Correspondent Banking Transfer Authority Failure Through Unverified Beneficial Ownership at Danske Bank Estonia

Danske Bank's Estonian branch, inherited through the 2007 acquisition of Sampo Pank, operated a large portfolio of non-resident accounts — clients whose businesses and owners were located outside Estonia, primarily in Russia, Azerbaijan, Moldova, and other former Soviet states. These clients used the Estonian branch as a gateway to the European banking system, routing transactions through Danske Bank's correspondent banking relationships with major international banks including Deutsche Bank, Bank of America, and JPMorgan Chase. The non-resident portfolio generated disproportionate revenue relative to its size.

The non-resident clients were predominantly corporate entities registered in jurisdictions with minimal beneficial ownership disclosure requirements — British Virgin Islands, Belize, the Marshall Islands, and similar offshore registration centers. The entities maintained legal existence as registered companies, but their ownership structures were opaque: nominee directors, bearer shares, and layered holding structures obscured who actually controlled the entities and the funds moving through their accounts.

In 2013, Howard Wilkinson, a British employee in Danske Bank's Estonian trading unit, reported concerns about suspicious transactions to management and subsequently to Danish and Estonian authorities. His reports described non-resident clients moving large sums through patterns consistent with money laundering — round-trip transactions, rapid fund movements through multiple accounts, and transfers with no apparent economic purpose. Danske Bank's internal response was inadequate; the non-resident portfolio continued operating for two more years.

In 2017 and 2018, Berlingske (a Danish newspaper) and other media outlets published investigations documenting the scale of suspicious flows. Danske Bank commissioned an internal investigation by the law firm Bruun & Hjejle, which reported in September 2018 that the majority of the approximately €200 billion in non-resident account transactions between 2007 and 2015 were suspicious. The report identified systematic deficiencies: the Estonian branch operated with significant autonomy from Copenhagen, know-your-customer procedures for non-resident clients were grossly inadequate, and multiple internal warnings had failed to produce effective remediation.

The transfer authorization system processed hundreds of billions in transactions from entities whose beneficial owners were unknown. The branch verified that client entities were registered legal structures — which they were. Registration confirmed the entity existed as a legal person, not that the bank knew who controlled it or where the money originated. Know-your-customer requirements existed in principle but were not enforced at a level that would have required the branch to identify and verify the natural persons controlling each corporate client. The KYC file for a non-resident client could contain the entity's registration documents, a nominee director's passport, and an address in an offshore jurisdiction — documentation that satisfied the procedural file requirement while conveying no information about beneficial ownership.

The Estonian branch operated with substantial autonomy from Danske Bank's Copenhagen headquarters. Compliance oversight from the parent bank did not extend to effective real-time monitoring of the Estonian branch's non-resident account activity. Internal reports flagging concerns about the non-resident portfolio reached management in Copenhagen multiple times between 2007 and 2014 without producing a shutdown or fundamental remediation of the client base. The branch's revenue contribution created an institutional dynamic where the risk warnings competed against the financial performance the non-resident portfolio generated — a structural conflict between the compliance function and the revenue the compliance function was evaluating.

Danske Bank closed the non-resident portfolio in 2015. The bank's CEO resigned in 2018. Criminal investigations were initiated in Denmark, Estonia, France, and the United States. The DOJ and SEC opened investigations into potential violations of U.S. anti-money laundering laws through the correspondent banking relationships that processed the Estonian branch's dollar-denominated transactions. Correspondent banks including Deutsche Bank faced their own regulatory scrutiny for processing Danske Bank Estonia's transactions without adequate due diligence on the underlying client base.