What happened?
Danske Bank’s Estonian branch had a “Non-Resident Portfolio” made up largely of customers living outside Estonia, including customers from Russia and other CIS countries. The portfolio contained about 10,000 customers over 2007–2015, while the later investigation expanded its scope to about 15,000 customers with cross-border characteristics. The flow of funds over the period was approximately EUR 200 billion.
The report does not say that the entire EUR 200 billion was suspicious. It explicitly says that a transaction-by-transaction review was not performed and that no accurate estimate could be made of what share of the flow was suspicious.
Following a whistleblower report in late 2013 and internal-audit work in early 2014, Group management concluded that the branch’s AML procedures had been manifestly insufficient and inadequate. This report by Bruun & Hjejle, the law firm overseeing and directing the investigations, was published on 19 September 2018. It reconstructs not only customer activity but also how warnings, audits and internal decisions were handled.
10 passages that stood out
Rather than using the largest headline figures as separate notes, this article focuses on concrete decisions and records buried in the report: a central-bank warning, the abandoned IT migration, internal concern about unusually high profits, the whistleblower response, and questions raised by USD correspondent banks.
Page numbers below refer to the printed pages of the report.
The Russian Central Bank warned of suspicious transactions worth “billions of rubles monthly”
In June 2007, the Russian Central Bank raised concerns through the Danish financial supervisor about non-resident customers of Sampo Bank in Estonia.
The information said customers were repeatedly involved in transactions of doubtful origin with an estimated scale of billions of rubles each month. It also referred to possible tax and customs evasion and criminal activity that could include money laundering.
The report describes the warning and the critical Estonian inspection report at the time as Danske Bank’s first real opportunity to recognize suspicious activity in the Non-Resident Portfolio not being caught by existing AML procedures.
The matter was discussed by both the Executive Board and the Board of Directors.
Migration to the Group IT platform was dropped because it was considered too expensive and too resource-intensive
Danske Bank had planned to move the Baltic banking activities onto the Group IT platform. Among the stated purposes were better access to business information and lower operational risk.
In August 2008, the migration plan was abandoned.
The reason recorded in the report was that the migration was considered too expensive and would take up too much capacity.
As a result, the Estonian branch did not use Group-developed customer systems or the same transaction and risk monitoring, while Group had more limited insight into the branch than into other parts of the bank.
A USD correspondent-bank exit notice was effective 1 August; an audit dated the same day rated KYC controls “reasonable”
In June 2013, one of the correspondent banks clearing USD payments for the Estonian branch indicated that it wanted to end the relationship on AML grounds. In agreement with that bank, the Estonian branch ultimately sent a closure notification effective as of 1 August 2013 with ordinary notice of three months.
On 1 August 2013, Group Internal Audit issued a report on KYC controls for non-resident customers at the branch.
The KYC procedures and related internal controls received the second-best rating out of four, while the KYC documentation was described as generally sufficient.
The audit also identified issues requiring improvement, but the relatively positive internal assessment came close in time to the correspondent bank’s AML-driven exit.
The bank’s own business review said unusually high profit was itself a warning sign
The termination of the correspondent-banking relationship prompted a 2013 business review of the Non-Resident Portfolio.
During that review, Business Banking noted that unusually high profitability could itself be a warning sign. Concern was also raised that some customers’ lack of price sensitivity might reflect something other than good service.
High profitability was not treated only as evidence of a successful business; an internal review explicitly identified it as a possible warning sign.
Group Compliance & AML also said that transaction volumes involving non-resident customers in Estonia were larger than expected.
A sentence saying the solution could be used for money laundering was removed from the final memo
In October 2013, the Estonian branch circulated a memorandum to its Executive Committee about a Russian-government-bond solution for intermediaries whose end-clients wanted to transfer money overseas.
The memo described the solution as faster, cheaper and more reliable than an international payment through a domestic Russian bank, and also as highly profitable. It separately identified risks, including incomplete knowledge of intermediaries’ end-clients and reputational risk from appearing to assist capital flight from Russia.
An earlier draft had also said that the solution could potentially be used for money laundering, but the report says those words were left out of the final version at the initiative of a member of branch management.
