TALLINN, Estonia—It took a £1 payment to uncover one of the world’s biggest money-laundering scandals.
Howard Wilkinson, a British trader at a Danish bank’s branch in Estonia, noticed that a London business, which moved more than $1 million through the branch almost daily, had filed a report with the U.K. government claiming it had no income or assets. Downloading the report cost Mr. Wilkinson one pound.
It is a money-laundering scandal on a grand scale, broaching one of the West’s rawest subjects, its tense relationship with Russia. The money involved is equal to more than all the corporate profits in Russia in a year. The scandal has tarred the reputation of Denmark, a country ranked among the world’s most transparent, and wiped out nearly half the stock-market value of the Scandinavian country’s largest bank, which knew about the problems for years before they became public. Its star CEO has resigned.
The revelations have ignited soul-searching in Europe about the cost incurred by some of its banks to survive the global financial crisis, especially how they welcomed flows of thinly monitored money from countries with weak rule of law. Regulators increasingly wonder whether their defenses against criminal money are broken, given how so much moved through the brand-name bank of a Scandinavian nation.
The U.S. Department of Justice has started a criminal investigation into the Danske matter, and the Treasury Department and Securities and Exchange Commission are also investigating. Following Danske’s September release of a report on its internal investigation, shareholders are bracing for the possibility of a huge fine. The bank says it still doesn’t know whose billions moved through the remote branch over nearly a decade.
From his home in the English countryside, Mr. Wilkinson, 47 years old, said that he had no idea of the scale when he first began poking into a few of his bank’s dealings. He described himself as shocked and disillusioned.
“If you wanted to launder money all you need to do is find an obscure branch in a bank with a good name,” he said. “And nobody is going to ask you any questions.”
As the investigations of wrong-doing have piled up, Danske’s stock price has suffered.
A Wall Street Journal review of hundreds of pages of internal bank documents, including memos and client records, along with interviews with dozens of officials and bankers involved with Danske’s Estonian operations reveals how a multibillion-dollar money-laundering pipeline remained open for years, and how a midlevel career banker, fixated on detail, finally brought it down.
“We want to make it absolutely clear that this case in no way reflects the bank we want to be,” Danske said in a written statement after being asked about the Journal’s findings. “We will do everything it takes to ensure that we never find ourselves in the same situation again.”
“Good, Easy Money”
The chief executive of Denmark’s biggest bank thought he was about to die in a plane crash. Peter Straarup’s flight to Copenhagen had lost cabin pressure and was dropping thousands of feet toward the Baltic Sea.
It managed a safe emergency landing, but Mr. Straarup later described the 2006 incident to a friend as a portent of the trouble ahead. He was returning from Helsinki to announce that Danske would take over Finland’s Sampo Bank and absorb its million customers.
The acquisition came with a little-mentioned subsidiary in Estonia headquartered in a six-story former factory with an unhappy history. Hitler’s military produced radios in the building before the Soviets repurposed it for tank components. After communism’s collapse, a new bank, named Eesti Forekspank, took over the building.
During a 2006 visit, Russian Central Bank Deputy Chairman Andrei Kozlov, who was conducting a crackdown on money laundering, complained to Estonian officials that the bank, which had changed hands a couple of times, was servicing customers suspected of financial wrongdoing such as tax evasion or corruption. Three months later, he was gunned down as he left a soccer match. A Russian court ruled it was a contract killing ordered by a businessman displeased with his laundering crackdown.
Two months after that, in November 2006, Danske agreed to buy the bank as part of its deal for Sampo Bank, which owned it. Mr. Wilkinson became an employee weeks later.
An Oxford graduate who had traveled the Nordics, he initially went to work at a bank in Finland, where former colleagues remembered him as a skilled but argumentative trader who once started a yearlong gripe over a monthly charge on his checking account.
Estonia offered a faster pace than Finland. The markets department Mr. Wilkinson led, with nine employees on the corner of the fourth floor, traded millions of dollars daily in currency and bonds, called “flow business.” In the years after the financial crisis, some European banks were in fragile shape—Danske had state help—but its Estonia branch was reporting strong results for such a small country.
The Englishman felt at home in the open-plan office with its international mix of youthful new hires and experienced bankers. He didn’t entirely understand its business model, though. Ninety percent of Danske’s Estonia profits, an internal memo would later explain, came from a department on the third floor, which served a lucrative customer type Mr. Wilkinson had never dealt with before, termed nonresident depositors.
