Mapping the risk of serious and organised crime infiltrating legitimate businesses : technical annexes.
Date: 2021-03-17
Institutions: Directorate-General for Migration and Home Affairs
Subjects: economic consequence, environmental offence, fight against crime, financial technology, illicit trade, industrial counterfeiting, information security, money laundering, organised crime, private sector, public procurement, report, risk management, social impact, trafficking in human beings, underground economy

Mapping the risk of 
serious and organised 
crime infiltrating 
legitimate businesses

Technical annexes

Edited by Shann Hulme, Emma Disley and Emma Louise Blondes 

Migration and 
2
Home Affairs

EUROPEAN COMMISSION 

Mapping the risk of serious 
and organised crime 
infiltrating legitimate 
businesses 

Technical annexes 

Edited by Shann Hulme, Emma Disley and Emma Louise Blondes, RAND Europe  

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
EUROPEAN COMMISSION 

EUROPEAN COMMISSION 

Directorate-General for Migration and Home Affairs 

Directorate D – Law Enforcement and Security 

Unit D.5 – Organised Crime and Drugs Policy 

E-mail:  HOME-NOTIFICATIONS-D5@ec.europa.eu  

European Commission 
B-1049 Brussels

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
EUROPEAN COMMISSION 

Europe Direct is a service to help you find answers  
to your questions about the European Union. 

Freephone number (*): 

00 800 6 7 8 9 10 11 

(*) 

The information given is free, as are most calls (though some operators, phone 

boxes or hotels may charge you). 

LEGAL NOTICE 

This document has been prepared for the European Commission however it reflects the views only of the authors, 
and the Commission cannot be held responsible for any use which may be made of the information contained 
therein. 

More information on the European Union is available on the internet (http://www.europa.eu). 

PDF  

ISBN 978-92-76-32153-8 

doi: 10.2837/442937 

DR-02-21-334-EN-N 

© European Union, 2021 

Reproduction is authorised provided the source is acknowledged. 

3 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
EUROPEAN COMMISSION 

Table of Contents 

Table of Contents .......................................................................................................... 4 
Tables ......................................................................................................................... 5 
Figures ........................................................................................................................ 6 
Boxes .......................................................................................................................... 6 
Abbreviations ............................................................................................................... 8 
  Methodology ..................................................................................................... 10 
1.1.  Major outputs of the study............................................................................ 10 
1.2.  Data collection activities ............................................................................... 11 
  Criminal markets .............................................................................................. 27 
Illicit drugs ................................................................................................. 27 
2.1. 
2.2.  Trafficking in human beings .......................................................................... 45 
2.3.  Smuggling of migrants ................................................................................. 63 
2.4.  Fraud ......................................................................................................... 73 
2.5.  Environmental crime .................................................................................. 105 
Illicit firearms ........................................................................................... 129 
2.6. 
2.7. 
Illicit tobacco ............................................................................................ 140 
2.8.  Cybercrime activities ................................................................................. 157 
2.9.  Organised property crime ........................................................................... 171 
  Serious and organised crime investment and infiltration in the legal economy189 
3.1.  Additional information on investments by OCGs in the legal economy .............. 189 
3.2.  Additional information on the freezing and confiscation of assets from OCGs..... 190 
3.3.  Additional information on risk factors for SOC infiltration ................................ 195 
3.4.  Additional information on the exploitation of the underground economy by OCGs

 ............................................................................................................... 229 
3.5.  Additional information on the exploitation of NPMs by OCGs ........................... 246 
  References ..................................................................................................... 256 

4 

 
 
 
EUROPEAN COMMISSION 

Tables 

Table 1.1: Outputs of the study informed by data collection activities ................................................. 10 
Table 1.2: Purpose of literature review for each task of the study ....................................................... 11 
Table 1.3: Search terms and databases searched ............................................................................. 11 
Table 1.4: Inclusion and exclusion criteria for market literature reviews .............................................. 18 
Table 1.5: Quality appraisal tool for studies of previous revenue estimates .......................................... 20 
Table 1.6: Organisations consulted for interviews ............................................................................. 20 
Table 1.7: Number of organisations consulted by stakeholder group ................................................... 22 
Table 1.8: Members of the expert panel .......................................................................................... 23 
Table 1.9: Proven cases of SOC investment or infiltration by Member State ......................................... 25 
Table 2.1: Criminal markets and areas examined in this study ........................................................... 27 
Table 2.2: Prior studies estimating the size or revenue of illicit drug markets in the EU ......................... 30 
Table 2.3: Summary of approach for estimating revenue from illicit drugs ........................................... 37 
Table 2.4: Revenue estimate of the EU retail illicit drug markets ........................................................ 38 
Table 2.5: Illicit drugs markets – Market actors ............................................................................... 39 
Table 2.6: Illicit drug markets – Future trends ................................................................................. 43 
Table 2.7: Recommendations – Illicit drug markets .......................................................................... 45 
Table 2.8: Prior studies estimating the size or criminal revenue of THB in the EU ................................. 49 
Table 2.9: Summary of approach for estimating the criminal revenues of THB for sexual exploitation ..... 52 
Table 2.10: Criminal revenue estimates on THB for sexual exploitation in the EU ................................. 54 
Table 2.11: THB – Actors .............................................................................................................. 55 
Table 2.12: THB – Future trends .................................................................................................... 61 
Table 2.13: Recommendations – THB market .................................................................................. 63 
Table 2.14: Price per passage for route to or on the way to the EU ..................................................... 65 
Table 2.15: Prior studies estimating the size or revenue from smuggling of migrants in the EU .............. 67 
Table 2.16: Summary of approach for estimating the revenues from the smuggling of migrants ............ 68 
Table 2.17: Revenue estimates of the EU smuggling of migrant market .............................................. 69 
Table 2.18: Smuggling of migrants – Market actors .......................................................................... 70 
Table 2.19: Smuggling of migrants – Future trends .......................................................................... 71 
Table 2.20: Recommendations – Smuggling of migrants ................................................................... 73 
Table 2.21: Prior studies estimating the size or revenue of the VAT / MTIC fraud market in the EU ......... 76 
Table 2.22: Summary of approach for estimating revenues from MTIC fraud ....................................... 78 
Table 2.23: Revenue estimate of the EU MTIC fraud market .............................................................. 79 
Table 2.24: MTIC fraud – Market actors .......................................................................................... 81 
Table 2.25: MTIC fraud – Future trends .......................................................................................... 83 
Table 2.26: Recommendations – MTIC fraud .................................................................................... 84 
Table 2.27: Prior estimates of IPR infringements in the EU ................................................................ 89 
Table 2.28: Prior estimates of revenue losses to legitimate industry ................................................... 91 
Table 2.29: IPR infringements – Market actors ................................................................................. 92 
Table 2.30: IPR infringements – Future trends ................................................................................. 95 
Table 2.31: Recommendations – IPR infringements market ............................................................... 97 
Table 2.32: Prior studies estimating the size or revenue of the food fraud market in the EU ................ 100 
Table 2.33: Food fraud – Market actors ......................................................................................... 102 
Table 2.34: Food fraud – Future trends ......................................................................................... 103 
Table 2.35: Recommendations – Food fraud market ....................................................................... 105 
Table 2.36: Prior studies estimating the size or revenue of the illicit waste market in the EU ............... 108 
Table 2.37: Summary of approach for estimating revenues from illicit waste ..................................... 109 
Table 2.38: Revenue estimate of the EU illicit waste market ............................................................ 112 
Table 2.39: Illicit waste – Market actors ........................................................................................ 114 
Table 2.40: Illicit waste – Future trends ........................................................................................ 115 
Table 2.41: Recommendations – Illicit waste market ...................................................................... 116 
Table 2.42: Prior studies estimating the size or revenue of the illicit wildlife market in the EU .............. 122 
Table 2.43: Summary of approach for estimating revenues from illegal glass eels .............................. 124 
Table 2.44: Revenue estimate of one species subject to illegal trade in Europe – European eels ........... 126 
Table 2.45: Illicit wildlife – Market actors ...................................................................................... 126 
Table 2.46: Illicit wildlife – Future trends ...................................................................................... 127 
Table 2.47: Recommendations – Illicit wildlife market ..................................................................... 128 
Table 2.48: Price of illicit firearms ................................................................................................ 131 
Table 2.49: Prior studies estimating the size or revenue of illicit firearms in the EU ............................ 133 
Table 2.50: Summary of approach for estimating revenues from illicit firearms sales .......................... 135 
Table 2.51: Revenue estimates of the EU illicit firearms market ....................................................... 136 
Table 2.52: Illicit firearms – Market actors .................................................................................... 137 
Table 2.53: Illicit firearms – Future trends..................................................................................... 138 
Table 2.54: Recommendations – Illicit firearms market ................................................................... 140 
Table 2.55: Prior studies estimating the size or revenue of the illicit tobacco market in the EU ............. 145 
Table 2.56: Summary of approach for estimating revenues from illicit tobacco ................................... 146 
Table 2.57: Revenue estimates of illicit cigarettes .......................................................................... 147 
Table 2.58: Exploration of differential illicit-to-licit price ratio for counterfeit products, 2019 ................ 149 
Table 2.59: Exploratory revenue estimates of the illicit fine-cut tobacco market in the EU, 2019 .......... 150 
Table 2.60: Illicit tobacco – Market actors ..................................................................................... 150 

5 

 
EUROPEAN COMMISSION 

Table 2.61: Illicit tobacco – Future trends ..................................................................................... 155 
Table 2.62: Recommendations – Illicit tobacco market .................................................................... 156 
Table 2.63: Overview of common CaaS products and services ......................................................... 158 
Table 2.64: Prior studies estimating the size or revenue of the EU cybercrime market in the EU ........... 162 
Table 2.65: Summary of approach for estimating revenues from card payment fraud ......................... 163 
Table 2.66: Revenue estimate of card payment fraud in the EU ....................................................... 164 
Table 2.67: Cybercrime – Market actors ........................................................................................ 165 
Table 2.68: Dark net listings by category ...................................................................................... 168 
Table 2.69: Cybercrime – Future trends ........................................................................................ 168 
Table 2.70: Recommendations – Cybercrime market ...................................................................... 171 
Table 2.71: Prior studies estimating the revenue of organised property crimes in the EU ..................... 176 
Table 2.72: Summary of approach for estimating revenue from cargo thefts ..................................... 178 
Table 2.73: Summary of approach for estimating losses from MVT, domestic burglary and robbery ...... 179 
Table 2.74: Revenue estimate of cargo theft and ATM physical attacks ............................................. 180 
Table 2.75: Organised property crime – Market actors .................................................................... 182 
Table 2.76: Organised property crime – Future trends .................................................................... 187 
Table 2.77: Recommendations – Organised property crime market .................................................. 188 
Table 3.1: List of statistical data to be maintained by intelligence / law enforcement / judicial authorities 

of the EU Member States .................................................................................................... 191 
Table 3.2: List of statistical data to be maintained in money-laundering cases ................................... 192 
Table  3.3:  Statistical  data  on  value  of  assets  frozen  and  confiscated  in  money-laundering  cases  (€ 

million) ............................................................................................................................. 193 
Table 3.4: Quantitative and qualitative measurement of SOC infiltration in the legal economy ............. 204 
Table 3.5: Summary of analytical steps for analysis of risk factors for companies ............................... 209 
Table 3.6: Available cases of SOC infiltration of legal entities for the analysis .................................... 210 
Table 3.7: Identified markets ....................................................................................................... 210 
Table 3.8: Descriptive statistics on variables used for clustering ....................................................... 211 
Table 3.9: Summary of analytical methods for analysis of risk factors in public procurement ............... 220 
Table 3.10: Overview of variables used in the analysis .................................................................... 220 
Table 3.11: Summary statistics for dissolved municipalities ............................................................. 222 
Table 3.12: Results of Logistic Regression for the SOC infiltration prediction ...................................... 223 
Table 3.13: Models’ accuracy and correlation coefficient of predicted probabilities of SOC infiltration and 

Transcrime Mafia Index ...................................................................................................... 227 
Table 3.14: Approaches that have been used for measuring the underground economy ...................... 233 
Table 3.15: Drivers and indicators of the underground economy ...................................................... 236 

Figures 

Figure 2.1: Geographical representation on the main smuggling routes ............................................... 70 
Figure 2.2: MTIC VAT loss (% of total VAT revenue) ......................................................................... 80 
Figure 2.3: Cybercrime ............................................................................................................... 166 
Figure 3.1: Optimal number of clusters as per elbow method ........................................................... 212 
Figure 3.2: Cluster dendrogram ................................................................................................... 213 
Figure 3.3: Distribution of similarity measure in markets with identified cases of SOC infiltration ......... 214 
Figure 3.4: Distribution of share of companies with high similarity measure as compared to identified 

cases of SOC across Europe ................................................................................................ 215 

Figure 3.5: Correlation between Control of Corruption Index and share of companies flagged as likely 

infiltrated in the motor vehicles trade sector ......................................................................... 216 

Figure 3.6: Correlation between countries’ cash intensity and share of companies flagged as likely to be 

infiltrated .......................................................................................................................... 217 

Figure 3.7: Correlation between countries’ rule of law index and share of companies flagged as likely to 

be infiltrated ..................................................................................................................... 218 
Figure 3.8: Sample decision tree from the model of SOC infiltration classification ............................... 226 
Figure  3.9:  Partial  dependence  plots  for  the  five  most  important  predictors  in  the  selected  Random 

Forest model ..................................................................................................................... 227 

Figure 3.10:  Predicted probabilities  of  SOC  infiltration  at  the  contract  level produced  by  the  selected 

Random Forest model for the Italian procurement data .......................................................... 228 

Figure 3.11: Mean value of predicted SOC infiltration probabilities for Italian regions based on contracts 

awarded by municipalities ................................................................................................... 229 
Figure 3.12: Relative size of the underground economy across EU Member States.............................. 232 
Figure 3.13: Victims of trafficking in Bulgaria by type of exploitation ................................................ 240 
Figure 3.14: Victims of trafficking in Romania by type of exploitation ................................................ 240 

Boxes 

Box 1: Search strategy for cases of investments or infiltration in the legal EU economy ........................ 24 
Box 2: Interviewees confirmed increasing violence related to drug trafficking by OCGs in Europe ........... 42 
Box 3: Formula for calculating revenue using demand-side approach .................................................. 86 
Box 4: Formula for calculating revenue from IPTV ............................................................................ 86 

6 

 
EUROPEAN COMMISSION 

Box 5: Main illicit wildlife markets in the EU ................................................................................... 117 
Box 6: Terrorism and firearms ..................................................................................................... 130 
Box 7: Attractiveness of illicit tobacco trade to OCGs ...................................................................... 151 
Box 8: Estimates of the costs of organised property crime in the EU ................................................. 181 
Box 9: MIMIC procedure ............................................................................................................. 231 
Box 10: The case of WannaCry .................................................................................................... 248 

7 

 
 
 
 
EUROPEAN COMMISSION 

Abbreviations 

AMO 

ARO 

ATM 

BvD 

CaaS 

CDA 

CNP 

CSD 

ELV 

Asset Management Office  

Asset Recovery Office 

Automated teller machine  

Bureau van Dijk 

Crimes-as-a-Service 

Currency demand approach  

Card-not-present  

Centre for the Study of Democracy  

End-of-life vehicles 

EMCDDA  

European Monitoring Centre for Drugs and Drug Addiction  

EMEA 

EMPACT 

EUIPO 

FATF 

FinTech 

FIU 

FRA 

FTZ 

GDP 

GI 

ICA 

IP 

IPR  

ISS 

MIMIC 

MOCG 

MTIC 

MVT 

NGO 

NLP 

NPM 

NPS 

OCG 

OHIM 

OLAF 

SEG 

SOC 

SOCTA 

TAPA 

TED 

THB  

T&T 

European, the Middle East and Africa  

European Multidisciplinary Platform Against Criminal Threats 

European Union Intellectual Property Office  

Financial Action Task Force 

Financial Technology  

Financial Intelligence Unit  

Fundamental Rights Agency  

Free trade zone  

Gross Domestic Product  

Geographical indications 

Intra-community acquisition 

Intellectual property  

Intellectual Property Rights  

Incident Information Service  

Multiple Indicators Multiple Causes 

Mobile organised crime group 

Missing trader intra-community  

Motor vehicle theft 

Non-government organisation  

Neuro-linguistic programming  

New payment method 

New psychoactive substance  

Organised crime group 

Office for Harmonisation in the Internal Market 

European Anti-Fraud Office  

Sustainable Eel Group  

Serious and organised crime 

Serious and Organised Crime Threat Assessment 

Transported Asset Protection Association 

Tenders Electronic Daily  

Trafficking in human beings  

Track and trace 

8 

 
UK 

UNEP  

UNODC  

USD 

VAT 

VPN 

WEEE 

WHO 

EUROPEAN COMMISSION 

United Kingdom 

United Nations Environment Programme  

United Nations Office on Drugs and Crime  

United States Dollars 

Value Added Tax 

Virtual Private Network 

Waste Electrical and Electronic Equipment 

World Health Organisation 

9 

 
 
 
 
EUROPEAN COMMISSION 

  Methodology 

Shann Hulme, RAND Europe 

In this annex we explain the methodological approach of this study. We provide a description of the 
cross-cutting data-collection activities that were undertaken to address the research questions and 
the major outputs of the study. This study was reliant upon existing literature and secondary data 
sources,  in  addition  to  primary  data  collected  through  interviews  with  stakeholders,  surveys  of 
organisations  responsible  for  asset-seizure  and  confiscation  in  the  EU,  and  the  collation  of  cases 
involving organised crime group (OCG) investment in the legal economy or infiltration of legitimate 
businesses.  

1.1.  Major outputs of the study 

The study produces a range of outputs through the triangulation of multiple data sources. As shown 
in the table below, each of these activities and outputs informed a series of recommendations and 
policy ideas that were produced to address both objectives of the study.  

Table 1.1: Outputs of the study informed by data collection activities 

Section of 
main report 

Output 

r
e
v
e
w

i

L
i
t
e
r
a
t
u
r
e

I
n
t
e
r
v
e
w
s

i

S
u
r
v
e
y

d
a
t
a

S
e
c
o
n
d
a
r
y

P
r
o
v
e
n

c
a
s
e
s

C
a
s
e

s
t
u
d
y

Section 2  

Section 3.1 

Section 3.2 

Objective 1 

Estimates of revenues of selected 
illicit markets at, where possible, EU 
and Member State level  

Analysis of organised crime 
involvement and key actors in each 
illicit market 

Analysis of future trends and 
dynamics for each illicit market 

Analysis of assets and sectors of 
investment by OCGs in the legal 
economy 

Analysis of modus operandi of 
investment by OCGs in the legal 
economy 

Analysis of availability of statistical 
data on asset-recovery at Member 
State level 

Summary of statistical data on asset-
seizure and confiscation 

Objective 2  

Section 3.3 

Micro- and macro-level risk factors 
for OCG infiltration in legitimate 
businesses  

Section 3.4 

Estimates of size of the underground 
economy 

Section 3.5 

Section 3.6 

Analysis of exploitation of the 
underground economy by OCGs 

Analysis of use of NPMs by OCGs, 
including modus operandi and risks 

Summary of emerging trends for 
management of criminal finances  

R
e
c
o
m
m
e
n
d
a
t
i
o
n
s

a
n
d

p
o

l
i
c
y

i

d
e
a
s

10 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
EUROPEAN COMMISSION 

1.2.  Data collection activities 

1.2.1. Literature review  

In-depth literature reviews were carried out for each task of the study. The specific purpose of each 
is provided in Table 1.2.  

Table 1.2: Purpose of literature review for each task of the study 

Section of 
main 
report  

Purpose of literature review 

2.1–2.9 

Identify prior estimates of revenue from the nine illicit markets. 

Identify what is known about actors in each market, including level of OCG involvement. 

Horizon-scanning for future trends and dynamics for each market and across the EU, 
specifically those likely to affect revenue. 

Identify what is known about where and how investments have been made by OCGs in the 
legal economy, including the type of assets, business sectors and geographic areas. 

Identify what is known about assets frozen or confiscated from OCGs. 

Identify what is known about the misuse of legal entities by OCGs in the EU, including 
opacity and complexity of corporate structures, business ownership anomalies and 
emerging enablers and trends. 

Identify links between underground economy and OCG and identify what quantitative data 
has previously been used to measure it, and what the previous estimates were. 

Scope evidence on the use of NPMs by OCGs (i.e. non-banking funds transfer methods, 
mobile payment methods, cryptocurrencies). 

Identify future threats with regard to management of criminal finances by OCGs.  

3.1 

3.2 

3.3 

3.4 

3.5 

3.6 

The general approach for carrying out the literature reviews is described below.  

Step 1: Searching and identifying sources 
The  first  step  of  the  literature  search  was  to  enter agreed  search  terms  into  Google  Scholar  and 
selected databases that catalogue academic and other research literature.  

The search terms and databases used for each task are outlined in the table below. Additionally, the 
full reference lists for each task were shared with the Expert Advisory Group members to identify 
any missing literature. Interviewees were also asked to recommend pertinent literature relevant to 
their areas of expertise. The bibliographies of included literature were also scanned.  

