CASE-003: Dacha Empire — 2.8B in Hidden Assets, 4 Countries

The Counterparty Who Wasn’t There

Instructing counsel for a foreign claimant in a long-running civil-recovery matter sent us the principal’s most recent annual anti-corruption declaration with a one-line cover note: “Tell us what this leaves out.” The declaration was a model of restraint. A two-room apartment in a regional administrative centre. A 2015 European-marque passenger sedan. Bank balances broadly consistent with the official salary scale for the principal’s position. The total declared net worth, on the document, would not have bought a single garage in the Montenegrin coastal town where the principal’s spouse held, on a separate cadastre we already had in hand, an unobstructed view of the Adriatic.

The mandate was strict on three points. First, OSINT only: no informants, no purchased data, no greyzone sources. Second, evidentiary discipline: every asset on the final map needed to be traceable back to a primary public-record source the issuing court would accept in admissibility. Third, family graph: counsel’s working assumption was that the principal’s declared assets were the only assets in his own name and that everything material would sit with spouse, adult children, parents, siblings, or a small set of long-standing personal associates. The civil-recovery jurisdiction permitted freezing relief against assets held by family members where adequate evidentiary basis existed; the question was whether we could build that basis from public records alone.

“We knew there was money. We needed an evidentiary map the court could act on, not an investigative narrative we’d have to defend through cross-examination of a confidential source.”
— Partner, international civil-recovery practice (instructing counsel)

What the Registries Said

Asset tracing of this kind is a registry problem with three multipliers. Family members and known associates routinely hold the assets the principal cannot openly own; high-value moveable assets (aircraft, yachts, exotic vehicles) are typically registered in offshore jurisdictions and tracked through their operational signals rather than their nameplate ownership; and on-chain holdings, where present, leave clustering patterns that link back to centralised exchange KYC. We worked all three multipliers in parallel.

The family-graph reconstruction came first. Spouse, three adult children, two living parents, two siblings, and two long-standing personal associates whose names recurred across archived regional press across a decade. Russian federal registries are unevenly accessible but the EGRUL portal at egrul.nalog.ru is fully public, EGRN (the Federal Real-Estate Register) is partially accessible through Rosreestr, and the Federal Bailiffs’ Service enforcement database at fssp.gov.ru exposes outstanding judgements against any named individual. Each name in the family graph was run against all three, against the Federal Tax Service’s public list of beneficial owners disclosure, and against archived regional press going back ten years.

Six of the ten family-graph members held registered assets that, on aggregate, materially exceeded any plausible disclosed income source. The spouse appeared as sole shareholder of two UAE free-zone entities whose disclosed activities were “general trading” and whose registered office sat in a Dubai building also occupied by a corporate-services provider previously identified in published reporting as a service-provider to sanctioned Russian principals. The adult children held real-property interests recorded in the Georgian National Agency of Public Registry (NAPR) cadastre in Tbilisi and in the Montenegrin Real Estate Administration (CRPS) cadastre along the coast. The Montenegrin titles, on inspection of the actual cadastral PDFs, listed the principal’s documented residential address as the correspondence address on two of the four registered titles. The children, in plain reading of the documents, were named owners with the principal’s address as the postal contact.

“You look at six members of an immediate family graph each holding registered assets they could not have earned on any disclosed income. That’s not coincidence. That’s portfolio architecture.”
— Senior asset-tracing analyst, [0x]INT

The Layer Underneath the Layer

The high-value-movables work produced the two cleanest evidentiary pieces in the bundle. Two yachts surfaced through cross-reference of family-graph names against the IMO’s vessel-information database GISIS, against Equasis, and against the operational AIS feeds aggregated by MarineTraffic and VesselFinder. The first, a 24-metre motor cruiser, was registered to a Marshall Islands single-vessel LLC whose corporate-services agent matched one of the entities we had already surfaced through the family graph. The yacht’s AIS pattern across the 2024 and 2025 summer seasons showed sustained presence in the same Adriatic marinas that the Montenegrin cadastral title commanded an unobstructed view of. The principal’s spouse had been photographed, in archived social-media content from a deleted account recovered via the Wayback Machine, aboard a vessel whose interior, on visual comparison against the yacht-brokerage listing from the original 2018 sale, was demonstrably the same cabin.

The second yacht, a 38-metre vessel, was registered to a separate Marshall Islands single-vessel LLC and operated under a management contract with a yacht-management company headquartered in the Mediterranean. The management company’s public client brochure for the 2019 and 2020 seasons — long since removed from the live website but cached comprehensively on Wayback — named the principal’s spouse as the operating client. The vessel’s AIS movements for the 2023, 2024 and 2025 seasons showed the same patterns of seasonal presence in the same handful of Mediterranean marinas and a winter berthing pattern in a UAE marina. The AIS log was reconstructible from public feeds with full temporal granularity; the management-contract attribution was reconstructible from the cached brochure with documented capture dates.

