Gulnara Karimova: Uzbek president’s daughter, pop star, diplomat… and money launderer? 

A report says she is. And that London and Virgin Islands firms didn’t do enough to stop her

Gulnara Karimova has already achieved a measure of fame – or notoriety. She is the daughter of Islam Karimov, who was president of Uzbekistan from 1989 until 2016, when he died. There was a period when it was thought that she would succeed him. She also appeared in pop videos under the stage name, “Googoosha,” she ran a jewellery company and she served as ambassador to Spain.

And now, an NGO, Freedom For Eurasia, released a report detailing how Karimova built a £200m empire on properties from London to Hong Kong with funds obtained through bribery and corruption.

What’s more, it adds that accounting firms in London and the British Virgin Islands acted for UK companies involved in the deals. 

According to the report titled “Who Enabled the Uzbek Princess?,” the ease with which Karimova obtained UK property is “concerning.” The report zeroes in on five properties now worth an estimated £50m that were bought in and around London. It names the firms in London and the British Virgin Islands that Karimova or her associates used to buy the properties.

There is currently no suggestion that those acting for the companies linked to her were aware of any connection to her nor that the source of funds could have been suspicious. Significantly, as of yet, no one who provided those services in the UK has been investigated or fined.

But because it was a high-value transaction linked to a high-risk jurisdiction, Uzbekistan,  the report contends that the firm should have conducted enhanced due diligence (EDD) employing thorough background checks to ensure the source of funds was legitimate and not derived from criminal activity.

Karimova’s background would give any compliance officer pause. In 2014, she disappeared from public view which turned out to be because she had been detained on corruption charges while her father was still in power. She was sentenced in December 2017 and then sent to prison two years later for breaching the terms of her house arrest.

The charges were impressive: Prosecutors accused her of being part of a criminal group that controlled assets of more than £760m in 12 countries, including the UK, Russia, and United Arab Emirates. Tom Mayne, one of the researchers on the Freedom For Eurasia report and a research fellow at the University of Oxford, notes, “The Karimova case is one of the largest bribery and corruption cases of all time.”

Karimova’s boyfriend, Rustam Madumarov, and others now alleged to be associates of hers were listed in official documents as the “beneficial owners” of companies based in the UK, Gibraltar and the British Virgin Islands. But the report asserts they were just proxies for Karimova, who used the firms to launder hundreds of millions of dollars.

Accountancy services for two UK companies linked to Karimova were provided by London-based SH Landes LLP. The BBC quotes the firm’s managing partner, Steven Landes, who said: “SH Landes LLP was never engaged by Gulnara Karimova. SH Landes LLP did act on behalf of Rustam Madumarov. SH Landes LLP obtained due diligence on all its clients and relevant regulatory authorities were notified and kept appraised.”

It’s unclear if UK regulators will even go after the firm for its involvement in what could be some serious financial crime. But whether they can demonstrate that their anti-money laundering efforts were effective if that happens remains to be seen. 

Read the report here.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

“In a world older and more complete than ours they move finished and complete, gifted with extensions of the senses we have lost or never attained, living by voices we shall never hear.”

Picture of James

James

VinciWorks CEO, VInciWorks

Spending time looking for your parcel around the neighbourhood is a thing of the past. That’s a promise.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.