Table 1.3: Search terms and databases searched 

Report section  

Search terms and databases searched  

2.1. Illicit drugs trafficking 

Search terms: 

Search 1 

‘illicit drug’ OR ‘illegal drug’ OR cannabis OR cocaine OR heroin OR 
amphet* OR meth* OR NPS 

(AND) 

Revenue OR value OR size OR scope OR magnitude 

Search 2 

‘illicit drug’ OR ‘illegal drug’ OR cannabis OR cocaine OR heroin OR 
amphet* OR meth* OR NPS 

(AND) 

Future OR risk OR threat OR enabler OR actor OR ‘organised crime’ OR 
‘criminal organisations’ OR ‘criminal groups’ OR ‘criminal networks’ 

Databases:  

11 

 
 
 
 
EUROPEAN COMMISSION 

Report section  

Search terms and databases searched  

Google Scholar, ProQuest 

2.2. THB 

Search terms: 

Grey literature: 

EMCDDA, UNODC, Europol, Transcrime  

‘Human trafficking’ OR ‘Sex trafficking’ OR ‘Labour trafficking’ OR ‘organ 
trafficking’ OR ‘forced begging’ OR ‘forced criminality’ 

(AND) 

Revenue OR value OR size OR scope OR magnitude OR estimate 

‘Human trafficking’ OR ‘Sex trafficking’ OR ‘Labour trafficking’ OR ‘organ 
trafficking’ OR ‘forced begging’ OR ‘forced criminality’ 

(AND) 

Future OR risk OR threat OR enabler OR actor OR ‘modus operandi’ OR 
‘organised crime’ AND EU or Europ* 

Databases:  

Google Scholar, JSTOR 

Grey literature: 

2.3. Smuggling of migrants 

Search terms: 

Europol, EUROSTAT, European Commission, UNODC, ILO 

2.4. MTIC / Value Added Tax 
(VAT) fraud 

‘Smuggling of migrants’ AND revenue OR value OR size OR price OR 
estimate AND EU or Europ* 

‘Migrant smuggling’ AND revenue OR value OR size OR price OR 
estimate AND EU or Europ* 

‘Smuggling of Migrants’ AND Future OR risk OR threat OR enabler OR 
actor OR organised crime AND EU or Europ* 

‘Migrant smuggling’ AND Future OR risk OR threat OR enabler OR actor 
OR ‘organised crime’ AND EU or Europ* 

Databases: 

Google scholar, JSTOR, Scopus 

Grey literature: 

UNODC, Frontex, Europa, Europol, IOM, ICMPD 

Search terms: 

‘VAT fraud’ OR ‘MTIC fraud’ OR ‘missing trader fraud’ OR ‘carousel 
fraud’ AND (revenue OR value OR size) 

‘vat fraud’ OR ‘mtic fraud’ OR ‘missing trader fraud’ OR ‘carousel fraud’ 
AND (future OR risk OR threat OR enabler OR actor OR ‘organised 
crime’)  

Databases: 

Google, Google Scholar, JSTOR, Scopus search  

Generic Google searches, terms used:  

- VAT fraud and organised crime in the EU 

- European Commission VAT fraud 

- VAT fraud market size EU 

- VAT fraud market value EU 

- VAT fraud attributable to VAT 

- future of VAT fraud 

- level of organised crime involved in VAT fraud 

- future of organised crime involved in VAT fraud 

12 

 
 
 
 
 
 
 
 
 
EUROPEAN COMMISSION 

Report section  

Search terms and databases searched  

- future risks in organised crime 

- how VAT fraud will be commmitted in the future 

- trends organised crime VAT fraud 

- new technologies organised crime will use to commit VAT fraud 

- link between organised crime and VAT fraud 

Backward citation checking to see if reported figures were original 
estimates or reported from other sources. 

2.4. Food fraud 

Search terms for Scopus: 

Scopus: ( TITLE-ABS-KEY AND  TITLE-ABS-KEY ( revenue  OR  value  
OR  size  OR  scope  OR  magnitude ) )  AND  PUBYEAR  >  2009   

Search terms for Google scholar:  ‘food fraud market estimate’ 

Grey literature:  

Food Fraud Network  

2.4. IPR infringements /  
counterfeit goods 

Search terms: 

Search 1 

Counterfeit IP OR ‘pirated goods’ OR counterfeit OR ‘fake goods’ OR 
‘IPR infringement’ OR ‘intellectual property’ 

(AND) 

Revenue OR value OR size OR scope OR magnitude 

Search 2 

Counterfeit IP OR ‘pirated goods’ OR counterfeit OR ‘fake goods’ OR 
‘IPR infringement’ OR ‘intellectual property’ 

(AND) 

Future OR risk OR threat OR enabler OR actor OR ‘organised crime’ OR 
‘criminal organisations’ OR ‘criminal groups’ OR ‘criminal networks’ 

Databases:  

Google Scholar, JSTOR, ProQuest, Scopus, Social Science Abstracts, 
and Sociological Abstracts.  

Grey literature: 

The research team searched intellectual property (IP) offices related to 
the EU, including the EUIPO and each Member States IP office for 
relevant publications. Only EUIPO produces estimates of loss from IPR 
infringements. 

2.5. Environmental crime 

Illicit wildlife trafficking 

Search terms: 

Scopus: ( TITLE-ABS-KEY ( 'revenue'  OR  'value'  OR  'size'  OR  
'scope'  OR  'magnitude' )  AND  TITLE-ABS-KEY ( 'threatened  AND 
species'  OR  'wildlife' )  AND  TITLE-ABS-KEY ( 'smuggling'  OR  
'poaching'  OR  'trade'  OR  'market' )  AND  TITLE-ABS-KEY ( 'Europe'  
OR  'global' ) )  AND  PUBYEAR  >  2009   

Google Scholar: ('revenue' OR 'value' OR 'size' OR 'scope' OR 
'magnitude') AND (‘smuggling’ OR ‘poaching’ OR 'market' OR 'trade') 
AND ('wildlife' OR 'threatened species' OR 'endangered species') AND 
('Europe' OR 'global') *anywhere in the article 

Databases: 

Google Scholar, Scopus  

13 

 
 
 
 
 
 
 
 
 
 
 
EUROPEAN COMMISSION 

Report section  

Search terms and databases searched  

Grey literature: 

TRAFFIC, WWF 

Illicit waste trafficking 

Search terms: 

TITLE-ABS-KEY ('revenue'  OR  'value'  OR  'size'  OR  'scope'  OR  
'magnitude')  AND  TITLE-ABS-KEY waste crime  OR  waste trafficking  
OR  waste dumping  AND  PUBYEAR  >  2009   

Databases: Google Scholar, Scopus 

Articles citing the Biard et al., 2014 study 

2.6. Illicit firearms 

Search terms: 

Firearms OR guns OR SALW AND revenue OR value OR size OR price 
OR estimate AND EU or Europ* 

Firearms OR guns OR SALW AND Future OR risk OR threat OR enabler 
OR actor OR organised crime AND EU or Europ* 

Databases: Google scholar, JSTOR, Scopus 

Grey literature: 

UNODC, Frontex, Europa, Europol, IOM, ICMPD 

2.7. Illicit tobacco 

Review of sources identified as part of previous RAND study 
commissioned by the European Anti-Fraud Office (OLAF) on measuring 
the illicit tobacco market in the EU  

Additional searches: 

Google Scholar (since 2010): 

- 

- 

- 

- 

tobacco Europe ‘organised crime’: 5,570 hits; searched the 
first 15 pages, resulted in 15 hits (including follow-on articles 
citing the original article) 

cigarette Europe ‘organised crime’: 4,390 hits; searched the 
first 15 pages, resulted in 4 hits (including articles from special 
journal issues highlighted by retrieved hits) 

cigarette Europe ‘organised crime’: 6,850 hits; searched the 
first 15 pages, resulted in 2 hits 

tobacco Europe ‘organised crime’: 7,390 hits; searched the 
first 15 pages, resulted in 0 hits 

Generic Google search 

- 

- 

- 

- 

‘Organised crime’ OR ‘Organised crime’ OR ‘criminal’ AND 
Tobacco AND Europ* filetype:pdf 

Tailored (advanced) Google searches 

EC (and OLAF), Europol, Eurojust, Interpol, FATF, World Health 
Organisation (WHO) (and FCTC), OECD, Transcrime, WCO, 
ITIC, EUIPO, Oxford Economics, KPMG, Euromonitor  

‘Organised crime’ OR ‘Organised crime’ OR ‘criminal’ AND 
Tobacco  

2.8. Cybercrime activities  

Google scholar (since 2010): 

cybercrime OR card fraud OR crimes-as-a-service  

(AND) 

Revenue OR value OR size OR scope OR magnitude OR estimate OR 
incidents 

2.9. Organised property crime   Search terms: 

14 

 
 
 
 
 
  
 
 
 
EUROPEAN COMMISSION 

Report section  

Search terms and databases searched  

‘Property crime’ OR burglary OR robbery OR ‘vehicle theft’ OR ‘car theft’ 
OR ‘cargo theft’ or ‘road theft’ OR ‘cultural goods trafficking‘ 

(AND) 

Revenue OR value OR size OR scope OR magnitude OR estimate OR 
incidents 

‘Property crime’ OR burglary OR robbery OR ‘vehicle theft’ OR ‘car theft’ 
OR ‘cargo theft’ or ‘road theft’ OR ‘cultural goods trafficking‘ 

(AND) 

Future OR risk OR threat OR enabler OR actor OR ‘modus operandi’ OR 
organised crime AND EU or Europ* 

Databases:  

Google Scholar, JSTOR 

Grey literature: 

Europol, EUCPN, Eurostat, Interpol, UNODC, UNESCO, Transcrime 

3.1. Investments by OCGs in 
the legal economy  

Google Scholar search (since 2015): 

Investment ‘organised crime’ 

Money launder ‘organised crime’ 

Legal economy ‘organised crime’ 

3.2. Asset freezing and 
confiscation  

3.3. Risk factors for infiltration 
of organisations 

3.4. Underground economy 

Articles citing Riccardi et al. (2015); Savona and Riccardi (2015)  

Searches were undertaken of open sources presenting statistical data 
on assets seizure and confiscation, including specialty literature, similar 
research performed on the topics, country assessments’ reports in the 
area of home affairs and criminal justice and information published by 
multiple stakeholders involved, such as international organisations, 
competent authorities and civil society initiatives. For literature review, 
majority of the information was collected from: 

Mutual Evaluation Reports adopted by FATF or FSRBs (especially 
Council of Europe – Moneyval Committee, for several EU Member 
States) 

public data available on the FIU and ARO’ websites 

information identified in respect to AMO’s, authorities in charge with 
receiving/submission of mutual legal assistance request, Eurojust, 
Europol and European Judicial Network.  

Search terms:  

organised crime, serious and organized crime, money laundering, open 
government, open government data, criminal assets, financial 
crime, early warning mechanism of crime, big data, network science, 
organised crime investments, financial secrecy, risk assessment, 
confiscation, financial investigation, asset recovery, mafia, 
transnational crime, public procurement 

Databases: 

Google Scholar, JSTOR, SpringerLink, SSRN, Scopus, Science Direct, 
RePEc, NBER databases and the following 

All Google Scholar (since 2010, first 10 pages of results) and general 
Google 
Search 1: underground economy construction organised crime 

Search 2: ‘underground economy’ construction organised crime 

Search 3: ‘shadow economy’ construction organised crime 

Search 4: ‘informal economy’ construction organised crime 

Search 5: ‘underground economy’ gambling organised crime 

Search 6: ‘informal economy’ gambling organised crime 

Search 7: ‘underground economy’ prostitution organised crime 

15 

 
 
 
 
 
 
EUROPEAN COMMISSION 

Report section  

Search terms and databases searched  

Search 8: ‘informal economy’ prostitution organised crime 

Search 9: underground economy transport 

Search 10: transport organised crime 

Search 11: transport cargo freight organised crime 

Search 12: transport shipping cargo freight underground informal 
economy 

Refer to search strategy used for Section 3.5 (NPMs) for approach to 
identifying literature relevant to the underground economy and the 
financial sector.  

3.5. New payment methods 
(NPMs) 

Search terms: 

Search 1 

‘virtual currency’ OR cryptocurrency OR bitcoin OR Monero 

(AND)  

‘organised crime’ OR ‘cybercrime’ OR ‘money laundering’ OR future OR 
risk OR threat OR enabler OR actor OR ‘modus operandi’ 

Search 2 

‘e-money’ OR ‘mobile money’ OR ‘prepaid card’ OR ‘digital wallet’ OR e-
wallet OR ‘mobile wallet’ OR PayPal 

(AND)  

‘organised crime’ OR ‘cybercrime’ OR ‘money laundering’ OR future OR 
risk OR threat OR enabler OR actor OR ‘modus operandi’ 

Search 3 

‘payment service’ OR ‘innovative payment’ OR ‘mobile payment’ OR 
‘payment initiation’ OR Fintech  

(AND)  

‘organised crime’ OR ‘cybercrime’ OR ‘money laundering’ OR future OR 
risk OR threat OR enabler OR actor OR ‘modus operandi’ AND EU OR  
Europ* 

Search 4 

‘money remittance’ OR ‘money service business’ OR ‘money transfer’ 
OR ‘Western Union’ OR ‘Money Gram’  

(AND)  

‘organised crime’ OR ‘cybercrime’ OR ‘money laundering’ OR future OR 
risk OR threat OR enabler OR actor OR ‘modus operandi’ 

Search 5 

‘informal value transfer’ OR ‘hawala’ OR ‘underground bank*’ OR  

(AND)  

‘organised crime’ OR ‘money laundering’ OR future OR risk OR threat 
OR enabler OR actor OR ‘modus operandi’ 

Databases:  

Google Scholar, JSTOR, generic Google serch 

Grey literature: 

Europol, European Commission, ECB, FATF, World Bank 

3.6. Future threats and 
enablers  

Search 1: Generic search to identify persistent and emerging 
trends/enablers  

Search terms:  

16 

 
 
 
 
 
 
 
 
 
 
EUROPEAN COMMISSION 

Report section  

Search terms and databases searched  

(‘money laundering’ OR ‘infiltration’ OR ‘proceeds of crime’ OR ‘criminal 
finances’) (AND) 

(foresight OR ‘future trend’ OR ‘emerging trend’ OR ‘emerging threat’ 
OR ‘ongoing trend’ OR ‘persistent trends’ OR ‘future enabler’) 

Databases: Google, Google Scholar, ProQuest 

Grey literature: Europol, Interpol, UNODC, RUSI, Transcrime 

Search 2: Targeted searches for each trend/enabler identified in search 
1 

Generic Search terms: 

(‘money laundering’ OR ‘infiltration’ OR ‘proceeds of crime’ OR ‘criminal 
finances’) (AND) 

(foresight OR ‘future trend’ OR ‘emerging trend’ OR ‘emerging threat’ 
OR ‘ongoing trend’ OR ‘persistent trends’ OR ‘future enabler’) 

Trend specific search terms: 

(OR) 

High-value goods: (‘High-value goods’ OR ‘high-value assets’ OR ‘Cash-
like assets’ OR ‘tradable lifestyle goods’ OR ‘Luxury sector’)  

Databases:  

Google, Google Scholar, ProQuest 

Grey literature:  

Europol, Interpol, FAFT, UNODC, Transparency International 

(OR) 

Golden visas schemes:  

(‘golden visa’ OR ‘citizenship by investment’ OR ‘golden passport’ 

(AND) 

(‘organised crime’ OR ‘proceeds of crime’ OR ‘illicit’ OR ‘money 
laundering’  

Databases:  

Google Scholar, Google, ProQuest  

Grey literature:  

European Commission, European Parliament, Transparency 
International 

(OR) 

Green economy: (‘Green economy’ OR ‘Green investments’ OR ‘Green 
Deal’ OR ‘Carbon credits scheme’ OR ‘Carbon credits market’ OR 
‘Carbon credits fraud’ OR ‘Carbon trading fraud’ OR ‘Carbon trading 
crime’ OR ‘Green bonds’)  

Databases:  

Google, Google Scholar, ProQuest, Springer 

Grey literature:  

Interpol, Esisc, Financial Times, OECD, Green climate fund, European 
Commission 

(OR) 

Brexit:  

(‘Brexit’ (AND) 

(‘organised crime’ OR ‘proceeds of crime’ OR ‘money laundering’ OR 
‘criminal justice cooperation’ OR ‘criminal justice’   

Databases:  

17 

 
 
 
 
 
 
 
 
 
EUROPEAN COMMISSION 

Report section  

Search terms and databases searched  

Google Scholar, Google, ProQuest  

Grey literature:  

UK Parliament, UK Government, European Commission, Europol  

(OR) 

Covid-19: (‘Covid-19’ OR ‘Coronavirus’ OR ‘Pandemic’) 

Databases:  

Google 

Grey literature:  

Europol, Interpol  

Step 2: Scanning and applying inclusion/exclusion criteria  
We  then  proceeded  to  a  two-stage  scan  of  the  sources.  First,  to  eliminate  clearly  irrelevant 
publications we assessed the relevance of each publication based on its title. Second, we assessed 
the  relevance  of  each  of  the  remaining  sources  by  reviewing  their  abstracts.  The  inclusion  and 
exclusion criteria for the literature review of markets is provided in the table below.  

Table 1.4: Inclusion and exclusion criteria for market literature reviews 

Inclusion 

Exclusion 

Time period 

Published from 2010 onwards 

Published prior to 2010  

Geographic region 

Revenues generated within the 28 EU 
Member States   

Outside Europe  

Geographic scope 

EU-level, Member-State level 

Neighbourhood, city, municipality  

Does not include information on 
revenue/value or size/magnitude of 
market or price of goods/services 
traded 

Pharmaceuticals  

Prescription drugs 

Medicinal cannabis   

Estimates 

Includes estimates of revenue  

Includes estimates of size/magnitude of 
market 

Offers information on the price of illicit 
goods/services  

Provides information on the actors in 
the market (i.e. ethnicity of key players, 
involvement of organised groups, 
hierarchy of groups, etc.) 

Provides information on future or 
emerging trends or dynamics of market 

Actors 

Futures 

Applicable to specific markets/areas 

Illicit drugs trafficking 

Cannabis 

Cocaine 

Heroin 

Meth/amphetamines 

Ecstasy/MDMA 

New psychoactive substances (NPS)  

Trafficking in human 
beings  

Trafficking for sexual exploitation 

Trafficking for labour exploitation  

Trafficking for organ removal 

Forced begging  

Trafficking for criminal activities 

Smuggling of migrants  Migrant smuggling 

Trafficking in human beings 

Irregular migration 

18 

 
 
 
 
 
 
 
 
EUROPEAN COMMISSION 

Inclusion 

Exclusion 

Online payment fraud (included in 
cybercrime markets) 

Metal theft 

Plant theft 

Water theft 

Timber theft 

Fraud related to 
organised crime 
activities 

MTIC fraud  

VAT fraud 

Carousel fraud 

Counterfeit goods/IPR infringements 

Food fraud 

Environmental crime 

Illicit waste trafficking  

Wildlife trafficking  

Firearms trafficking 

Firearms AND 3D printing 

Illicit tobacco 
trafficking 

Alarm firearms 

Military-grade firearms 

Illicit whites 

Counterfeit/illegal manufacturing 

Cross-border smuggling/ 
bootlegging  

Cybercrime activities  

Card payment fraud (present and not 
present) 

Crimes-as-a-service 

Child exploitation material 

Online sale of illegal goods and services 
(e.g. drugs, firearms) 

Organised property 
crime  

Road cargo and freight theft  

Metal theft  

Trafficking in cultural goods  

Domestic burglary, robbery, motor 
vehicle theft 

ATM fraud 

Step  3:  Following  up  relevant  references  from  identified  sources  and 
interviews  
In addition to the formal database search, the following methods were used to identify additional 
sources:  

• 

• 

• 

(i) Bibliography search: Bibliographies of included sources were reviewed for any 
potentially relevant sources, which were subsequently screened against the inclusion 
criteria and included in the review if relevant. 

(ii) Additional sources identified in interviews: While interviewees were asked to 
identify key literature and studies, the interviews did not result in the identification of 
many sources that had not already been identified in the literature review. This is because 
the reviews were relatively comprehensive.   

(iii) Additional sources identified by the Expert Advisory Group to the study: The 
full literature lists for the entire study were shared with experts, who they were invited to 
provide input on any additional studies missing. As with the interviews, this resulted in few 
additional studies suggesting the searches carried out were comprehensive.  

Step 4: Reading and data extraction  
Individual  sources  were  read,  and  relevant  information  was  recorded  in  the  extraction  templates 
that  had  been  prepared  and  tested  beforehand.  The  template  prompts  the  researcher  to  record 
information  about  each  source  in  a  systematic  way,  which  allows  sources  to  be  compared  and 
assessed.  The  use  of  a  pre-agreed  data-extraction  template  provides  the  basis  for  an  objective, 
independent  review  of  previous  methods  –  minimising  the  chance  of  bias.  It  also  facilitates 
transparency  as  the  information  recorded  in  the  extraction  template  is  then  recorded  in  the 
assessment framework, so readers can see the reasoning and basis of the assessment. 

19 

 
 
 
 
EUROPEAN COMMISSION 

Step 5: Critical assessment and quality appraisal   
In addition to extracting information from previous studies, the research team also subjected the 
information to critical assessment. Prior revenue estimates were subjected to a structured critique 
that involved assessing reliability, robustness, independence, transparency and replicability. The tool 
used for this appraisal is provided in the table below.   

Table 1.5: Quality appraisal tool for studies of previous revenue estimates 

Assessment criterion 

Sub-criterion 

Reliability (the extent to which the method can 
yield results that are reliable, i.e., provide a 
reasonably true estimate of the phenomenon 
measured free of bias and not dependent on its 
external factors) 

Robustness (the extent to which the method can 
yield a comprehensive estimate of the phenomenon 
measured, when applied to a broad range of 
aspects of the phenomenon under assessment) 

Transparency and replicability (the extent to which 
the method is used transparently and can be 
replicated) 

Have the outputs based on the method been peer-
reviewed? 

Are data required by this method prone to 
measurement/recording error? [Note: this refers to 
data collection only once the sampling has been 
decided, not processing/analysis] 

Is the method prone to self-reported biases? 

Is the method susceptible to bias? 

Is the method likely to produce an undercount/ 
overcount of the true extent of the illicit market? 

Does the method require sampling? If so, does it 
yield generalisable results? 

Does the method capture a complete estimate of: 

The size/magnitude of market? 

The revenues generated? 

Is the method suitable to be applied in all 28 Member 
States and at the EU-level? 

Are the method's measurements defined correctly?  

Does the method include robustness checks? 

Has the method been successfully replicated? 

Is the method based on clear and justified 
assumptions? 

Does the methodology consist of relatively 
straightforward steps, or does the method consist of 
complex stages that are susceptible to not disclosing 
all the details? 

Are there multiple variants of this method that could 
give rise to uncertainty over how it has been 
employed or how to interpret its results? 

1.2.2. Expert and stakeholder consultation 

Stakeholder interviews 
We conducted interviews with 102 stakeholders from 66 organisations. Topic guides and the content 
of interviews were tailored to the expertise of the interviewee. For instance, some interviews focused 
on  specific  illicit  markets,  whereas  others  focused  on  methodologies  or  specific  Member  State 
circumstances.  Stakeholders  were  identified  through  a  stakeholder  mapping  process.  Additional 
experts and stakeholders were identified through  literature review and through suggestions from 
the expert panel and the Commission. A full list of  the organisations consulted  is provided in the 
table below.   

