Although the documents do not directly link the $3.3 million to the meeting, they show that officials at three separate banks raised red flags about the funds. Many of the transfers seemed to have no legitimate purpose, bankers noted. Kaveladze quickly moved money to other accounts he controlled, and appeared to use some of it to make payments on Agalarov’s behalf — including more than $700,000 to pay off American Express charges.

That money is on top of the more than $20 million that was flagged as suspicious, BuzzFeed News revealed earlier this month , after the money ricocheted among the planners and participants of the Trump Tower meeting. Special counsel Robert Mueller’s team, which has been investigating whether any individuals colluded with Russia to influence the 2016 presidential election, is examining the suspicious transactions, four federal law enforcement officials said. A spokesperson for Mueller’s office declined to comment.

Documents reviewed by BuzzFeed News show that $3.3 million began moving on June 3 between two of the men who orchestrated the meeting: Aras Agalarov, a billionaire real estate developer close to both Vladimir Putin and President Donald Trump, and Irakly “Ike” Kaveladze, a longtime Agalarov employee once investigated for money laundering.

But the very day that email was sent, another exchange was taking place behind the scenes.

That email led to a meeting at Trump Tower that has become a central focus of the investigation into possible collusion between Russia and the Trump campaign.

On June 3, 2016 , Donald Trump Jr. received one of the most striking emails of the presidential campaign, offering dirt on Hillary Clinton as part of the Russian government’s “ support for Mr. Trump .”

Scott Balber, an attorney for Agalarov and Kaveladze, said each of these transactions was legitimate and there is nothing improper with their financial activity. Balber explained that Agalarov sent funds to Kaveladze, an employee, to pay various business or personal expenses in the US.

“What is suspicious, or insidious, about a billionaire who pays his employee in the US to pay his business or domestic bills?” Balber said. “This looks like complete nonsense.”

“It’s obvious the events of June 2016 have been a focal point of the special counsel’s investigation, various congressional inquiries, tremendous media attention and the like,” Balber said. “We are in the lens of that reality, so it doesn’t surprise me that there’s been some flyspecking, some gross overreporting by a number of financial institutions. They won’t be criticized for overreporting suspicious activity.”

None of these transactions was discovered until 2017, after the New York Times revealed the Trump Tower meeting. Shortly after that report, investigators asked financial institutions to look back at their accounts to learn how money flowed among the people who planned and attended the meeting: Agalarov; Kaveladze; Agalarov’s pop star son, Emin; their employee, Rob Goldstone, who sent the original email to Trump Jr.; and others.

To unearth connections between some of their accounts, banks took an extraordinary step: They invoked a provision of the Patriot Act — a post-9/11 law that included new tools to track money laundering and terrorist financing. That provision, rarely used in the Trump-Russia investigation, allowed the banks to share information about customers with one another.

Three financial institutions — Citibank, JP Morgan Chase, and Morgan Stanley — discovered the $3.3 million that flowed from Agalarov to Kaveladze.

They also learned that Kaveladze had given different banks radically different descriptions of one of his main companies, Corsy International. To JP Morgan Chase, Kaveladze said Corsy was a “transportation equipment and supplies merchant wholesaler.” He told Citibank it was a “music promotion company.” Agalarov gave yet another description to Morgan Stanley, calling the firm a “service provider” for his vast real estate company, Crocus Group.

Balber, the attorney, said that there are two separate businesses, both named “Corsy International,” that Kaveladze controlled. One is based in California and is involved in “procurement” issues related to Agalarov’s business empire. The other is based in New York and is largely involved with the music career of Emin Agalarov.

That lack of transparency made it difficult for bankers to know the true purpose of the funds into the company’s accounts. Examiners also became concerned with how Kaveladze handled the money.

On June 3, the day of the email exchange with Donald Trump Jr., Kaveladze began depositing checks into his JP Morgan Chase Platinum business checking account in California. He used three different branches in Huntington Beach, California, and the five checks totaled about $397,000. Each originated with Agalarov and referred to “compensation Amex expenses.”

Then on June 6, Agalarov started sending checks through an account at Morgan Stanley Wealth Management to Kaveladze’s company. Those funds totaled about $971,000.

When they reviewed these accounts, bank examiners became suspicious because it was unclear exactly how the money was supposed to be used.

For instance, at JP Morgan Chase, Kaveladze transferred money from one of his companies’ accounts to another and ultimately sent 24 payments over 15 months to American Express for a total of $725,000 — a red flag to bankers because they said it appeared Kaveladze was making the payments for Agalarov. The documents do not say what expenses were charged to American Express, and three federal law enforcement agents said investigators are still trying to figure it out. Balber said these transactions were legitimate personal and business expenses for Agalarov.

The details unearthed by bankers were compiled in “suspicious activity reports” sent to the Treasury Department’s Financial Crimes Enforcement Network, which shared them with other law enforcement agencies investigating Russian interference.

Suspicious activity reports are not evidence of wrongdoing, but they can provide valuable information to investigators looking into possible money laundering, fraud, tax evasion, or other financial misconduct.

During their reviews in 2017, some banks noticed behavior that they had not previously flagged. Bank of America, for example, noted about $7.8 million that was sent from Corsy International to another of Kaveladze’s businesses, Promomed, between 2012 and 2014. Bankers said they were concerned that by transferring funds from one company to another, Kaveladze was trying to obscure the original source of the money.

Citibank went far back into its accounts to search for suspicious activity by Kaveladze and the Agalarov family. Examiners “elevated” about $11.9 million in transactions that began in 2015, largely because the transactions originated in “high-risk jurisdictions,” or locations that are known as havens for money laundering, and because the funds were sent for “unknown purposes.”

Kaveladze had popped up on Citibank’s radar in September 2015, when he applied for a $100,000 line of credit for Corsy International. At that time, he told bankers that the company had $8 million in sales the previous year and that it had about $240,000 in available funds — but when Citibank investigated further, examiners learned that Corsy International’s account was actually overdrawn.

Citibank denied the loan.

Balber, Kaveladze’s attorney, said that his client did nothing improper, and that he doesn’t recall telling the bank about Corsy International’s available funds.

All three banks cited a 2000 report by the Government Accountability Office, in which Kaveladze was investigated as part of a Russian money laundering scheme. Kaveladze, that report found, established more than 2,000 corporations in Delaware for Russian real estate brokers, then set up US bank accounts for them. The brokers used these accounts to transfer about $1.4 billion, the report found.

Kaveladze was never charged with a crime and called the GAO’s inquiry a “witch hunt.” ●