Surveys

Executive summary 

View the full report in Estonian here. 

Executive summary

Due to the hostilities that erupted after the Hamas attack on 7 October 2023, it is necessary to pay greater attention to preventing the financing of terrorist groups linked to Gaza and the West Bank. The short study therefore aims to draw the attention of market participants to potential risk areas. However, the hostilities clearly have a highly nuanced context that cannot be covered here. The first part provides an overview of Hamas, the Palestinian Islamic Jihad and Hezbollah, all of which play an important role considering the regional aspect of the conflict. This is followed by risk indicators and sample cases, as well as the primary typologies of Hamas financing both in terms of raising and transferring funds for terrorist purposes.

Traditionally, there are three distinguished stages of terrorist financing: 1) raising, 2) moving, and 3) using funds. Estonia is most vulnerable at the stage of moving of funds for terrorist purposes. However, it is clear that raising funds may also occur in Estonia during the current conflict. The third phase, ie use, which is not covered in the short study, concerns, among other things, the costs of maintaining the organisation, propaganda, recruitment and arranging attacks. According to the updated approach, the list of stages of terrorist financing often includes the obscuring, management and storage of funds.^[i] Although all the aforementioned stages of terrorist financing apply to Hamas, for the sake of conciseness, this short study focuses on the collection and transfer of funds.

The primary income sources of the terrorist organisation Hamas are: the support of Iran, taxation, a global investment portfolio, diversion of relief funds provided by charities, and proceeds from crowdfunding campaigns (including in virtual currencies). In the stage of moving funds, Hamas mainly uses credit and financial institutions, but also informal transfer systems, illicit traffic, shell companies and trade-based money laundering. They use cash, bank accounts and virtual currencies, and funds are also transferred to individuals with no known connection to the organisation. On the other hand, it is important to keep in mind that identity-based support networks play a part in both raising and the moving funds.

Download the full report in Estonian here.

Executive Summary

1. Cash is a primary vehicle for criminal activity. This assessment analyses the movement of licit and illicit cash between and among the Baltic states of Estonia, Latvia, and Lithuania through the period of 2019¬¬–2022. The assessment develops an analytical approach that incorporates macro-level central bank emission data, cross-border cash declaration data, and data received by Baltic Financial Intelligence Units (FIUs) from the reports of the AML/CFT obliged entities. A comparison of the regulatory framework for reporting rules contextualizes the assessment.
2. The assessment finds that while the general risk exposure of the three Baltic states is similar, net cash movement differs significantly. At a macro-level, initial analysis indicates that the velocity of cash flows out of Estonia have increased over time. However, cash flows into Latvia, observed a trend reversal beginning the year 2020. The flow of cash out of Lithuania increased significantly over the analysed period. Banknote denomination proportion analysis reveals anomalies for the EUR 100 note, which flows into Estonia and Latvia from abroad, while flowing out of Lithuania.
3. Baltic states are transit countries. Customs data highlights that the Baltic states are rarely the initial origin or destination of the cash entering across Baltic borders. Until the restrictions imposed by the Covid-19 crisis, a common origin of cash entering both Estonia and Latvia was from Russia. The cash declaration trends suggest that unlike Estonia and Lithuania, much of the cash entering Latvia was intended to stay there. However, cash flows became significantly smaller after the travel restrictions imposed after Covid-19 and the Russian invasion of Ukraine in early 2022. For Lithuania, Kazakhstan and Belarus remain the highest source of funds, but, together with Estonia, and increasingly Latvia, the United Kingdom is the uppermost destination country. 
4. Differences in suspicious transaction reporting (STR) regulations across the Baltic states, contribute to an inconsistent availability of cash-related reporting information at local levels. A comparison of STRs, cash threshold reports (CTRs) and other types of report indicates that there is a growing risk exposure between the Baltic states, and that illicit cash may be moving among the three jurisdictions utilizing cross-Baltic criminal networks. While the restrictions imposed by the Covid-19 crisis and war against Ukraine impacted reports received by the Baltic FIUs, inter-Baltic reporting remained relatively stable. 
5. The high amount of cash movement and cash-related reporting aligns with the general risk exposure of the Baltic states. The informal economies in the Baltic states enable money laundering, especially for the purpose of tax evasion. However, more sophisticated money laundering structures may also persist in the Baltic states, which launder illicit cash through more complex schemes involving real estate purchases, currency exchanges, shell companies, or other methods.
6. The assessment concludes with several recommendations. Though digital payments are on the rise, cash remains an integral part of the Baltic, and global economies. However, cash remains a highly elusive subject of investigation, with little available data. Harmonization of data access points is a high priority, especially the reporting rules between FIUs. 

