Weeks after Russian tanks rolled into Ukraine in early 2022, a North Carolina biotech company that has done work for the Pentagon scrambled to help civilians and soldiers wounded by the war.

Nasdaq-listed Humacyte, which is developing a platform designed to harness the body's own ability to heal, believed its technology could make a difference in the unfolding humanitarian disaster. The company, chaired by former Obama Cabinet secretary Kathleen Sebelius, quickly provided hospitals on the frontlines with its technology, the Human Acellular Vessel, an implant engineered to expedite the healing of vessel tissue repair.

Humacyte, which in 2017 was awarded a $3.4 million contract by the US Department of Defense, proudly showcases these efforts in Ukraine on its website and its annual report as proof that its technology works.

Buried in corporate filings is another relationship that is central to Humacyte: Russian billionaire Gavril Yushvaev is the company's second-largest individual shareholder.

However, the shadowy history of Yushvaev -- who has been described by the Organized Crime and Corruption Reporting Project as the "head of a Russian criminal gang" is not disclosed in those filings, even though some experts tell CNN the company may have been obligated to reveal that information to investors.

Born in 1957, Yushvaev served nine years in a Soviet prison camp after being convicted of a violent crime in 1980, according to a Securities and Exchange Commission filing.

'Unique and novel situation'

Yushvaev is sanctioned by Ukraine, which describes him as a "quintessential example of the criminal world tying in with law enforcement and the government in Russia."

Forbes estimates Yushvaev and his family are worth approximately $1.9 billion, a fortune built in part by selling a stake in dairy and juice company Wimm-Bill-Dann to Pepsico in 2010

"It raises this odd situation where you have an alleged Russian crime boss who will benefit economically from a company that is able to showcase its products in a war started by Russia," said Charles Whitehead, a professor of business law at Cornell Law School.

Yushvaev holds an 8.7% stake in Humacyte that is worth nearly $28 million, according to data provider Refinitiv. That's just ahead of institutional investors including BlackRock, Vanguard and State Street.

"This is a unique and novel situation. It's the only example I know of where a US-listed public company has a Russian oligarch sanctioned by Ukraine as one of its largest shareholders," said Steven Tian, research director at the Yale School of Management's Chief Executive Leadership Institute.

Yushvaev did not respond to multiple requests for comment.

Humacyte: Russian billionaire has no 'control' over firm

Yushvaev has not been sanctioned by the US government. That means companies like Humacyte have not been compelled to take action against him.

Still, in 2018 Yushvaev was included on the "Putin List," a Treasury Department listing of 210 prominent Russians, many with close ties to the Kremlin, all of whom rose to prominence under Russian President Vladimir Putin. Under legislation meant to punish Russia for 2016 election interference, the Trump administration was required to release this list and consider whether to impose sanctions.

Sebelius, who chairs Humacyte and previously served as secretary of health and human services in the Obama administration, did not respond to requests for comment.

In a statement to CNN, Humacyte stressed that as a result of its humanitarian support to Ukraine, 19 patients who were victims of gunshots, blast injuries and explosions have been treated with the HAV.

"There are patients walking today on their own limbs who would not be doing so without access to the HAV to repair their damaged arteries," a Humacyte spokesperson said.

The company also sought to minimize the role of Yushvaev.

"This is a minority shareholder who was one of over 150 shareholders who invested in Humacyte when it was a privately held company," the Humacyte spokesperson said. "As a minority shareholder, this person has no involvement in, or control over, the conduct of Humacyte's business."

Yushvaev invested alongside founder's husband

However, Yushvaev did not simply buy shares of Humacyte off the Nasdaq.

Instead, he participated in a 2015 Series B round of funding that raised $150 million in exchange for preferred stock in Humacyte, which was still a private company at that point.

"This was at a time when most corporations were running away from Russian cash," said Yale's Tian, who noted this investment occurred just more than a year after Russia invaded Crimea, setting off a wave of Western sanctions.

"When you're private, it's a bit more of a partnership because the investor has little or no liquidity. A Series B round is a little more personal and direct," said Whitehead.

"That doesn't mean there is a problem, but it does make you wonder what the company was doing taking money from someone with this kind of a record," said Whitehead. "Presumably they would have checked him out beforehand. You want to be very careful about the source of money you're taking."

It's also noteworthy that Yushvaev was one of just two individuals who were announced to have joined that $150 million Series B round of funding, along with several institutions.

The other individual is former Credit Suisse CEO Brady Dougan, who is currently the leading individual shareholder with 9.7% of shares in Humacyte through his control of a firm called Ayabudge LLC.

Dougan is the husband of Humacyte founder, president and current CEO Dr. Laura Niklason. The former Credit Suisse banker also sits on the Humacyte board.

At the time of the 2015 Series B, Dougan had just stepped down from the helm of Credit Suisse.

Humacyte announced that Credit Suisse advised and acted as the sole underwriter and placement agent for the Series B investment that included Yushvaev.

