EXECUTIVE FINDING

On 21 March 2023, U.S. prosecutors announced the extradition from Bulgaria of Irina Dilkinska, described as OneCoin’s former Head of Legal and Compliance.

The title should have represented control.

According to prosecutors, it represented the opposite.

Dilkinska was charged with conspiracy to commit wire fraud and conspiracy to commit money laundering in connection with OneCoin, the global cryptocurrency scheme founded by Ruja Ignatova and Karl Sebastian Greenwood. Prosecutors alleged that Dilkinska helped facilitate the movement and laundering of millions of dollars in OneCoin proceeds, including assisting former international law-firm partner Mark Scott in laundering approximately $400 million.

The allegations were especially significant because Dilkinska did not occupy a sales role.

She was not simply an MLM promoter.

She was not a cryptocurrency evangelist.

She was the person publicly associated with legal and compliance.

That distinction changes the nature of the investigation.

Fraud schemes need customers.

Large fraud schemes need something more.

They need:

• bank accounts
• corporate entities
• lawyers
• payment channels
• contracts
• investment structures
• compliance explanations

and professionals capable of making unusual financial activity appear administratively ordinary.

OneCoin appears to have understood this problem.

According to U.S. authorities, the scheme used multiple corporate names and entities, including OneCoin Ltd., OnePayments Ltd., OneNetwork Services Ltd., OneAcademy and OneLife.

It distributed its product through a global multi-level-marketing network.

It generated enormous inflows.

OneCoin’s own records, cited by prosecutors, showed approximately €4.037 billion in sales revenue and €2.735 billion in purported profit between the fourth quarter of 2014 and the fourth quarter of 2016 alone.

Millions of people bought into the system.

Prosecutors said total victim investments exceeded $4 billion worldwide.

The central Kleptik question is therefore not simply:

How did OneCoin persuade millions of people to invest?

It is:

HOW DID A FRAUD THIS LARGE CONTINUE TO MOVE MONEY THROUGH THE LEGITIMATE FINANCIAL SYSTEM?

THE FINDING

Fraud and money laundering solve different problems.

Fraud creates proceeds.

Money laundering attempts to make those proceeds usable.

A fraudulent investment operation can convince a victim to send €10,000 relatively easily compared with the problem that comes afterward.

If millions of victims are sending billions of euros, the criminal enterprise must answer:

• Where does the money arrive?
• Which company receives it?
• Which bank opens the account?
• What purpose is stated?
• How are transfers explained?
• How are proceeds distributed?
• How are commissions paid?
• How are large balances invested?
• How are beneficial owners concealed?
• How does money move between jurisdictions?
• How does illicit wealth eventually purchase legitimate assets?

At small scale, fraud can survive on cash.

At OneCoin scale, fraud requires financial architecture.

That is why the professional layer matters.

THE ONECOIN MACHINE

The scheme can be reduced to four functional systems.

SYSTEM 1 — RECRUITMENT

SYSTEM 2 — NARRATIVE

OneCoin presents itself as:

• a cryptocurrency
• a financial revolution
• a competitor to Bitcoin

and an investment opportunity.

SYSTEM 3 — COLLECTION

Victims transfer real money.

↓

Funds enter OneCoin-related accounts and corporate structures.

SYSTEM 4 — EXTRACTION AND LAUNDERING

Proceeds move through:

• companies
• investment funds
• bank accounts
• professional intermediaries

and asset structures.

The first two systems create belief.

The last two convert belief into money.

THE MLM ENGINE

OneCoin was not merely marketed as cryptocurrency.

It was distributed through multi-level marketing.

This matters because MLM changes how fraud scales.

A conventional investment fraud requires the central organisation to recruit every victim.

An MLM system outsources recruitment to the victims and promoters themselves.

The architecture becomes:

Each recruit becomes a potential salesperson.

Growth becomes exponential.

Prosecutors said members received commissions for recruiting additional buyers of cryptocurrency packages, and that the structure drove rapid expansion.

THE INCENTIVE PROBLEM

An MLM creates a conflict that ordinary investment analysis often ignores.

A participant may believe the product is valuable.

But the participant may also earn money if another person believes it.

Those are two different incentives.

Consider:

Investor A buys.

Investor A then recruits Investors B, C and D.

Investor A receives commission income.

The system has now transformed Investor A from:

customer

into

financially incentivised promoter.

