On 19 November 2024, law enforcement across Europe cracked down on a criminal network led by two Ukrainian brothers. The action day, which follows raids conducted in October 2024, saw the arrest of several suspects and the seizure of various criminal assets. In total, the operation, which took place over several months, led to the arrest of 23 suspects, the seizure of EUR 35.7 million in cash, bank accounts and cryptocurrencies as well as 36 vehicles, real estate, watches, and jewellery.

The organised criminal network, composed of mostly Ukrainian but also Armenian, Azerbaijani, or Kazakh nationals, has been providing cash courier and underground banking services to other criminal networks. Chinese actors were also part of this criminal network, providing money laundering services. This catalogue of crime-as-a-service offerings was used by various Russian-speaking and Asian criminal actors engaged in drug trafficking, tax evasion, or the smuggling of illicit goods. These crimes were mostly committed in Spain.

Results of the action days include:

• 23 suspects arrested (20 in Spain, 1 in France, and 2 in Slovenia)
• 91 house searches carried out (77 in Spain, 1 in France, and 13 in Cyprus)
• 17 additional suspects prosecuted
• EUR 8.2 million in cash seized
• EUR 27 million in cryptocurrency seized or frozen
• EUR 2 million in bank accounts seized or frozen
• 36 vehicles (including some luxury vehicles), real estate, luxury watches, jewellery as well as electronic devices seized

Abuse of temporary protection status as Ukrainian citizens

The suspects are believed to have abused the temporary protection status granted to Ukrainian refugees by the EU since 2022, as well as other citizens affected by the Russian war of aggression against Ukraine. Many of the millions of refugees from Ukraine took their savings with them to Europe in cash to safeguard it from the consequences of the war. Taking advantage of the exceptions put in place to facilitate the transfer of money between jurisdictions, the criminal network moved huge amounts of cash without being questioned in detail or scrutinised during customs checks. Declaring the cash sums as part of their own patrimony, the money mules, some of whom are family members of the criminal leaders, travelled regularly between Spain, Cyprus, France, and other countries. 

Once several cash couriers started to be arrested, the criminal network adapted their modus operandi. It moved from significant physical cash movements to the cryptocurrency sphere, making the money transfers harder to detect. According to initial estimates, at least EUR 75 million had been moved from March 2023 to February 2024. During raids performed in Cyprus, law enforcement seized and froze around EUR 26 million in one cryptocurrency.

Europol’s role

Europol supported this international operation with experts specialised in financial crime, fighting high-risk criminal networks, unravelling money laundering structures, and tracing cryptocurrency flows. 

Providing analytical, operational, and coordination support to the involved countries from the very start, Europol supported the action days by deploying analysts and specialists. During the action days, these experts performed cross-checks with their mobile offices, gave forensic support in reading out seized electronic devices, and provided cryptocurrency expertise. 

Europol was also part of the judicial Joint Investigation Team formed by Eurojust and involving Spain, Cyprus, and Germany. 

The European Multidisciplinary Platform Against Criminal Threats (EMPACT) tackles the most important threats posed by organised and serious international crime affecting the EU. EMPACT strengthens intelligence, strategic and operational cooperation between national authorities, EU institutions and bodies, and international partners. EMPACT runs in four-year cycles focusing on common EU crime priorities.