The whistleblower email was titled “knowingly dealing with criminals in Estonia Branch”
On 27 December 2013, a whistleblower at the Estonian branch sent an email to a member of the Executive Board and employees in Baltic Banking, Group Compliance & AML and Group Internal Audit.
The subject line said the disclosure concerned “knowingly dealing with criminals in Estonia Branch.”
The email alleged, among other things, that a specific customer had submitted false financial accounts and that the bank continued dealing with that customer. Those details remain whistleblower allegations unless separately confirmed by the report, and are treated here as such.
Account managers had so many customers that ongoing monitoring was “in fact impossible”; an employee also explained why beneficial owners were not identified
A January 2014 Group Internal Audit letter confirmed some of the whistleblower’s allegations and examined how ongoing monitoring was being performed.
Monitoring was manual, and account managers were responsible for so many customers that the audit said it was effectively impossible to perform the work efficiently and effectively.
During an on-site audit in February, Group Internal Audit also reported that actual sources of funds and beneficial owners could not be identified.
A branch employee told the three auditors that beneficial owners were not identified because doing so could cause problems for clients if Russian authorities requested information.
Group Legal sought an external misconduct inquiry, but two Executive Board members overturned that approach
As the whistleblower matter was being handled, Group Legal asked an external consultancy to conduct an inquiry into misconduct allegations based on the whistleblower material and other critical information involving senior staff.
According to the report, that approach was overturned by two members of the Executive Board.
Group Legal then asked Group Compliance & AML to bring the whistleblower matter to an end. The “full list” of allegations supplied for that work summarized some allegations only broadly and omitted others entirely, including allegations of internal collusion.
A later overview prepared by Group Compliance & AML treated five allegations as verified. The report says it found no information showing additional investigation of the whistleblower allegations.
A strategy presentation treated AML requirements as a threat while the Non-Resident Portfolio contributed 90% of Estonia’s profit before tax
A 2014 Baltic strategy presentation described a number of challenges facing the business and treated AML requirements overall as a threat.
Another slide explained that a significant change in appetite for non-resident business would reduce net profit for the Baltic operation.
The presentation said the Non-Resident Portfolio contributed 90% of Estonia’s profit before tax.
At the same time, the recommended strategy included gradually running off the non-resident business and repositioning toward a corporate Baltic bank focused on Nordic customers.
A USD correspondent bank reviewed 10 customers. Only one was described as “okay”
In 2015, another correspondent bank clearing USD transactions for the Estonian branch told Danske Bank that it had concerns about some payments.
Danske Bank shared a list of 30 customers with significant USD payments, and the correspondent bank reviewed 10 of them.
Of the 10, the correspondent bank was uncomfortable with four; five others did business with customers that concerned the correspondent bank; only one was described as “okay.”
The report says the Board of Directors was not informed either about questions from another correspondent bank in May 2015 or about this bank’s July decision to stop clearing USD transactions for the Non-Resident Portfolio, which led to termination of the correspondent-banking relationship.
What the report says about the background
The report points to several conditions that allowed the problems to persist: the Estonian branch remained on a separate IT platform, Group had less visibility into customers and transactions there, confidence in the branch’s AML procedures lasted too long, and reporting from control functions was often reassuring.
By early 2014, Group had recognized that AML procedures involving the Non-Resident Portfolio had been manifestly insufficient and inadequate and that all lines of defence had failed at both branch and Group level. The report nevertheless concludes that important follow-up work, including investigation of the whistleblower allegations and responses to concrete risks, remained insufficient.
This article uses only the 19 September 2018 report as its primary source. It does not mix in later criminal or civil proceedings or separate regulator investigations.
Corrections to this article
Clarified that the closure notification was effective as of 1 August 2013 with ordinary notice of three months, and that the internal-audit report was dated the same day. Distinguished company assessments in audit, business and strategy documents from the report author’s assessments, clarified the attribution of the later allegation overview, and added p.8 for the warning and abandoned IT migration. Japanese wording concerning tax/customs evasion and the scope of missing information about further investigation was also corrected.