New Delhi: The mother of the prime suspect in the June attack on a Rashtriya Swayamsevak Sangh (RSS) office in Jharkhand received nearly Rs 1.4 lakh in her bank account in the days before and after, separate investigations by the National Investigation Agency (NIA) and the Enforcement Directorate (ED) are learnt to have found. The money, sources told ThePrint, came from three suspicious accounts linked to a company named Singo, fraudulently set up in the name of a Delhi-based autorickshaw driver. These source accounts, they added, received more than Rs 300 crore over a six-week period preceding and following the attack.
According to the sources, the breakthrough in finding the alleged money trail came when the investigators chanced upon a Rs 20,000 payment made to prime suspect Aman Ansari’s mother on the day of the attack (17 June) from the account of a labourer based in Bihar’s Banka.
The attack on the RSS office took place on the intervening night of 16 and 17 June this year, when two men in a car hurled petrol bombs on the premises. No injuries were reported in the case. The Tehreek-e-Taliban Hindustan, a little-known entity purportedly linked to Pakistani gangster Shehzad Bhatti, later claimed responsibility for the attack via social media.
The Jharkhand Anti-Terrorism Squad arrested three suspects in the case—Aman Ansari, Sai Ansari, and Sayam Sujan—before the Ministry of Home Affairs (MHA) handed over the investigation to the NIA. The anti-terrorism agency is now probing the alleged role of foreign-based handlers in orchestrating the attack.
Looking to unmask the local module involved and its funding, the NIA has conducted raids in Lohardaga, Aman Ansari’s hometown in Jharkhand, as well as Ranchi and New Delhi. The ED has also conducted searches in Delhi, Bengaluru, Banka, and Lohardaga, covering the same set of accused, as well as the companies allegedly used to channel funds for the attack.
Flow of funds
The alleged Rs 1.4 lakh payment to Aman Ansari’s mother Safrana Khatoon was made through numerous transactions, and routed through the bank account of a daily-wage labourer named Sandeep Kumar, based in Bihar’s Banka, the sources said. The NIA, it is learnt, has established that Sandeep Kumar’s account in Banka was used as a source of funds for the module.
According to the sources, the money originated from three accounts linked to Singo. The company is believed to have been set up in the name of an auto driver identified as Himanshu, with the digital KYC process for its incorporation carried out overseas. Over a period of six weeks before and after the attack, the sources said, around Rs 350 crore was remitted into these bank accounts.
The funds were allegedly routed through multiple channels, including a Bengaluru-based fintech company, Escrow Stack, that offers payment solutions, among other things. Escrow Stack, the sources said, has told investigators that the payment to Sandeep Kumar’s account was made on the instructions of Singo, a client of the firm since May.
Separate examinations of Himanshu and Sandeep, the sources said, did not reveal any breakthrough for the agencies. However, an analysis of the three bank accounts linked to Singo revealed that they received around Rs 350 crore between May and July this year, before all the funds were siphoned off to various beneficiaries. Sources said this was done through nearly 1,000 transactions of Rs 1 lakh or less to evade scrutiny by banks and financial regulators. The fund transfer to Sarfana Khatoon via Sandeep Kumar was one such transaction.
The NIA, the sources said, has also identified one Sandeep Kumar Gupta following an analysis of Dubai-based entities and individuals who allegedly coordinated the movement of funds and communication between the handlers and the accused arrested so far.
Edited by Sunanda Ranjan