Table 1.6: Organisations consulted for interviews 

Organisation 

AMO France 

Stakeholder level 

Member State / National  

20 

 
Organisation 

AMO Italy 

AMO Netherlands 

AMO Romania 

ARO Belgium 

ARO Ireland 

ARO Italy 

ARO Portugal 

ARO Romania 

ARO Sweden 

EUROPEAN COMMISSION 

Stakeholder level 

Member State / National 

Member State / National 

Member State / National 

Member State / National 

Member State / National 

Member State / National 

Member State / National  

Member State / National  

Member State / National 

Bulgarian Embassy in Austria – Social and Labour Affairs 

Member State / National 

Commerzbank AG 

Council of Europe  

Private sector 

EU institution  

Council of Europe - Group of States Against Corruption (GRECO) 

EU institution  

E-liberare 

Elliptic 

Non-government organisation 
(NGO) 
Private sector 

Embassy of Bulgaria in Spain, Department for Labour and Social Issues 

Member State / National 

Eurojust  

Member State / National 

European Association for Secure Transactions (EAST) 

NGO 

European Central Bank 

European Commission  

EU institution  

EU institution  

European Monitoring Centre for Drugs and Drug Addiction (EMCDDA) 

EU institution  

European Union Intellectual Property Office (EUIPO) 

Europol 

EU’s network of anti-fraud experts (Eurofisc) 

FIU Finland  

FIU Italy 

FIU Romania 

Flemish Peace Institute 

Food Fraud Network  

GD Combatting Organised Crime 

General Labour Inspectorate – Bulgaria  

EU institution  

EU institution  

Member State / National 

Member State / National 

Member State / National 

Member State / National 

Member State / National 

EU institution  

Member State / National 

Member State / National 

German Trade Union Confederation, Fair Mobility Advisory Centre Munich 

Member State / National 

Guardia Civil 

International Labour Organisation 

Member State / National 

International  

International Organisation for Migration (IOM) – Bucharest Office 

International  

Labour Inspectorate – Romania  

Member State / National 

Member State / National Office for Social Security 

Member State / National 

21 

 
EUROPEAN COMMISSION 

Organisation 

Nature Protection Service (SEPRONA) 

Stakeholder level 

Member State / National  

Netherlands Institute for the Study of Crime and Law Enforcement (NSCR) 

Academic 

Office for Social Security – Belgium  

Member State / National 

OLAF 

Peace Research Institute Oslo 

EU institution  

Academic 

Professional Investigation Service Environmental Crime in the Netherlands   Member State / National  

Romanian National Agency against Trafficking in Persons (ANÎTP)  

Member State / National 

Schwarzthal Kapital 

Private sector 

Scottish Environmental Protection Agency (SEPA) 

Member State / National  

Sphonic 

Sustainable Eel Group (SEG) 

Swedish Prosecution  

Private sector 

NGO 

Member State / National  

Taxation and Customs Union (TAXUD) 

EU institution  

Tessiside University  

Tilburg University 

TRAFFIC 

Academic 

Academic 

NGO 

Transported Asset Protection Authority (TAPA) 

Private sector 

United Nations Educational, Scientific and Cultural Organisation (UNESCO) 

International  

United Nations Interregional Crime and Justice Research Institute (UNICRI) 

International  

United Nations Office on Drugs and Crime (UNODC) 

International  

University of Cardiff 

Università Cattolica del Sacro Cuore 

University of Leeds 

University of Linz 

University of Vienna 

University of Zagreb 

Utrecht University 

Academic 

Academic 

Academic 

Academic 

Academic 

Academic 

Academic 

West Flanders Prosecutor’s Office, Bruges section  

Member State / National 

Interviews  were  audio-recorded,  and  summary  notes  were  taken.  The  key  information  was  then 
coded into an interview-notes grid, which served to capture high-level themes from the interviews.  

Table 1.7: Number of organisations consulted by stakeholder group 

Stakeholder group 

Number of organisations consulted 

Academic 

EU institution  

International organisation 

National/Member State organisation  

Non-governmental organisation (NGO) 

11 

9 

5 

31 

4 

22 

 
 
EUROPEAN COMMISSION 

Private sector 

6 

Expert panel  
The research team was supported by a panel of international experts on SOC. At the outset of the 
study,  we  held  a  series  of  telephone  consultations  to  hear  the  experts’  thoughts,  comments  and 
suggestions on:  

• 

• 

The basic parameters of the study; 

The search strategy for identifying relevant literature, and additional literature sources; 
and 

•  Our approach for the stakeholder and expert consultation, and which organisations and 

individuals to approach.  

The experts provided feedback on all drafts and deliverables prepared over the course of this study. 
The  experts  helped  steer  the  overall  approach  and  made  suggestions  regarding  literature, 
stakeholders and methodologies. Their inputs were either received in writing or through telephone 
discussions, although correspondence mostly took place via email. The research team incorporated 
the  experts’  inputs  as  appropriate.  In  cases  where  the  study  team  disagreed  or  considered  the 
suggestions or comments beyond the scope of the study, a justification was provided. The members 
of the expert panel are listed in the table below.  

Table 1.8: Members of the expert panel 

Expert 

Dr Giulia Berlusconi 

Dr Luca Giommoni 

Professor Michael Levi 

Professor Letizia Paoli 

Dr Lorenzo Segato  

1.2.3. Surveys 

Affiliation 

University of Surrey  

Cardiff University  

Cardiff University  

Leuven Institute of Criminology  

React Italy  

Asset Recovery Offices (AROs), Asset Management Offices (AMOs) and Financial Intelligence Units 
(FIUs) in the 28 EU Member States were sent an email invitation to participate in a survey, which 
requested statistical information on assets seized and confiscated from OCGs in their Member States. 
Potentially due to the COVID-19 pandemic, the response rates to the surveys were much lower than 
anticipated  (13  of  28  AROs,  7  of  28  AMOs  and  11  of  28  FIUs  responded).  Nevertheless,  the 
information  that  was  provided has  been used  qualitatively  to  understand, to  the  extent  possible, 
investments made by OCGs in the legal economy (3.1) and data availability on asset seizure and 
recovery from OCGs in the EU (3.2 of the main report).   

1.2.4. Secondary data  

Several tasks in the study relied upon quantitative indicators from existing datasets. To calculate 
estimates of the economic revenue from the illicit markets, secondary data from a range of public 
sources  have  been  used.  Rather  than  listing  them  here,  each  of  these  datasets  are  discussed  in 
relation to the methodology employed for deriving market estimates in 2.  

The  study  also  utilised  two  non-public  data  sources  held  by  one  of  the  project  partners,  the 
Government  Transparency  Institute,  namely  the  Bureau  van  Dijk  (BvD)  company  ownership 
database  and  Italian  public-procurement  data.  These  datasets,  described  below,  were  principally 
used for predicting risk factors for SOC infiltration of legitimate businesses. Results of this analysis 
are provided in Section 3.3 of the main report.  

Bureau van Dijk – Organisation dataset  
Bureau van Dijk (BvD) data contains information on more than 365 million businesses all over the 
world.  It  is  the  largest  administrative  cross-country,  company-level  dataset  of  companies  and 

23 

 
EUROPEAN COMMISSION 

provides access to company registry, management, ownership and financial information1. The data 
also provides time-series, allowing for analysis across time.  

Despite  covering  firms  in  all  European  countries,  the  BvD  dataset  presents  some  data  quality 
challenges.  There  are  many  duplicates  and  some  company  classes  and  sources,  particularly 
regarding small firms, are systematically missing. Data-cleaning techniques were applied to identify 
duplicates and a weighted sample was used for macro-aggregations (as discussed further in Section 
3.3).  

DIGIWHIST – Italian procurement data    
To  empirically  evaluate  the  effect  of  Italian  OCGs  or  ‘mafia-style’  groups  on  corruption  in  public 
procurement, we constructed a dataset including yearly observations from more than 1,500 Italian 
municipalities  over  the  period  2008  to  2014.  Detailed  information  on  each  open-tendered  public 
contract was taken from a national dataset managed by the Italian anticorruption agency (ANAC), 
which contains information on all contracts with a reserve price higher than €150,000. The dataset 
provides information on the auction ID, number of bidders, bidders′ names, bids, contract-awarding 
procedure, reserve price of the contract, categories of work involved in the contract, final price paid 
by the contracting authority and the timing for the completion of the project. At this stage of the 
research, we restricted the set of municipalities included to those that experienced an intense and 
active mafia infiltration in this period.  

1.2.5. Cases of SOC investment or infiltration in the legal economy  

We  identified  81  cases  that  were  accompanied  by  evidence  that  OCGs  had  invested  in  the  legal 
economy  or  infiltrated  a  legitimate  business  in  the  EU,  covering  14  Member States  (as  shown  in 
Table 1.9). These cases cannot be considered representative of SOC investment and infiltration in 
the legal economy across the EU. Several databases and resources were consulted when searching 
for cases: UNODC  SHERLOC2, Project ANTICORRP3, European Court  of  Human Rights (HUDOC)  – 
upheld  cases  of  asset  forfeiture4,  KPKONPI  Bulgaria5  and  an  Italian  Media  Archive.  The  search 
strategy  is  described  in  the  box  below.  The  types  of  information  were  media  articles,  judicial 
documents and summaries or transcripts of court proceedings.  

Box 1: Search strategy for cases of investments or infiltration in the legal EU 
economy 

UNODC SHERLOC  

Key word and crime searches: Search terms ‘organised’, ‘crime’, ‘asset(s)’, ‘seizure’ and ‘business’ in a 
variety of combinations (e.g. or, and, as well as for each independently) 

Country by country searches  

Skimmed 831 case summaries from EU Member States – paying most attention to those classed as 
organised crime 

European Court of Human Rights 

Key word and crime searches: Search terms ‘organised’, ‘crime’, ‘asset(s)’, ‘seizure’ and ‘business’ in a 
variety of combinations (e.g. or, and, as well as for each independently) 

Excluded non-EU states (Russia, Moldova), and Italy, Hungary, Bulgaria  

JuriFast and Dec.Nat 

Search terms ‘organised’, ‘crime’, ‘asset(s)’, ‘seizure’ and ‘business’ in a variety of combinations (e.g. or, 
and, as well as for each independently) 

For EU Directives 2014/42 (on asset seizure) –12 results 

- 

- 

98/733/JHA (Joint Action from 1998 on participation in organised crime, since repealed)  

2018/1673 (on combatting money laundering)  

1  This  data  was  obtained  by  the  DIGIWHIST  project  for  the  purposes  of  research  and  analysis  of  public-
procurement performance across Europe. 
2 Available at: https://sherloc.unodc.org/cld/v3/sherloc/ 
3 Available at: https://anticorrp.eu/ 
4 Available at: https://hudoc.echr.coe.int/eng 
5 Available at: ciaf.government.bg  

24 

 
 
EUROPEAN COMMISSION 

- 

- 

- 

- 

- 

- 

- 

- 

- 

- 

- 

1697/79/EEC (allowing for seizure of assets in light of acts that ‘could give rise to criminal 
court proceedings’)  

ETS No. 141 (Convention on Laundering, Search, Seizure and Confiscation)—9 search 
results none relevant  

ETS No. 173 (Criminal Law Convention on Corruption)  

CETS No. 198 (Council of Europe Convention on Laundering, Search, Seizure and 
Confiscation of the Proceeds from Crime and on the Financing of Terrorism) 

Council Directive 91/308/EEC of 10 June 1991 on prevention of the use of the financial 
system for the purpose of money laundering  

Council Framework Decision 2002/584/JHA of 13 June 2002 on the European arrest warrant 
and the surrender procedures between Member States and subsequent amending act, 

Council Framework Decision 2003/577/JHA of 22 July 2003 on the execution in the 
European Union of orders freezing property or evidence 

Council Framework Decision 2005/212/JHA of 24 February 2005 on confiscation of crime-
related proceeds, instrumentalities and property  

Directive 2005/60/EC on the prevention of the use of the financial system for the purpose of 
money laundering and terrorist financing  

Council Framework Decision 2008/841/JHA on the fight against organised crime  

EC Third Directive and the Council of Europe Convention CETS No. 198 on Laundering, 
Search, Seizure and Confiscation of the Proceeds from Crime and on the Financing of 
Terrorism 

Where the available summaries hinted at some involvement of organised crime, national case files were 
tracked down for further clarification.  

Project ANTICORRP and Italian Media Archive 

All available records were reviewed for relevance.  

The inclusion criteria for these cases were that they: 

• 

• 

• 

involved activities taking place in one of the 28 EU Member States; 

involved OCGs according to the definition specified in the ‘Glossary’ (see Main Report); and 

provided evidence of investment or infiltration by OCGs in the legal economy. 

On this basis, cases were excluded if they involved activities taking place outside the 28 EU Member 
States,  provided  no  evidence  of  OCG  involvement  (e.g.  single  perpetrators  with  no  known 
associations), or provided no evidence of investment of infiltration in the legal economy (e.g. if there 
was only evidence in relation to reinvestment in illicit markets or illicit activities). These cases were 
used for understanding the nature and modus operandi of investments by OCGs in the legal economy 
(Section  3.1  of  the  main  report)  and  risk  factors  for  infiltration  (Section  3.3  of  the  main 
report).  

Table 1.9: Proven cases of SOC investment or infiltration by Member State 

Member State 

Number of cases  

Percentage of 
cases (%) 

Austria 

Belgium 

Bulgaria 

Croatia 

Czech Republic 

Denmark 

France 

Hungary 

1 

1 

15 

2 

11 

1 

1 

4 

1 

1 

19 

2 

14 

1 

1 

5 

25 

 
 
EUROPEAN COMMISSION 

Member State 

Number of cases  

Percentage of 
cases (%) 

Ireland 

Italy 

Netherlands 

Romania 

Spain 

UK 

Total 

1 

32 

1 

4 

2 

5 

1 

40 

1 

5 

2 

6 

81 cases 

100 

A codebook was developed for extracting information from cases of infiltration, including details of 
OCG and offences, investments by OCGs – including type of asset and sector of investment – driver 
of  infiltration,  details  of  the  infiltrated  business  such  as  geographic  location,  size,  ownership  and 
management structure.  

26 

 
 
 
 
EUROPEAN COMMISSION 

  Criminal markets  

Annexes 2.1 to 2.9 are the full reports on each of the nine criminal markets examined for this study, 
which build on the summaries in Sections 2.1 to 2.9 of the main report. Each annex includes:  

• 

• 

literature review of prior revenue estimates published since 2010; 

an assessment of the quality of prior estimates; 

•  methodology for estimating revenues in this study; 

• 

• 

• 

revenue estimates at the EU- and Member-State level, where available;  

discussion of market actors and modus operandi and future trends and dynamics;  

recommendations for improving data-collection and estimation of revenues for each 
market.  

The selection of criminal markets examined in this study 
The nine criminal markets were selected for analysis because they were identified as a priority crime 
area in the EU Policy Cycle/EMPACT (European Multidisciplinary Platform Against Criminal Threats) 
for  the  period  2018  to  2021.  This  study  builds  upon  an  existing  and  growing  evidence-base  on 
criminal  markets  in  the  EU.  Of  particular  relevance  is  a  2015  Commission-funded  study  by 
Transcrime – Project Organised Crime Portfolio (OCP) – that also sought to produce estimates of the 
revenues generated in criminal markets in the EU (Savona & Riccardi, 2015).  

Table 2.1: Criminal markets and areas examined in this study 

EU Policy Cycle 
priority crime area 
for 2018–2021  

Examined in previous 
Commission-funded 
study  

Section of the main 
report 

Illicit drugs 

Trafficking in human 
beings (THB) 

Smuggling of migrants 

Fraud  

Environmental crime 

Illicit firearms  

Illicit tobacco  

Cybercrime  

Organised property 
crime  

2.1 

2.2 

2.3 

2.4 

2.5 

2.6 

2.7 

2.8 

2.9 

2.1.  Illicit drugs  

Emma Louise Blondes and Shann Hulme, RAND Europe 

Key findings: 

•  According to estimates produced by the EMCDDA and Europol (2019) (adjusted for 
inflation to 2019 values), the annual revenues earned on the EU illicit retail-drug 
markets were between €27 billion and €36 billion (€31 billion).  

• 

These estimates update the EMCDDA and Europol’s previous estimates that found 
that in 2013 the EU’s overall illicit retail-drug markets were worth €24 billion 
(EMCDDA & Europol, 2016). While comparison of the figures suggests an overall 
increase in the revenue of the EU’s drug markets, caution should be exercised given 
that the methodologies between the two years are not directly comparable.  

27 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
EUROPEAN COMMISSION 

• 

• 

• 

The drug markets are particularly attractive for OCGs as they are highly profitable. 
Illicit drug markets in the EU are highly competitive, comprising a myriad of 
loose/horizontal networks acting across the supply chain (including importation, 
production, distribution and retail). OCGs involved in the EU drugs market are 
increasingly inter-ethnic and transnational. Nevertheless, these phenomena should 
not be overstated as some OCGs are still well-established along some trafficking 
routes.   

The size and composition of groups involved in the EU drug markets varies greatly, 
not least because no OCG holds a monopoly over drugs’ supply chains. While some 
OCGs are well-established along some trafficking roots, most actors involved in the 
drug markets are better characterised as loose criminal networks or small enterprises 
carrying out illicit profit-driven activities, rather than highly structured OCGs. 

Future trends and dynamics identified within the EU drug markets include the 
increasing production of herbal cannabis, synthetic drugs and precursors within the 
EU; growing online trade; and the use of cutting-edge technology to maximise 
production output. 

This Annex provides a comprehensive overview of the illicit drugs market in the EU, building upon 
the summary provided in Section 2.1 of the main report.   

Illicit  markets  for  drugs  involve  the  cultivation,  manufacture,  distribution,  sale  and  purchase  of 
substances that are subject to drug laws. For this study, the drug markets refer to cannabis, cocaine, 
heroin, and synthetic drugs (including amphetamine, methamphetamine and MDMA/ecstasy) and 
NPS. Excluded from this analysis are pharmaceutical and prescription drugs, as well as drugs used 
for medicinal purposes. 

2.1.1. Previous revenue estimates of the EU illicit drug markets 

The literature search identified nine studies that contained prior estimates of the illicit drugs market 
in the EU, published since 2010 (Table 2.2). Among them, the EMCDDA and Europol EU Drug Markets 
Reports (2019 and 2016), as well as Transcrime’s Organised Crime Portfolio study provide the most 
comprehensive  overviews  of  the  European  retail  drugs  market  (Savona  &  Riccardi,  2015).  There 
were four other studies identified that offered estimates of the revenues from specific substances 
bought in the EU. One study produced estimates for the EU’s cannabis market (Caulkins & Kilmer, 
2013) and one study estimated the size of the Dutch cannabis market (van der Giessen et al., 2016). 
One  study  estimated  the revenue  from  the  EU’s  cocaine  market  (Transcrime,  2015c).  One  study 
estimated  the  revenue  from  the  EU’s  heroin  market  (Transcrime,  2015c)  and  one  assessed  the 
revenue from England/Wales and the Czech Republic’s heroin markets (Kilmer et al., 2013). Finally, 
one study estimated the revenue for synthetic drugs (ecstasy and amphetamine) in the Netherlands 
(Tops et al., 2018). Although this study presents considerable methodological limitations, it has been 
included  for  comparative  purposes.  Evidently,  the  geographic  scope  of  these  estimates  varied, 
although most estimates covered at least 19 EU Member States.  

Each  of  these  studies  provide  demand-side  estimates  of  the  total  money  spent  on  drugs  by 
consumers  at  the  retail-level  in  the  EU.  Demand-side  approaches  typically  use  inputs  from 
consumers’ self-reported surveys, which are used for measuring the prevalence and  frequency of 
drug consumption among a population. The simple formula for determining annual consumption 𝐶𝑖 
is as follows: 

𝐶𝑖 = 𝑉𝑖 × 𝑁𝑙 × 𝑃𝑟 

Where: 

𝑉𝑖 is the volume of illicit consumption 
𝑁𝑖 is the number of last year users 
𝑃𝑟 is the amount used per year 

The EU-level estimate is calculated as the sum of all Member State-level estimates. 

28 

 
 
 
EUROPEAN COMMISSION 

To derive a monetary value, consumption information is combined with data on the retail price of 
drugs. The EMCDDA and Europol draw upon routinely collected EU law-enforcement data for price. 
The simple formula for calculating annual revenue 𝑅𝑖 is as follows: 

𝑅𝑖 = 𝐶𝑖 × 𝑃𝑖 

Where: 

𝐶𝑖 is annual consumption 
𝑃𝑖 is price 

The prices were collected as retail prices and were not adjusted for purity, given the shortage of 
information.  The  EMCDDA  and  Europol  have  identified  this  as  an  important  area  for  future 
development to improve the quality and completeness of the data and estimates produced.  

Some  limited  studies  have  also  sought  to  go  beyond  market  revenue  to  estimate  the  profits  of 
traffickers at different levels of the supply chain. For instance, the United Nations Office on Drugs 
and Crime (UNODC) published two reports that estimated the profits from transnational illicit drug 
trafficking.  One  study  calculated  the  profitability  of  the  global  cocaine  market,  which  includes  an 
indicative  figure  for  Western  and  Central  Europe  (UNODC,  2011).  The  other  study  estimated  the 
profits generated from illicit opiate-trafficking along the Balkan route (UNODC, 2015a). These studies 
employed a combination of a demand-side approach (to estimate the overall retail revenue of the 
drug market in question) and a supply-based approach (using seizure data to adjust for the costs 
borne by drug traffickers in loss of product due to law enforcement) to estimate the overall flow of 
drugs trafficked and the gross profit made from drug trafficking. Finally, one study was identified 
that estimated the size and revenue of the online illicit drugs trade (Kruithof et al., 2016). This study 
yielded figures related to the illicit online drug markets hosted by eight transnational crypto markets, 
and estimated the size of the Netherlands’ online retail market. The study highlighted that in the 
context of the entire drugs market, the size of the online trade remains negligible. 

2.1.2. Quality of prior revenue estimates  

Demand-based approaches are  widely deemed to be the most reliable method for estimating the 
size and revenue of drug markets, because the input data is less susceptible to biases associated 
with data sources used for supply-based approaches (Kilmer et al., 2011). Supply-based approaches 
estimate  the  scope  of  illicit  drug  production  by  drawing  on  a  combination  of  production,  seizure, 
importation/exportation  and  average  retail  price  data.  This  method  is  limited  by  the  fact  that 
fluctuations in seizure data might reflect changes in law enforcement efforts rather than changing 
drug  trafficking  patterns.  That  said,  a  demand-based  approach  also  presents  methodological 
limitations, as listed below6:  

• 

First, the lack of harmonised data-collection practices across EU Member States leads to 
data gaps in overall market estimations. Missing data is often imputed from estimations 
and assumptions, which can undermine the validity of the results. In addition, inconsistent 
statistical tools used across Member States make it difficult to compare results. 

•  Second, large-scale surveys that record drug prevalence are prone to reporting biases. 

Users are likely to underreport their own drug consumption, due to recall problems and/or 
social desirability bias linked to drug consumption being a stigmatised behaviour. 

• 

Third, survey data is likely to suffer from under-coverage, as they are unlikely to capture 
consumption patterns of marginalised populations or problematic drug users. While 
treatment data offers a useful substitute to capture this information, the undercount of 
high-risk users remains an important caveat for drug market estimates. 

• 

Finally, the price data does not adjust for purity or potency variations. 

6 While these methodological limitations apply to all demand-based approaches, the degree to which they apply 
may vary across drug markets. For example, underreporting of drug consumption is more prevalent for heroin 
or cocaine than it is for cannabis because stigma for heroin and cocaine consumption is stronger than it is for 
cannabis.  Similarly,  under  coverage  tends  to  be  higher  for  heroin,  as  this  drug  is  more  widely  consumed  by 
marginalised populations or problematic drug users, whom are less represented in survey data.  