That creates a powerful reinforcement loop.

The investor’s personal economic interest becomes aligned with maintaining belief in the product.

THE SOCIAL-PROOF MACHINE

OneCoin events reportedly attracted enormous crowds.

Promoters displayed:

• luxury
• success
• international expansion
• stage presentations
• wealth

and rapid appreciation.

This is not incidental.

Fraud at scale often depends upon social proof.

A prospective investor sees:

• thousands of other participants
• successful promoters
• international offices
• lawyers
• corporate structures
• bank relationships
• compliance staff

and polished conferences.

Each element appears to validate the others.

The investor may think:

Surely all of this cannot be fake.

That is one of the most powerful psychological mechanisms in complex fraud.

THE COMPLIANCE PARADOX

The role of Head of Legal and Compliance should theoretically represent the institution’s strongest internal defence against financial crime.

A legitimate compliance function asks:

• Who is the customer?
• Where did the money come from?
• Is the transaction suspicious?
• Is the beneficiary sanctioned?
• Is the company laundering money?
• Does the activity make commercial sense?
• Should the bank be notified?
• Should the transaction be blocked?
• Should the relationship be terminated?

According to prosecutors, Dilkinska instead allegedly assisted OneCoin’s laundering architecture.

This produces the central paradox of the dossier:

WHAT HAPPENS WHEN THE PERSON WHO UNDERSTANDS THE CONTROLS ALSO UNDERSTANDS HOW TO AVOID THEM?

COMPLIANCE AS INTELLIGENCE

A compliance officer often possesses more intelligence about a financial organisation than almost anyone else.

Compliance may know:

• all bank accounts
• all entities
• beneficial owners
• high-risk transactions
• bank objections
• account closures
• suspicious counterparties
• payment routes
• KYC documentation
• law-enforcement inquiries

and internal concerns.

This creates enormous defensive value.

It also creates enormous potential offensive value if the function becomes compromised.

The person who knows:

why Bank A rejected the transaction

also knows:

how Bank B might accept it.

THE BANK-REJECTION TEST

One of the strongest financial-crime signals is often not a transaction that succeeds.

It is a transaction that fails.

Suppose:

The relevant investigation is not simply:

Why did Bank C accept it?

It is:

WHO KNEW ABOUT THE EARLIER REJECTIONS?

A sophisticated compliance operation should treat repeated rejection as increasing risk.

A corrupted operation may treat rejection as a routing problem.

IRINA DILKINSKA

POSITION

Head of Legal and Compliance for OneCoin.

LEGAL STATUS AS OF 21 MARCH 2023

Extradited from Bulgaria to the United States.

Charged with:

conspiracy to commit wire fraud

and

conspiracy to commit money laundering.

Each charge carried a statutory maximum potential sentence of 20 years.

At the archive date, the charges against Dilkinska were allegations.

She had not yet pleaded guilty.

THE MARK SCOTT CONNECTION

The most significant allegation concerning Dilkinska involved former lawyer Mark Scott.

Scott had been an equity partner at the international law firm Locke Lord LLP.

U.S. authorities had already convicted him in 2019 for his role in laundering OneCoin proceeds.

According to DOJ, Scott helped launder more than $400 million through purported investment funds with banking relationships in jurisdictions including the Cayman Islands and Ireland.

Prosecutors alleged that Dilkinska helped Scott carry out that laundering operation.

This makes the relationship crucial.

OneCoin generated the proceeds.

Scott allegedly supplied a professional investment structure.

Dilkinska allegedly helped facilitate the process.

THE PROFESSIONALISATION OF LAUNDERING

The basic architecture can be visualised as:

The purpose of the fund structure is analytically important.

A transfer from:

fraud company → individual

looks dangerous.

A transfer from:

investment fund → portfolio investment

can look normal.

The professional structure changes the narrative surrounding the money.

MONEY NEEDS A STORY

Every large financial transfer eventually needs an explanation.

Why is €20 million moving?

Possible answers include:

• investment
• loan
• subscription
• dividend
• capital contribution
• management fee
• property purchase
• fund redemption

consulting fee.

Each explanation corresponds to a legitimate financial transaction.

Money laundering frequently involves giving criminal proceeds one of these legitimate identities.