On-chain work was the third multiplier. Three deposit clusters surfaced across two exchanges with KYC obligations enforceable under a future order from a competent authority. The clusters were tied, by shared-input heuristics and by deposit-timing correlation, to wallets registered against email addresses recoverable through public breach-data corpora to two of the adult children. The cluster aggregate, valued at terminal-block snapshot prices for the relevant assessment dates, was a material multiple of the children’s declared bank balances. The on-chain leg was not itself the largest asset class — the real estate and the yachts dwarfed it — but it provided an additional jurisdictionally-portable freezing target that the civil-recovery process could pursue without engaging Russian, Georgian or Montenegrin co-operation.

“Yachts move. Real estate doesn’t. We had both. The yacht AIS gave us a behavioural signature; the cadastre gave us the unmovable target. The on-chain leg gave us a third venue for relief.”
— Senior asset-tracing analyst, [0x]INT

Where the Money Touched Ground

The consolidated asset map identified holdings across four jurisdictions at a multiple comfortably exceeding two orders of magnitude over the disclosed annual declaration. The map was delivered as a court-ready evidentiary bundle: each asset paired with the public-records extract that established it, each extract paired with capture date, source URL, certified translation where required, and an explicit chain-of-inference note for any conclusion that rested on more than direct registry evidence.

Instructing counsel used the bundle to apply for and obtain freezing orders in two of the four jurisdictions inside the following quarter. Applications in the remaining two jurisdictions are pending at the date of this case study. No source listed in the bundle has been challenged on authenticity to date. The principal’s annual declaration for the subsequent year — filed after the freezing orders had been publicly registered — was substantively unchanged: the apartment, the sedan, the modest bank balance. The declaration remains a public document. The reconstruction remains a public-records derivation. The gap between the two has not yet been formally explained.

“The freezing orders went out on the strength of the public-records bundle alone. No confidential informant. No purchased dataset. That mattered enormously when the principal’s counsel tried to challenge admissibility.”
— Partner, international civil-recovery practice (instructing counsel)

What We Took Away

Three patterns from this dacha-empire asset-tracing engagement that have generalised across our subsequent asset-tracing work against politically-exposed Russian principals.

The family-graph multiplier is the operative one. A principal who is institutionally exposed under domestic anti-corruption rules will rarely hold material assets in his own name. The relevant population is the immediate family graph extended through associates whose names recur across his biographical history. Constructing that graph from archived regional press is the unglamorous, repetitive, time-consuming first leg of any serious asset-tracing engagement; it is also the leg without which everything downstream is guesswork. The standard workflow we use is documented in the asset-tracing service brief at /services/asset-tracing/.

Yacht AIS is the single most under-used behavioural signature in offshore asset work. A yacht under flag of convenience can be registered to whatever single-vessel LLC the principal’s service-provider chooses to incorporate; the registration tells you very little. What tells you a great deal is the AIS movement pattern across operational seasons. Vessels appear in the same handful of marinas, on the same calendar, in the same crewing configuration, year after year. Where the marina overlap is also the location of a cadastrally-registered title held by a family-graph member, the inference chain is short and defensible. Our Shadow-fleet IMO lookup is designed for the sanctioned-tanker case but the underlying registries (Equasis, IMO GISIS) are the same instruments any yacht-tracing engagement uses, and the standard AIS gap-analysis methodology applies symmetrically to a 38-metre pleasure yacht and to a 110,000-DWT crude tanker.

Transliteration is the silent risk-multiplier on every Russian-name search. The same individual appears in EGRUL under one Cyrillic-to-Latin transliteration, in the Georgian NAPR under another, in the Montenegrin CRPS under a third, on UAE free-zone disclosures under a fourth, and in archived regional press under a fifth. A name-match negative across these registries is not a clean result if the name has not been run through the canonical transliteration standards. Our free Cyrillic-to-Latin transliterator outputs GOST 7.79-2000, ICAO Doc 9303, BGN/PCGN 1947, and Russian Passport 2010+ standards side-by-side; every name in this engagement’s family graph was run through that tool as a default step before any cross-jurisdictional registry pull.

External public-record sources referenced in this methodology

• Federal Tax Service of Russia — EGRUL public lookup portal.
• Federal Bailiffs’ Service of Russia (FSSP) — enforcement-action database.
• Rosreestr — Russian Federal Service for State Registration (real estate).
• Georgian National Agency of Public Registry (NAPR) — cadastral and business registry.
• Montenegrin Real Estate Administration (CRPS) — cadastral records.
• Equasis — international vessel-information consolidation portal (operated under EU and IMO MoUs).
• IMO GISIS — Global Integrated Shipping Information System.
• MarineTraffic — aggregated AIS feed for pleasure-vessel and commercial-vessel tracking.
• Internet Archive Wayback Machine — archived web content.
• OCCRP Aleph — investigative archive of corporate documents and beneficial-ownership leaks.

About this engagement

Case identifiers, the principal’s jurisdiction and role, the specific aggregate value of the reconstructed portfolio, and all individually identifying details of family members and named entities have been adjusted to protect client confidentiality and to comply with the underlying civil-recovery proceeding’s confidentiality directions. The methodology, the role of cadastral correspondence addresses in establishing aggregate-control inference, the use of cached yacht-management brochures for management-contract attribution, the AIS-pattern overlap with cadastral title locations, and the overall four-jurisdiction shape of the reconstruction are accurate to the engagement.