Since 2005, the European Union has rolled out a series of Anti-Money Laundering Directives (AMLD), tightening requirements on customer identification, reporting obligations, and risk controls. Yet the tougher rules have failed to prevent a string of high-profile money laundering scandals involving Deutsche Bank, UBS, Edmond de Rothschild, BNP Paribas, and other financial institutions, experts say.
Two decades on, the picture remains bleak. According to industry surveys, banks’ rules-based monitoring systems generate false-positive alerts up to 95% of the time — flagging legitimate transactions as suspicious while missing much of the actual illicit activity. According to Europol data cited by Transparency International, just 1% of criminal proceeds are confiscated across the EU each year. The rest moves on.
A System That Misses the Obvious
The scale of the problem became apparent in the Deutsche Bank case. Between 2011 and 2015, the German lender processed approximately $10 billion in suspicious transfers out of Russia through its so-called “mirror trade” scheme, in which clients simultaneously bought and sold identical securities in roubles and U.S. dollars to shift money across borders. German and British regulators eventually fined the bank a combined $630 million — a sum critics noted was a fraction of the funds moved through the scheme. No senior executives faced criminal charges.
It was not a one-off. BNP Paribas, Edmond de Rothschild, and other institutions have faced similar scrutiny, yet enforcement has remained inconsistent and penalties modest relative to the scale of the violations.
Golden Visas, Paper Walls
Europe’s AML problems run deeper than banking. For years, EU member states including Cyprus and Malta operated “golden visa” programmes that granted residency or citizenship to wealthy investors in exchange for capital injections — with due diligence standards that were not always applied consistently across jurisdictions.
The Cyprus Papers, leaked in August 2020 by Al Jazeera’s investigative unit, revealed that the island’s citizenship-by-investment scheme had approved applications for more than 30 individuals under criminal investigation, facing international sanctions, or serving prison sentences — all of whom had paid upwards of €2 million for an EU passport.
Malta’s programme attracted similar scrutiny, with approvals remaining opaque and cross-border information sharing minimal. Cyprus suspended its programme in November 2020, while the EU Court of Justice ruled Malta’s scheme illegal in April 2025.
The Panama Papers — a leak of 11.5 million documents from Panamanian law firm Mossack Fonseca published in 2016 — and the Pandora Papers, a 2021 leak of nearly 12 million files, told a similar story. Both showed how shell companies, free-zone structures, and nominee ownership arrangements — many routed through EU jurisdictions — were used to conceal the origins of illicit wealth.
A Case in Point
A lawsuit brought by Russian-Uzbek billionaire Alisher Usmanov points to a different but equally serious shortcoming: a tendency within the system to flag routine activity while more complex schemes go undetected.
In June 2024, Usmanov filed a lawsuit against UBS Europe SE, the bank’s German subsidiary, alleging that between 2018 and 2022 it submitted more than a dozen suspicious activity reports that, he contends, lacked factual basis. Routine transactions — cash withdrawals and rental payments — were flagged as potential money laundering.
Usmanov claims the reports breached banking secrecy and triggered a criminal investigation that a German court ruled baseless in 2023 and which prosecutors dropped in November 2024. His lawyers argue that UBS applied a double standard, citing cases in which the bank allegedly helped Ghislaine Maxwell, a Jeffrey Epstein associate later convicted of sex trafficking, move millions of dollars, and failed to file AML reports when the son of Yemen’s president cashed a $10 million cheque from the Sultan of Oman. A ruling expected in late April could set a significant precedent for how AML reporting obligations are enforced across the bloc.
Major Problems
Europe’s framework has long remained heavily dependent on national watchdogs across the EU’s 27 member states, fragmented reporting systems, and retrospective checks that lag behind the pace of money flows. Low fines, limited public accountability, and weak cross-border coordination mean banks may find it easier to over-report borderline cases — protecting themselves from regulatory risk — than to invest in the sophisticated systems needed to identify genuinely suspicious activity.
Around half of Europe’s financial institutions still operate outdated or partly manual AML systems, while a third of their technological tools fail to detect certain suspicious patterns. That helps explain how significant laundering activity has gone undetected at major institutions for years.
Crypto has exposed similar weaknesses. Under updated EU rules, crypto exchanges are now classified as “crypto-asset service providers” and subject to the same AML regime as banks. In theory, they must register, implement “know your customer” procedures, maintain transaction records, and report suspicious activity.
In practice, enforcement has lagged. Last year, the Central Bank of Ireland fined Coinbase Europe €21.5 million for failing to properly monitor transactions worth €176 billion between 2021 and 2023. Investigators found that coding errors prevented compliance software from recognizing special characters in crypto wallet addresses, allowing large volumes of transactions to bypass automated checks altogether.
Changes to Come
None of this is going unnoticed. The EU last year established the Anti-Money Laundering Authority (AMLA) as a pan-European watchdog, expected to become fully operational in 2028. By then, a new EU-wide framework will tighten oversight of banks, crypto exchanges, and major corporations.
The hope is that it will curb the true scale of money laundering flowing through Europe’s financial system — while also reducing the costly false positives that incorrectly flag legitimate clients.