Risks

Estonia’s money laundering risk landscape is shaped by the trend of crime becoming more international and networked, with criminals making use of professional money laundering networks and seeking individuals and companies around the world willing to participate temporarily in specific criminal projects. In the Estonian context, there are indications of international criminal networks being active, particularly in relation to fraud, tax offences, and the subsequent laundering of illicit proceeds. The money laundering threat in Estonia is also linked to the increasingly tense geopolitical situation. Russia continues its aggression in Ukraine and hybrid attacks in Europe. Such activities require funding, which is why the movement of money or its equivalents through Estonia’s financial system must be monitored especially closely.

Sanctions imposed on Russia are forcing criminals to adopt more complex methods to evade restrictions on trade and financial flows. Both traditional money laundering methods and international laundering networks are used to circumvent sanctions. Russian intelligence services and organised crime groups are known to cooperate in order to evade sanctions, exploiting existing laundering infrastructures as well as cryptocurrencies. In 2024, the Estonian Financial Intelligence Unit (RAB) observed laundering of money earned through sanction violations in the cases it analysed.

The number of suspicious transaction reports (STRs) submitted to RAB, as well as the amounts involved, were on the rise in 2024. At the same time, the identified volume of laundered money was still in decline: in 2024, RAB forwarded suspicious transactions worth a total of €222 million to investigative authorities, representing a 19% drop compared with 2023, and the number of such transmissions fell by 29%. The main predicate offences indicated in these reports were sanction evasion, tax offences, and fraud. Compared with previous years, cases linked to corruption and embezzlement stood out more clearly. As before, the majority of RAB’s reports concerned so-called autonomous money laundering, where there were no direct indications of predicate offences, but the activity patterns strongly suggested laundering. International information exchange continued to focus primarily on fraud-related money laundering, although this showed a declining trend.

Thanks to the work of Estonian supervisory authorities, the number of high-risk market participants has decreased among credit institutions, virtual asset service providers, financing institutions, and corporate service providers. The money laundering risks of these sectors have become concentrated in the hands of a few participants with higher-than-average risk appetite and more international clientele, several of whom have seen significant growth in cross-border transaction volumes. The inherent risk of the gambling sector is increasingly coming to the fore, particularly in relation to internationally licensed online casinos and sports betting platforms operating in Estonia. Both financial and non-financial obligated entities remain vulnerable due to the presence of unlicensed operators in their sectors.

Estonia’s terrorist financing risk landscape is primarily shaped by correspondent relationships. It is mainly through such arrangements that the majority of suspected terrorist financing cases originate. This is evident both in the banking sector and among virtual asset service providers. In both cases, Estonia’s jurisdiction and open economic environment are exploited. Transactions are carried out through the Estonian legal-entity customer of the service provider (the respondent institution), which itself operates in another jurisdiction. The client of that respondent institution – usually a natural person residing abroad – is typically the one sending the funds.

The quality of reports submitted to RAB concerning suspected terrorist financing improved significantly in the years leading up to 2024, but since then progress has slowed. In 2024, the total number of such reports was about one-third lower than in the couple of years before. Some sectors still do not submit any relevant reports at all, such as non-profit organisations, while others submit them with insufficient quality, such as some virtual asset service providers.

Threats

• The greatest threat for Estonia remains the layering of criminal proceeds obtained abroad within Estonia’s financial system, particularly when used to circumvent and violate sanctions against Russia. Cross-border layering of illicit funds continues to pose the highest risk to payment services provided by credit institutions, especially regarding correspondent services to foreign fintech providers. Since 2021, the total sums of cross-border transactions reflected in RAB reports have grown markedly. According to reports, the main destination countries for suspicious funds were Lithuania, the United Kingdom, Poland, Bulgaria, and Switzerland, while the main source countries were Lithuania, Germany, Latvia, Finland, the United Kingdom, and Poland.
• Estonian legal entities, especially private limited companies (OÜs), are exploited in international criminal schemes (mainly tax offences, fraud, and associated money laundering). In many cases, these suspicious transactions do not involve Estonia’s financial system at all. RAB frequently receives information about suspicious transactions by Estonian persons conducted through payment accounts in foreign banks and e-money institutions. Lithuanian payment accounts still predominate in RAB’s reports, but in terms of transaction volumes, accounts held by Estonian persons in Belgium, Malta, the United Kingdom, Austria, and Germany also stand out.
• In the context of terrorist financing, Estonia’s main risk concerns money transfers to Tajikistan, Kyrgyzstan, and Turkmenistan. Estonia’s competent authorities added these three states to the list of countries with elevated terrorist financing risks.
• Donations linked to the Hamas–Israel war continue to affect Estonia’s risk landscape. The threat has materialised in correspondent relationships of credit institutions, where donations from abroad can be directed to foreign non-profit organisations through payment service providers.

Actions

• The Financial Intelligence Unit (RAB) continuously analyses the risk environment and prepares and publishes strategic analyses. Supervisory authorities assess the risks linked to their regulated entities and to specific sectors. Market participants themselves are also required to assess the risks inherent to their field of activity and to implement mitigation measures.
• Competent authorities organise the registration and licensing of market participants and oversee their compliance. Market participants are required to build organisational systems to prevent money laundering and terrorist financing, including applying due diligence measures and fulfilling reporting obligations.
• In response to emerging trends in financial crime and the increasing complexity of money laundering as a concealed offence, more technologically advanced solutions must be used for detection. In the field of anti-money laundering and counter-terrorist financing, data-driven risk assessment and decision-making are essential. The demand for better data analytics necessitates the development of data management and the creation of the necessary legal environment, on which RAB has been actively working.