That is why Kleptik defines professional laundering as:

THE CREATION OF A PLAUSIBLE ECONOMIC STORY AROUND ILLEGITIMATE MONEY.

THE FUND STRUCTURE

Investment funds can be particularly useful for financial concealment because legitimate funds naturally involve:

• multiple investors
• cross-border transfers
• portfolio companies
• subscription agreements
• redemptions
• professional managers
• banks

and complex ownership.

Again, this does not make investment funds suspicious.

It makes sham or abused fund structures potentially powerful laundering tools.

The investigator must ask:

• Who invested?
• Where did capital originate?
• Was the investment genuine?
• What assets did the fund buy?
• Who controlled the manager?
• Were valuations legitimate?
• Were redemptions commercially rational?
• Where did redeemed money go?

SHELL COMPANIES

Prosecutors specifically alleged that Dilkinska enabled OneCoin to launder millions through shell companies.

A shell company is not inherently illegal.

Shell entities can serve legitimate purposes:

• holding assets
• joint ventures
• special-purpose vehicles
• intellectual property
• real estate

or investment transactions.

The issue is economic substance.

The investigator should ask:

• Does the company have employees?
• Does it have premises?
• Does it produce goods?
• Does it provide services?
• Who controls it?
• Why is it receiving money?
• Why was it incorporated in this jurisdiction?
• Does its activity match its stated purpose?

THE SHELL-COMPANY TEST

For every entity:

OWNERSHIP

Who legally owns it?

CONTROL

Who actually directs it?

SUBSTANCE

What does it physically do?

BANKING

Where are its accounts?

PURPOSE

Why was it created?

TRANSACTIONS

What money moves through it?

COUNTERPARTIES

Who pays it and whom does it pay?

TIMING

Was it formed shortly before significant transfers?

A shell company is not suspicious because it is empty.

It becomes relevant when its emptiness conflicts with the economic activity appearing in its accounts.

THE DOCUMENT-DESTRUCTION ALLEGATION

The charges against Dilkinska included an additional allegation with substantial evidentiary importance.

According to the FBI, after Dilkinska learned of Mark Scott’s arrest, she allegedly destroyed incriminating documents and sent incriminating messages to another co-conspirator.

At the archive date, this remained an allegation.

But document destruction matters because it suggests another investigative layer:

consciousness of risk.

Financial-crime cases often turn not only on the underlying transaction but also on what participants did after learning that investigators were looking.

THE POST-ARREST TEST

Whenever law enforcement intervenes, investigators should examine what happens next.

• Were files deleted?
• Were phones replaced?
• Were companies dissolved?
• Were funds transferred?
• Were accounts closed?
• Were records backdated?
• Were witnesses contacted?
• Were internal explanations changed?
• Were assets moved?

These actions can provide insight into intent.

They can also independently create legal exposure.

RUJA IGNATOVA

OneCoin co-founder Ruja Ignatova, known publicly as the “Cryptoqueen,” remained a fugitive as of the archive date.

U.S. prosecutors said she was charged in October 2017.

On 25 October 2017, she travelled commercially from Sofia to Athens and was not publicly seen afterward.

The FBI added her to its Ten Most Wanted Fugitives list in June 2022.

Her disappearance creates one of the largest unresolved questions in the entire OneCoin investigation.

FOUNDER RISK

Founder-led frauds often centralise:

• brand
• authority
• bank relationships
• key passwords
• strategic decisions

and loyalty.

When the founder disappears, the organisation may fragment.

But the financial architecture remains.

Companies remain.

Accounts remain.

Property remains.

Intermediaries remain.

Promoters remain.

That is why a fugitive founder does not end the investigation.

In some ways, it begins the asset-recovery phase.

KARL SEBASTIAN GREENWOOD

Greenwood co-founded OneCoin with Ignatova.

Unlike Ignatova, he was apprehended.

He was arrested in Thailand in July 2018 and extradited to the United States in October 2018.

On 16 December 2022, he pleaded guilty to:

• conspiracy to commit wire fraud
• wire fraud
• and

conspiracy to commit money laundering.

His guilty plea materially changes the evidentiary status of OneCoin itself.

By the time Dilkinska was extradited, OneCoin was no longer merely a scheme described by prosecutors.

One of its two co-founders had admitted criminal responsibility.

