The organised criminal network, composed of mostly Ukrainian but also Armenian, Azerbaijani, or Kazakh nationals, has been providing cash courier and underground banking services to other criminal networks. Chinese actors were also part of this criminal network, providing money laundering services. This catalogue of crime-as-a-service offerings was used by various Russian-speaking and Asian criminal actors engaged in drug trafficking, tax evasion, or the smuggling of illicit goods. These crimes were mostly committed in Spain.
Results of the action days include:

23 suspects arrested (20 in Spain, 1 in France, and 2 in Slovenia)
91 house searches carried out (77 in Spain, 1 in France, and 13 in Cyprus)
17 additional suspects prosecuted
EUR 8.2 million in cash seized
EUR 27 million in cryptocurrency seized or frozen
EUR 2 million in bank accounts seized or frozen
36 vehicles (including some luxury vehicles), real estate, luxury watches, jewellery as well as electronic devices seized

Abuse of temporary protection status as Ukrainian citizens

The suspects are believed to have abused the temporary protection status granted to Ukrainian refugees by the EU since 2022, as well as other citizens affected by the Russian war of aggression against Ukraine. Many of the millions of refugees from Ukraine took their savings with them to Europe in cash to safeguard it from the consequences of the war. Taking advantage of the exceptions put in place to facilitate the transfer of money between jurisdictions, the criminal network moved huge amounts of cash without being questioned in detail or scrutinised during customs checks. Declaring the cash sums as part of their own patrimony, the money mules, some of whom are family members of the criminal leaders, travelled regularly between Spain, Cyprus, France, and other countries.

Once several cash couriers started to be arrested, the criminal network adapted their modus operandi. It moved from significant physical cash movements to the cryptocurrency sphere, making the money transfers harder to detect. According to initial estimates, at least EUR 75 million had been moved from March 2023 to February 2024. During raids performed in Cyprus, law enforcement seized and froze around EUR 26 million in one cryptocurrency.