29 

 
 
 
 
EUROPEAN COMMISSION 

Table 2.2: Prior studies estimating the size or revenue of illicit drug markets in the EU7 

Sub-market 

Data source(s) 

Countries included 
in estimate 

Disaggregated at 
Member State level?  

Estimate 
produced (size)  

Year(s) 
of 
estimate 

2017 

Cannabis (resin and 
herb) 

2017 

Cocaine (crack cocaine 
and powder cocaine) 

2017 

Heroin 

1 

1 

1 

Citation 

EMCDDA 
and 
Europol 
(2019) 

EMCDDA 
and 
Europol 
(2019) 

EMCDDA 
and 
Europol 
(2019) 

EU 28 

EU 28 

EU 28 

General population 
survey – number of 
cannabis users 

European Web Survey 
on Drugs – amount of 
cannabis used 

EMCDDA routine data 
collections – price 

General population 
survey – number of 
cocaine users 

European Web Survey 
on Drugs – amount of 
cocaine used 

EMCDDA routine data 
collections – price 

General population 
survey – number of 
heroin users 

European Web Survey 
on Drugs – amount of 
heroin used 

EMCDDA problem drug 
use (PDU) indicator 
data and treatment 
demand indicator (TDI) 
data 

EMCDDA routine data 
collections – price 

No; disaggregated data 
not available for 
confidentiality reasons 

1,550.97 tonnes 
(mid) 

1,405.73 tonnes 
(low) 

1,710.33 tonnes 
(high) 

Estimate 
produced 
(revenue) 

Retail revenue 

€11,635.04 mil. 
(mid) 

€10,533.99 mil. 
(low) 

€12,823.34 mil. 
(high) 

No; disaggregated data 
not available for 
confidentiality reasons 

No; disaggregated data 
not available for 
confidentiality reasons 

118.56 tonnes (mid) 

Retail revenue 

99.65 tonnes (low) 

137.46 tonnes 
(high) 

€9,068.96 mil. 
(mid) 

€7,635.30 mil. 
(low) 

€10,502.60 mil. 
(high) 

148.86 tonnes (mid) 

Retail revenue 

126.81 tonnes (low) 

181.17 tonnes 
(high) 

€7,440.86 mil. 
(mid) 

€6,394.04 mil. 
(low) 

€9,119.55 mil. 
(high) 

7 When comparing the market size and revenue of drug markets, it is important to consider each study’s adopted measurement units and methodology. For example, while some 
estimations cover the overall retail revenue of a given drug market, others adjust for the costs borne by drug traffickers. In the latter case, the estimations provided reflect the 
growth of profit generated by the drug market, which is significantly smaller than the figures suggesting the revenue of the overall retail market.   

30 

 
 
 
EUROPEAN COMMISSION 

Sub-market 

Data source(s) 

Countries included 
in estimate 

Disaggregated at 
Member State level?  

Estimate 
produced (size)  

Estimate 
produced 
(revenue) 

No; disaggregated data 
not available for 
confidentiality reasons 

Amphetamines: 

Retail revenue 

61.99 tonnes (mid) 

Amphetamines: 

50.99 tonnes (low) 

81.18 tonnes (high) 

€1,007.69 mil. 
(mid) 

Year(s) 
of 
estimate 

2017 

Citation 

1 

EMCDDA 
and 
Europol 
(2019) 

Synthetic drugs 
(amphetamine, 
methamphetamine, 
MDMA) 

EU 28 

General population 
survey – number of 
synthetic-drug users 

European Web Survey 
on Drugs – amount of 
synthetic drugs used 

EMCDDA routine data 
collections – price 

2 

EMCDDA 
and 
Europol 
(2016) 

2013 

Cannabis (resin and 
herb) 

EU 28 

No; disaggregated data 
not available for 
confidentiality reasons 

General population 
survey – number of 
cannabis users 

European Web Survey 
on Drugs – amount of 
cannabis used 

EMCDDA problem drug 
use (PDU) indicator 
data and treatment 
demand indicator (TDI) 
data 

EMCDDA routine data 
collections – price 

Number of drug users 
(data drawn from van 
Laar et al., 2013) 

MDMA: 

59.73 million tablets 
(mid) 

49.70 million tablets 
(low) 

69.76 million tablets 
(high) 

€830,88 mil. (low) 

€1,283.50 mil. 
(high) 

MDMA:  

€528.63 mil. 
(mid) 

€437.33 mil. (low) 

€619.94 mil. 
(high) 

1,288.5 tonnes 
(mid) 

1,154.2 tonnes 
(low) 

1,789.7 tonnes 
(high) 

Retail revenue 

€9,313.4 mil. 
(mid) 

€8,405.6 mil. 
(low) 

€12,851.2 mil. 
(high) 

31 

 
 
 
 
 
 
Year(s) 
of 
estimate 

2013 

Citation 

2 

EMCDDA 
and 
Europol 
(2016) 

Cocaine (crack cocaine 
and powder cocaine) 

2013 

Heroin 

2 

EMCDDA 
and 
Europol 
(2016) 

EUROPEAN COMMISSION 

Sub-market 

Data source(s) 

Countries included 
in estimate 

Disaggregated at 
Member State level?  

Estimate 
produced (size)  

Estimate 
produced 
(revenue) 

EU 28 

No; disaggregated data 
not available for 
confidentiality reasons 

91.0 tonnes (mid) 

Retail revenue 

72.2 tonnes (low) 

110.2 tonnes (high) 

€5,742.2 mil. 
(mid) 

€4,545.9 mil. 
(low) 

€6,962.5 mil. 
(high) 

EU 28 

No; disaggregated data 
not available for 
confidentiality reasons 

138.4 tonnes (mid) 

Retail revenue 

121.4 tonnes (low) 

165.5 tonnes (high) 

€6,782.7 mil. 
(mid) 

€6,041.6 mil. 
(low) 

€7,845.6 mil. 
(high) 

General population 
survey – number of 
cocaine users 

European Web Survey 
on Drugs – amount of 
cocaine used 

EMCDDA problem drug 
use (PDU) indicator 
data and treatment 
demand indicator (TDI) 
data 

EMCDDA routine data 
collections – price 

General population 
survey – number of 
heroin users 

European Web Survey 
on Drugs – amount of 
heroin used 

EMCDDA problem drug 
use (PDU) indicator 
data and treatment 
demand indicator (TDI) 
data 

EMCDDA routine data 
collections – price 

Number of drug users 
(data drawn from van 
Laar et al., 2013) 

2013 

2 

EMCDDA 
and 
Europol 
(2016) 

Synthetic drugs 
(meth/amphetamine, 
MDMA) 

General population 
survey – number of 
synthetic drugs users 

EU 28 

No; disaggregated data 
not available for 
confidentiality reasons 

European Web Survey 
on Drugs – amount of 
synthetic drugs used 

Amphetamines: 

Retail revenue 

76.3 tonnes (mid) 

Amphetamines: 

52.1 tonnes (low) 

101.6 tonnes (high) 

MDMA: 

€1,828.1 mil. 
(mid) 

€1,210.3 mil. 
(low) 

32 

 
 
 
 
EUROPEAN COMMISSION 

Citation 

Year(s) 
of 
estimate 

Sub-market 

Data source(s) 

Countries included 
in estimate 

Disaggregated at 
Member State level?  

Estimate 
produced (size)  

Estimate 
produced 
(revenue) 

3  

Caulkins 
and 
Kilmer 
(2013) 

2010 

Cannabis (resin and 
herb) 

4 

Kilmer et 
al. (2013) 

2004–
2006 

Heroin  

5 

Kruithof 
et al. 
(2016) 

2016 

Cannabis 

EMCDDA problem drug 
use (PDU) indicator 
data and treatment 
demand indicator (TDI) 
data 

EMCDDA routine data 
collections – price 

General population 
survey – number of 
cannabis users 

European Web Survey 
on Drugs – amount of 
cannabis used 

EMCDDA routine data 
collections – price 

General population 
surveys – number of 
drug users  

National Monitoring 
Centre for Drug 
Addition data – 
number of Czech PHUs 

National treatment and 
criminal justice data – 
number of British PHUs  

Primary data collected 
from crypto markets, 
websites selling licit 
and illicit products and 
services on the dark 
web 

Literature review: 
academic, grey 
literature, and work of 
journalists and 

86.6 million tablets 
(mid) 

€2,497.3 mil. 
(high) 

78.9 million tablets 
(low) 

94.0 million tablets 
(high) 

EU 27 (which 
excludes HR) 

Yes 

CZ, England 

Yes 

Czech Republic: 
0.11–0.2 tons  

England: 8–12 tons 

MDMA:  

€666.1 mil. (mid) 

€607.0 mil. (low) 

€723.1 mil. (high) 

Retail revenue 

Estimated range 
from €6.7 billion 
to €9.8 billion 

Retail revenue 

Czech Republic: 
€51 million (in 
€2004)  

England: €2.5 
billion  

8 crypto markets 
(AlphaBay, 
Cryptomarket, Dark 
Net Heroes League, 
Dreammarket, 
French Dark Net, 
Hansa, Nucleus, and 
Python) 

No – except for the 
Netherlands 

Volume of cannabis 
traded on 
marketplaces over 
the previous month: 
474,455 grams 

Monthly revenue: 
$4,436,803  

33 

 
 
 
 
 
  
 
EUROPEAN COMMISSION 

Citation 

Year(s) 
of 
estimate 

Sub-market 

Data source(s) 

Countries included 
in estimate 

Disaggregated at 
Member State level?  

Estimate 
produced (size)  

Estimate 
produced 
(revenue) 

5 

Kruithof 
et al. 
(2016) 

2016 

Heroin 

5 

Kruithof 
et al. 
(2016) 

2016 

Synthetic drugs 
(stimulants, ecstasy-
type drugs, 
psychedelics) 

6 

Savona & 
Riccardi 
(2015) 

2014 

Heroin 

8 crypto markets 
(AlphaBay, 
Cryptomarket, Dark 
Net Heroes League, 
Dreammarket, 
French Dark Net, 
Hansa, Nucleus, and 
Python)  

8 crypto markets 
(AlphaBay, 
Cryptomarket, Dark 
Net Heroes League, 
Dreammarket, 
French Dark Net, 
Hansa, Nucleus, and 
Python) 

EU 19 and Norway 

independent 
researchers 

Primary data collected 
from crypto markets, 
websites selling licit 
and illicit products and 
services on the dark 
web 

Literature review: 
academic, grey 
literature, and work of 
journalists and 
independent 
researchers 

Primary data collected 
from crypto markets, 
websites selling licit 
and illicit products and 
services on the dark 
web 

Literature review: 
academic, grey 
literature, and work of 
journalists and 
independent 
researchers 

General population 
survey – number of 
heroin users 

European Web Survey 
on Drugs – amount of 
heroin used 

EMCDDA and UNODC 
routine data collections 
– price 

Literature review of 
previous estimates 

No – except for the 
Netherlands 

Monthly revenue: 
$751,021 

No – except for the 
Netherlands 

Yes – for Norway and 
EU 19 (which excludes 
Belgium, Bulgaria, 
Cyprus, Denmark, 
Estonia, Luxembourg, 
Portugal, Romania and 
Sweden) 

Stimulants: 
$3,461,023 
(monthly 
revenue)  

Ecstasy-type: 
$2,262,850 
(monthly 
revenue)  

Psychedelics: 
$1,020,059 
(monthly 
revenue)   

Retail revenue 

€7,996 million 
(mid) 

€6,395 million 
(low) 

€10,656 million 
(high) 

34 

 
 
 
 
 
 
EUROPEAN COMMISSION 

Citation 

Year(s) 
of 
estimate 

Sub-market 

Data source(s) 

Countries included 
in estimate 

Disaggregated at 
Member State level?  

Estimate 
produced (size)  

6 

Savona & 
Riccardi 
(2015) 

2014 

Cocaine 

7 

van der 
Giessen 
et al. 
(2016) 

2012–
2014 

Cannabis 

8 

UNODC 
(2011) 

2009 

Cocaine 

9 

UNODC 
(2015a) 

2009–
2012 

Heroin 

General population 
survey – number of 
cocaine users 

European Web Survey 
on Drugs – amount of 
cocaine used 

EMCDDA and UNODC 
routine data collections 
– price 

Literature review of 
previous estimates 

Comprehensive 
literature review – 
secondary analyses on 
data from available 
registrations (2012–
2014) and previous 
studies, and expert 
opinion 

EU 24 

Yes – for EU 24 (which 
excludes Cyprus, 
Luxembourg, Malta and 
Sweden) 

NL 

Yes 

Between 171 and 
965 tons (95% IE of 
271-613 tons) of 
cannabis produced 
in the Netherlands 

Household surveys 
(number of cocaine 
users) 

UNODC Annual Reports 
Questionnaire (cocaine 
prices) 

West and Central 
Europe (which 
includes AT, CY, UK, 
EE, FR, DE, EL, HU, 
IR, IT, ML, PT, ES, 
SE)  

General survey data 
from World Drug 
Report and EMCDDA 
(prevalence data)  

UNDESA, Population 
Division data 
(population data)  

Balkan route 
(including AT, BE, 
BG, HR, CZ, DK, FR, 
DE, EL, HU, IE, IT, 
LU, NL, PL, PT, RO, 
SK, SI, ES, SE, UK)  

No 

Yes 

Estimate 
produced 
(revenue) 

Retail revenue 

€6,765 million 
(mid) 

€5,040 million 
(min) 

€7,575 million 
(max) 

Growth profit from 
illicit cocaine 
trafficking:  
US$26 billion  

Total revenue 
from illicit opiates 
trafficked along 
Balkan route:  
$28 billion 

35 

 
 
 
 
 
 
 
 
 
 
 
 
EUROPEAN COMMISSION 

Citation 

Year(s) 
of 
estimate 

Sub-market 

Data source(s) 

Countries included 
in estimate 

Disaggregated at 
Member State level?  

Estimate 
produced (size)  

Estimate 
produced 
(revenue) 

Seizure data reported 
by UN, as presented in 
World Drug Report 

Purity data reported by 
UN Member State to 
UNODC  

Price data reported by 
UN Member State to 
UNODC 

Law enforcement 
annual reports  

Seizure data  

Stakeholder interviews 

108  Tops et 

2017 

al. (2018) 

Synthetic drugs 
(ecstasy and 
amphetamines) 

NL 

No 

€18.9 billion 

8 The research team notes that the Tops et al. (2018) study presents significant methodological limitations due to its ill-defined methodological process and use of seizure data. 
Nevertheless, it has been included in the table for comparative purposes. While this estimate was produced at the national level and drew primarily on seizure data, it highlights that 
the EU’s illicit drug markets might be larger in scope, if compared to EU-level estimates.   

36 

 
 
 
 
 
EUROPEAN COMMISSION 

2.1.3. Methodology for estimating revenues in this study  

The literature review identified numerous prior estimates of the revenue from illicit drug markets 
in the EU. In particular, the EMCDDA and Europol jointly published high-quality estimates in their 
EU Drugs Market report in November 2019, which represents the best available estimates to date. 
For the purposes of this study, the EMCDDA/Europol estimates are used and discussed alongside 
findings from interviews with experts and stakeholders on market actors and future trends and 
dynamics.  

A summary of the approach used in this study for estimating the revenue from illicit drugs – and 
details of the limitations of this approach – is outlined in the table below.  

Table 2.3: Summary of approach for estimating revenue from illicit drugs 

Summary of approach  The approach for examining the revenue of retail level illicit drug markets in 

the EU will use demand-based estimates produced by the EMCDDA/Europol in 
their latest report released in November 2019 (EMCDDA & Europol, 2019). 

Output 

Annual revenue from the cannabis, cocaine, heroin, synthetic drugs (MDMA, 
meth/amphetamine) drug markets in the EU.  

Scope and coverage 

Geographical scope: EU-level estimate 

Year(s) of estimate: 2017, updated to 2019 values 

Sub-markets: Cannabis, cocaine, heroin, MDMA, meth/amphetamine 

Data sources 

EMCDDA (2019b); EMCDDA & Europol (2019) 

Rationale 

Limitations and 
caveats of this 
approach 

The EMCDDA/Europol data represents the most robust available estimates for 
estimating the size and revenue of drug retail markets, as it draws from the 
most recent country-level data and covers all EU Member States.  

The EMCDDA’s reliance on population-level data from self-report surveys – 
while representing the best-practice approach, means that estimates are 
likely to underestimate consumption and under-cover marginalised 
populations.  

The EMCDDA does not release Member State-level estimates for 
confidentiality reasons. As such, Member State-level estimates are not 
reported for this study. In lieu of this, differences across the 28 EU Member 
States have been explored through in-depth literature reviews and interviews 
with key stakeholders. 

It is not possible to estimate the retail revenue from NPS markets in the EU 
because these drugs are often consumed unknowingly by consumers, when 
adulterated within other drugs combinations. Moreover, NPS is a dynamic and 
constantly evolving market with new substances arising regularly. This makes 
estimation very difficult. For these reasons and as confirmed in interviews 
with key market experts, it is not possible to derive reliable estimates on NPS 
in the EU9. Nevertheless, this does not discount the importance of this 
market, particularly given the risks of polysubstance use.  

2.1.4. Revenue estimates of the EU illicit drugs market 

Table  2.4  below  presents  the  revenue  estimates  produced  by  the  EMCDDA  and  Europol  and 
published in the EU Drug Markets Report and related technical report. According to these figures 
(adjusted for inflation to 2019 values), the revenues generated on retail markets for illicit drugs 
in  the  EU  – including  cannabis,  cocaine,  amphetamine,  MDMA  and  heroin  – was  between  €27 
billion and €36 billion (€30 billion) (EMCDDA & Europol, 2019)10. 

•  According to the EMCDDA/Europol’s drug markets estimates, cannabis was the largest 

retail market at between €10 billion and €13 billion (€12 billion), followed by cocaine at 
between €8 billion and €11 billion (€9 billion), heroin at between €7 billion and €9 billion 
(€8 billion) and synthetic drugs (amphetamine and MDMA) at between €1.3 billion and 
€2 billion (€1.5 billion) (EMCDDA & Europol, 2019). 

9 Interview with EU-level stakeholder, 12 February 2020 (#3). 
10 The EU Drug Markets Report and related Technical report (2019) did not estimate the value of the EU’s new 
psychoactive substances’ market due to inconsistent consumption data for these drugs. 

37 

 
 
EUROPEAN COMMISSION 

• 

• 

The EMCDDA/Europol study does not provide disaggregated Member State-level 
estimates for confidentiality reasons11. However, Savona and Riccardi (2015)’s study 
(using a different methodological basis)12, highlighted that the EU’s four largest 
economies – namely Germany, France, the UK and Italy – recorded the highest retail 
revenues for illicit drugs. It is pertinent to note that in 2015, the UK recorded the 
highest revenue for cocaine and heroin in the EU. This finding suggests that the EU’s 
overall revenue estimate of the EU retail illicit drug markets might differ with the UK 
leaving the EU13. Notably, EMCDDA and Europol (2019) report that synthetic drugs are 
increasingly produced in the EU, both for domestic trafficking and exportation, with 
Belgium, the Netherlands, the Czech Republic and Poland recording the highest 
wholesale revenues for synthetic drugs.   

Importantly, Savona and Riccardi (2015) noted that overall drug-market estimates and 
country-level estimates presented in their report are not directly comparable, given that 
they rely on a range of data sources provided by Member States (such as drug 
prevalence data), which are produced using different methodological approaches and 
estimated at different times. For this reason, comparisons between Member States 
should be made with caution. These results were consistent across the studies identified 
in the literature review.  

Table 2.4: Revenue estimate of the EU retail illicit drug markets 

Drug type 

Revenue estimates (€ million) 

Mid 

Low 

High 

28 EU Member States 

Cannabis 

Cocaine 

Amphetamine 

MDMA 

Heroin 

30,688.41 

12,029.87 

9,376.71 

1,041.89 

546.57 

7,693.36 

26,708.13 

35,514.56 

10,891.46 

7,894.40 

859.08 

452.17 

6,611.02 

13,258.50 

10,859.00 

1,327.06 

640.98 

9,429.02 

Source: Estimates produced by EMCDDA are for 2017 (EMCDDA & Europol, 2019), which we updated to 2019 values using Eurostat’s HICP 
(Eurostat, 2020b). Estimates are not disaggregated at Member State level, so these estimates represent 28 EU Member States (including the 
UK). 

The figures presented in the table above update the EMCDDA and Europol’s previous estimates 
published in 2016, which found that in 2013, the EU’s overall illicit retail drugs market was worth 
€24 billion (EMCDDA & Europol, 2016). The cannabis retail market was €9.3 billion, the cocaine 
retail market was €5.7 billion, the heroin retail market was €6.8 billion, and the synthetic drug 
retail market was €2.4 billion (EMCDDA & Europol, 2016). While these figures suggest an overall 
increase in the revenue from the EU’s drug markets, these results between the two years are not 
directly comparable due to changes in the methodology used to estimate market revenue14.  

In 2017, the cannabis market remained the largest drug market in the EU, followed by the cocaine 
and  heroin  markets.  According  to  the  EMCDDA/Europol,  between  2013  and  2017  the  cocaine 
market  experienced  the  largest  increase  (EMCDDA  &  Europol,  2019).  An  EU-level  stakeholder 
claimed  this  increase  can  be  partly  attributed  to  global  growth  in  cocaine  production  in  third 
countries,  especially  in  the  Andean  region15.  However,  the  EMCCDA/Europol’s87  estimates  – 
calculated based on a demand-side approach – do not reflect how variations in production impact 
the size of the retail market. While the above figures suggest that the European synthetic drug 
market is shrinking, the EMCDDA reports that amphetamine, methamphetamine and MDMA are 
increasingly produced within the EU and exported abroad  (EMCDDA & Europol, 2019). Besides, 

11 Interview with EU-level stakeholder, 10 February 2020 (#1).
12 The OCP project produced its own estimates for the EU cocaine and heroin retail markets, and aggregated 
existing estimates for the cannabis and synthetic drugs (amphetamine and ecstasy) markets, drawing from 
Kilmer & Pacula (2009) and Caulkins, Kilmer, & Graf (2013).  
13 In the absence of Member State level estimates, the study cannot deduce a revenue estimate of the EU 27 
retail illicit drugs markets. 
14 The EMCDDA/Europol 2019 EU Drug Markets Report drew from a wider range of data sources, improved 
research methodology and updated data sources compared to that used for the 2016 EU Drug Markets Report. 
Methodological improvements include extending coverage to more countries participating in the surveys, and 
adjustment of data-collection instruments to better capture the number of users and the frequency of drug 
use. 
15 Interview with EU-level stakeholder, 10 February 2020 (#1).  

38 

 
 
 
 
 
EUROPEAN COMMISSION 

three interviewed stakeholders stressed that the volume of drugs circulating within Europe had 
significantly increased in recent years, though this is not reflected in the EU retail market revenue 
estimates16.   