Full report: 

Summary

Despite the increasing prevalence of electronic payments and the decrease of cash payments in Europe, Europol still considers cash to be the instrument of choice for money launderers: crypto transactions have thus far not taken its place as the main payment instrument for concealing the identities of transaction parties.

Since 2017, all European Commission’s Supranational Risk Assessments (SNRA) have called out various cash products and services – cash couriers, cash-intensive businesses, high value banknotes, payments in cash and privately owned ATMs - as having the highest risk of money laundering and a significant risk of terrorist financing. Due to their cash-intensive nature, high-value goods (including precious metals and vehicles) and investment real estate have also been classified as having a high risk of money laundering. Furthermore, certain financial services (retail banking, transfers of funds and money remittance; foreign exchange) and the gambling sector have earned an elevated risk level in the SNRA due to the large number of cash transactions involved.

The Estonian national money laundering and terrorist financing risk assessment published in 2021 includes few references to cash-related risks of money laundering and terrorist financing. The Financial Intelligence Unit (FIU) has previously analysed cash-related crime risks in its internal risk assessments and various thematic analyses. This survey is the first public systematic analysis of cash-related risks. With its broad approach and variety of data sources - interviews with law enforcement experts and data on cash seized in criminal proceedings, payment statistics and cash circulation data collected by the Estonian Central Bank cash control data from the Estonian Tax and Customs Board, as well as cash-related reports received by the FIU, its goal is to fill in some gaps in the national risk assessment by considering Estonia-specific cash-related threats and vulnerabilities. The quantitative analysis is based on data from 2018-2022.

The main questions the survey sought to answer were:

1. What has been the dynamic of cash usage in Estonia during the past five years?
2. On the basis of information gathered from Estonian law enforcement and obliged entities, what are the trends of cash usage and patterns of potential illicit use of cash?
3. What are the main reporting gaps in cash-intensive obliged sectors?

Based on the survey results and considering that the prevalence of cash transactions in Estonia is lower than the EU average, the FIU concluded that, on average, the level of risk associated with cash transactions in Estonia is lower than the "very high" money laundering and terrorist financing risk identified in the SNRA. Estonia's level of national vulnerability is moderately significant to significant because there is insufficient risk awareness on the government level, which in turn affects obliged entities. Because cash is an important instrument of money laundering and cash-intensive service providers are also vulnerable to the risks of terrorist financing, cash-related risks require a consistent and methodical approach in the NRA.

During the period analysed, Estonia's role as a transit country for criminal proceeds diminished significantly. Cash-generating tax crime is an ongoing issue in Estonia, but drug trade and smuggling are also significant sources of cash. Based on known typologies, the criminals have well-established methods and channels for routing criminal proceeds abroad.

Cash-related risks of money laundering and terrorist financing have regained prominence in past two years due to the resurgence of cash transactions in Estonia associated with the end of COVID restrictions, rapid inflation, as well as the recent economic downturn fuelling the shadow economy. The full-blown war initiated by Russia in Ukraine in 2022 have also increased the threat of cash being used for money laundering and evasion of financial sanctions. The war has led to increased smuggling of cash across the EU border, and the black market for smuggled Ukrainian goods is also boosting the cash turnover in Europe. The cash data analysed did not reveal any significant threats of terrorist financing in Estonia, but it must be taken into account that the analysis used mostly aggregated data which might not reflect actual threats. There has been an increase of cash transactions with high-risk countries known to be used for evading financial sanctions imposed on Russia (Central Asian countries, Turkey and the UAE) in 2022.