Those customers didn’t live in Estonia, and their companies did little business there. Most were Russian, and their reasons for banking in tiny Estonia weren’t always evident. Many of the nonresident depositors yanked incoming money out of their accounts within days of its arrival, sometimes hours.
Little Place, Big Money
More than €500 billion in cross-border payments entered tiny Estonia between 2008 and 2017, with a similar amount exiting. The country’s GDP for the same period was only €184.9 billion.
Mr. Wilkinson managed market transactions related to those customers, mostly currency trades and buying and selling treasuries. “Good, easy money,” he called it. Returns on equity approached 400%, a bank memo said.
His first hint of unease came five years into the job, as his colleagues rushed to take their summer 2012 holidays. A young junior account manager asked for help wrapping up paperwork on a British client.
The client—listed in the U.K. as Lantana Trade LLP—was registered next door to a suburban London hardware store, according to documents. They show it had moved $480 million through the Estonian branch in about five months.
When Mr. Wilkinson downloaded the business’s records, what he saw made no sense. “Net Assets,” said a filing it made to Companies House, the British registrar that collects company data: “0.00.”
A simple clerical error, Mr. Wilkinson said a bank compliance officer reassured him weeks later, adding that Danske had asked Lantana to submit a new, correct version to Companies House. He forgot about it.
A year later, in September 2013, a senior bank official said Lantana was no longer a client, Mr. Wilkinson said. He added that another official told him that one of Lantana’s owners was a relative of Vladimir Putin, which was denied by a spokesman for the Russian president. Lantana couldn’t be reached.
“It sat in the back of my head that there was something that wasn’t quite right,” Mr. Wilkinson said.
“The Alpha Male”
Danske’s excellent returns from Estonia were helping power the rise of a tall and elegant gray-haired banker several rungs above Mr. Wilkinson, who championed the Estonian branch’s business before the board of directors.
Thomas Borgen, then in charge of international banking for Danske, impressed other executives with his ramrod posture and soothing intonation, colleagues recalled. “He’s extremely charismatic…unquestionably the alpha male in the room,” said an adviser to a board member.
The Estonian branch’s profits were a point of pride during a European business slump. “This was his baby,” the adviser said.
In 2010, Mr. Straarup, Danske’s CEO, grew concerned about the high level of Russian transactions going through the branch. Barron’s magazine had contacted the bank about the possible involvement of its Estonian branch in a North Korean arms-smuggling case in Thailand, although the ensuing article didn’t identify the bank.
Months later, Mr. Straarup asked Mr. Borgen: Was he comfortable with the exposure to nonresident clients? Mr. Borgen, according to a person who attended the meeting, said he hadn’t come across any cause for concern. Mr. Straarup declined through a spokesman to comment, and Mr. Borgen didn’t respond to requests for comment.
Russia’s central bank, which maintained a measure of independence in a country sliding into autocracy, kept a blacklist of hundreds of thousands of individuals barred from Russia’s banking sector on suspicion of financial crimes. Many of those people were popping up as clients of the Danske branch next door in Estonia, the Russian central bank complained to Estonia’s banking supervisor, the Financial Supervision Authority.
Estonia’s FSA had just two employees to conduct money-laundering reviews, one of them part-time. It took six months to assess a single bank’s practices, and larger banks than the local Danske branch had priority. Estonia’s maximum fine for money laundering was €32,000—a few hours’ worth of profits at the branch.
In addition, European Union directives discouraged Estonian inspectors from entering the bank building without permission from their Danish regulatory counterparts. Denmark’s FSA oversaw the business because Danske had made it a branch rather than a subsidiary.
The Estonian regulators, despite their limited jurisdiction and resources, raised red flags, mailing about six letters to Denmark’s FSA between 2007 and 2014. The complaints became caustic as years went by.
One Estonian FSA letter “is brutal…close to the worst I have ever read…and I have read some harsh letters,” a Danske compliance officer emailed a colleague.
Denmark’s FSA says it raised the Estonian regulators’ concerns with Danske Bank and was assured that the bank regularly sent people to check the branch and they found no problems.
