In Part One of my in-depth look into the Danske Bank report I focused mainly on what was referred to as the “bond loop” which I interpreted as referring to the “mirror trades” which were known to have been conducted through the Danske Bank Estonia (DBE) branch.
In this part I want to look more at what is referred to as the “flow” business and then zoom in on the role that UK entities (primarily LLPs and SLPs) played in the debacle.
All of the newspaper reports have carried the headline news that DBE saw around $200bn travel through the Non-Resident Portfolio (NRP) in the years from 2007 to 2015, most of which was labelled as suspicious. What most of them failed to do (and I understand the space afforded to these stories published in the mainstream media, is at a premium) is explain exactly what ‘suspicious’ meant. Which is a shame as Bruun & Hjejle (who wrote the report) kindly take the trouble to do so.
They quote from advisory guidelines issued by the Estonian FIU (updated in 2011 solely to accommodate the change from EEK to EUR) which stated that typical grounds for suspicion include inter alia:
1. “cash payments to the client’s account which will be used for purchasing securities or derivatives”;
2. “single unusually large [national or cross-border] payment not conforming to normal turnover and/or not sufficiently justified”;
3. “large payments (EEK 200,000 [EUR 15,000 according to the 2011 version]) and/or smaller periodic payments with the clients of the banks located in the territories with higher money laundering risks”
Clearly, given that lawyers are very careful about the language they use in reports, especially one that was going to attract as much attention as this one, the insertion of that little Latin phrase ‘inter alia’ (amongst others) was neither accidental nor unimportant.
Why were they singling out these three specific elements? I believe it is because these three were the basis for identifying the suspicious payments in the Estonian Branch. We know that there were two elements to the issues found in DBE – mirror trading and flow. Item one clearly points to issues with what the report refers to as the OFZ (Russian Government Bond) trading business and items 2 and 3 to the flow.
As many of you know, I have seen six sets of bank statements dating from 2007/08 and virtually every single inflow to those accounts triggered either one or both of those elements.
Now some of those payments (and, to a much lesser degree, receipts) went to, or came from, extremely well known high street names and there is no suggestion (emphasised in the report) that these firms were knowingly involved in money laundering.
Many of the payments were for non-round amounts (e.g. €14,768.43) which might reasonably be assumed to be the end use of freshly laundered sums to buy luxury merchandise, computer equipment, property or whatever else the perpetrators fancied doing with their money. Other payments to well-known firms were for large round sum amounts which, on the surface, does look suspicious.
However, it is a known further stage of the money laundering process to place a large order for goods with a well known brand, remit a significant chunk of money to secure the order and then ‘cancel’ it (owing to unforeseen circumstances) at the last moment and request a refund. Often that would be accompanied by a penalty clause (say, 5%) but that might be considered a small price to pay to receive funds back from a high street name, especially as this process has successfully disrupted the money flow.
Even better if you can persuade the high street brand that, for some reason, you cannot receive the money back into the remitting bank account and have them send it on somewhere else. Job done.
Nevertheless, these were a small fraction of the overall flow that I’ve seen and I have no doubt that the majority of the suspicious behaviour I witnessed continued in the same vein for the ensuing years.
So, by way of example, here are the opening receipts and payments from one account:
- Credit from Cypriot Account: €20,000.00 (Materials of construction)
- Payment to Swiss account: €19,994,57 (For wall-paper)
- FX Credit: €18,000.00
- Payment to Czech account: €17,623.00 (for turbocharger)
- FX Credit: €117,000.00
- Payment to German account: €117,220.10 (for sanitary equipment)
- FX Credit: €75,600.00
- Payment to Lithuanian account: €75,000.00 (for **named persons**)
Over the next few pages there are numerous payments to the Netherlands, France, Italy, UK and others. A typical day, on this account would see, for example credits of €603,000 and debits of €602,577.30. And so it went on.
I think it would be fair to say that these certainly bear the hallmarks of “suspicious” even though further investigation would be needed before determining whether they met sufficient standards for filing as SARs (but I strongly suspect they did).
So, in effect, what the report is saying is that the majority of the flow has similar hallmarks to the above example.
The other problematic element, at least within the examples I’ve examined, is the incidence of UK Limited Liability partnerships (LLPs) and, later, Scottish Limited Partnerships (SLPs) and it’s that part I want to look at in more detail.
The first mention of LLPs is on page 33 within section 7 looking at the activity of customers in the NRP.
Before we look at that, there is an interesting graphic in section 7 about the source of funds flowing into the NRP:
I think you need to be a bit careful with this because, as far as I can tell, this relates to the immediate source of the inflows and outflows but not, necessarily, the ultimate sources. So that, while 23% of incoming funds came from within Estonia, it is highly likely that this was simply because it was the immediately preceding home of funds which had already been on quite a journey. The same for outflows. They are likely to be but one destination on a journey of many, a lot of which, I would surmise, eventually landed in some offshore “secrecy” location.
It is true, in respect of the statements in my possession, that the location of the account is often at odds with the entity in whose name the account is held. So while you may see a lot of credits from other accounts held in Estonia or Latvia, very often the underlying entity will be a UK LLP or a New Zealand Limited Company and the actual account is probably being operated form a third country (all of those I have seen were based in Moscow).
The other activity you see a lot of are inter-account transfers between, almost exclusively, other UK LLPs also with accounts with DBE and which are almost always for large, round figure sums (e.g. €450,00 etc.).