THE NUMBERS

OneCoin’s own records, according to prosecutors, showed that between the fourth quarter of 2014 and the fourth quarter of 2016:

Sales revenue: €4.037 billion

Purported profit: €2.735 billion

Those figures are extraordinary.

They demonstrate something important about modern fraud:

A fraudulent product does not need to be financially marginal.

It can develop the revenues of a major multinational business.

At that scale, the organisation inevitably interacts with legitimate institutions.

THE LEGITIMATE-INSTITUTION PROBLEM

Billions of euros do not move entirely outside the financial system.

At some point, the scheme may require:

• banks
• correspondent banks
• lawyers
• accountants
• payment processors
• corporate registries
• property professionals
• fund administrators

and financial advisers.

This creates a crucial investigative distinction.

There are three categories of professional involvement:

CATEGORY 1 — UNWITTING

Professional provides services without knowledge of fraud.

CATEGORY 2 — NEGLIGENT OR WILLFULLY BLIND

Professional encounters significant red flags but fails adequately to investigate.

CATEGORY 3 — KNOWING

Professional knowingly facilitates criminal conduct.

Kleptik must never collapse those categories.

Association is not complicity.

THE PROFESSIONAL-ENABLER TEST

For each professional intermediary, investigate:

• What did they know?
• When did they know it?
• What documents did they receive?
• What red flags existed?
• Did they ask questions?
• What answers were given?
• Did they verify those answers?
• Did they terminate the relationship?
• Did they file required reports?
• Did they help restructure activity after a bank or regulator raised concerns?

Knowledge is the critical dividing line.

THE BANKING TRAIL

A global MLM collecting billions needs many banking channels.

The banking investigation should therefore map:

The investigation should identify where banks terminated accounts and where the flow moved afterward.

That movement often reveals the internal financial strategy.

FOLLOW THE ACCOUNT CLOSURES

When a bank closes an account, ask:

Where did the business go next?

If OneCoin-related flows moved:

the sequence may reveal escalating efforts to maintain financial access.

Account migration can be more informative than any single account.

THE CORPORATE NETWORK

Prosecutors noted that OneCoin operated through several names and entities:

OneCoin Ltd.

OnePayments Ltd.

OneNetwork Services Ltd.

OneAcademy

OneLife

Multiple entities are not inherently suspicious.

But investigators should ask what each one did.

• Which contracted with members?
• Which processed payments?
• Which employed staff?
• Which owned intellectual property?
• Which paid commissions?
• Which owned assets?
• Which held bank accounts?
• Which operated websites?
• Which interfaced with regulators?

That is how the legal organisation becomes an economic map.

THE PRODUCT PROBLEM

OneCoin marketed something called a cryptocurrency.

But a genuine cryptocurrency should usually allow independent verification of key characteristics.

The investigator should ask:

• Is there a public blockchain?
• Can transactions be independently verified?
• Can users hold assets outside the issuer’s system?
• Can the supply be independently audited?
• Can third parties run nodes?
• Can independent exchanges price the asset?

OneCoin’s structure allegedly failed the fundamental verification test.

The product’s value depended heavily on information controlled by the issuer itself.

THE CLOSED-SYSTEM PROBLEM

A financial product becomes difficult to verify where one organisation controls:

• the ledger
• the exchange
• the price
• the wallet
• the customer dashboard

and the supply information.

This creates an informational monopoly.

The investor sees only what the platform chooses to display.

The same issue later appeared in other digital-finance failures.

The lesson is broader than OneCoin:

IF THE ISSUER CONTROLS BOTH THE ASSET AND THE ONLY SYSTEM THAT PROVES THE ASSET EXISTS, INDEPENDENT VERIFICATION IS ESSENTIAL.

EDUCATION PACKAGES

OneCoin often framed purchases through educational packages associated with cryptocurrency tokens or related benefits.

That structure is analytically relevant because it can create a legal narrative different from the economic reality perceived by investors.

The paperwork may say:

education.

The customer may believe:

investment.

Investigators should compare:

• marketing statements
• contracts
• promoter scripts
• customer testimony

and actual consumer behaviour.

The question is:

WHAT DID THE BUYER THINK THEY WERE BUYING?

FOLLOW THE PROMOTERS

MLM investigations cannot stop with corporate headquarters.

Promoters are the distribution layer.

For each top promoter:

• recruitment volume
• commission income
• countries operated in
• companies controlled
• events organised
• bank accounts
• property
• marketing claims

and relationship with founders.