2.1.5. Criminal actors and modus operandi 

Table 2.5: Illicit drugs markets – Market actors 

Level of OCG involvement 

Size and composition of OCGs 

Modus operandi of OCGs 

Poly-criminality of OCGs 

The drugs market is particularly attractive for OCGs as it is 
highly profitable. The EU drugs market is highly 
competitive, comprising a myriad of loose/horizontal 
networks acting across the supply chain (including 
importation, production, distribution and retail). OCGs 
involved in the EU drugs market are increasingly inter-
ethnic and transnational.  

The size and composition of groups involved in the EU 
drugs market varies greatly, least because no OCG holds a 
monopoly over the illicit importation, trafficking, 
distribution or domestic production of each drug type. 
While some OCGs are well established along some 
trafficking roots, most actors involved in the drugs market 
are better characterised as loose criminal networks or 
small enterprises carrying out illicit profit-driven activities, 
rather than highly structured OCGs.                                                   

The modus operandi of actors involved in the EU drugs 
market varies by drug type.  

Cannabis resin consumed in Europe is primarily produced 
in Morocco and imported via Spain, France and the 
Netherlands, while herbal cannabis is largely produced in 
the Netherlands, Belgium, Italy and Spain, for domestic 
consumption.  

Cocaine consumed in the EU is sourced in the Andean 
region and largely trafficked into Europe via the ports of 
Belgium, the Netherlands and Spain. The quantity of 
cocaine trafficked in Europe has reportedly grown in recent 
years. 

Heroin consumed in the EU mainly originates from 
Afghanistan and is primarily trafficked into the EU via the 
Balkan route. Evidence suggests that heroin is increasingly 
manufactured in Europe, using diverted legal precursors as 
a raw material.  

The EU has become a significant hub for the production 
and distribution of synthetic drugs, including 
amphetamine, MDMA and to a lesser extent, 
methamphetamine. These drugs are largely produced in 
the Netherlands, Belgium, the Czech Republic and Poland 
for both domestic consumption and exportation. NPS and 
precursors for synthetic drugs are mainly sourced from 
China and India, though also reportedly increasingly 
manufactured in the EU.  

Although there is limited evidence to support these links, 
the principal overlapping criminal activities alongside drug 
trafficking include THB, migrant smuggling and firearms 
trafficking, which are likely to result from shared trafficking 
routes. Additionally, substances are apparently used as a 
means of payment between OCGs involved in the drug 
markets.  

Other key actors  

N/A 

We identified 16 studies in the literature review that included information on the key actors in 
illicit  drug  markets  in  the  EU.  The  2017  EU  Serious  and  Organised  Crime  Threat  Assessment 
(SOCTA) estimated that more than 35% of criminal groups active in the EU are directly involved 
in European drugs trafficking (Europol, 2017). The drugs market is particularly attractive for OCGs 

16 Interview with EU-level stakeholder, 10 February 2020 (#1); Interview with international-level stakeholder, 
10 February 2020 (#2); Interview with EU-level stakeholder, 11 March 2020 (#14). 

39 

 
 
 
EUROPEAN COMMISSION 

as it is highly profitable and offers numerous business opportunities given its large consumer base 
and the variety of products on offer (Savona & Riccardi, 2015). While each drug market presents 
its own characteristics, this study found that two overall trends characterise the European illicit 
drugs market.  

First,  the  EU  drugs  market  is  highly  competitive,  which  prevents  any  single  criminal 
organisation  from  gaining  a  monopoly  (Europol,  2017),  even  when  the  organisation  is 
structured hierarchically. Savona and Riccardi (2015) report that revenues generated from drug 
trafficking are distributed across the supply chain. Specifically, two interviewees highlighted the 
importance of  distinguishing levels of  OCG involvement at different stages of the drugs supply 
chain,  namely  those  involved  in  importing  drugs  into  Europe,  producing  drugs  within  Europe, 
distributing drugs across the continent, and selling drugs to consumers17. Other findings from the 
literature review support these claims. Paoli argued that OCG involvement in the European drugs 
market is characterised by a range of loose/horizontal criminal networks carrying out various illicit 
profit-driven  activities,  rather  than  monopolisation  by  a  few  mafia-type  and  highly  structured 
organisations (Paoli et al., 2017). Through interviews with incarcerated drug traffickers, Caulkins 
et al. also found that Italy and Slovenia’s cocaine and heroin markets involved a variety of actors 
at three levels of the market (retail, wholesale and multi-kilo trafficking), suggesting that each 
category  represents  an  autonomous  profit  centre  rather  than  a  division  of  a  single  criminal 
organisation (Caulkins et al., 2016).  Nevertheless, the increased competition within the market 
does not preclude the strong position of certain OCGs at some levels of the supply chain (Europol, 
2017). 

Second, European OCGs involved in the  drugs market are  becoming  more inter-ethnic 
and transnational. Europol estimates that 70% of OCGs are multinational in their membership 
(Europol, 2013a). Despite the economic competition mentioned above, Europol and the EMCDDA 
report that some European OCGs have increasingly cooperated to facilitate trafficking across the 
continent (EMCDDA & Europol, 2019). For instance, the EMCDDA and Europol report that Dutch 
OCGs have collaborated with traffickers of Turkish origin, resulting in two-way trafficking: Dutch 
OCGs send MDMA and other drugs from the Netherlands to Turkey in exchange for heroin and 
morphine (EMCDDA & Europol, 2017)18. However, the presence of inter-ethnic OCGs operating 
across the market should not be overstated, as evidence suggests that some ethnic groups have 
a stronger presence in parts of the market (Saggers, 2019). 

The  EMCDDA  and  Europol  (2019)  suggest  that  two-thirds  of  the  OCGs  involved  in  drug 
trafficking are also involved in other criminal activities19. The principal overlapping criminal 
activity is THB and migrant smuggling, likely due to shared trafficking routes (Saggers, 2019). 
Weapons trafficking activities have also been identified as operating alongside the drugs trade. 
An interview with a market expert highlighted that OCGs involved in illicit trafficking along the 
Balkan route often export firearms out of Europe in exchange for drugs20. Finally, the EMCDDA 
reports that heroin is often used as a means of payment between OCGs involved in other drug 
markets. For example, heroin is often exchanged for acetic anhydride, cannabis, synthetic drugs 
and cocaine trafficked to destinations outside the EU (Saggers, 2019). Similarly, an interviewee 
claimed that cocaine from the Andean region is imported into the EU in exchange for synthetic 
drugs, which are sent back to South America21. However, these poly-criminality trends should not 
be overstated as there is limited substantive evidence to support them. 

Modus operandi 
While  the  European  drugs  market  has  become  increasingly  inter-ethnic  and  competitive,  each 
sub-market  presents  distinct  characteristics  that  are  outlined  below.  As  stated  above,  it  is 
important to distinguish the various levels of OCG involvement at different stages of the drugs 
market (production, trafficking, distribution and retail), and to emphasise the preponderance of 
loose criminal networks over highly structured OCGs within each sub-market.  

The European cannabis market comprises resin and herbal cannabis, which are considered by 
Europol  as  two  distinct  markets  regarding  illicit  trafficking  (Europol,  2017).  Herbal  cannabis 
consumed in Europe is primarily produced in the Netherlands, Belgium, Italy and Spain, although 

17  Interview  with  EU-level  stakeholder,  10  February  2020  (#1);  Interview  with  EU-level  stakeholder,  12 
February 2020 (#3). 
18 Interview with EU-level stakeholder, 11 March 2020 (#14). 
19 Interview with EU-level stakeholder, 10 February 2020 (#1).  
20 Interview with EU-level stakeholder, 10 February 2020 (#1) 
21 Interview with international-level stakeholder, 10 February 2020 (#2). 

40 

 
 
EUROPEAN COMMISSION 

the  EMCDDA  reports  that  it  is  difficult  to  estimate  the  number  of  production  sites  in  the  EU 
(EMCDDA & Europol, 2019). Europol also states that some herbal cannabis consumed in the EU 
is  produced  in  Albania  (Europol,  2017).  The  EU  SOCTA  2017  reports  that  cannabis  resin 
consumed in the EU mainly originates from Morocco, entering Europe through Spain, France and 
the Netherlands (Europol, 2017). According to Europol, Libya has also emerged as an important 
transit hub for cannabis ahead of transportation to Europe (Europol, 2017). Europol reports that 
OCGs of Moroccan origin primarily import cannabis resin into Europe, along with OCGs of Dutch 
and Vietnamese origin (Europol, 2017; Savona & Riccardi, 2015). 

Europol  suggests  that  herbal  and  resin  cannabis  is  mainly  trafficked  into  Europe  via  couriers, 
pleasure boats, speed boats, containers, lorries and small aircraft, while cannabis trafficked within 
Europe is distributed via couriers, private cars, buses, lorries and small aircraft (Europol, 2017). 
Overall,  Europol  concludes  that  the  European  cannabis  market  has  become  more 
competitive and specialised (Europol, 2017). Notably, the EMCDDA and Europol reveal that a 
range  of  loosely  organised  OCGs  are  increasingly  involved  along  the  resin  and  herbal 
cannabis  supply  chain  due  to  the  market’s  profitable  and  diverse  nature  (EMCDDA  & 
Europol, 2019). In turn, the growing competition has reportedly led to increased violence within 
these drug markets (EMCDDA & Europol, 2019; Europol, 2017). Nevertheless, Saggers reports 
signs  of  growing  cooperation  between  some  OCGs  involved  in  the  EU’s  cannabis  market.  For 
instance,  Albanian-speaking  OCGs  reportedly  liaise  with  Italian  mafia-style  OCGs  to  traffic 
cannabis along the Italian coast (Saggers, 2019). However, the dynamics that determine these 
inter-relationships  are  not  currently  well-understood.  Savona  and  Riccardi  suggest  that  these 
market  changes  likely  result  from  the  growing  consumer  market  and  increased  domestic 
production (Savona & Riccardi, 2015).  

Cocaine imported to Europe is primarily produced in South America – namely in Colombia, Bolivia 
and Peru – where production has increased in recent years (Europol, 2017). Europol states that 
a range of OCGs is involved in the EU cocaine market, including Albanian-speaking, British, Dutch, 
French,  Irish,  Moroccan,  Serbian,  Spanish,  Turkish  and  Mexican  OCGs  (Europol,  2017).  An 
interviewee  highlighted  that  cocaine  is  primarily  imported  into  Europe  via  the  ports  of  the 
Netherlands, Belgium and Spain, although law enforcement agencies are increasingly reporting 
cocaine seizures in the ports of Finland, Romania and the Balkan States22. Saggers reports that 
cocaine is typically imported into the EU via various traditional means of transportation, including 
general aviation, as part of large shipments in containers (hidden among legal goods) or in smaller 
quantities by couriers (Saggers, 2019). Within the EU, cocaine is transported in lorries or private 
vehicles.  Finally,  the  EMCDDA  notes  an  emerging  trend  within  the  European  cocaine  market, 
whereby European OCGs use national overseas territories located close to production countries to 
smuggle cocaine into Europe, since these territories are part of the European single market and 
European customs territory (EMCDDA, 2018).   

Most of the heroin imported to Europe is produced in Afghanistan and trafficked into the EU via 
the Balkan route (UNODC, 2015a). The EMCDDA/Europol EU Drug Markets Report highlights that 
Turkish  OCGs  coordinate  most  of  the  European  heroin  trade,  benefiting  from  well-established 
networks  and  infrastructure  across  the  continent  (EMCDDA  &  Europol,  2019;  Saggers,  2019). 
While  Turkish  OCGs  are  heavily  involved  in  heroin-import  activities,  the  distribution  of  heroin 
across Europe is shared by a range of criminal organisations, including OCGs of Dutch, British, 
Western  Balkan,  Iranian  and  Pakistani  origin  (Saggers,  2019).  These  groups  distribute 
responsibilities  across  the  supply  chain  but  seem  to  largely  operate  within  national  borders. 
Europol reveals that although heroin consumed in the EU is mainly imported via the Balkan route 
in land-shipments, there has been evidence of laboratories manufacturing heroin within the EU. 
Seizure data reveals that acetic anhydride  –  the main  heroin precursor  –  is increasingly  being 
exported  from  Europe  (Europol,  2017).  This  finding was  supported  by  two  of the  stakeholders 
interviewed during this study23. Heroin is occasionally distributed across the EU in small quantities 
via  post  and  parcel  services,  and  has  increasingly  become  available  on  online  marketplaces 
(Europol, 2017).  

The EU SOCTA 2017 reports that the EU is a significant hub for the production and distribution of 
synthetic drugs, including amphetamine, MDMA and – to a lesser extent – methamphetamine 
(Europol, 2017). More specifically, growing amounts of MDMA and amphetamine are produced in 
the  Netherlands  and  Belgium,  and  are  largely  destined  for  markets  outside  of  the  EU,  while 
amphetamine and methamphetamine are increasingly produced in the Czech Republic, Slovakia 

22 Interview with EU-level stakeholder, 11 March 2020 (#14), 
23 Interview with EU-level stakeholder, 12 February 2020 (#3); Interview with EU-level stakeholder, 11 March 
2020 (#14). 

41 

 
 
EUROPEAN COMMISSION 

and  Poland  for  domestic  trafficking.  Europol  states  that  Dutch  OCGs  primarily  coordinate  the 
trafficking of amphetamine and MDMA produced in the Netherlands and Belgium, and Vietnamese 
OCGs  handle  the  trafficking  of  synthetic  drugs  produced  in  the  Czech  Republic,  Slovakia  and 
Poland. These findings were supported by two stakeholders interviewed during the study24. 

According to Europol, the pre-precursors25 and laboratory tools used to produce these synthetic 
drugs in the EU mainly originate from China and are imported into Europe via parcels, couriers, 
containers and aircraft (Europol, 2017). Synthetic drugs within the EU are trafficked via parcels, 
private cars and lorries. As such, Europol suggests that OCGs increasingly use online platforms to 
traffic synthetic drugs both within and outside of the EU, taking advantage of legitimate postal 
services to carry out their illicit activities. 

Finally, Europol signals that  the  European synthetic drugs market is highly flexible,  with  OCGs 
constantly exploring new avenues to expand and diversify this illicit market. This finding echoes 
the  Spapens  (2011)  study  of  synthetic  drug  traffickers  in  the  Netherlands,  which  showed  that 
OCGs  swiftly  adapted  to  counter  law-enforcement  measures,  and  that  new  criminal  groups 
emerged to replace those dismantled by the police to sustain the synthetic drug market.  

NPS continue to pose significant  health and security risks in Europe, despite a  decrease in the 
number of first substance detections. EMCDDA (2020) report that over 790 NPS were reported to 
the EU Early Warning System, of which 53 were detected in 2018. Although most NPS consumed 
in  the  EU  currently  are  imported  from  China  and  India,  Europol  reports  that  some  of  these 
substances might be produced in the EU as well. However, a representative from an EU agency 
highlighted the significant knowledge gaps regarding NPS consumption and trafficking in the EU26. 
More specifically, the interviewee stressed that NPS can be misleadingly sold as traditional drugs, 
making their detection particularly difficult for law enforcement.  

Box 2: Interviewees confirmed increasing violence related to drug trafficking 
by OCGs in Europe 

The EMCDDA and Europol identified an increase in violence within the European drugs market (EMCDDA & 
Europol,  2019)  which  was  confirmed  during  stakeholder  consultations27.  This  was  largely  attributed  to 
growing competition and changing models of cocaine and heroin supply. For example, the EMCDDA and 
Europol reported a growing trend, whereby local users in provincial areas source their drug supply directly 
from big cities (EMCDDA & Europol, 2019). This is disrupting traditional drug-supply models, with ‘elder’ 
suppliers  in  big  cities  increasingly  trafficking  directly  with  ‘younger’  dealers  in  provincial  areas.  This 
phenomenon  has  been  reported  mainly  in  the  UK,  but  evidence  collected  by  the  EMCDDA  and  Europol 
suggests  it  is  also  occurring  in  Belgium,  Estonia,  Greece,  Ireland  and  Sweden.  Such  changes  have 
reportedly resulted in increasing levels of violence and exploitation as city-based drug-dealing groups resort 
to aggression and intimidation to establish themselves and assert dominance in new localities (EMCDDA & 
Europol, 2019).  

According to a stakeholder interview28, the rising levels of violence within the European Drugs market can 
be partly attributed to the growth in cocaine production in South America and in cocaine retail markets in 
Europe. This suggests that cocaine is more readily available in Europe, opening opportunities for mounting 
OCG involvement. For example, Europol notes an increase in violence in the port of Antwerp, where large 
amounts  of  cocaine  are  imported.  In  addition,  evidence  suggests  that  corruption  and  intimidation 
techniques were widespread. According to European port authorities, OCGs have approached port workers 
in Antwerp and offered up to €5,000 in exchange for a simple conversation. 

Finally, the EMCDDA and Europol’s collaborative research suggests that levels of drug-related homicides 
have increased across Europe, though they highlight that precise estimates are difficult to calculate due to 
methodological challenges and inconsistent data recorded across the EU (EMCDDA & Europol, 2019). 

While the law-enforcement evidence presented here suggests increasing levels of violence across the EU 
drugs market, this trend should not be overstated. The evidence collected to-date is limited and the violence 

24  Interview  with  EU-level  stakeholder,  10  February  2020  (#1);  Interview  with  EU-level  stakeholder,  12 
February 2020 (#3). 
25 Amphetamine,  methamphetamine  and  MDMA  are  produced  from  chemical  starting  materials  called  drug 
precursors. These drug precursors may also have legitimate uses and are strictly regulated at the global 
level to avoid diversion for illicit use. Yet, to bypass these regulations, OCGs producing illicit drugs in the 
EU  have  introduced  alternative  chemicals,  which  are  then  converted  into  drug  precursors  to  produce 
synthetic drugs. 

26 Interview with EU-level stakeholder, 12 February 2020 (#3). 
27 Interview with EU-level stakeholder, 12 February 2020 (#3); Interview with EU-level stakeholder, 11 March 
2020 (#14).  
28 Interview with EU-level stakeholder, 10 February 2020 (#1).  

42 

 
 
EUROPEAN COMMISSION 

might result from factors that are not directly related to the drugs market. Future analysis should consider 
the extent to which these reported levels of violence are sustained over time, and the extent to which they 
are localised or more widespread.   

2.1.6. Future trends and dynamics  

Table 2.6: Illicit drug markets – Future trends 

Future trends and dynamics 

Impact on market and criminal 
finances  

Future trends and dynamics identified within the EU drug 
markets include the increasing production of synthetic 
drugs and the diversion of precursors within the EU; 
growing online trade; and the use of cutting-edge 
technology to maximise production output. 

These changes suggest that drug production and 
trafficking is likely to increase in the EU in the coming 
years, creating more opportunities for criminal networks to 
generate illicit profit. 

Six  studies  identified  in  the  literature  review  included  information  on  the  future  trends  and 
dynamics  in  illicit  drug  markets  in  the  EU.  Drawing  primarily  on  the  EU  SOCTA  2017  and 
consultations with stakeholders, the following section highlights four main trends and dynamics. 

First,  the  EMCDDA  reports  that  synthetic  drugs  are  increasingly  produced  within  the  EU 
due  to  more  sophisticated  production  processes  (EMCDDA  &  Europol,  2019).  Law 
enforcement agencies have reported the development of low-cost, non-scheduled chemicals (drug 
precursors),  mainly  sourced  from  China,  and  industrial-scale  equipment  that  allows  larger 
production  runs  and  methods  borrowed  from  the  pharmaceutical  industry  (e.g.  automated 
production  processes)  (Europol,  2017).  Europol  also  highlights  two  consequences  of  these 
technological advances for the European synthetic-drug market:  

•  Amphetamines and MDMA can be produced in larger quantities, which increases the 

customer base and multiplies health risks associated with drug taking. This is especially 
problematic given that more chemicals are used to produce them. Europol also 
highlights the growing environmental implications of such changes: the production of 
synthetic drugs generates large quantities of highly toxic and dangerous waste as a 
result of the new production methods and the introduction of new alternative chemicals 
used to produce drug precursors (this phenomenon is further described below) 
(EMCDDA, 2019a).  

•  Synthetic-drug trafficking has become a profitable market for OCGs as they can export 
drugs outside of Europe and easily reach EU customers, taking advantage of parcel 
delivery services and online retail platforms. The EMCDDA and Europol report that while 
the amphetamine, methamphetamine and MDMA produced in the EU is largely destined 
for the domestic market, Europe is increasingly playing a part in the global drugs 
market for amphetamine and methamphetamine (EMCDDA & Europol, 2019). According 
to the EMCDDA and Europol, the combination of these trends is likely to continue to 
pose a significant challenge for European law enforcement agencies in the future.  

Second, European synthetic-drug producers are increasingly circumventing regulations 
to produce synthetic drugs in the EU (EMCDDA, 2019a). Amphetamine, methamphetamine 
and  MDMA  are  produced  from  chemical  starting  materials  called  drug  precursors.  These  drug 
precursors may also have legitimate uses and are strictly regulated at the  global level to avoid 
diversion for illicit use. Yet, to bypass these regulations, OCGs producing illicit drugs in the EU 
have introduced alternative chemicals, which are then converted into drug precursors to produce 
synthetic drugs. This finding was supported by one interviewee29. Another stakeholder affirmed 
that seizures of drug precursors had significantly increased in the EU over the past year, though 
the interviewee warned that this might also result from intensified law enforcement actions30. The 
interviewee  also  signalled  a  new  trend  whereby  ‘designer  precursors’  are  produced  by  illegal 
companies in developing  countries and  then smuggled into the EU  to be used in production  of 
synthetic drugs31. Additionally, Europol notes that the EU is increasingly becoming a producer 
for  the  pre-precursors  of  drugs  (Europol,  2017).  For  example,  pre-precursors  and  other 

29 Interview with EU-level stakeholder, 12 February 2020 (#3).  
30 Interview with EU-level stakeholder, 16 March 2020 (#22). 
31 Interview with EU-level stakeholder, 16 March 2020 (#22). 

