The Estonian Financial Intelligence Unit, together with its counterparts in Latvia and Lithuania and the Bank of Lithuania, has released a landmark strategic study covering 2021 to mid-2024. Titled “Evolving Payment Landscapes and AML Challenges in the Baltic States,” the document does not read like dry regulatory jargon. It reads like an autopsy report on a failed containment strategy.
The conclusion is brutal and undeniable: the anti-money laundering battlefield has shifted entirely. Criminals no longer need to compromise legacy banks. They have simply migrated to the digital architecture of the Baltic States, turning licensed fintechs, payment institutions, and crypto on-ramps into the preferred infrastructure for fraud, sanctions evasion, and illegal gambling.
Lithuania’s Fintech Hub: A Regional Success Story Built on Sand
Lithuania has won the race to become the Baltic’s premier FinTech centre. According to the joint FIU study, the country hosts a materially larger market for payment institutions and e-money institutions than Estonia or Latvia combined. By the end of 2024, over 120 licensed fintech firms were operating out of Vilnius, serving more than 30 million EU customers. On paper, this is a triumph of digital policy.
But the FIUs are explicit: Lithuania’s PI/EMI sector has been assessed as high-risk because of non-resident portfolios, international transactions, high-risk industries, remote onboarding, and pass-through payments. This is not theoretical. Estonian and Latvian suspicious transaction reports overwhelmingly reference Lithuanian FinTech PSP accounts. In plain English, when criminals in the Baltics need to move dirty money, they open an account with a Lithuanian digital bank.
The study confirms that client off-boarding by traditional Scandinavian and Baltic banks did not kill the criminal money flow. It merely relocated it. De-risking by responsible banks drove high-risk clients directly into the arms of Lithuanian payment processors, virtual IBAN providers, and crypto-friendly intermediaries. The regulatory arbitrage is complete.
Estonia: The BaaS and VIBAN Smoke Screen
Estonia presents a different but equally alarming picture. The FIU study points directly to vulnerabilities in Banking-as-a-Service models and the rampant use of Virtual IBANs. These structures allow one master account to spawn hundreds of sub-accounts for third-party clients, effectively turning a single licence into a franchise for opacity.
The numbers are staggering. Cross-border payment volumes in Estonia surged from €105 billion in 2021 to €136 billion in 2024. Of this, PI and EMI payments reached €84 billion, while VASP-related transactions hit €33.5 billion. A staggering 89% of this total cross-border volume involved non-resident respondents. This means the Estonian financial system is processing vast sums for people who do not live there, will not be investigated there, and whose source of wealth is verified only by automated software.
The FIU warns that VIBANs are a major obstacle to identifying beneficial owners. When law enforcement tries to freeze assets or trace a transaction, they hit a wall of bundled files and sub-account structures where the original customer data is diluted to the point of uselessness. This is not a bug in the system; for criminal operators, it is the feature.
The Real Economy of Fraud: Vishing, Investment Scams, and Sanctions Evasion
The Baltic FIUs identify three dominant predicate offences: fraud, tax evasion, and sanctions circumvention. The data backs this up with real human losses. In 2024, Estonians lost €4.8 million to investment scams alone. Latvians reported 3,671 cases of investment fraud, losing over €5.6 million. Lithuanians lost €4.8 million in 2023.
There is a linguistic geography to the crime. Because roughly a quarter of the population in Estonia and Latvia speaks Russian, phone scams – vishing – conducted in Russian account for nearly two-thirds of fraud losses in Latvia. In Lithuania, where the Russian-speaking population is only about 5%, vishing losses are the lowest. Instead, Lithuania suffers from high-volume investment fraud, which accounts for nearly 40% of the country’s total fraud losses.
The FIU study confirms that crypto-related risks are exploding in Lithuanian FinTech PSPs. While only 7% of Estonian STRs included crypto activity on average, that share rose to 12% by 2024. For Lithuanian accounts, the proportion was roughly 18%. Criminals are not just using exchanges; they are using payment rails that touch crypto on-ramps, effectively converting fiat currency into untraceable assets within the same transaction chain.
The Shell Company and Straw Man Factory
The study highlights transit accounts, shell companies, strawmen, and VIBAN structures as recurring obstacles to tracing illicit funds. This aligns perfectly with the Estonian national risk assessment for 2025, which found that companies registered in Estonia but with weak ties to the country – often managed by foreign nationals – are used to commit crimes abroad, particularly tax offences.
The gambling sector received the highest residual risk assessment in Estonia. Remote gambling operators managed abroad but registered in Estonia were specifically flagged. Many transactions involve non-residents and counterparties located in high-risk jurisdictions. This is not a coincidence. It is a business model where the physical presence is a mailbox, the economic activity is elsewhere, and the licence is just a tool to access EU banking rails.
Regulatory Reaction: Fines, Clawbacks, and a Race to Catch Up
The regulators are not entirely asleep. In 2025, the Bank of Lithuania revoked the EMI licence of KogoPay UAB and is seeking its bankruptcy after the company admitted it was insolvent and could not meet obligations. The same regulator fined ValorPay €12,000 for late financial reporting. Lithuania also introduced an EU-wide beneficiary name check system across 70 institutions, forcing banks to verify payee names before releasing funds.
But these are tactical victories. The strategic reality is that the Baltic States are playing whack-a-mole with a highly mobile criminal infrastructure. When Estonia cracked down on its famously lax crypto licensing regime – reducing licensed VASPs from 641 in mid-2021 to just 36 active providers – the dirty money did not disappear. It simply flowed south to Lithuania. As oversight tightened in Tallinn, many firms shifted operations to Vilnius, highlighting the complete absence of coordinated regional enforcement.
The Intelligence Gap
Ironically, the Baltic FIUs have produced an excellent diagnostic. They recommend regional indicators for STRs, detailed sector-specific typology studies, better dissemination of red flags, and stronger data harmonisation. Yet, the private sector is still catching up. Fraud prevention has historically relied on transaction monitoring, sanctions screening, and risk assessment. Intelligence sharing is the vital fourth pillar, but it is still in its infancy.
Platforms like Salv Bridge are launching in Lithuania to enable cross-border intelligence sharing between Paysera, NEO Finance, and others. But these are voluntary networks. Until intelligence sharing is mandatory and carries penalties for non-compliance, the financial criminals will always be one step ahead, sharing data faster through Telegram channels than banks do through compliance departments.
The Baltic FIU study proves that the region has become a payment-rail laboratory. The experiment has produced massive GDP growth and fintech innovation, but it has also produced a criminal supply chain. Every low-friction, remote-onboarding, VIBAN-splitting, crypto-friendly feature that attracts legitimate start-ups also attracts the money launderers.
The key question is no longer whether a PSP is licensed. The question is: what payment rail is the PSP enabling, and for whom? Until supervisors in Tallinn, Riga, and Vilnius start treating payment-rail opacity as a standalone compliance violation – and until they start revoking licences for gross negligence rather than just issuing fines – the Baltic States will remain the EU’s premier laundering machine. The study is a warning. The silence from the regulators about who exactly runs the single Lithuanian bank that dominates Estonian and Latvian cross-border flows is a disgrace.