The highest earners often function as regional financial nodes.

They may receive large commission payments and redistribute them to lower levels.

THE COMMISSION ECONOMY

If billions in sales are generated through MLM, a substantial portion may be redistributed as recruitment commissions.

The investigator should therefore build:

• TOTAL MEMBER PAYMENTS
• minus
• PROMOTER COMMISSIONS
• minus
• OPERATING COSTS
• minus
• ASSET PURCHASES
• minus
• FUNDS TRANSFERRED TO FOUNDERS / AFFILIATES
• =
• UNACCOUNTED OR REMAINING FUNDS

That is the beginning of the recovery model.

MONEY LAUNDERING VERSUS SPENDING

Not every expenditure from criminal proceeds is technically money laundering in every jurisdiction.

Legal definitions vary.

Investigatively, however, funds generally move into one of four buckets:

CONCEALMENT

Transactions designed to hide origin or ownership.

INTEGRATION

Funds converted into apparently legitimate assets.

CONSUMPTION

Luxury spending.

REINVESTMENT

Proceeds used to finance additional operations.

A complete OneCoin money map should classify every major transfer accordingly.

ASSET CONVERSION

Fraud proceeds eventually become something else.

Possible assets include:

• property
• companies
• vehicles
• securities
• investment funds
• bank deposits
• luxury goods

and cryptocurrency.

This is where asset recovery becomes possible.

Money may disappear through transfers.

Property cannot disappear as easily.

THE REAL ESTATE QUESTION

Real estate is particularly attractive for laundering because it can:

• absorb large amounts of capital
• appreciate
• generate rental income
• serve as loan collateral

and be held through companies.

For every significant OneCoin-linked property, investigators should establish:

• purchase price
• legal owner
• beneficial owner
• funding source
• mortgage
• seller
• current status

and any subsequent transfer.

CROSS-BORDER LAUNDERING

The Scott allegations demonstrate OneCoin’s international financial reach.

According to DOJ, more than $400 million in OneCoin proceeds were laundered through purported investment funds using bank accounts in jurisdictions including the Cayman Islands and Ireland.

This creates the classic laundering architecture:

No single jurisdiction necessarily sees the full structure.

EXTRADITION

Dilkinska’s March 2023 transfer to the United States also demonstrates the increasing importance of extradition in international financial crime.

She was extradited from Bulgaria on 20 March and appeared in Manhattan federal court the following day.

That sequence reinforces a recurring Kleptik theme:

financial flows can be global.

The defendant remains physically located somewhere.

International cooperation converts physical location from shield into enforcement mechanism.

BULGARIA

Bulgaria is central to the OneCoin story because Sofia served as the scheme’s operational base.

The relevant investigation should therefore examine not merely individual defendants but the local ecosystem.

Corporate registrations.

Office leases.

Employees.

Bank accounts.

Property.

Professional advisers.

Local institutions.

Regulatory contacts.

Law-enforcement activity.

The deeper question is:

HOW DOES A BILLION-EURO FRAUD OPERATE PHYSICALLY INSIDE A REAL CITY?

Large digital fraud still requires real people and real infrastructure.

DOCUMENT DESTRUCTION AND COMPLIANCE

The allegation that a compliance executive destroyed incriminating material after another participant’s arrest has an especially important governance implication.

A legitimate compliance function preserves evidence.

It investigates.

Escalates.

Documents.

Reports.

If evidence is instead destroyed, the function becomes inverted.

The role stops being:

control

and becomes:

counter-control.

THE COUNTER-COMPLIANCE MODEL

Criminal organisations often develop informal systems designed specifically around regulated controls.

A legitimate compliance programme asks:

How do we prevent laundering?

A counter-compliance system asks:

• How do banks detect laundering?
• What transaction sizes attract scrutiny?
• Which descriptions create fewer questions?
• Which jurisdictions are easier?
• Which documentation satisfies KYC?
• Which structure makes the transfer look legitimate?

This is the professionalisation of evasion.

THE LAWYER PROBLEM

Mark Scott’s conviction creates a broader question for the legal profession.

Lawyers can legitimately:

• establish companies
• design funds
• prepare contracts
• open escrow arrangements
• advise on tax
• structure investments

and communicate with banks.

Those same skills can be exploited by criminal clients.