The risk of money laundering associated with various cash-intensive services - foreign exchange, sale of investment gold and gambling services - has recently risen in Estonia. In the gambling sector, the FIU identified a novel cash threat in remote gambling services. For payment and e-money services mediated by local agents (cash remittance, deposit and withdrawal from foreign payment accounts), as well as real estate transactions in cash, the threat of money laundering remains very significant. However, cash-intensive service providers tend to send very few reports to the FIU regarding suspicious cash transactions, indicating either insufficient due diligence or low risk-awareness (gambling operators and notaries, in particular). Certain sectors where only a handful of service providers are regularly reporting to the FIU and most of the market participants do not report at all (foreign exchange, trade in precious metals, real estate professionals) are even more vulnerable to money laundering.

Recently, Estonian credit institutions have terminated many accounts of customers who have made unusual or suspicious cash transactions. This has resulted in these customers turning to cash-related fintech service providers registered in other jurisdictions, which has transferred also the associated risks to these new sectors and jurisdictions. The data sources used in the survey revealed an increasing role of cross-border payment and e-money service providers who are registered in Lithuania but also serve Estonian clients. Via Estonian payment agents, the cross-border service providers have become a channel for Estonian criminal proceeds. The cash risk of cross-border payment and e-money service providers is primarily associated with tax crime, but these services are also vulnerable to the laundering of proceeds from other types of crimes and to terrorist financing.

Download the full report in Estonian here.

A brief summary

On 24th of February 2022, Russia started its aggression against Ukraine. In response to the Russian aggression in Ukraine, the European Union took fast and decisive steps. In the first half of 2022, the EU adopted six sanction packages against Russia and Belarus. The packages include both individual (i.e. imposed on specific individuals and entities) restrictive measures as well as financial, trade and transport sanctions against the Russian Federation (RF) and Belarus.

This analysis provides an overview of the changes in the volume of the deposits of Russian and Belarusian persons, cross-border payments with Russia and Belarus, the turnover of the virtual asset services mediated to Russian and Belarusian natural person customers of the virtual asset service providers (VASPs) with an Estonian authorisation for economic activity, and the use of cash in Estonia. We will also give an overview of the implementation of financial sanctions in Estonia.

In the first months of the war, the deposits of Russian and Belarusian persons in Estonia, cross-border payments with Russia and Belarus, payments and cash withdrawals made with bank cards issued by Estonian credit institutions in Russia and the turnover of the services mediated by VASPs with an Estonian authorisation to Russian customers decreased sharply. The activity of Russian and Belarusian citizens in establishing Estonian companies did not change in the early months of the war. In the first three weeks of the war, the demand for cash increased 2-3 times in Estonia and then returned to the pre-war level.

From the beginning of the war until the end of June, 545 International Sanctions Reports were submitted to the Financial Intelligence Unit (a total of 99 in 2021), and the Financial Intelligence Unit (FIU) identified failure to lawfully apply a financial sanction in 30 cases. Since the beginning of the war, the volume and export of large cross-border payments made from Estonia to countries associated with sanctions evasion, have increased. The FIU will continue to pay particular attention to these transactions.

Deposits of Russian and Belarusian persons in Estonia

• The balance of the deposits of Russian persons (households and companies, except financial companies) at Estonian credit institutions has sharply decreased since the beginning of Russian aggression in Ukraine: from 83 million euros in February to 53 million euros in June.
• The fifth sanctions package imposed on 8 April 2022 prohibited the acceptance of deposits exceeding 100,000 euros from Russia. As of 26 February 2022, there were 109 Russian persons whose volume of deposits at an Estonian credit institution exceeded 100,000 euros: 104 households, 1 credit institution, 1 company and 3 government sector institutions. The total volume of the deposits of these Russian persons amounted to 46.6 million euros.
• The balance of the deposits of Belarusian persons (households and companies, except financial companies) at Estonian credit institutions decreased dramatically: from 15 million euros in February 2022 to 3 million in June.
• As of 10 March 2022, there were 7 Belarusian persons with deposits exceeding 100,000 euros at an Estonian credit institution; 6 of them were households (i.e. private persons, deposits totalling 2.95 million euros) and 1 was a company (deposit volume slightly below 180,000 euros).

