One fine,
140 shells

sources→cleanse→graph db→traversal→context

stage 1 · data sources

The three data sources

• ICIJ Offshore Leaks: the leaked registries behind the Panama and Pandora Papers. They record what people own offshore: companies, officers, intermediaries, and the addresses behind them.
• OpenSanctions: the world's sanctions lists and watchlists, aggregated. It records who governments have flagged, and why.
• News articles: reporting and enforcement actions. The news records what happened, which neither registry ever states.

Each dataset was collected for a different purpose, by people who never compared notes. Before any linking, the graph is exactly what you see here: three separate clouds of nodes, no connections.

sources→cleanse→graph db→traversal→context

stage 2 · cleansing & standardization

Same men, different spellings

Standardization forces every record into one schema: names are case-folded, addresses are normalized so "16 STAKHANOVTSEV STREET" and its misspelled sibling "16 STAKHANEVTSEV STREET" can be compared, and a record that misspells the family name as "Rotemberg" stays in play. But no amount of cleaning makes the sources agree on a name. The same two people arrive differently from each source:

• Igor Rotenberg is "MR. IGOR ROTENBERG" in the leaks, "Rotenberg Igor Arkadyevich" on the sanctions lists, and "Igor Arkadyevich Rotenberg" in the news.
• Arkady Rotenberg is "Arkady Rotenberg" and "Rotenberg - Arkady" in the leaks, "ROTENBERH ARKADII" on the sanctions lists, and "Arkady Rotenberg" in the news.

Real-world identity is messy. The highlighted nodes are all of these representations; nothing connects them yet.

sources→cleanse→graph db→traversal→context

stage 3 · the graph db, connecting the sources

Drawing the missing edges

The build step connects records across sources three ways:

• Names. A fuzzy matcher proposes same_as edges between similar names, each carrying a confidence score. Common names score low; rare names like Rotenberg score high.
• Addresses. Records registered at the same normalized address get connected, which is how the misspelled "Rotemberg" record joins the cluster.
• Family. Relations extracted from text, like Igor being Arkady's son, become family of edges.

Inferred edges are drawn dashed and keep their generator and confidence. Click any node to read its edges verbatim, labeled with the source's own words: "beneficiary of", "shareholder of", "registered at".

sources→cleanse→graph db→traversal→context

stage 3 · the graph db, node features

A node feature:
who is sanctioned

Nodes carry features: flags that answer a question about the node. The one that matters here is sanctioned, which answers "who is sanctioned". Igor Rotenberg holds it: he is the son of Arkady Rotenberg, a childhood friend of Vladimir Putin, and the family built billions on state construction tenders. OFAC designated Igor in 2018 under the Ukraine-related program, and 19 authorities now list him, from the EU Council to Japan's Ministry of Finance.

On the graph, sanctioned nodes wear a red ring. The flag is what retrieval will filter on: it marks the bad actors the architecture asks about.

sources→cleanse→graph db→traversal→context

stage 3 · the graph db, assembled

One network from three sources

With the identity edges drawn and the features set, the three clouds are one graph. Leaked shell companies sit two hops from the sanctions lists that name their owners; news entities resolve into both. Every node keeps its source color, and every connection states how it was made: asserted by a registry, or inferred with a confidence score.

This is the whole demo subgraph, 136 nodes exported verbatim from the full 2.3M-node build. Use the explore button to wander it freely.

sources→cleanse→graph db→traversal→context

stage 4 · traversal, the story in the graph

Ask: "What connects the
Rotenbergs offshore?"

Traversal starts from the two flagged men and walks toward each other. The paths converge on one company: Markom Management Ltd, the intermediary with 140 connections. Igor reaches it through Stormont Systems, where he is shareholder. Arkady reaches it through Beechwood Associates, which he owns. A joint "Igor Rotemberg and Boris Rotemberg" record reaches it through Kenrick Overseas, where they are beneficiaries. One agent, one family, three shells:

Igor [shareholder of] Stormont Systems and Arkady [owner of] Beechwood Associates, both [intermediary of] Markom Management, with both men [same as] their sanctions-list entries every hop cites a node ID, an edge class, and its provenance

The graph knew this story from context alone: leaked registries plus sanctions lists, no journalism required. The last stage checks that context against the outside world.

sources→cleanse→graph db→traversal→context

stage 5 · the context, validated

Validating the context

In August 2025 the Financial Times reported that OFSI, the Treasury's sanctions enforcer, had fined Markom Management Limited £300,000 for wiring £416,590 to a designated person. The pipeline folded the article in as nodes, each relation carrying its quote:

"the group was used to maintain shell companies for the Rotenberg family…"linked_to · llm_extraction · confidence 0.85 · FT, 2025-08-01

The article's "Markom Management Limited" resolves, dashed and at confidence 1.0, onto the same intermediary node the traversal found. The enforcement action lands on the company the graph had already placed at the center of the family's paper trail. The article does not create the story; it validates the context the graph assembled from registries and sanctions lists alone.

(Per the FT: no allegations of wrongdoing have been made against the Rotenbergs or Mark Omelnitski himself.)