The decisive issue is knowledge and intent.

The investigator must distinguish:

lawyer advising a difficult client

from

lawyer knowingly facilitating criminal proceeds.

Scott’s conviction established the latter with respect to his own conduct.

THE COMPLIANCE OFFICER PROBLEM

The same principle applies to compliance professionals.

A compliance officer is not responsible every time a criminal successfully uses a company.

Controls cannot prevent every offence.

But the OneCoin allegations raise a more serious possibility:

that a professional supposedly responsible for preventing laundering allegedly assisted it.

That is fundamentally different from failure.

It is facilitation.

CHRONOLOGY

2014

Ruja Ignatova and Karl Sebastian Greenwood co-found OneCoin in Sofia, Bulgaria.

The scheme markets a purported cryptocurrency through an MLM network.

Q4 2014–Q4 2016

OneCoin records cited by prosecutors show approximately €4.037 billion in sales revenue and €2.735 billion in purported profits.

2016–2017

Regulatory and law-enforcement scrutiny intensifies internationally.

12 October 2017

U.S. authorities charge Ruja Ignatova in connection with OneCoin.

25 October 2017

Ignatova travels from Sofia to Athens and disappears from public view.

July 2018

Karl Sebastian Greenwood is arrested in Thailand.

October 2018

Greenwood is extradited to the United States.

November 2019

Mark Scott is convicted in the United States in connection with laundering hundreds of millions of dollars in OneCoin proceeds.

June 2022

The FBI adds Ignatova to its Ten Most Wanted Fugitives list.

16 December 2022

Greenwood pleads guilty to wire-fraud and money-laundering offences.

20 March 2023

Dilkinska is extradited from Bulgaria to the United States.

21 March 2023

U.S. prosecutors publicly announce charges against Dilkinska and her extradition.

At the archive date, she is presumed innocent unless and until proven guilty.

DOCUMENTARY RECORD

DOJ — DILKINSKA EXTRADITION AND CHARGES

The 21 March 2023 Justice Department announcement establishes the government’s allegations concerning Dilkinska’s role, her position as Head of Legal and Compliance, the approximately $400 million Scott laundering operation and the document-destruction allegation.

DOJ — GREENWOOD GUILTY PLEA

Greenwood’s December 2022 guilty plea establishes an admitted criminal foundation for the OneCoin scheme and records OneCoin’s MLM structure, revenue figures and Ignatova’s fugitive status.

MARK SCOTT RECORD

U.S. government materials identify Scott as a former partner of a major international law firm and describe the laundering of more than $400 million through purported investment-fund structures and international banking relationships.

WHAT THE AUTHORITIES SAY

U.S. prosecutors describe OneCoin as a fraudulent cryptocurrency pyramid scheme sold through a worldwide MLM network.

They say victims invested more than $4 billion.

They allege that Dilkinska, despite holding the title Head of Legal and Compliance, helped facilitate laundering and assisted Scott’s approximately $400 million laundering structure.

At the archive date, those claims against Dilkinska remain allegations.

Greenwood’s role, by contrast, is supported by his guilty plea.

Scott’s role is supported by his 2019 conviction.

WHAT THIS DOSSIER DOES NOT ESTABLISH

This dossier does not establish that:

• every OneCoin employee knew the product was fraudulent
• every MLM promoter knowingly defrauded recruits
• every bank processing OneCoin transactions knowingly facilitated money laundering

• every lawyer advising a OneCoin entity engaged in wrongdoing
• every Bulgarian professional working with the company was complicit
• every offshore company connected with OneCoin was unlawful
• every investment fund associated with a participant was fictitious

or every compliance failure was intentional.

It also does not treat the charges against Dilkinska as a conviction.

As of 21 March 2023, she had been charged and extradited and was presumed innocent.

RIGHT OF REPLY

Before publication, Kleptik should seek comment from:

• Irina Dilkinska and counsel
• Ruja Ignatova through any known legal representative
• Karl Sebastian Greenwood and counsel
• Mark Scott and counsel

OneCoin / OneLife representatives where any remain legally constituted

relevant Bulgarian corporate entities

professional advisers identified in transaction-specific reporting

financial institutions where Kleptik intends to make specific findings concerning control failures

Any promoter named in a future Kleptik money-trail investigation should receive a transaction-specific opportunity to respond.