43 

 
 
 
EUROPEAN COMMISSION 

chemicals  for  cocaine  production  are  reportedly  being  exported  to  South  America,  where  coca 
plantations are expanding. A stakeholder also highlighted  that solvents and chemicals used for 
creating precursors for synthetic drugs were increasingly produced in the EU, notably in Poland.32  

Third, online trade is becoming more prevalent within Europe’s drug markets (EMCDDA 
&  Europol,  2017).  This  finding  was  also  supported  by  three  stakeholders  interviewed  over  the 
course  of this study33. Online platforms can help drug suppliers improve their business models 
and increase profit margins by allowing suppliers to deliver drugs directly to consumers via regular 
postal services. This reduces the risks of getting caught and can enable vendors to reach a greater 
number of customers (Europol, 2017). According to Kruithof et al. (2016), in January 2016 the 
online drug market generated a monthly revenue of approximately €12.6 million. While this study 
suggests that the online drug market is relatively small compared to the street-level drug market, 
it suggests that drug traffickers might use crypto markets to make large wholesale transactions 
with the intention of dealing offline. Yet the EMCCDA and Europol found that mid- and low-level 
transactions are still predominant on illicit online platforms (EMCDDA & Europol, 2017). In a study 
looking  at  crypto  markets’  potential  for  disrupting  international drug trafficking,  Demant  et  al. 
(2018)  found  that  the  distribution  of  cannabis,  cocaine  and  synthetic  drugs  on  the  internet  is 
concentrated  in  consumption  countries  (with  MDMA  also  produced  in  Europe),  suggesting  that 
drug  online  sales  operate  a  regional  rather  than  international  level.  The  EMCDDA  and  Europol 
(2017)  emphasise  that  the  anonymity  offered  by  online  retail  platforms  is  valued  by  drug 
traffickers  and  consumers.  Sophisticated  encrypted  messaging  systems  and  apps  as  well  as 
cryptocurrencies provide useful tools to avoid law enforcement scrutiny.  

Fourth,  cutting-edge  technology  has  helped  drug  producers  across  Europe  maximise 
their  production  outputs.  For  example,  Europol  reports that  large-scale  cannabis  cultivation 
sites in the Netherlands increasingly use professional growing equipment – such as climate control 
systems – to produce herbal cannabis. This phenomenon is leading to an increase in productivity 
and hence to a potential growth of production and trafficking volume. The use of technologies has 
also been observed within the heroin market. The increase in opium production volume has been 
attributed to agricultural innovations, such as solar-powered tube wells used in Afghanistan, which 
have  helped  increase  the  surface  area  used  for  production  (Saggers,  2019).  In  addition,  the 
increase  in  production  of  cocaine  in  South  America  has  largely  been  attributed  to  technology 
advancements, such as novel cocaine-manufacturing processes, which subsequently result in an 
increase of cocaine available in Europe (Saggers, 2019). Finally, a stakeholder highlighted that 
new  technologies  have  facilitated  the  emergence  of  Europe’s  industrial-like  synthetic  drug 
production, though the interviewee stressed that these large-scale productions are making OCGs 
involved in this market less agile34.   

The desk research and an interview with a stakeholder also highlighted that technologies were 
used by OCGs to facilitate drug trafficking within Europe. First, a stakeholder suggested 
that increasingly, traditional OCGs hire specialised criminal actors to carry out cyber-activities to 
assist  in  drug  trafficking35.  For  example,  the  interviewee  stressed  that  OCGs  operating  in  the 
Netherlands had hacked surveillance technologies in ports to avoid detection. Berry also stressed 
that technologies deployed in  smart cities were exploited  by criminal actors to facilitate offline 
drug trading (Berry, 2018).   

2.1.7. Recommendations 

This study finds that there are two principal ways in which data collection and estimation on the 
illicit drugs market could be improved in the EU:  

• 

First, two stakeholders noted that the data gaps identified in the literature review could 
be filled by encouraging Member States to consistently collect prevalence data 
on drugs on an annual basis36. As such, estimates could draw from annual data 
rather than averages of annual data spanning four to five years.  

32 Interview with EU-level stakeholder, 16 March 2020 (#22). 
33 Interview with EU-level stakeholder, 10 February 2020 (#1); Interview with National-level stakeholder, 25 
February 2020 (#35). 
34 Interview with EU-level stakeholder, 10 February 2020 (#1).  
35 Interview with National-level stakeholder, 25 February 2020 (#35). 
36 Interview with international-level stakeholder, 10 February 2020 (#2); Interview with EU-level stakeholder, 
12 February 2020 (#3). 

44 

 
 
EUROPEAN COMMISSION 

•  Second, two stakeholders highlighted the need to better-adjust prices for drugs’ 
purity or potency levels37. One interviewee suggested that improving forensic 
investigations on drugs could help collect robust data on drug purity level and retail 
price38. Further, the interviewee added that forensic investigations could provide more 
information about the origin of drugs imported and pertinent data on the health 
implications of drugs consumed in the EU.  

• 

The key findings, recommendations and actors for actioning or implementing these 
recommendations are summarised in the table below.  

Table 2.7: Recommendations – Illicit drug markets 

Key actors for 
recommendations 

Member States 

European 
Commission 

EMCDDA 

Key findings 

Recommendations 

The EMCDDA produces demand-based 
estimates of the revenue from the 
retail market for illicit drugs at the EU-
level using routine data collections 
from Member States on prevalence of 
consumption and price, and the 
European Web Survey on Drugs for 
quantities consumed.  

However, price data is not adjusted for 
purity and Member State-level 
estimates are not published.  

Of the markets examined in this study, 
illicit drug markets represent the 
second-most significant in terms of 
revenues generated in the EU.   

Member States should collect annual 
prevalence data via general population 
surveys so that EU-level estimates can 
be updated annually. There should be 
continued efforts to harmonise the 
data collected by Member States.  

There should be efforts to improve 
forensic testing of drugs so that price 
data can be purity-adjusted 
consistently across Member States.   

The EMCDDA should share Member 
States’ disaggregated estimates with 
the European Commission. 

The work of the EMCDDA in providing a 
factual overview of European drug 
problems and a solid evidence-base for 
informing drug policy should be further 
strengthened.   

2.2.  Trafficking in human beings  

Alexander Gerganov, Kamelia Dimitrova and Atanas Rusev, Centre for the Study of Democracy  

Key findings: 

•  According to the estimates produced in this study, the annual revenues derived from 
trafficking of human beings (THB) for sexual exploitation in the EU range between 
€0.4 billion and €14 billion. 

• 

• 

• 

This is the first time a reliable estimate at the EU-level has been produced for the 
criminal revenue generated from THB for sexual exploitation, since all previous 
estimates referred to wider world regions.  

There is heavy involvement of OCGs in trafficking for sexual exploitation (especially 
Nigerian OCGs), as well as in trafficking for forced criminality, for begging and for 
organ removal.  

The typical structure of criminal groups active in this market consists of loose 
networks, linked by family, kinship or ethnic ties.   

•  Other key actors are various legitimate businesses involved in the trafficking chain 
that benefit from victims trafficked for sexual and labour exploitation and other 
exploitation, including companies in sectors such as transport, hospitality, agriculture, 
the entertainment industry, construction, catering, etc. 

•  Criminals increasingly use the internet and technological advances to recruit, control 

and exploit their victims and to hide the criminal proceeds. 

• 

In addition to the traditional trafficking flow from Eastern Europe to Western Europe, 
there are multiple and diverse flows of victims trafficked from all over the world to 
the EU. For THB, Nigeria and China contribute the most.  

37 Interview with international-level stakeholder, 10 February 2020 (#2); Interview with EU-level stakeholder, 
12 February 2020 (#3). 
38 Interview with EU-level stakeholder, 12 February 2020 (#3). 

45 

 
 
EUROPEAN COMMISSION 

This  Annex  provides  a  comprehensive  overview  of  THB  in  the  EU,  building  upon  the  summary 
provided in Section 2.2 of the main report.   

THB represents a particularly serious crime and a violation of the fundamental rights and dignity 
of individuals, which is recognised as one of the main threats in the EU (Europol, 2017c). The two 
most prevalent forms of THB in the EU are THB for  sexual exploitation and labour exploitation 
(European  Commission,  2018c;  European  Commission,  2020b).  In  the  period  2015–2016,  the 
number  of  registered  victims  of  THB  across  the  28  EU  Member  States  was  20,532  (European 
Commission, 2018c). Sexual exploitation was the most commonly registered form of exploitation, 
accounting for over half (56%) of registered victims (65% excluding the UK). Trafficking for labour 
exploitation contributed around one quarter (26%) of the registered victims (15% excluding the 
UK) and ‘other’ forms accounted for 18% (20% excluding the UK). 

The  current  study  adopts  the  definitions  of  THB  and  exploitation  as  laid  down  in  Directive 
2011/36/EU:  ‘the  recruitment,  transportation,  transfer,  harbouring  or  reception  of  persons, 
including the exchange or transfer of control over those persons, by means of the threat or use 
of force or other forms of coercion, of abduction, of fraud, of deception, of the abuse of power or 
of a position of vulnerability or of the giving or receiving of payments or benefits to achieve the 
consent of a person  having  control  over another  person, for the purpose  of exploitation’.  The 
detailed definitions for exploitation – as well as the different forms of THB – are provided in the 
Glossary at the beginning of the main report. 

Most of the prior research, estimates and data sources focus on THB for sexual exploitation and 
labour  exploitation  –  there  are  very  few  quantitative  analyses  for  forced  begging  and  organ 
removal.  Nevertheless,  their  particularly  harmful  effects  for  society  and  especially  the  victims 
have qualified these under-investigated crimes as among the high priorities of the Commission. 
The  current  section  produces  quantitative  estimates  of  the  market  revenue  of  THB  for  sexual 
exploitation, in addition to a qualitative analysis of THB for labour exploitation, forced begging, 
organ removal and exploitation for criminal activities. 

2.2.1. Previous revenue estimates of THB in the EU 

We identified 10 studies that produced estimates of some aspect of the THB market in the EU. Of 
these,  three  produced  monetised  estimates  for  Europe  or  wider  regions,  seven  produced 
estimates of the number of victims and one produced an estimate of revenues. There were no 
studies identified that estimated the overall revenue from the THB market and all its sub-markets. 

Prior revenue estimates 
The UNODC employed a supply-sided approach to produce an estimate of €2.5 billion annually for 
the whole European39 market in trafficking for sexual exploitation in 2007–2008 (UNODC, 2010). 
The number of identified victims collected for each country by UNODC was multiplied by a value 
of 20 to account for the hidden population (the real number of victims), and the resulting number 
of victims was in turn multiplied by a gross assumption of what the annual revenue generated by 
a victim might be. The assumption was based on very limited information about the sex services, 
combining accounts from a US study on the number of sex services rendered annually by drug-
dependent sex workers in the US with an Italian study about the average price of services. 

In a report from 2015 Europol provided estimates on the revenues generated by THB for sexual 
and labour exploitation, but a closer examination of the provided revenues shows that were drawn 
from previous estimates by the International Labour Organisation (ILO) from 2005 and 2014, and 
pertain to wider world regions (Europol, 2015). According to the Europol report, the global annual 
profits  of  THB  are  €29.4  billion,  with  THB-related  sexual  exploitation  and  THB-related  labour 
exploitation amounting respectively to €25.8 billion and €3.5 billion globally (Europol, 2015). The 
‘EU  and  developed  economies’40  account  for  a  very  large  share  of  the  annual profits  of  sexual 
exploitation, estimated at €23.5 billion (Europol, 2015). While the exact source and methodology 

39  The  guestimate  included  the  28  EU  Member  States  in  addition  to  Iceland,  Liechtenstein,  Norway, 
Switzerland, the Western Balkans and Turkey. 
40  EU  27,  UK,  Canada,  USA,  Australia,  Gibraltar,  Greenland,  Isle  of  Man,  Israel,  Japan,  New  Zealand,  San 
Marino, St. Pierre and Miquelon, Andorra, Iceland, Liechtenstein, Monaco, Norway, Switzerland. 

46 

 
 
 
EUROPEAN COMMISSION 

for producing these market revenues are not disclosed by Europol, the numbers are consistent 
with ILO’s estimates (de Cock & Woode, 2014), previously cited in the same report.  

The identified methodologies from UNODC and Europol (ILO) for estimation of revenues from THB 
follow the same supply-based approach, which ultimately draws on multiplication of the number 
of victims with the annual revenue generated per victim. 

Prior estimates of the number of victims 
The primary source of data on the number of victims for both EU and Member States is the official 
data on registered THB victims in the EU – disaggregated at the Member State level and by forms 
of  exploitation  –  which  are  collected  by  the  Commission  and  published  biannually.  The  latest 
available  data  are  for  the  period  2015–2016  (European  Commission,  2018c).  The  compiled 
dataset follows the official EU definition of THB in Directive 2011/36/EU and provides proven cases 
of  THB  as  well  as  presumed  ones  (European  Commission,  2018c)41.  The  report  provides  data 
about  numbers  of  both  victims  of  trafficking  for  sexual  exploitation  and  trafficking  for  labour 
exploitation at Member State level. 

The  desk  research  identified  several  estimates  for  the  hidden  population  of  victims.  However, 
most of these (e.g. ILO’s estimates of forced labour (ILO, 2012, 2017), Walk Free Foundation’s 
Global Slavery Index (Walk Free Foundation, 2018a), and others) are based on definitions that 
differ from that established in the EU anti-trafficking directive. ‘Forced labour’ or ‘modern slavery’ 
are much broader concepts that are only to some extent related to THB (detailed definitions for 
‘forced labour’ or ‘modern slavery’ are provided in the Glossary). As part of their 2012 study, 
ILO  produced  the  first  EU-level  estimate  for  the  number  of  victims  of  forced  labour,  including 
victims of ‘forced sexual exploitation’ and victims of ‘forced labour exploitation’ (ILO, 2012). 

The only identified approach that is somewhat consistent with the current scope and definition of 
THB was promoted by UNODC to produce estimates of the hidden population of THB victims at a 
country  level.  The  approach  applies  the  so  called  multiple-systems  estimation  (MSE)  method, 
which is an enhanced capture-recapture method for producing estimates of hidden populations 
(UNODC, 2018b). The MSE method has been applied in only four Member States so far (Romania, 
Ireland,  the  Netherlands  and  UK)  and  is  based  on  cross-comparing  two  or  more  independent 
registers listing members from the studied hidden population. 

Prior estimates of the annual revenue generated by a victim 
The desk research did not identify any source that has systematically collected estimates of the 
annual revenue generated per victim of THB at the EU or Member State level. While rough regional 
estimates  can  be  derived  from  some  sources42,  such  annual  revenues  would  assume  no 
differences between Member States and would contribute to a significantly higher margin of error.  

41 The data collection guidelines explain the difference as follows: ‘(…) the relevant formal authority to identify 
victims  of  trafficking  in  human  beings  in  these  countries  seemed  to  be  the  police.  In  some  countries,  the 
status of “victim” could be granted by other authorities such as the immigration service, the state agency for 
social  welfare  or  mandated  NGOs.  The  term  “identified  victim”  will  be  used  for  this  category  of  victims  of 
trafficking in human beings, and can be defined as a person who has been formally identified as a victim of 
trafficking in human beings by the relevant formal authority in a Member State. But in some cases victims 
will not report to the relevant formal authority, such as in cases where the victim does not report the crime 
to  the  police  or  does  not  want  to  cooperate  with  the  police.  The  victim  may  be  in  need  of  assistance  and 
support and for this reason contact victim service providers. Also in these cases, the victim could fulfil the 
constituent  elements  of  the  crime  of  trafficking  in  human  beings  and  therefore  be  considered  a  victim  of 
trafficking in human beings according to the legal definitions. In different studies this category of victims is 
either  called  “presumed”  or  “potential”  victims  of  trafficking  in  human  beings.  Article  11  of  the  Directive 
2011/36/EU  introduces  the  “reasonable-grounds  indication”  for  believing  that  the  person  might  have  been 
subjected to trafficking in human beings. To obtain a figure for the total number of victims of trafficking, data 
on victims that have not been formally registered by the relevant formal authority as a victim of trafficking 
should be used. The term “presumed victim” will be used for this category of trafficking victims and could be 
defined as a person who has met the criteria of the EU Directive but has not been formally identified by the 
relevant  formal  authority  as  a  trafficking  victim  or  who  has  declined  to  be  formally  or  legally  identified  as 
trafficked’. 
42 For example, the 2010 UNODC estimate of €2.5 billion annually was based on the assumption of 140,000 
trafficking victims in Europe, which would make the average annual revenue per victim about €17,860. See 
UNODC (2010) for details on how the number of victims and the market revenue are calculated. 

47 

 
 
EUROPEAN COMMISSION 

2.2.2. Quality of prior revenue estimates  

The prior studies described above were subject to quality appraisal, and several limitations were 
identified with regards to their methodologies and pertinent datasets:   

•  Different definitions of THB used by most of sources – for example, the ILO’s 

estimates are based on their definition of ‘forced labour’.  While the ILO include trafficking 
for sexual exploitation in ‘forced labour’ and refer to the Palermo protocol in their works, 
their definition of forced labour – as well as instruments for estimating its scope – deviate 
significantly from Directive 2011/36/EU, which outlines the scope and focus of the current 
endeavour. Similarly, Walk Free Foundation’s Global Slavery Index estimates the actual 
number of victims of ‘modern slavery’, an umbrella term covering a number of coercive and 
exploitative practices that is not focused on THB alone (Walk Free Foundation, 2018a). This 
is why estimates on numbers of victims based on this definition could not be directly 
equalled to victims of THB under the EU Directive. 

•  Different geographical scope of estimates – the identified sources provide estimates for 

much wider world regions and do not provide revenues at EU- or Member State-level (e.g. 
ILO, 2012, 2017, Walk Free Foundation, 2018a).  

•  Lack of clearly outlined methodology (or a very rudimentary one) – for example, 

Europol’s estimates do not stem from a clearly outlined methodology that can be replicated.   

•  Number of victims of trafficking not known (hidden population issue) – this issue is 
also noted in the most reliable source of data for the number of victims, the bi-annual 
reports on the registered and presumed victims in EU produced by the Commission 
(European Commission, 2018e). The Commission’s first progress report notes with regard to 
EU-wide reported statistics that given the complexity of the phenomenon, there are solid 
grounds to expect that the actual number of victims of trafficking in the EU is indeed 
substantially higher. In other words, the registered victims are a very conservative 
measure of the actual number of victims of THB. Therefore, the official statistics on 
registered victims alone can be used only as a lower bound estimate and should be viewed 
with great caution, especially on the level of Member States where estimates seem to be 
prone to a particularly high reporting bias.  

• 

• 

Few attempts have been made at producing an estimate for this hidden population on 
Member State level. For example, the only relatively reliable approach we identified for 
estimating the hidden number of victims  was capture-recapture and its advanced version, 
MSE. However, this method has been applied in only four EU countries and not in the 
remaining Member States. In addition, this approach has also been heavily criticised for its 
methodology (Gallagher, 2017, Whitehead et al., 2019). Its shortcomings include strong 
dependence on quality of input data and problems with the assumptions behind the data 
analysis, which may result in a large margin of error when estimating the hidden population.  

Lack of reliable data on annual revenue generated by traffickers per victim, since no 
institution, national authorities or other stakeholders have systematically collected data on 
this variable. Calculating the average revenue per victim proves challenging, since this 
varies depending on factors such as the form of exploitation, industry where the victim is 
exploited, country of exploitation, duration of exploitation, and modus operandi of 
traffickers. The few identified sources rely on less robust data acquired through 
extrapolations, or assumptions based on expert opinions or qualitative studies (CSD, 2019). 
The only financial data on victims of THB at EU-level is provided by Europol (2015), but the 
revenue numbers refer solely to ILO estimates for EU and developed countries (i.e. they 
relate to a wider world region). All cited numbers in the Europol report come from ILO 
sources, some of which are as old as 2005 and refer to even older estimates. 

48 

 
EUROPEAN COMMISSION 

Table 2.8: Prior studies estimating the size or criminal revenue of THB in the EU 

Citation 

Year(s) of 
estimate 

Sub-market 

Data source(s) 

Countries 
included in 
estimate 

Disaggregated at 
Member State 
level?  

Estimate 
produced  
(size)  

1 

1 

European 
Commission 
(2018c) 

2010–2016 

All 

Official number of registered 
victims of THB collected by 
the relevant authorities 

EU 28 

Yes 

European 
Commission 
(2018c) 

2010–2016 

THB for sexual 
exploitation  

Official number of registered 
victims of THB collected by 
the relevant authorities 

EU 28 

Yes 

1 

European 
Commission 
(2018c) 

2010–2016 

THB for labour 
exploitation  

Official number of registered 
victims of THB collected by 
the relevant authorities 

EU 28 

Yes 

1 

European 
Commission 
(2018c) 

2010–2016 

THB for forced 
begging, 
organ removal 
and others 

Official number of registered 
victims of THB collected by 
the relevant authorities 

EU 28 

Yes 

Time period / 
Registered victims 
of THB 
2010–2012: 30,146 
2013–2014: 15,846 
2015–2016: 20,532 

Time period / 
Registered victims 
of THB / THB for 
sexual exploitation 
victims 
2010–2012: 30,146 
/ 69% 
2013–2014: 15,846 
/ 67% 
2015–2016: 20,532 
/ 56%  

Time period / 
Registered victims 
of THB / THB for 
labour exploitation 
victims 
2010–2012: 30,146 
/19% 
2013–2014: 15,846 
/ 21% 
2015–2016: 20,532 
/ 26%  

Time period / 
Registered victims 
of THB / Forced 
begging victims, 
Organ removal 
victims and others  
2010–2012: 30,146 
/ 12% 
2013–2014: 15,846 

Estimate 
produced 
(revenue) 

 N/A 

N/A 

N/A 

N/A 

49 

 
 
EUROPEAN COMMISSION 

Citation 

Year(s) of 
estimate 

Sub-market 

Data source(s) 

Countries 
included in 
estimate 

Disaggregated at 
Member State 
level?  

Estimate 
produced  
(size)  

Estimate 
produced 
(revenue) 

2 

3 

4 

5 

6 

UNODC 
(2010) 

 2007–2008 

THB for sexual 
exploitation 

 National authorities mostly 

 EU 28 

 Yes 

Walk Free 
Foundation 
(2018a) 

2018 

THB for forced 
labour, 
including 
forced sexual 
exploitation 

UNODC 
(2018d) 

UNODC 
(2018c) 

UNODC 
(2018b) 

2015–2016 

2014–2016 

2010–2015 

THB for sexual 
exploitation 

THB for sexual 
exploitation 

THB for sexual 
and labour 
exploitation 

A complex predictive 
statistical model was built 
based on both World Poll (by 
Gallup) surveys (2014–
2016) and on multiple 
systems estimation. The 
exact methodology, 
including algorithms are in 
Walk Free Foundation 
(2018b).  

The model includes forced 
labour (state-imposed 
forced labour, forced labour 
exploitation, and forced 
sexual exploitation of adults 
and children) and forced 
marriage components, which 
are aggregated in 
combined-country estimates 
about prevalence rates.  