Danske, meanwhile, was hoping to open a U.S. branch. In late 2012, Denmark’s FSA issued a statement of support to the Federal Reserve saying that Danske followed correct anti-money-laundering procedures.
Danske’s anti-money-laundering chief later emailed colleagues about issues at the Estonian branch, saying: “The Danish FSA has helped the Bank in a critical situation. They are now very worried that any situation may arise.”
Danske and the Federal Reserve declined to comment when asked about the exchange.
In 2013, Mr. Borgen, the charismatic chief of international banking, became Danske’s CEO. “People were in awe of” Mr. Borgen, a person close to the board said. “He was producing these enormous returns.”
At a meeting that year of the European Banking Authority, with top officials from across the Continent present, a shouting match erupted, said people familiar with the session. The Estonians yelled across the room that criminal Russian money was washing through their country, and Denmark, a founding member of NATO, was doing little to stop it.
“In simple terms, we were quite pissed off,” said Raul Malmstein, then-chairman of Estonia’s FSA. “They were not doing anything.”
Mr. Wilkinson’s daughters had finished opening their presents on Christmas 2013 when, in the holiday calm, a thought buried deeply away came to mind. Had Lantana—the London business that moved millions through the Estonian bank while listing its assets as zero—properly amended its filing to U.K. authorities, as he’d been told 18 months before?
The day after Christmas, Mr. Wilkinson spent another pound to download Lantana’s amended filing. On the third page, Lantana said that as of as of May 31, 2012, its bank accounts held £15,689, equal to about $20,500. Bank records showed it had close to $1 million on deposit with Danske that day.
Lantana had replaced one lie with another. Worse, some of Mr. Wilkinson’s colleagues probably knew, he guessed. “At that point there’s a problem, and the question is how big is the problem,” he said.
The next morning, before dawn, Mr. Wilkinson emailed four Danske officials in Copenhagen, with the subject “Whistleblowing disclosure — knowingly dealing with criminals in Estonia branch.”
“Dear Sirs,” he wrote. “The bank may itself have committed a criminal offence…. There has been a near total process failure.”
Mr. Wilkinson imagined Danske’s executives would investigate his allegations, make changes, and they’d all share a pleasant handshake.
Two days later, a bank executive dashed off a terse response on his phone to Wilkinson: “Thanks for drawing our attention to this. It must be investigated asap.”
“We’re Not the Police.”
Danske’s executive board met during the first week of 2014, now with Mr. Borgen as CEO. The Christmas whistleblower email was discussed, but board members weren’t provided a copy and it didn’t cause much alarm, according to two people familiar with the meeting.
The board had other incoming items to deal with. JPMorgan Chase & Co. had ceased clearing dollars for the Estonian branch over money-laundering concerns at nonresident accounts. Also, with the financial crisis fading, European banks had less appetite for taking on legally risky clients to obtain deposits. The Estonian branch had proposed a freeze on some new clients deemed too risky, according to a Danske PowerPoint document.
Mr. Borgen offered an alternative plan, said people close to the board: Sell the branch.
Two days after that board meeting, Danske senior management received another email from Mr. Wilkinson. He had checked three more clients. All three had filed false assets and income reports to the British authorities, he wrote.
In Estonia, the Englishman’s campaign infuriated co-workers: “We’re not the police,” a branch executive snapped in one heated meeting, Mr. Wilkinson recalled.
One day around February 2014, Estonian government inspectors barged into the building, without permission from Copenhagen, and pulled thousands of documents. They sent Danske Bank a scathing, 340-page report listing lengthy violations.
The report was in Estonian. It wasn’t translated into English or Danish for another three years.
Danske management did order an internal audit team to do some digging, around the same time. Mr. Wilkinson found the team members motivated and intelligent. They interviewed him at length by phone.
A report the audit team prepared was damning. A summary of it said the Estonian branch wasn’t able to identify the true source of funds—a basic banking requirement—and “therefore acts against [anti-money-laundering] legislatory principles.”
The draft report said the branch’s head of international banking, who helped oversee nonresident accounts, had told the auditors his employees weren’t recording the true owners of the companies because, in the report’s language, “it could cause problems for clients if Russian authorities request information.” The banker couldn’t be reached for comment.
In March 2014, Mr. Wilkinson checked what 12 additional Danske clients had reported to British authorities. Each moved millions but reported scant income or assets. Mr. Wilkinson made a total of four complaints. He didn’t find a single Danske client that correctly reported its income to the government where it was registered.