On top of the definition of “suspicious transactions” the report also helpfully identifies customers with suspicious features, which are:
1. customers that have been identified as registered to or otherwise associated with addresses that are shared with numerous other customers and that have been identified as suspicious in various jurisdictions including the British Virgin Islands, United Kingdom, Cyprus and also Denmark. Some of the customers also share other properties, for instance email addresses and phone numbers;
2. customers with significant differences between their revenue figures reported in publicly available documents and their payment activity as per their ac-counts at the Estonian branch;
3. customers that have been identified in the public domain as being associated with money laundering schemes;
4. customers with large amounts of funds passing through accounts regularly in short periods of time, with unusual payment chains, with unexplained or un-usual source of funds or wealth, with unusual payments descriptions, with ad-verse media or with other suspicious characteristics or behaviour; and
5. customers with payments with suspicious counterparties in other banks
Looking at the first two points we find:
1. Of the UK LLPs which I have found in the statements provided to me nearly two thirds were registered to the same address
2. For those where accounts are still available to be viewed, they either show dormant accounts or income which is a tiny fraction of what flowed through the accounts at DBE
I haven’t had the time to conduct specific searches in relation to points 3 or 5 but, as regards point 4, as exemplified above and in other articles I’ve published, the accounts I’ve seen are almost entirely composed of transactions which meet that definition.
Helpfully, the report breaks down, across the 6000 odd accounts they have analysed, how the broad population fits in with these various suspicious features:
One thing I would caution though. Although the total of these different elements very neatly comes to the 6,200 accounts analysed, I am certain that some fit in more than one category and, to avoid double counting, they have been deliberately place in a single category, even though more than one applies.
The following chart shows the numbers onboarded (allowing for the fact that DBE inherited c1600 customers when it bought Sampo Bank in 2007 which were subsequently deemed suspicious:
It can be seen that there was a fairly significant set up of new accounts in 2007 which then slowly subsided through 2008 and 2009, picking up again in 2010 and 2011, levelling off for the next two years and then dramatically subsiding as Danske started to realise they had a problem. Given that the Russian Laundromat ran between 2010 and 2014 and the Azerbaijani Laundromat between 2012 and 2014, it’s fairly straightforward a job to see the correlation.
And that’s where we pick up the story of the LLPs (and now SLPs which weren’t present in the early years).
In respect of the Russian Laundromat, the report states:
In relation to the “Russian Laundromat”, the Portfolio Investigation has identified 177 customers that received payments through Moldindconbank and Trasta Komercbanka from 21 “core companies” mentioned by the media. These 177 customers could potentially be involved in the “Russian Laundromat”. The majority of the 177 customers are limited partnerships (“LPs”) or Limited Liability Partnerships (“LLPs”) incorporated in the U.K. or in countries generally considered tax havens (British Virgin Islands, Hong Kong, Belize, Cyprus, etc.). Among the 177 customers are also three Danish K/S entities. The main activity took place in 2013 and 2014.
And again for the Azerbaijani Launderomat:
In relation to the “Azerbaijani Laundromat”, the Portfolio Investigation has identified 75 customers of the Estonian branch that have made payments with private persons and corporate entities outside of the Estonian branch that, according to media, have been involved in the scheme. Two thirds of the 75 customers were LPs or LLPs incor-porated in the U.K. Funds transferred by the 75 customers were characterised by being moved rapidly (credits followed by immediate debits with corresponding amounts). The Portfolio Investigation has identified six customers which have conducted the vast majority of payments that could potentially relate to the “Azerbaijani Laundromat”. All six customers were LPs or LLPs incorporated in the U.K.
So, clearly, UK entities were intrinsic to both these undertakings.
But it’s equally clear, looking at the number of customers identified in the chart above, the entities involved in these laundromats, accounted for a relatively small subset of the overall number of customers (although I suspect they accounted for a much larger proportion of the flow).
So, you may well ask, how many UK entities were involved altogether?
I don’t know the answer to that question but I am intrigued by the figure of 1,700 customers who had significant difference between revenue figures and payment activity. Few countries of which I am aware publish the annual accounts of private limited companies and partnerships. The UK is certainly one so I suspect (but do not know for certain) that a substantial number of these customers were UK entities. I also suspect that many of the customers who fall into the first category (sharing addresses) are also UK LLPs and SLPs simply because there are so many of them and they have to have been formed for a purpose.
That view is reinforced on page 51 by a direct quote from the whistleblower who said:
…UK LLPs [Limited Liability Partnerships] are the preferred vehicle for non-resident clients…
On page 54, the Group Internal Audit (GIA) report stated:
“[t]he Branch’s portfolio of non-resident customers has to be reviewed and information on the commercial rationale for the customers structuring their business within LLP layers as well as on the ultimate beneficial owners of the trading entities underlying the LLPs have to be sufficiently documented in the Bank systems”. Included in the report were the following six obser-vations with first-priority recommendations attached: (i) “Documentation of due dili-gence on non-resident customers structured with LLPs”, (ii) “Segregation of duties”, (iii) “Risk assessment”, (iv) “Customer monitoring”, (v) “Closure of accounts”, and (vi) “FX lines granting”. Deadlines were included and responsibility assigned to employees within the branch.
So it’s absolutely clear, throughout the report, that UK entities (mainly LLPs but also SLPs) were intrinsic to the laundering of funds and that the structuring of entities around LLPs was so common that it warranted specific mention in the audit report.
What is also intriguing is looking at UK LLP formations over the same time period. The following data are taken from a spreadsheet provided by Companies House and which I have therefore presumed to be as accurate as could be found:
Compare the levelling out of LLP totals (i.e. very few new LLPs being formed) with the tail off of new suspicious account openings in DBE and there is a remarkable correlation.
If you look at a similar chart, taken from the same source, in relation to SLPs, there is a slightly different story:
Which suggests the problem hasn’t gone away, it’s just changed from LLPs to SLPs and has, apparently, gone to a bank (or banks) somewhere else.
But that’s a story for another day.
Hiding in plain sight - my search for money launderers 