Questions should distinguish between:

• promotion
• commission income
• knowledge of product characteristics

and participation in money movement.

UNANSWERED QUESTIONS

OneCoin generated billions.

The central unresolved question is where those billions went.

1. THE MASTER LEDGER

Can all major OneCoin inflows be reconstructed by entity and bank account?

2. COLLECTION ACCOUNTS

Which accounts received the largest victim deposits?

3. BANK MIGRATION

Which banks closed OneCoin-linked accounts, and where did the flows move afterward?

4. PAYMENT PROCESSORS

Which processors facilitated cross-border collections?

5. CORPORATE OWNERSHIP

Who beneficially owned each principal OneCoin entity?

6. DILKINSKA’S AUTHORITY

What actual authority did the Head of Legal and Compliance possess over banking, corporate structures and payment decisions?

7. COMPLIANCE FILES

What KYC, AML and bank correspondence existed internally?

8. SCOTT FUNDS

What was the full path of the approximately $400 million laundered through Scott’s structures?

9. CAYMAN ISLANDS

Which fund vehicles and financial institutions were involved?

10. IRELAND

Which banking or financial structures received the relevant flows?

11. PROMOTERS

Who were the highest-paid OneCoin promoters globally?

12. COMMISSIONS

How much money was redistributed as MLM compensation?

13. FOUNDERS

How much did Ignatova and Greenwood personally receive?

14. PROPERTY

What real estate was acquired with OneCoin-linked proceeds?

15. PROFESSIONAL FEES

How much was paid to lawyers, accountants, consultants and company agents?

16. DOCUMENT DESTRUCTION

What materials did prosecutors allege were destroyed following Scott’s arrest?

17. BULGARIAN OVERSIGHT

What did domestic authorities know about OneCoin’s operations and when?

18. INTERNATIONAL WARNINGS

Which regulators issued the earliest warnings?

Did financial institutions respond?

19. IGNATOVA

Where is Ruja Ignatova?

20. RECOVERY

Of the more than $4 billion prosecutors say victims invested, how much remains identifiable and recoverable?

This number may ultimately become the most important measure of the entire case.

KLEPTIK INTELLIGENCE ASSESSMENT

ASSESSMENT: HIGH CONFIDENCE

OneCoin operated as a large-scale fraudulent cryptocurrency MLM scheme.

This is supported by Greenwood’s guilty plea and the established criminal record.

ASSESSMENT: HIGH CONFIDENCE

OneCoin generated financial flows at a scale requiring substantial interaction with conventional financial and professional infrastructure.

Its own records cited by prosecutors show billions of euros in sales.

ASSESSMENT: HIGH CONFIDENCE

Professional intermediaries played a material role in the movement and concealment of OneCoin proceeds.

Scott’s conviction concerning more than $400 million provides direct support for this conclusion.

ASSESSMENT: OFFICIAL ALLEGATION — NOT YET ADJUDICATED AS OF REPORT DATE

Prosecutors allege that Dilkinska used her legal and compliance position to facilitate laundering rather than prevent it.

ASSESSMENT: HIGH CONFIDENCE

The MLM distribution structure materially accelerated OneCoin’s global reach by financially incentivising existing participants to recruit additional purchasers.

ASSESSMENT: MODERATE-TO-HIGH CONFIDENCE

A complete understanding of OneCoin requires investigation of the professional and banking network surrounding the scheme, rather than focusing exclusively on its founders.

ASSESSMENT: OPEN

The ultimate disposition of a substantial portion of victim funds remains unresolved as of the archive date.

THE KLEPTIK VIEW

OneCoin sold a fantasy about money.

But fantasy does not move billions through banks.

Infrastructure does.

The motivational speeches mattered.

The stadium events mattered.

The promoters mattered.

The promise of becoming rich mattered.

But none of that explains how billions of euros travelled from victims in dozens of countries into a system capable of paying commissions, maintaining offices, funding founders and moving enormous sums through international financial structures.

That requires another class of participant.

The professional.

Someone creates the company.

Someone opens the bank account.

Someone writes the agreement.

Someone explains the payment.

Someone answers the bank’s compliance questions.

Someone structures the investment fund.

Someone manages the corporate records.

Someone solves the problem when an account closes.

That does not mean every professional around a fraudulent enterprise knows it is fraudulent.

Most professional services are legitimate.

