In a significant operation targeting financial crime, law enforcement agencies across Europe dismantled a criminal underground banking network operating across multiple countries. The network, primarily composed of Ukrainian nationals, exploited the European Union’s temporary protection status to move staggering amounts of illicit funds.

The operation, spearheaded by Europol and various national agencies, led to the arrest of 23 individuals and the seizure of financial assets worth millions. This crackdown highlights the growing threat of underground banking operations facilitating tax evasion, drug trafficking, and other illicit activities.

How the Underground Banking Network Operated

Underground banking is a clandestine financial system that enables large-scale money laundering while bypassing traditional banking regulations. This specific network, led by two Ukrainian brothers, specialized in providing illicit financial services to organized crime groups. Operating mainly in Spain, the syndicate also included Armenian, Azerbaijani, Kazakh, and Chinese nationals, forming a sophisticated crime-as-a-service model.

The illicit services were utilized by various Russian-speaking and Asian criminal organizations engaged in:

• Drug trafficking
• Smuggling illicit goods
• Tax evasion

Underground banking systems function outside of the legal financial framework, using unregulated transactions that make it difficult for authorities to track illicit money flows. Initially relying on cash couriers, this network transitioned to cryptocurrency transactions to evade detection, leveraging the increasing anonymity of digital assets. Authorities estimate that from March 2023 to February 2024, the criminals transferred at least EUR 75 million through their underground banking operations.

Key Arrests and Seizures

The crackdown, which unfolded over several months, resulted in a series of coordinated actions across multiple jurisdictions. On November 19, 2024, police forces executed large-scale raids, leading to:

• 23 arrests (20 in Spain, 1 in France, and 2 in Slovenia)
• 91 house searches (77 in Spain, 1 in France, 13 in Cyprus)
• 17 additional suspects prosecuted
• EUR 8.2 million in cash seized
• EUR 27 million in cryptocurrency frozen
• EUR 2 million in bank accounts seized
• 36 vehicles, including luxury models, confiscated
• Real estate, luxury watches, and jewelry seized

Abuse of EU’s Temporary Protection Status

Following the Russian invasion of Ukraine in 2022, millions of Ukrainians sought refuge in Europe, many carrying their life savings in cash to avoid the financial instability caused by the war. The EU introduced temporary protection measures to facilitate the movement of these funds, a loophole the criminals exploited to conduct large-scale money laundering.

Money mules, including family members of the criminal leaders, declared large cash sums as personal savings. Traveling frequently between Spain, Cyprus, France, and other countries, they moved vast amounts without arousing suspicion at customs checks.

However, as law enforcement began identifying and arresting couriers, the network quickly adapted by shifting to cryptocurrency transactions, further complicating detection efforts. This transition is a hallmark of underground banking networks, as digital assets provide a less traceable and more secure method of transferring illicit funds across jurisdictions.

The Role of Cryptocurrency in Underground Banking

Cryptocurrency has become a major tool for underground banking operations. This network’s shift from physical cash transfers to digital currencies demonstrates the growing sophistication of financial crime.

Authorities discovered that the criminals used privacy-focused cryptocurrencies and decentralized exchanges to bypass anti-money laundering (AML) controls. The network relied on crypto mixers and layering techniques to obscure the source and destination of illicit funds.

During the raids performed in Cyprus, law enforcement seized and froze around EUR 26 million in one cryptocurrency. This highlights the scale of underground banking operations and their reliance on cutting-edge financial technologies to evade detection.

Europol’s Role in the Crackdown

Europol played a crucial role in dismantling this network by providing extensive analytical, operational, and forensic support. As part of the judicial Joint Investigation Team (JIT), which included Spain, Cyprus, and Germany, Europol deployed financial crime experts to track illicit financial flows and cryptocurrency transactions.

During the operation, Europol specialists assisted in:

• Performing cross-checks using mobile forensic offices
• Providing expertise in cryptocurrency tracking
• Supporting digital forensics by analyzing seized electronic devices

The operation exemplifies the increasing sophistication of financial crime and the international cooperation needed to combat money laundering networks operating across multiple jurisdictions.

Conclusion: Strengthening Financial Crime Prevention

This high-profile crackdown underscores the urgent need for enhanced financial crime detection measures and stricter monitoring of underground banking operations. As financial crime networks become more sophisticated, financial institutions and regulatory bodies must bolster their AML (Anti-Money Laundering) frameworks to detect and disrupt illicit financial flows more effectively.

By leveraging advanced technologies, inter-agency cooperation, and continuous monitoring of evolving financial crime trends, authorities can stay ahead of these criminal enterprises. The dismantling of this Ukrainian-led underground banking network serves as a powerful reminder of the ongoing battle against financial crime worldwide.

Related Links

• Europol’s Financial Crime Operations
• European Commission on Anti-Money Laundering
• Interpol’s Financial Crime Investigations
• FATF Recommendations on Money Laundering
• United Nations Office on Drugs and Crime – Money Laundering
• European Banking Authority Guidelines on AML

Other FinCrime central Articles about Europol Operations

• Europol’s Landmark Operation Dismantles Crypto Crime Network
• Europol’s Record Operation Seizes Criminal Assets Worldwide

Source: Europol