MSE-based estimates 

MSE-based estimates 

Europe, World, 
individual 
countries 

Yes 

RO 

IE 

Yes 

Yes 

MSE-based estimates 

Netherlands 

Yes 

/ 12% 
2015–2016: 20,532 
/ 18% 

140,000 victims; 
inflow of 70,000 
annually 

Region / N / 
Prevalence rate 
(per 1000) 
Europe Total: 3.28 
million / 3.8 

EU Total: 1.16 
million / 2.6 

$3 billion/€2.5 
billion 

 N/A 

N/A 

N/A 

 N/A 

1,300 in 2015; 
1,200 in 2016 

98 in 2014; 
153 in 2015;  
179 in 2016 

5,562 victims in 
2010;  
8,424 in 2011; 
8,435 in 2012; 
7,078 in 2013; 

50 

 
 
EUROPEAN COMMISSION 

Citation 

Year(s) of 
estimate 

Sub-market 

Data source(s) 

Countries 
included in 
estimate 

Disaggregated at 
Member State 
level?  

Estimate 
produced  
(size)  

Estimate 
produced 
(revenue) 

7 

Bales, 
Hesketh, and 
Silverman 
(2015) 

2013 

Modern 
Slavery 

MSE-based estimates 

UK 

Yes 

8 

ILO (2012) 

2011 

8 

ILO (2012) 

2012 

9 

ILO (2017) 

2016 

World regions 

 No 

EU 

No 

World regions 

 No 

Trafficking for 
forced labour, 
including 
forced sexual 
exploitation 

Trafficking for 
forced labour, 
including 
forced sexual 
exploitation 

Trafficking for 
forced labour, 
including 
forced sexual 
exploitation 

Secondary data, estimation 
based on statistical model. 
The core element is a 
specially designed national 
survey for measuring forced 
labour exploitation of the 
adult population and forced 
marriage.  

Secondary data, estimation 
based on statistical model. 
The core element is a 
specially designed national 
survey for measuring forced 
labour exploitation of the 
adult population and forced 
marriage. 

Secondary data, estimation 
based on statistical model. 
The core element is a 
specially designed national 
survey for measuring forced 
labour exploitation of the 
adult population and forced 
marriage. According to the 
authors, estimates are not 
directly comparable to the 
2012 estimate of ILO, nor to 
the 2016 Global Slavery 
Index, because of 
differences in scope, 
methodology and regional 
groupings. 

6,702 in 2014; 
5,846 in 2015 

10,000 to 13,000 
victims 

 N/A 

 N/A 

Developed 
Economies & EU: 
1,500,000; Central 
& South-Eastern 
Europe (non-EU) & 
CIS: 1,600,000 

N/A 

EU: 270,000 
victims of forced 
sexual exploitation, 
and 610,000 
victims of forced 
labour exploitation 

3,250,000 in 
Europe and Central 
Asia 

 N/A 

51 

 
 
EUROPEAN COMMISSION 

2.2.3. Methodology for estimating revenues in this study  

The general methodological approach used in this study is supply-sided, wherein the number of 
victims  is  multiplied  by  the  annual  revenue  per  victim.  While  the  approach  provides  a 
straightforward way to calculate the criminal revenue, there are few estimates for both required 
elements  (e.g.  number  of  victims  and  annual  revenue  per  victim)  and  all  of  these  suffer  from 
multiple limitations, as discussed in the section on the quality of prior estimates. 

Concerning  number  of  victims,  the  European  Commission’s  dataset  remains  the  only  reliable 
source in the context of the current study for estimating the number of THB victims because: (1) 
it follows the official EU definition of THB in Directive 2011/36/EU; (2) it provides identified cases 
of THB as well as presumed ones; and (3) data sources are reliable (mainly public organisations, 
but also civil society organisations working with victims in many Member States).  

Since the literature review did not establish any reliable data regarding annual revenue generated 
by a victim, the only available data that could be used as a viable proxy is the data on annual 
revenues generated on the sex service (prostitution) market, collected through desk research for 
most Member States. The use of data on annual revenues of sex workers43 has several limitations. 
First is the problem of definitions – sex workers and victims of THB are two distinct groups and 
should not be conflated.  Prostitution and the sex industry are high-risk sectors for women and 
children  trafficked  for  sexual  exploitation,  and  victims  of  trafficking  do  not  consent  to  their 
exploitation. Moreover, whether revenues of sex workers are the same as the revenues generated 
by victims of sexual exploitation for criminals is generally unknown. Second, the country estimates 
obtained  through  literature  review  vary  greatly  in  terms  of  time  of  the  estimate,  the  adopted 
methodological approach and its reliability.   

This could lead both to under- and overestimation of the average annual revenues generated for 
criminals by victims of THB for sexual exploitation. With a disclaimer of the many limitations of 
this approach, annual revenues of sex workers can be adopted as a proxy of the victims’ revenues 
and  used  after  appropriate  statistical  adjustments  have  been  made.  Henceforth,  existing  prior 
estimates  related  to  annual  revenues  of  sex  workers  were  identified  for  26  out  of  28  Member 
States. Drawing on these prior estimates, an average sex worker’s revenue was estimated for 24 
of the Member States (no prior data was identified or produced for Cyprus, Ireland, Latvia and 
Luxembourg). 

A  tentative  upper  bound  estimate  for  the  whole  of  the  EU  can  be  produced  only  if  the  ‘forced 
sexual exploitation’ number produced by ILO is adopted as a proxy of victims of THB for sexual 
exploitation. The upper bound estimate uses the same annual revenue per victim of trafficking 
for sexual exploitation as the lower bound, but tries to approximate the hidden population using 
the only available estimate on the EU-level (as provided by ILO). The identified estimate from ILO 
is for 2012 (ILO, 2012). Such an approach is in line with estimates produced by Europol, which 
are also based on ILO’s sources for the number of victims.   

Since  no  reliable  data  for  the  average  annual  revenues  of  victims  of  THB  (except  for  sexual 
exploitation)  were  identified,  generation  of  new  estimates  for  these  sub-markets  was  not 
conducted and these sub-markets were covered only descriptively. 

A summary of the approach used in this study for estimating the criminal revenues from THB for 
sexual exploitation and the limitations of this approach is outlined in the table below.  

Table 2.9: Summary of approach for estimating the criminal revenues of THB 
for sexual exploitation 

Summary of 
approach 

Rationale 

Supply-based estimate using number of registered victims and annual revenue 
per sex worker as a proxy for annual revenue generated per victim of THB for 
sexual exploitation.  

Due to lack of reliable data, this was the only possible approach for estimating 
the criminal revenue. This is the first time such an estimate has been 
produced for the THB for sexual exploitation in the EU. 

43 The term ‘sex worker’ is used by Europol; THB Financial Business Model (2015). 

52 

 
 
EUROPEAN COMMISSION 

Output 

This approach measures the total annual revenue generated from THB for 
sexual exploitation. 

Scope and coverage 

Geographical scope: EU-level and Member State  

Year(s) of estimate: 2016, updated to 2019 values 

Sub-markets: Only THB for sexual exploitation was covered  

Data sources 

European Commission (2018c)44 & ILO (2012) 

Key steps 

Limitations and 
caveats of this 
approach 

Various sources that provide information on the annual revenue per sex 
worker on the Member State level, adjusted for inflation and harmonised 
through statistical procedures.      

Number of victims for 2016 was directly taken from the European 
Commission’s report and used to estimate the lower bound. ILOs estimate for 
overall number of victims of forced sexual exploitation (also accounting for the 
hidden population) was used for the upper bound estimate.  

Collected national estimates for the annual revenue per sex worker were 
adjusted first for inflation (with 2016 as the target year), and then all 
estimates were adjusted towards a mean value45 to harmonise the estimates. 
Missing values for four Member States were imputed through multiple 
imputation.  

Finally, the two numbers for each Member State were multiplied according to 
the formula below to produce Total market revenue for each Member State:    

𝑇𝑜𝑡𝑎𝑙 𝑚𝑎𝑟𝑘𝑒𝑡 𝑣𝑎𝑙𝑢𝑒 = 𝑁𝑢𝑚𝑏𝑒𝑟 𝑜𝑓 𝑣𝑖𝑐𝑡𝑖𝑚𝑠 ∗ 𝐴𝑣𝑒𝑟𝑎𝑔𝑒 𝑎𝑛𝑛𝑢𝑎𝑙 𝑟𝑒𝑣𝑒𝑛𝑢𝑒 𝑝𝑒𝑟 𝑜𝑛𝑒 𝑣𝑖𝑐𝑡𝑖𝑚 

The above approach produces a lower and upper bound estimate of the 
volume of and criminal revenue from THB for sexual exploitation. The 
suggested method for estimation is inherently constrained by the lack of more 
accurate and robust data about the actual size of the hidden population on a 
Member State level, which makes it impossible to provide a reliable and valid 
upper bound estimate of the market for each EU country.  

Another constraint is the lack of data on the share of OCG involvement (as 
opposed to trafficking by individual perpetrators). Similarly, there is no 
systematic collection of data on average annual revenues generated by 
victims of THB, and very few such estimates are available. Hence, the 
approach uses annual revenues per sex worker as a proxy for the annual 
revenues generated per victim. Sex workers and victims of THB for sexual 
exploitation are very different groups that cannot be conflated, and the 
approach uses only the earnings of sex workers as a rough proxy for the 
possible revenues generated by the victims of THB for sexual exploitation. The 
suggested method is expected to produce an underestimate of the market. 

2.2.4. Revenue estimates of THB for sexual exploitation in the 

EU 

To estimate the market  revenue  from  THB for  sexual  exploitation,  we adopted  a supply-based 
approach. Due to the unavailability of reliable estimates of the actual number of victims of THB 
at the EU-level46, to calculate the criminal revenue we multiplied the number of registered victims 
from the Commission data collection (European Commission, 2018c) with the annual revenue per 
sex worker47 as a proxy for annual revenue per victim of trafficking for sexual exploitation. Since 
sex  workers  and  victims  of  trafficking  are  very  different  groups,  this  approach  will 

44 Numbers for trafficking for sexual exploitation are from Annex Table A1.3 (p 179). Due to lack of information 
about Romania and Poland in this Annex, data for TSE cases for these two countries is calculated additionally, 
wherein  the  total  number  presented  in  Table  3.2.2  (p  35)  is  multiplied  by  the  average  Member  State 
percentage of the corresponding type of victims. 
45  The  adjustment  used  linear  regression,  where  the  annual  revenue  per  sex  worker  was  the  dependent 
variable  and  several  Eurostat  indicators of  the  standard  of  living  in  the  country  were  used  as  independent 
variables or predictors. The indicators used in the regression model were ‘GDP per capita in PPS’, ‘Real GDP 
per  capita  [SDG_08_10]’,  ‘Final  consumption  expenditure of  households per  capita’,  ‘Exports of goods  and 
services per capita’, and ‘Imports of goods and services per capita’. Individual country estimates were then 
adjusted towards their predicted values by the regression model. This slightly reduced the large variation in 
estimates, which probably stemmed from different approaches in producing the different country estimates. 
Multiple imputations used the same predictor variables listed above.  
46 UNODC multiple-system estimation can be used to produce national-level estimates, but has been applied 
so far only in a few EU Member States (UNODC, 2018c). 
47 It should be noted that sex workers and victims of THB for sexual exploitation are very different groups 
that cannot be conflated, and this approach uses only the earnings of sex workers as a rough proxy for the 
possible revenues generated by the victims of THB for sexual exploitation. 

53 

 
 
EUROPEAN COMMISSION 

presumably  provide  a  much  lower  estimate  of  the  proceeds  per  victim  generated  by 
traffickers. Due to these methodological limitations, the market-revenue estimates for 
the lucrative crime of THB beings are also likely much lower than for other crime areas.  

To  compensate  for  the  shortcomings  of  the  lower  bound  estimate,  a  tentative  upper  bound 
estimate for the whole of the EU was produced based on the much higher estimate of ILO 48  for 
the victims of ‘forced sexual exploitation’ (which also accounts for the hidden population). The 
upper bound estimate uses the same proxy values for the annual revenue per victim of trafficking 
for  sexual  exploitation,  which  were  applied  for  the  lower  bound  estimate.  Despite  the 
methodological caveats of producing such upper bound estimates by drawing on ILO data, such 
an approach is also in line with Europol practice of using ILO’s estimates as a yardstick for the 
size of the THB market (Europol, 2015).  

However, it must be emphasised that while ILO’s definition of victims of forced sexual exploitation 
is  broadly  based  on  the  Palermo  protocol,  it  deviates  significantly  from  Directive  2011/36/EU 
(which  we  used  to  outline  the  scope  and  focus  of  the  current  study).  In  addition,  the  latest 
available ILO estimates for the EU (made for 2012) were published just after the Anti-trafficking 
Directive was adopted, and data collections in the EU on THB victims have since been developed 
in relation to the Directive. Therefore, the upper bound estimate does not consider the social and 
economic developments since 2012, which have had an impact on the number of victims trafficked 
for sexual exploitation. 

The table below presents the estimates of THB for sexual exploitation market at the EU-level and 
for each of the 28 EU Member States. The results show that a conservative (lower bound) estimate 
of market revenue is €402 million (€274 million excluding the UK) solely for trafficking for sexual 
exploitation,  hinting  at  a  much  higher  actual  revenue  if  the  hidden  population  of  victims  is 
accounted for. At the same time a tentative estimate of the revenues generated by trafficking for 
sexual exploitation in the EU shows it could be as high as €13 billion.   

Table 2.10: Criminal revenue estimates on THB for sexual exploitation in the 
EU 

EU Member State 

Annual revenue, adjusted for inflation, 2019 (€ million) 

Mid 

Low 

High 

28 EU Member States 

7,185.93 

27 EU Member States without UK 

401.94 

273.70 

13,969.91 

Austria 

Belgium 

Bulgaria 

Croatia 

Cyprus 

Czech Republic 

Denmark 

Estonia 

Finland 

France 

Germany  

Greece 

Hungary  

Ireland 

Italy  

Latvia 

Lithuania 

9.05 

2.46 

6.30 

0.44 

0.99 

0.07 

7.26 

0.14 

1.96 

78.30 

30.00 

3.63 

29.98 

2.65 

50.10 

0.55 

0.25 

48 The most recent estimate available for the EU is for 270,000 persons: ILO (2012).  

54 

 
 
 
 
 
EUROPEAN COMMISSION 

EU Member State 

Annual revenue, adjusted for inflation, 2019 (€ million) 

Mid 

Low 

High 

Luxembourg 

Malta 

Netherlands 

Poland 

Portugal  

Romania 

Slovakia 

Slovenia 

Spain 

Sweden 

United Kingdom 

1.63 

0.07 

24.20 

1.92 

0.91 

7.95 

0.41 

1.01 

7.16 

5.01 

129.73 

Note: Estimates were produced for 2016 and updated to 2019 values using Eurostat (2020b) HICP.  

Data on different Member States indicate a disproportionately large contribution of UK, France, 
Germany, Hungary, Italy and the Netherlands, which together account for 85% of the total market 
(UK alone accounts for 32% of the €130 million). These differences between Member States stem 
mainly  from  the  number  of  registered  victims,  while  the  difference  between  average  annual 
revenues  generated  per victim  are  much smaller49.  Therefore, the relative weight of  particular 
Member States in the total market revenue estimate produced should be interpreted with caution, 
as it likely stems not only from the actual market size, but also from differences in collecting and 
providing information about victims of THB (as discussed in the previous section on the quality of 
prior estimates).   

2.2.5. Criminal actors and modus operandi 

Table 2.11: THB – Actors 

Level of OCG involvement 

Size and composition of OCGs 

Modus operandi of OCGs 

Poly-criminality of OCGs 

Other key actors  

Heavy involvement of OCGs, in trafficking for sexual 
exploitation (especially Nigerian OCGs), for forced 
criminalities and for begging and for organ trafficking. THB 
for sexual exploitation (especially domestic trafficking) can 
be organised not only by OCGs, but also by single 
traffickers often by family members or close person to 
victim. Trafficking for labour exploitation by OCGs is 
increasing. 

Loose networks linked by family kinship or ethnic ties. 
Three types – small-medium sized OCGs, highly organised 
OCGs; unorganised domestic traffickers. 

Recruitment – ‘Lover boy’ method for sexual exploitation; 
use of intermediary companies for labour exploitation. 

Transport – Land and air, including by vehicles organised 
by traffickers (EU OCGs).  

Control – debt bondage, use of threats, psychological and 
physical abuse. 

Drug trafficking, benefit fraud, smuggling, money-
laundering. 

Legitimate businesses involved in the trafficking chain who 
benefit from victims trafficked for sexual and labour 
exploitation and other exploitation include transport, 
recruitment agencies, hotels, agriculture, entertainment 
facilities, construction, catering, etc. 

More than 42 studies identified in the literature review included information on the key actors in 

49 The lowest adjusted annual revenue per sex worker was for Poland: €17,468; highest revenues were for 
Italy and Luxembourg: €92,735 and €118,361 respectively.  

55 

 
 
 
 
EUROPEAN COMMISSION 

THB in the EU and the modus operandi of traffickers. Additional studies were identified that were 
country focused. In addition, interviews were conducted with 22 international and EU experts, as 
well as national practitioners working in the field of investigating THB.  

With regards to the level of OCG involvement, studies and interviewees reveal that THB is a 
crime  that  can  be  conducted  by  individual  criminals  with  limited  organisation  in  place,  or  by 
complex organised criminal networks that govern the entire process of trafficking. International, 
EU-level and national experts provide diverging viewpoints on the level of control exercised by 
OCGs  on  the  market.  According  to  a  law  enforcement  stakeholder,  the  market  is  heavily 
controlled by OCGs, and international-level expert interviewees noted that the proportion of 
OCG convictions related to THB is relatively higher than those in other criminal markets, 
such  as  drug  trafficking  and  smuggling50.  Consistent with  the  literature,  interviewees  revealed 
that OCGs are especially involved in some of the trafficking sub-markets and forms of exploitation.  

In  general,  based  on  literature  and  interviewees,  it  is  concurred  that  trafficking  for  sexual 
exploitation,  trafficking  for  criminal  activities  and  for  begging  and  trafficking  for  organ 
removal purposes are predominantly conducted by OCGs, due to the necessary complexity of the 
operation and the highly profitable nature of the crimes51.  Some noted a decentralisation of the 
actors involved in cases of THB for sexual exploitation, where lone traffickers can organise the 
scheme and exploit one or two victims who are recruited and exploited domestically52. Trafficking 
for begging can be established by OCGs, exploiting many victims for begging and pickpocketing, 
or it can be organised on a family basis, in which parents exploit their children53.  In the case of 
trafficking for labour exploitation, it is organised by individuals as well as OCGs (who also use 
legitimate companies in the process of recruitment and exploitation)54. 

In  terms  of  the  nature  of  the  OCGs  involved,  according  to  Europol  ‘the  typical  structure  of 
criminal groups active in THB consists of loose networks, linked by family kinship or ethnic ties 
(Europol, 2016).’ These groups are highly flexible, able to adapt to changing circumstances and 
respond  to  new  opportunities.  Operations  are  easily  shifted  to  other  countries  in  cases  where 
activities are detected, or when more profitable opportunities are identified (Europol, 2016). In 
the age of the COVID-19 pandemic, OCGs across the whole trafficking chain rely increasingly on 
the internet (Europol, 2020a; European Commission, 2020b).  

UNODC identified  three  types  of  THB  groups  based on the  organisation, size  and  trafficking 
distances (UNODC, 2014).  

•  Small- or medium-sized OCGs, often family- or clan-based, who engage in sub-

regional trafficking. Unlike individual traffickers, these OCGs rarely operate 
independently, instead relying on other actors in specific phases of the trafficking 
process. More robust organisational structures are in place, especially when cultural 
conditions that favour family or local community networks exist (UNODC, 2014). These 
networks are thus applied into criminal activities55. The number of victims being 
exploited by such OCGs simultaneously is higher in number and the period of 
exploitation is longer than for individual traffickers.  

•  Highly organised, large-scale OCGs that engage in sub-regional or trans-regional 

trafficking. These OCGs are more prevalent among non-EU actors, such as Nigerian and 
Chinese OCGs, and are often family- or kinship-based with members coming from the 
same community and cultural background. These OCGs handle all phases of the 
trafficking process independently and are best able to hide their activities via legal 
businesses – for example, hotels, modelling agencies, labour agencies, nightclubs, 
massage parlours, manicure parlours, saunas, cafes, bars and likely others (Europol, 
2016). 

• 

The last group consists of unorganised domestic traffickers. These actors are usually 
independent, individual traffickers who deceive one or a couple of victims 

50  Interview  with  International-level  stakeholder,  20  February  2020  (#33);  Interview  with  EU-level 
stakeholder, 26 February 2020 (#36). 
51  Interview  with  EU-level  stakeholder,  20  February  2020  (#33);  Interview  with  EU-level  stakeholder,  26 
February 2020 (#36). 
52 Interview with Member State stakeholder BE, 26 February 2020 (#37); Interview with EU-level stakeholder, 
20 February 2020 (#33). 
53 Interview with EU-level stakeholder, 26 February 2020 (#36). 
54 Interview with EU-level stakeholder, 26 February 2020 (#36). 
55 Interview with EU-level stakeholder/academic, 19 February 2020 (#53).  

56 

 
 
 
 
EUROPEAN COMMISSION 

interpersonally. They tend to be oriented towards sex trafficking over short distances, 
mostly domestically, although cases of individual labour traffickers have also been 
recorded. This type of organisation may include couples, or a trafficker with one or two 
girls, recruited via the ‘lover boy’ method. According to investigative authorities, victims 
do not realise that they are exploited and do not report the situation to the police56. 

According to Europol, the most threatening OCGs are generally those capable of governing the 
entire process of trafficking, from the recruitment of victims to the reinvestment of the criminal 
proceeds (Europol, 2016). These OCGs are relatively small (up to 15 persons) but have the ability 
to simultaneously handle numerous victims and to move them around between different sites of 
exploitation, having  established  logistical  bases  and contacts in source, transit and destination 
countries (Europol, 2016). The groups do not necessarily have a hierarchical structure and they 
are  able  to  build  flexible  networks  with  cooperating  clusters.  One  cluster  is  responsible  for 
recruitment,  another  cluster  for  transportation  and  control,  another  cluster  for  exploitation. 
According to EU experts, the clusters can together form a well-functioning OCG57. According to a 
study by Paolo Campana on Nigerian trafficking networks, the logistics of OCG THB networks can 
be both costly and very labour intensive (Campana, 2016). 

A reliable source of information on the origins of perpetrators of THB is the data collected by 
the  Commission  from  the  criminal  justice  systems  of  Member  States  on  traffickers  who  are  in 
formal contact with the police and  criminal justice  systems, prosecuted or convicted across all 
Member States. The 2018 report reveals that across the period 2015–2016, 7,503 people were in 
formal contact with the police and criminal justice system (European Commission, 2018e). Most 
people who were suspected (84%) or prosecuted  (87%)  in the EU  for  THB in 2015–2016 with 
known  citizenship  were  nationals  of  Member  States.  Some  three-quarters  of  these  were  adult 
men. Bulgaria, Romania and Germany were among the top five citizenships in terms of suspects 
for both 2010–2012 and 2015–2016. When considering suspects, prosecutions and convictions 
together, Romania, Hungary, the Netherlands, Poland and Bulgaria were in the top five in 2015–
2016 (European Commission, 2018e). 