The distinction lies in knowledge.

But where knowledge and professional capability converge, the professional becomes extraordinarily important.

A fraudster can lie to a victim.

A professional enabler can potentially help the proceeds survive contact with the legitimate financial system.

That is why the title Head of Legal and Compliance matters so much in this case.

Compliance is supposed to be the wall between illicit money and legitimate finance.

Prosecutors allege that at OneCoin, a person sitting behind that wall helped money move through it.

As of this dossier’s archive date, that allegation against Irina Dilkinska remains to be proven.

But OneCoin has already established the larger lesson.

A billion-dollar fraud cannot be understood by looking only at who sold the lie.

Investigators must also examine who built the machinery around the money.

FOLLOW THE PROMOTER.

FOLLOW THE COMPANY.

FOLLOW THE BANK ACCOUNT.

THEN FOLLOW THE PROFESSIONAL WHO EXPLAINS WHY THE MONEY IS THERE.

KLEPTIK METHODOLOGY

This dossier is dated 21 March 2023 and is intentionally frozen to the legal and evidentiary position existing on that date.

Kleptik distinguishes between:

• guilty pleas
• criminal convictions
• criminal charges
• prosecutorial allegations
• documentary fact
• and

analytical assessment.

Accordingly:

Karl Sebastian Greenwood is described as having pleaded guilty.

Mark Scott is described as convicted.

Ruja Ignatova is described as a charged fugitive.

Irina Dilkinska is described as charged and extradited, not convicted.

The principal sources for this dossier are U.S. Department of Justice records concerning:

• the Dilkinska prosecution
• the Greenwood guilty plea
• the Scott laundering case

and related OneCoin proceedings.

Professional-enabler analysis follows a heightened evidentiary standard.

Kleptik does not infer complicity merely because a professional:

• formed a company
• opened a bank account
• provided legal advice
• performed compliance services
• served a OneCoin entity
• processed a transfer

or appeared in corporate records.

Professional culpability requires evidence concerning:

• knowledge
• intent
• red flags
• communications
• transaction structure
• misrepresentations

or direct participation.

Financial analysis should reconstruct money flows using, wherever available:

• bank statements
• SWIFT records
• fund subscription documents
• corporate registries
• wallet records
• property records
• investment agreements
• court exhibits

and accounting ledgers.

For MLM investigations, Kleptik should maintain separate datasets for:

• victim inflows
• promoter commissions
• corporate expenses
• professional fees
• founder distributions
• and

asset acquisitions.

This prevents legitimate commission payments or operating expenditure from being automatically categorised as laundering.

Corporate entities should be analysed according to actual function rather than name alone.

A company labelled “Academy,” “Payments” or “Network Services” should be classified according to what it actually did.

Where shell-company status is asserted, Kleptik should document the absence of meaningful operating substance.

Where a bank or professional institution is criticised, it should receive a detailed opportunity to explain:

• its relationship
• its due-diligence procedures
• its knowledge at the relevant time

and any action taken after red flags emerged.

EVIDENTIARY LABELS

ESTABLISHED
Supported by authoritative documentary evidence, judicial record, guilty plea or conviction.

GUILTY PLEA
Formal admission of criminal responsibility.

CONVICTED
Criminal liability established through judgment or verdict.

CRIMINALLY CHARGED
Formal accusation not constituting proof of guilt.

OFFICIAL ALLEGATION
Claim advanced by prosecutors or law-enforcement authorities but not finally adjudicated.

PROFESSIONAL-ENABLER INDICATOR
Evidence suggesting a professional relationship warrants enhanced investigation; not itself proof of complicity.

KLEPTIK VERIFIED
Independently corroborated through primary records.

KLEPTIK ASSESSMENT
Analytical conclusion derived from identified evidence.

INVESTIGATIVE LEAD
Information requiring further documentary verification.

UNVERIFIED
Information not sufficiently corroborated to publish as fact.

DOCUMENT STATUS

KLTK-2023-006

Subject: OneCoin / Irina Dilkinska / Professional Laundering Infrastructure
Archive date: 21 March 2023
Status at archive date: Dilkinska extradited and charged; Greenwood guilty plea entered; Scott convicted; Ignatova fugitive
Historical treatment: Fixed to report date

© KLEPTIK — Investigations into Power, Money and the Systems Designed to Hide Both