlling Quantus Division’s multi-currency bank account converted $55,047 into 35,400 euros. The next day, 35,400 euros were paid to Tredwell. Other Quantus payments on June 11 included $756,300 to another core Troika Laundromat company, Delco Networks, which then paid almost the same amount ($755,300) to Roldugin’s International Media Overseas on June 12.
The mid-2000s fuel scam at Moscow’s Sheremetyevo International Airport involved inserting unnecessary shell companies into aviation fuel purchases. Novaya Gazeta and OCCRP reported that some of the $200 million in proceeds went through Iduna Commerce, a company in the Proxy Platform laundromat.
From 2006 to 2008, Iduna Commerce paid $20 million to another company, Brasnick Trading, which in turn paid $1.1 million to the Khouri Network’s Armas Marketing in 2008.
The Khouri Network’s companies also appear in Swedbank’s 37-billion-euro money laundering scandal. In March, the Swedish bank published an independent report by the law firm Clifford Chance, which describes customers at Swedbank’s Baltic branches transacting with “companies connected to the alleged perpetrator of the Magnitsky fraud—an individual also reportedly linked to the Syrian chemical weapons program.” Issa al-Zeydi fits the description of the unnamed individual.
Fraud is not a victimless crime. The Khouri Network was part of a common phenomenon in post-Soviet states where shadow financial systems were set up to enable massive capital flight. Laundromats, meanwhile, stunt economic growth and deny ordinary citizens the money needed for functioning health and education systems.
The Khouri Network in particular shows another danger: Laundromats are financial weapons. If you leave them lying around, they can be picked up and repurposed to help finance crimes against humanity.
In this instance, the Khouri Network used its laundromat to attempt to help the Assad regime, disregarding the Syrian government’s repeated attacks on civilians using chemical and conventional weapons.
After several attacks against medical facilities in Kafr Zeita, Dr. Abdullah Darwish and colleagues in 2014 dug a new hospital into the side of a mountain. Though protected by some 20 meters of solid rock, it was destroyed by a Syrian government airstrike in 2018.
When asked why he thought the regime used chlorine in waging war, Darwish said it was to spread fear and horror among civilians, causing them to flee. It worked. He eventually joined the 5.6 million Syrians who have since become refugees in other countries.