Payments

• Cross-border payments with Russia have considerably decreased since the beginning of Russian aggression in Ukraine on 24 February 2022. Cross-border payments from Russia to Estonia decreased by 18% (from 113.4 million euros in February to 92.6 million euros in May 2022) and payments from Estonia to Russia decreased by 40% (from 121.1 million euros in February to 72.9 million euros in May 2022).
• At the beginning of the war, the volume of large cross-border payments (over 10,000 euros) of several companies of Russian citizens engaged in the wholesale of motor fuel and the manufacturing of iron, steel and ferro-alloys and the wholesale of electrical materials, etc., increased several times.
• The volume of large (over 10,000 euros) cross-border payments by the companies of Russian and Belarusian e-residents (except one fuel company) is very modest and the volumes of these large cross-border transactions did not change in the early months of the war (February–April 2022).
• The volume of cross-border payments with Belarus is modest (a couple of dozen million euros per month) and decreased in the first four months of the war (payments to Estonia making up 40% and from Estonia 20%).
• In the first four months of the war, the volume of large cross-border payments from Estonia to Armenia, Azerbaijan, Australia, Austria, Bulgaria, Egypt, Georgia, Ghana, Jersey, Jordan, Kazakhstan, Turkey and Uzbekistan increased. Incoming payments have increased from the United Arab Emirates, Bulgaria, China, Cyprus, Lebanon, Luxembourg and Turkey. This is partly explained by changes in trade flows due to the war, but several of these countries have also been reported in the international media as contributing to sanction evasion.
• After the war began, the use of banking services by Estonian e-residents with Russian citizenship became more active. In January, a total of 2,035 (authentication or signing) transactions were made by 170 Estonian e-residents with Russian citizenship using an ID-card, whereas in March, 252 e-residents made a total of 4,437 transactions. The activity in using the ID-card by Estonian e-residents who are citizens of Belarus also increased after the war began (31 users in January and 50 in March) but was much more modest compared to that of Russian e-residents.
• After the onset of the war, payments made in Russia with bank cards issued by Estonian credit institutions dropped to zero when in March 2022, Visa and Mastercard suspended their business activities in Russia. The volume of monthly payments made using a bank card decreased by 99.9%, from approximately 2 million euros in January–February to a couple of thousand euros in April–June 2022.
• The volume of payments made in Belarus using the bank cards of Estonian credit institutions varied in the first half of 2022 and the total volume was modest.
• The activity of Russian and Belarusian citizens in establishing Estonian companies did not change in the early months of the war. In the last two years (during the coronavirus epidemic), the number of companies established in Estonia by Russian and Belarusian citizens has been on a decline. 

Virtual currencies

• On 8 April 2022, the fifth sanctions package prohibited the provision of cryptoasset wallet, account or custody services to Russian nationals or natural persons residing in Russia, or legal persons, entities or bodies established in Russia, if the total value of cryptoassets of the natural or legal person, entity or body per wallet, account or custody provider exceeds 10,000 euros.

• In the first half of 2022, there were 52 virtual asset service providers (VASPs) with an Estonian authorisation who had Russian customers [1]. The beginning of Russian aggression in Ukraine at the end of February and the sanctions imposed thereafter did not bring about any drastic changes in the number of the Russian customers of VASPs with an Estonian authorisation. Russian customers accounted for about 12% of their total customers in the first half of 2022. However, the turnover of the services mediated to Russian customers decreased drastically – by nearly 80%: from 21 million per week just before the beginning of the aggression to 3.7 million per week at the end of May; the share of Russian customers in the total turnover decreased from 8.7% to 1.2%. This major decrease was mainly caused by a decline in the turnover of the Russian customers of one VASP, while the turnover related to the rest of the VASPs’ Russian customers remained stable. Overall, the total number of the customers of these VASPs and the total turnover volume increased.

• 26 VASPs with an Estonian authorisation had customers from Belarus in the first half of 20221. The volume of virtual asset services mediated to Belarusian customers is much more modest than that of Russian customers (0.5% of the total turnover in January 2022, less than 0.2% in May), and the share of Belarusian customers in total customers is modest (2%). At the beginning of the war, it amounted to 1.4 million euros a week, and by the end of May, had dropped to 400,000 euros. The decrease has not been linear. Similarly to cross-border payments, the turnover of the services mediated by virtual asset service providers was volatile, with weekly fluctuations ranging between several hundred thousand euros.