'It shows poor judgment'

Yushvaev was brought in as an accredited private investor by Credit Suisse's capital markets advisory group, a Humacyte spokesperson told CNN. The biotech company was not made aware of any alleged criminal activity, the spokesperson said.

Yushvaev was a client of Credit Suisse, according to the Organized Crime and Corruption Reporting Project. The OCCRP reported in March that "Credit Suisse provided debt security a Cypriot trust -- PTC, whose beneficial owner" is Yushvaev.

Dougan does not personally know Yushvaev, a Humacyte spokesperson told CNN.

Credit Suisse declined to comment in response to questions from CNN.

Yale professor in management practice Jeff Sonnenfeld told CNN the close ties between the major parties in the Series B investment shows that the investment by Yushvaev in Humacyte was not done by "carelessness."

"It's worse than negligence. It was done knowingly. Rather than a failure of management and oversight, it shows poor judgment," said Sonnenfeld, who has championed and chronicled the corporate exodus out of Russia.

'Treading on thin ice'

Public companies are required by the SEC to disclose to investors material risks that could impact the business. The goal is to ensure investors are not blindsided. So-called risk factors typically include vulnerability to cybersecurity breakdowns, natural disasters or sudden changes in demand for products or services.

In its SEC filings, Humacyte makes no mention of the checkered history of its second-biggest individual shareholder.

By contrast, in its 2005 annual report, Wimm-Bill-Dann alerted shareholders to the criminal history of Yushvaev, who at the time was the largest shareholder in the European dairy products company.

"Our largest shareholder, who has been a member of our Board of Directors since June 14, 2005, was convicted of a violent crime in 1980 under the Soviet system and served nine years in a labor camp," the Wimm-Bill-Dann filing states. "Press speculation about these or other matters relating to our shareholders or directors could adversely affect our reputation and the value of our securities."

Humacyte likely should have done the same, spelling out its exposure to Yushvaev as a key risk, according to Sonnenfeld.

"Where they are treading on thin ice is by not revealing this risk factor," said Sonnenfeld.

Disclosure questions raised

The Yale professor argued that if Humacyte's second-biggest shareholder were an infamous American crime boss, the company would have had to disclose that risk.

"This just happens to be the Russian version of that character," said Sonnenfeld. "This person is sanctioned as a criminal by at least one country and has served time for a decade as a criminal in another country. Isn't that a risk? If he is sanctioned this afternoon or tomorrow by the US or the UK, what does that do to the health of this company and its viability in the public health community?"

Yushvaev has not been sanctioned by the US Treasury. But if he was, that would likely require Humacyte to take action.

In general, companies are required to block or freeze shares of individuals sanctioned by the US government and disclose this matter publicly, according to Lawrence Ward, a partner in Dorsey & Whitney's national security law group.

Ward said the impact would largely be "reputational" for the company, including raising concerns among investors, financial institutions and customers.

The federal government -- which Humacyte has considered as a potential future customer -- is particularly sensitive to this issue.

Eleanor Bloxham, CEO of The Value Alliance, which advises boards on corporate governance practices, agrees that Humacyte should describe these risks to shareholders.

"Lack of company risk disclosure would suggest to shareholders: (1) management is clueless about the company's major investors and/or (2) management does not take their obligations to inform shareholders of risks seriously," Bloxham wrote in an email to CNN.

Links to Pentagon

Given Humacyte's work as a US defense contractor, the requirements of disclosure are even higher, according to Bloxham.

"Humacyte should be certain that the US Department of Defense, as a major customer with vital security interests, has been fully informed" about the history of one of its largest individual shareholders, she said.

The Department of Defense declined to comment.

In 2017, the DOD awarded Humacyte a $3.4 million contract that helped fund the development of the company's main product, the HAV, which is designed to treat vascular trauma. Humacyte said those grants have run their full term.

During a call with analysts earlier this year, Humacyte said it expects the DOD, other government agencies and international agencies will eventually be a customer. The company said the DOD has already selected the HAV as one of its top five priority products that it wants the FDA to approve.

Whitehead, the Cornell professor, said Humacyte's relationship with Yushvaev would not necessarily rise to the level of needing to be disclosed as a risk factor.

'They should sever ties'

Still, Sonnenfeld, who has testified before Congress about companies leaving Russia, called on Humacyte to buy out Yushvaev's stake.

"They should sever ties," he said.

Asked if Humacyte plans to cut ties with Yushvaev, a company spokesperson said: "As a public company, Humacyte has no influence over who continues to buy, hold or sell shares in the company."

Yushvaev was previously a major shareholder in Lyft. However, the ride-sharing app's relationship with Yushvaev appears to have ended years ago.

"We are not aware of this individual being a current investor based on SEC filings," a Lyft spokesperson told CNN.

The Lyft spokesperson would not answer further questions about Yushvaev's investment nor how the relationship ended.

Lyft told Mother Jones in 2020, nearly a year before Russia launched its invasion of Ukraine, that Yushvaev is no longer an investor.

"That was a good call by Lyft to cleanse themselves. There is no reason it can't happen here," said Sonnenfeld.