A Kyrgyz payment platform promoted in Moscow as an alternative to SWIFT has exposed the difficulty of tracing who controls a financial project spread across several countries. At the centre is Michael Donald, a former Visa UK board member who attended the meeting where VexPay’s leadership was presented but denies that he ever ran the platform.
The dispute matters because VexPay appeared as Russian banks and payment networks sought new routes around international sanctions. It also shows how a British company, a respected payments specialist and a formally Kyrgyz state-linked operator can sit inside a much wider and more contested financial structure.
A name on the leadership list
On 12 August 2025, Moldovan oligarch Ilan Shor presented what he described as VexPay’s new management at a meeting in Moscow involving representatives of the A7 network. Donald was named as one of the platform’s leaders.
Donald has confirmed that he attended the meeting, but rejects the account of his role. He says he was never a VexPay employee or director and never agreed to take such a position. His explanation is that he advised Processing KG, a Kyrgyz state-owned company formally linked to VexPay, on international payments, bank-card acceptance, Apple Pay and relations with Visa.
Those competing accounts leave an important distinction unresolved. Donald’s attendance and advisory work are acknowledged by him; his formal or operational authority at VexPay is not established. The difference is significant because a former senior payments executive can bring technical knowledge, industry contacts and an understanding of regulatory procedures even without holding a directorship.
VexPay is formally associated with Processing KG rather than A7, and the Kyrgyz side denies that the platform is controlled from abroad. But an investigation published by The Insider reported that Shor and A7 personnel took part in discussions about the project’s structure, accounts, staffing and technical organisation.
That reported involvement does not prove that every company or individual connected with VexPay knowingly took part in sanctions evasion. It does, however, explain why the question of practical control matters more than the name on a company register.
The value of a British connection
Donald is a co-owner of ImageNPay, a British fintech company with an environmentally focused public profile. A UK registration and the association with a former Visa executive could make a payment project appear more familiar to banks, commercial partners and compliance teams. Neither feature, by itself, establishes a breach of sanctions or criminal conduct by ImageNPay or Donald.
The potential value lies in the credibility and expertise attached to the connection. A new operator seeking access to international payment services must understand card processing, compliance checks, technical integration and the relationships between payment providers. Someone with experience at Visa can understand those systems in a way that a newly created company in a third country may not.
That is why the episode raises a broader regulatory concern. A Western corporate identity can be assessed as evidence of commercial respectability even when financing, decision-making and technical organisation extend across several jurisdictions. The legal structure may look local while the project’s significant relationships are elsewhere.
Claims that ImageNPay concealed Russian shareholders or links to the Skolkovo innovation centre should not be treated as established findings on the information available here. What can be said is narrower: the British connection formed part of the project’s reported international profile, while the extent of ImageNPay’s involvement and any knowledge of the wider network remain unresolved.
From SWIFT exclusion to replacement routes
VexPay emerged against the backdrop of Moscow’s effort to preserve international payment channels after major Russian banks were cut off from parts of the global financial system. The loss of access to SWIFT, alongside sectoral sanctions, encouraged the development of alternative routes involving fintech companies, intermediary banks and operators in third countries.
A7 became one of the most prominent networks associated with that effort. It was established with state-controlled Promsvyazbank, which services Russia’s defence sector, and Shor, who is under sanctions. The US Treasury has described A7 as a “transnational criminal organisation”. Figures cited in reporting on the network indicate that more than $6.9bn moved through A7 structures between late 2024 and August 2025, while US authorities have referred more broadly to tens of billions of dollars processed in ways intended to circumvent international restrictions.
Those descriptions and figures come from US authorities and related reporting. They are not a judicial finding that every person or company that had contact with A7 or VexPay committed an offence. That qualification is particularly important in this case: VexPay’s formal ownership points to Processing KG, while the extent of A7’s practical influence is disputed.
After sanctions were imposed on A7, activity reportedly began shifting towards Kyrgyzstan and the VexPay project. Such a change does not require a network to rebuild its entire infrastructure. New companies, accounts and jurisdictions can be inserted between the original actors and the final payment, while technical knowledge and professional relationships remain in place.
Why the route is difficult to trace
Viewed separately, each stage of a cross-border transfer may resemble an ordinary commercial transaction. A customer may be based in one country, the payment operator in Kyrgyzstan, the technology provider in Britain and the intermediary bank somewhere else. The link to a sanctioned network may only become visible when investigators compare ownership, advisers, staff, financing, account arrangements and the final recipient.
This fragmentation weakens screening systems that focus mainly on named entities and individual transactions. A company can appear independent in official records while strategic decisions are being made elsewhere. A Western business or a familiar industry figure can increase confidence in a project without revealing who supplies its capital, directs its operations or ultimately benefits from its payments.
For banks and fintech companies, the exposure is substantial. An institution that processes funds linked to a sanctioned network could face investigations, frozen accounts, loss of correspondent-banking relationships or secondary sanctions. US transactions may be examined by the Office of Foreign Assets Control, while British firms could face scrutiny from the Financial Conduct Authority. The existence of those risks is not evidence that any particular bank or company has already broken the rules.
The VexPay case shows why regulatory checks cannot end with the formal registration of a payment operator. Investigators need to establish who designed the accounts and technical systems, who selected personnel, who provided capital, who negotiated with international payment networks and who benefited from the transactions.
That task also demands restraint. Attendance at a meeting, advisory work or a professional connection does not prove covert affiliation or illegal conduct. But those details can become relevant when combined with decisions about staffing, accounts and operational control. The challenge is to distinguish genuine independence from a structure that is legally local but functionally directed from abroad.
The unresolved question
Donald’s disputed status is therefore more than a disagreement over a job title. If he was only an adviser, his presentation in Moscow as part of VexPay’s leadership overstated his formal role. If he held wider operational influence, the available accounts do not establish what authority he had or how it was exercised.
The same uncertainty surrounds the relationship between VexPay, Processing KG and A7. Formal ownership indicates one arrangement; reported participation in planning and organisation suggests possible influence beyond it. Whether that influence amounted to control remains an open question.
That gap is where sanctions enforcement is most vulnerable. When financial pressure forces a network to change its intermediaries, it may preserve its expertise and payment capabilities while changing its corporate identity and jurisdiction. The decisive issue for regulators is not simply which company appears next in the chain, but who controls the chain and who profits when the money moves.