Cash 

• At the beginning of the war, the demand for cash increased in Estonia. Before 24 February, the daily output was 5–7 million euros, but after the onset of the war, demand increased to the range of 10–28 million euros for three weeks, then returned to pre-war levels in mid-March. There was a particular increase in the demand for 50-euro and 100-euro bank notes, which people are probably using as a crisis reserve. The return of cash to the Bank of Estonia decreased at the beginning of the war as people refrained from putting money into circulation, keeping it as a crisis reserve.
• The withdrawal of cash in Russia using bank cards issued by Estonian credit institutions also decreased drastically: in February, withdrawals amounted to nearly 900,000 euros, but were close to zero from April to June 2022.
• The withdrawal of cash in Estonia using bank cards issued in Russia also decreased after the rapid increase in February and March – from 4.8 million euros in February and March to zero in April and May.
• The volume of cash withdrawals in Belarus using bank cards issued by Estonian credit institutions is modest (100,000–160,000 euros per month in the first five months of 2022) and has not had a constant trend since the beginning of the war (increased in March and April, decreased in May and June).
• After the beginning of Russia's aggression in Ukraine, the volume of declared cash movements from both Russia to Estonia and Estonia to Russia has increased: the total amount of the first five months made up 70% (2,5 million euros) of the total volume for 2021 from Russia to Estonia and 67% (1.1 million euros) from Estonia to Russia.
• The information in the declarations by private persons analysis of cash declarations revealed that no redeclaring private persons have suggests that the cash declared is cash transported for private purposes.

Sanctions 

• From the beginning of the war until 30 June 2022, the Financial Intelligence Unit (FIU) received 545 ISRs or International Sanctions Reports, of which 30 cases were found by the FIU to not have lawfully applied a financial sanction. During this period, the FIU provided feedback to about 400 reports, responded to 151 requests for clarification and inquiries and authorised over 35 exemptions.
• Between April 2022 and 30 June 2022, timber products and sawn timber were the most often mentioned product groups in the trade sanction reports (report indicator ISR 5) submitted to the FIU [2]. These were followed by lubricants, oils and chemical products and parts of mechanisms. Analysis of the reports shows that the role of Estonian companies often lies in the provision of transport and forwarding services. 
• Although, as stated above, cross-border payments have become more frequent with countries where there is a risk of sanctions evasion, based on practices and assessments from other countries, the reports submitted to the FIU do not indicate that trade flows would be diverted with the aim to circumvent sanctions. Reports of the suspicion of violation of international sanctions (ISR) have been submitted about a few larger companies that carry out large-scale transactions with these countries (e.g. United Arab Emirates and Turkey). Furthermore, a few companies show a decrease in cross-border payments toward Russia and Belarus and an increase in payments toward countries through which to circumvent sanctions. Therefore, the FIU continues to actively monitor the situation.
• The ISRs submitted to the FIU do not show that the risk of circumvention of trade sanctions through Central Asia, the Caucasus or the Middle East countries, which has been spoken a lot about in media, has materialised in Estonia. However, it is important to note that a transaction with a party in these regions alone is not sufficient to submit a report to the FIU and therefore, this trend may not necessarily be evident in the reports. It should also be kept in mind that the impact of the sanctions is long-term and that trends will be emerging from the information over a longer period of time. So, the FIU will continue to monitor the overall picture of these countries in the future as well.
• The reports submitted to the FIU indicate that Russian citizens have not increased investments into Estonian real estate in the period observed. Nor has the risk of the exportation of euros and bank notes denominated in the official currency of the Member States to Russia and Belarus materialised, which could be linked to circumventing sanctions. This was also the purpose of imposing sanctions.
• Failure to lawfully apply financial sanctions has not been large-scale, but one credit institution stands out, which has significantly more often violated the prohibition to accept deposits from Russian citizens exceeding 100,000 euros, as the development of the systems has been a long-term process. 

[1] At least 10 customers and/or a turnover of at least 1,000 euros for the services mediated to the customers.

[2] The ISR5 indicator “Application of the restrictions specified in other type of sanction (other than financial sanction) or suspicion of the imposition of other type of sanction” was introduced in April 2022.

Download full report in Estonian here.