It took a phone call to break Mr. Wilkinson’s zeal.
The internal audit team’s draft report, the product of a two-month investigation, was being watered down under pressure, an auditor called to tell him. The bank’s auditing chief wouldn’t give Mr. Wilkinson a copy.
The report would permanently remain a draft. If it was made final, Denmark’s banking supervisor would have access to it.
In April 2014, a colleague told Mr. Wilkinson that Estonian branch management had been listening to recordings of his calls with auditors. He felt spooked—and infuriated.
He resigned. “After over seven years with the bank, I’ve decided it’s time to do something else,” he emailed management.
Seconds later, Mr. Wilkinson sent an email he had pre-written to Danske’s chief risk officer: If Danske didn’t report the false accounts to Estonian police, then he would.
Three hours later, the officer responded: “I can assure you that the issues you have raised are receiving a huge amount of attention both locally and in Copenhagen.”
Estonia at the time was ranked as the second-best country on earth in combating money laundering, by a standard called the Basel AML index, while corruption watchdog Transparency International rated Denmark the world’s most transparent country that year. What was unusual, Mr. Wilkinson concluded, wasn’t that a name-brand branch had turned a blind eye to its customers, but that it got caught.
At the end of April 2014, he cleaned out his desk. Danske Bank’s top legal officer hired a consulting firm to investigate allegations of misconduct at the Estonian branch. The hiring decision was overturned by two executive-board members.
In June, the board of directors met. Mr. Borgen had told colleagues two banks were considering buying Danske’s Baltic portfolio, including the Estonian branch. Let the business carry on a bit longer, he said.
“CEO found it unwise to speed up an exit strategy as this might significantly impact any sales price,” the minutes of the meeting say.
Board members swallowed their misgivings, according to people familiar with the session. “Nobody ever disagrees with Thomas,” said one. “He was regarded as the most successful CEO Danske Bank had ever had…. He had steered the bank through a very difficult time.”
“My Own Small Bit”
Danske didn’t find a buyer for the Baltic business. The nonresident business at the Estonian branch carried on for another year. Then, in 2015, Bank of America Corp. and Deutsche Bank AG , the last two correspondent banks still processing U.S. dollar transactions for the Estonian branch, both said they would stop dealing with the branch’s clients on money-laundering concerns. Late that year, Danske pulled the plug on its nonresident business and shut thousands of accounts.
In early 2017, Danish newspaper Berlingske published reports describing Danske Estonia money-laundering schemes. In September of that year, Danske opened an internal investigation.
Mr. Borgen dismissed notions he would have to resign, people close to the board recalled. He told an investor as recently as June there was nearly zero chance Danske would have to pay a significant fine. He expected to stay on after the investigation, people close to the board recalled.
As Danske’s investigators, based partly on Mr. Wilkinson’s tips, combed through stacks of transaction records, the scale of the money flows remained a mystery. After a year of work, the investigators had managed to review less than half of the branch’s 15,000 clients.
“The vast majority of these customers have been deemed suspicious,” Danske said in the September report of its internal investigation.
The investigators determined that the branch had handled €200 billion, equal to $233 billion, in largely suspicious transactions. They were unable to figure out who owned the lucrative nonresident companies that banked there. Those clients’ money has long since vanished into a labyrinth of offshore companies around the globe.
The internal investigation mostly exonerated top management, including Mr. Borgen. It accused dozens of low-level employees of wrongdoing.
Mr. Borgen said he would resign as CEO nonetheless. “Danske Bank has failed to live up to its responsibility,” he said. “I deeply regret this.”
Mr. Wilkinson was following events from the kitchen table of his countryside home. Even he was flabbergasted by the scale. “Surreal,” he says.
If he filed any whistleblowing claims to the SEC, there is the possibility under U.S. law he could collect a portion of any fine against the bank. His lawyer declined to comment on whether he has spoken with U.S. or European law enforcement, citing Estonian bank-secrecy laws.
These days, the Englishman looks after his daughters. Sometimes in the evenings, he occupies his mind with a Bletchley Park cipher puzzle book, named after the team of World War II codebreakers that cracked Germany’s secret Enigma encryption.
“I’ve done my own small bit,” he said.