Only  16%  of  suspects  held  non-EU  nationalities  in  2015–2016.  Of  these,  the  most  frequent 
countries  of  citizenship  were  China,  Nigeria,  Turkey,  Albania  and  Morocco.  (Nigeria,  China, 
Morocco  and  Albania  were  the  most  common  non-EU  citizenships  in  2010–2012.)  In  terms  of 
prosecutions, the top five non-EU countries of citizenship were Nigeria, Albania, Serbia, Bosnia 
and Herzegovina and Egypt (European Commission, 2018e). 

Modus operandi 
THB for sexual exploitation 
THB  for  sexual  exploitation  is  a  form  of  gender-based  violence  that  disproportionately  affects 
women and girls (Yonkova et  al., 2017). It  is the most prevalent form of trafficking in human 
begins in the EU and globally. Member States report that traffickers increasingly use the internet 
and  social  networking  tools  to  recruit  victims,  for  logistics,  to  enable  the  exploitation  of 
victims, and as a marketing platform for prostitution  (European Commission, 2018c; European 
Commission, 2020b). There has been a growing tendency for exploiters to use digital surveillance 
to monitor their victims remotely and distance themselves from the scene of the crime. Traffickers 
increasingly rely on digital communication (i.e. social media, messaging apps, VoIP) in all phases 
of the THB process (European Commission, 2018c; European Commission, 2020b).  

The  EU  SOCTA  concludes  that  OCGs  increasingly  use  legal  businesses  that  can  conceal 
exploitations such as hotels, nightclubs and massage parlours  (Europol, 2017). Interviews with 
national investigative authorities reveal that for instance, in Belgium, brothels could be used to 
conceal sexual exploitation to lower the risk of criminal prosecution58. 

The  traditional  flows  from  Eastern  Europe  to  Western  Europe  has  been  diversified  by  different 
flows of victims from all over the world. The modus operandi thus varies across the legal status 
and ethnic origin of the perpetrators, who recruit, transport and exploit victims in the EU. 

According  to  Europol,  Eastern  and  Central  European  OCGs  (mainly  Bulgarian,  Czech, 
Hungarian, Romanian and Slovakian) were known to have organised hierarchical structures with 
strict divisions. Since these countries entered the EU, Bulgarian, Czech, Hungarian and Romanian 

56 Interview with Member State stakeholder BE, 26 February 2020 (#37). 
57 Interview with EU-level stakeholder, 12 March 2020 (#49). 
58 Interview with Member State stakeholder (BE), 26 February 2020 (#37). 

57 

 
 
EUROPEAN COMMISSION 

OCGs have started relying on more ‘flexible structures’ as a way of adapting to stricter and more 
competent law enforcement standards (Europol, 2016). Victims of sexual exploitation are typically 
recruited by the ‘lover boy’ method of recruitment, where victims are manipulated to become 
emotionally  attached  to  their  exploiters.  EU  citizens  are  typically  transported  through 
conventional channels using their official identification documents, thus making their exploitation 
lucrative (Shentov et al., 2019). 

According to Europol, the sexual exploitation of EU nationals no longer relies predominantly on 
the use  of  violence  and  coercion  towards  victims. Some  OCGs  increasingly  rely  on  threats  of 
violence  towards  victims  and  their  families  rather  than  attacking  the  victim  (Europol,  2017; 
European Commission, 2020b).  

Europol’s reports reveal that non-EU OCGs – Nigerian and Chinese ones being the most prominent 
– are relatively more organised than their European counterparts  (Europol, 2016). Most of the 
Nigerian groups are so called ‘fraternities’ often formed in Nigerian universities. The groups are 
based  on  gang  culture,  with  a  strict  hierarchy  (Europol,  2020c).  Primary  methods  for 
recruitment involve deception, persuasion, outright abduction or a combination of these.  Victims 
are  often  misled  by  false  promises  of  employment  opportunities,  good  working  and/or  living 
conditions, and/or a high wage. Victims can also be deceived by their exploiters and travel to  a 
destination  point  voluntarily,  which  occurs  quite  often  in  ‘lover  boy’  cases  where  emotional 
manipulation  plays  important  role.  Victims  originating  from  outside  the  EU  are  still  routinely 
subjected  to  violence,  debt  bondage,  passport  confiscation  and  other  forms  of  coercion  as  an 
integral part of THB modus operandi  (Europol, 2017). Nigerian victims are recruited from their 
home  country  through  false  promises  of  job  opportunities  in  Europe.  Victims  fall  into  debt 
bondage, which could be more than €30,000 per victim, and are forced to repay this debt through 
prostitution (Europol, 2020c).  

West African victims are often recruited and controlled via the exploitation of cultural beliefs 
related  to  voodoo  rituals.  Case  studies  indicate  that  Nigerian  OCGs  favour  psychological 
techniques related to juju folk magic for recruiting and keeping victims compliant. The Nigerian 
example showcases the importance  of  social  capital and social connections  –  victims are  often 
recruited in their own home, sometimes by a relative or family friend  (Gebrewold et al., 2017; 
UNODC, 2010). Contracts are made between exploiters and victims through the juju ritual, which 
is used to great effect in deterring victims from breaching the agreement because they believe 
bad omens – even death – will follow. The victims are recruited by Madams, who in most cases 
have  been  victims  themselves,  with  false  promises  of  work  in  shops,  hairdressing  salons  and 
domestic  works.  The  women  and  their  families  are  indebted  to  the  traffickers  for  the 
transportation  and  living  costs  and  are  thus  subjected  to  exploitation  to  repay  this  dept59.  EU 
experts, as well as investigators interviewed for this study, assess a slight decrease in the overall 
presence of Nigerian victims in the EU, which could be the result of declining migration pressure, 
or  the  success  of  law  enforcement  operations  that  could  lead  to  the  displacement  of  THB 
networks60. 

Unlike EU-based OCGs, Nigerian and Chinese traffickers are very reliant on falsifying travel 
documents, and abusing tourist visas and the asylum system  (Europol, 2017). Both are known 
for  operating  independently  in  cellular,  kinship-based  structures  and  making  use  of  extensive 
diaspora communities in the EU (Europol, 2017). Non-EU victims are often persuaded to apply for 
asylum or visa to a Member State, usually in the Schengen Area. 

Chinese  sex THB networks recruit  Chinese women via smugglers who obtain tourist visas for 
them. Once they have arrived at their destination, women are temporarily accommodated by local 
Chinese  diaspora  or  EU  nationals  who  are  paid  by  the  OCGs.  Alternatively,  Chinese  actors 
manipulate Chinese women emotionally or deceive them with promises of work, luring them into 
their European exploitation operations (Shentov et al., 2019). 

THB for labour exploitation  
According to Europol, involvement of OCGs in THB for labour exploitation is increasing in the EU. 
OCGs cater to the growing demand for cheap labour across many Member States and have access 
to  many  potential  victims  (Europol,  2016).  Traffickers  often  take  advantage  of  discrepancies 
between national labour legislation in different EU Member States to organise the exploitation of 

59 Interview with Member State stakeholder (SE), 10 March 2020 (#43).  
60 Interview with Member State stakeholder (SE), 10 March 2020 (#43); Interview with EU-level stakeholder, 
26 February 2020 (#36). 

58 

 
 
EUROPEAN COMMISSION 

workers  in  the  grey  zone  between  legal  employment  and  labour  exploitation  (Europol,  2017). 
Further  details  on  the  link  between  THB  for  labour  exploitation  and  underground  economic 
practices is available in Annex 3.4.  

According  to  Europol,  victims  are  usually  recruited  through  deception  about  the  nature  or 
conditions of the work, with promises of well-paid jobs with no requirement for qualifications. The 
recruitment  is  conducted  by  online  advertisements,  newspapers,  word  of  mouth  and  local 
employment agencies (Europol, 2016). 

The  transport  is  typically  organised  by  land  in  the  case  of  EU  nationals.  In  the  case  of  third 
country  nationals,  traffickers  provide  victims  with  false  documents  and  sometimes  bogus 
contracts to facilitate travel across borders. Victims are often charged extortionate fees for their 
travel, which eventually leads to debt entrapment as a tactic to keep them in exploitation (Europol, 
2016). 

According  to  the  ILO,  the  intermediaries  facilitating  the  link  between  supply  and  demand  of 
migrant labour can be criminal networks or disguised legitimate business with close ties to the 
formal and informal economy in destination countries (Andrees, 2008). In labour exploitation in 
general, perpetrators either infiltrate or create their legal business structures to recruit workers, 
to engage in a contractual relationship with them, and move them to the country of exploitation. 
This also serves as a facade for criminal activities because it gives an impression of legitimacy 
(European Commission, 2020b)61. 

A  Europol  report  reveals  that  compliance  is  achieved  less  by  the  use  of  force,  and  more  by 
victims being subject to verbal manipulation, psychological pressure and threats. Victims are told 
that they have incurred significant costs for their transport, accommodation and arrangement of 
logistics,  which  they  have  to  repay  with  long  hours  of  labour  (Europol,  2016  #293;  European 
Commission, 2020b). The workers are offered contracts, sometimes in a language that they do 
not understand. Sometimes passports are taken by the traffickers when the victims arrive at the 
country of exploitation, with the excuse that they will be used to register the workers with the 
social services62. 

Previous studies reveal that the use of intermediaries and long labour-supply chains – including 
cascade  subcontracting  – are  some  of  the  main  features  in  cases  of  labour  exploitation  where 
traffickers also exploit the informal sector (Davies & Ollus, 2019). The role of supply chains (both 
of  products  and  labour)  is  also  argued  to  be  key  to  identifying  the  intersections  between  the 
formal  and  informal  economy  within  forced  labour  and  labour  THB  (Allain,  Crane,  LeBaron,  & 
Behbahani, 2013).  

THB for forced begging 
Traffickers  typically  target  child  victims  for  forced  begging  through  voluntary  offers  to  their 
families, or recruit adults with physical and psychological disabilities. OCGs involved in THB for 
forced begging specifically target vulnerable people, such as children deprived of parental care, 
or single mothers (Europol, 2014).  

Traffickers target impoverished families and push them into debt with the involvement of complicit 
money lenders. High interest rates prevent families from paying off debt, prompting them to put 
children in exploitative situations (Europol, 2014). Monetary transactions between the traffickers 
and the families can take place and the families subsequently provide the traffickers with the legal 
documents needed  for the minor to  leave the country  (Europol,  2016). As with other  forms of 
THB, ethnic and cultural ties are used by traffickers who mainly target their fellow nationals. 
Roma  are  flagged  by  Anti-Slavery  Study  as  particularly  vulnerable  to  THB  for  forced  begging 
(Anti-slavery, 2014). Young Roma women and girls are especially vulnerable to exploitation and 
trafficking, which is sometimes arranged by their own families. Children are mainly engaged in 
street crimes such as pick-pocketing, bag-snatching and shoplifting in crowded and tourist areas. 
Men  are  traditionally  in  charge  of  the  logistics  and  organisational  management  of  the  criminal 
activities (Europol 2016).  

Children usually travel under genuine passports of unrelated adults, though multiple identities 
are used, and the identities of children of close resemblance are used interchangeably to avoid 

61 Interview with EU-level stakeholder, 12 March 2020 (#49).  
62 Interview with EU-level stakeholder, 12 March 2020 (#49). 

59 

 
 
 
 
 
EUROPEAN COMMISSION 

detection. The traffickers are very flexible and mobile, and children are quickly moved from one 
country to another upon detection from law enforcement63. 

In the phase of exploitation, in the case of minors a lower level of coercion is used, as they are 
dependent on adults. Instead, pressure is exerted from their traffickers or relatives to beg and 
achieve a minimum amount of money. Children often do not consider themselves as victims of 
exploitation, thus further challenging their identification as victims (Europol, 2014). Nevertheless, 
EU  Directive  2011/36  stipulates  that  consent  of  a  victim  of  THB  to  their  exploitation,  whether 
intended or actual, is irrelevant. 

Child begging could be accompanied by other auxiliary activities such as selling flowers, candles, 
tissues,  gadgets,  newspapers  or  socks,  etc.,  or  offering  services,  such  as  washing  car 
windscreens, parking services or playing music. In addition, children are either accompanied by 
an adult, who collects the money right away, or monitored by an adult, who collects the money 
at certain times of the day (European Commission, 2012). 

THB for forced begging can be organised by individuals, exploiting family members or relatives, 
or it can be managed by a sophisticated OCG, exploiting more than 2,000 victims for begging and 
petty  crime64.  However,  as  victims  are  most  likely  encountered  by  non-THB  experts,  including 
frontline police officers, begging incidents are dealt with individually and often treated as a minor 
offence. Authorities rarely detect the organised nature of the group behind the activity65.  

THB for organ removal 
The demand for organ transplants has been exploited by trafficking networks that engage in organ 
trafficking or THB for the purpose of organ removal. The most sought-after organs are kidneys, 
followed by liver lobes (Shimazono, 2007). While the latter falls within the scope of anti-trafficking 
legislation, there is little knowledge on the extent and characteristics of the phenomenon. For the 
2017–2018  Data Collection of the  European  Commission  only 27  cases of  trafficking for organ 
removal were reported in the whole EU (European Commission, 2020b). THB for organ removal 
was reported under  ‘other forms of trafficking’  in previous Commission  data collection reports. 
These other forms of trafficking accounted for 12% of victims of THB in 2013–2014 and 18% in 
2015–2016. The  metadata  information  of  the  2018  report  –  containing  comments  from  the 
reporting  countries  and  EU  agencies  –  includes  only  limited  indications  of  trafficking  for  organ 
removals taking place in the EU (European Commission, 2018c). 

Prior academic studies reveal that trafficking networks involved in trafficking of persons for organ 
removal vary in size, division of tasks between actors and geographical scope of activities. Experts 
point  to  the  predominant  involvement  of  OCGs  due  to  the  transnational  and  highly  profitable 
nature of the crime66. A UNODC assessment tool kit states that the severe organ scarcity leads to 
the functioning of the black market, where OCGs may act as a link between impoverished people 
who  are  willing  to  sell  their  organs,  and  those  seeking  transplants  (UNODC,  2015c).  Studies 
delineate  several  key  roles  of  actors  involved  in  this  type  of  crime,  including:  brokers,  local 
recruiters, healthcare professionals and facilitators (Bos, 2015).   

Brokers  typically  manage  overarching  logistics  by  tracking  down  lucrative  deals,  connecting 
clients,  victims  and  surgeons,  and  generally  managing  the  whole  operation.  These  actors  are 
usually  best  placed  to  coordinate  the  other  roles  and  make  strategic  decisions  for  the  group. 
Brokers negotiate the price of the transplant package and set a fee for the organ supplier. Several 
brokers may be involved in larger transnational networks. In some  cases,  doctors/surgeons or 
directors of hospitals or tissue-matching laboratories may play the role of brokers (Bos, 2015).  

Local recruiters procure victims, typically from their own community. Some former victims are 
told  they  will  only  be  paid  for  their  organs  if  they  help  in  the  recruitment  process.  Recruiters 
typically operate within one country or a specific geographical area and are sometimes involved 
in  other  forms  of  THB  (e.g.  sexual  exploitation,  forced  labour).  The  local  recruiters  receive 
payments per successful recruit (i.e. resulting in a transplant) (Bos, 2015).  

63 Interview with EU-level stakeholder, 10 March 2020 (#44).  
64 Interview with EU-level stakeholder, 26 February 2020 (#36). 
65 Interview with EU-level stakeholder, 10 March 2020, (#44). 
66  Interview  with  EU-level  stakeholder,  26  February  2020  (#36);  Interview  with  EU-level  stakeholder,  20 
February 2020 (#33). 

60 

 
 
 
  
 
EUROPEAN COMMISSION 

Healthcare professionals consist of a variety of medical experts who are necessary for organ 
transplantation – from surgeons to anaesthesiologists. The low number of prosecutions of doctors 
in cases of THB for organ removal suggests this is the safest role in the group. Lastly, facilitators 
are not necessarily directly engaged with the operation, but they enable its functioning by giving 
the  group  access  to  medical  facilities,  medical  licenses  and  signing  off  on  transplantation 
surgeries. Thus, facilitators can be a variety of actors – from public officials to low ranking nurses 
and administrative staff in  hospitals  (López-Fraga et al., 2017). Unlike OCGs engaged in other 
forms of THB, actors in this sub-market are opportunists rather than professional criminals: ‘they 
do  not  specialize  in  criminal  activity’  and  ‘neither  do  they  cater  to  a  specific  market’.  Their 
connection  to  the  formal  economy  is  a  precondition  for  the  success  of  the  criminal  operation 
(Columb, 2017).  

Expert interviews reveal that OCGs revert to corruption for the conduct of trafficking for organ 
removal67. Typically, this may involve corrupt police and/or customs officials, officials giving out 
visa and travel documents, and sometimes officials in the health administration who issue false 
licenses to hospitals and doctors (Bos, 2015). 

THB for criminal activities 
Despite  the  entry  into  force  of  the  EU  anti-trafficking  Directive  2011/36/EU  –  which  includes 
criminal activities as a form of exploitation – this type of THB remains under-researched. Europol 
reports that victims are increasingly used by THB networks for criminal activities, such as begging, 
benefit fraud, identity fraud, credit fraud and insurance fraud (Europol, 2015). Notably, Article 8 
of  the  EU  Directive  calls  for  non-punishment  of  criminal  activities  that  perpetrators  have  been 
compelled to commit because of THB (European Parliament, 2011). In the Second report on the 
progress made in the fight against THB (2018), Member States report an increase in trafficking 
for  forced  criminality  and  forced  begging  (European  Commission,  2018d).  An  additional  noted 
tendency by Member States is the increase of instances of victims entering into sham or forced 
marriages.  Such  victims  may  be  subjected  to  sexual  or  labour  exploitation,  forced  into 
childbearing  or  compelled  to  marry  non-EU  citizens  to  regularise  their  stay  (European 
Commission, 2018d).  

A Europol brief concludes that children are especially vulnerable to trafficking for criminal activities 
due  to  their  dependency  on  adults  (Europol,  2014).  According  to  Europol,  minors  are  usually 
recruited from families in difficult economic circumstances. In some cases, children are sold by 
their families to the traffickers. Thus, they do not consider themselves to be in an exploitative 
situation, but rather perceive their exploitation as loyalty to their family (Europol, 2014).  

A study on THB for the purpose of criminal activities and forced begging in the UK, Ireland, the 
Czech Republic and the Netherlands and across the EU by Anti-Slavery reports that very few cases 
are reported in official statistics and many victims are misidentified as offenders. According to the 
study, victims – most commonly trafficked for forced criminality and begging – come from South-
East Europe (many of them of Roma origin) and from South-East Asia (Vietnam and China) (Anti-
slavery, 2014).  

THB for criminal activities illustrates one of the aspects of the poly-criminality of THB. Even if 
THB is the primary operation of a criminal group, according to Europol it is often facilitated through 
other  illicit  activities,  such  as  money-laundering,  drug  trafficking,  illegal  immigration,  and 
smuggling  money  and  people  (Europol,  2016).  Regarding  THB  for  sexual  exploitation, 
perpetrators  often  make  their  victims  dependent  on  drugs  or  utilize  pre-existing  addictions  to 
control them. Europol reports that victims of THB are often also exploited for the production and 
trafficking  of  drugs  (Europol,  2016).  THB  OCGs  from  Southern  Italy  and  Albania  have  been 
documented  exchanging  drugs  –  or  trading  them  at  privileged  prices  –  with  other  groups,  in 
exchange  for  consent  to  carry  out  exploitation  of  THB  victims  on  their  territory.  Alternatively, 
OCGs  have  been  known  to  reinvest  income  from  THB  into  improving  their  relations  with  drug 
traffickers as part of a complex interplay in a criminal hierarchy (Raets & Janssens, 2019). 

2.2.6. Future trends and dynamics  

Table 2.12: THB – Future trends 

Future trends and dynamics 

Increasing use of internet and technological advances. 
Increased targeting of people with developmental and 

67 Interview with EU-level stakeholder, 26 February 2020 (#33). 

61 

 
 
 
   
 
EUROPEAN COMMISSION 

Impact on market and criminal 
finances  

physical disabilities, and increased targeting and use of 
legal businesses.  

Multiple flows into EU criminal markets, diverse flows of 
victims. Increased demand for sexual services leading to 
exploitation.  

Three studies were identified in the literature review that included information on future trends 
and dynamics in THB in the EU. Several discernible trends are reported by Member States in the 
latest  reports  of  the  Commission.  Member  States  report  that  the  age  of  identified  victims  is 
decreasing, with children constituting nearly a quarter (23%) of identified victims. Children from 
Eastern European countries and Roma communities continue to be particularly vulnerable, with 
traffickers  exploiting  kinship  in  order  to  organize  recruitment  and  exploitation  of  the  child.  In 
addition,  people  with  developmental  and  physical  disabilities  are  increasingly  targeted  by 
traffickers (European Commission, 2018e). 

As previously noted, traffickers use  physical  abuse  less  frequently,  instead  using  psychological 
and  emotional  violence  and  threats  to  control  victims.  This  poses  additional  challenges  for 
detection. Member states also report the increasing number of women as perpetrators of THB; in 
many cases these women are former victims themselves. Nevertheless, women account for only 
one  quarter  of  prosecuted  and  convicted  suspects.  Around  three-quarters  of  those  suspected, 
prosecuted or convicted for THB are male (European Commission, 2018c).  

In  the  latest  EU  SOCTA  report,  Europol  identified  the  following  major  trends:  (1)  traffickers 
continue to rely on the use of social media, VoIP and instant messaging applications at all stages 
of the THB cycle; (2) THB for labour exploitation is increasing in the EU and traffickers are mostly 
targeting  less  regulated  industries  and  those  with  seasonal  demand  of  labour  force;  (3)  the 
traditional trafficking flow from Eastern Europe to Western Europe is gradually being replaced by 
multiple  and  diverse  flows  of  victims  from  all  over  the  world  –  in  this  aspect,  THB  flows  from 
Nigeria and China contribute the highest numbers; and (4) traffickers have further increased their 
use  of  legal  businesses  that  can  conceal  exploitation,  such  as  hotels,  nightclubs  and  massage 
parlours (Europol, 2017). 

A Europol report on the future of organised crime reveals that technological advances in robotics, 
nanotechnology, cryptocurrencies and digital surveillance, as well as the digitalisation of Big Data, 
could  act  as  enabling  factors  for  traffickers  to  create  new  and  sophisticated  strategies  that 
simultaneously reduce their chances of detection. The ongoing outsourcing of data management 
to a few consolidated companies on a global level will create new opportunities for cyber-stealing 
personal  data  (i.e.  identities  for  victims)  or  information  related  to  transportation  and  logistics 
(Europol, 2017).   

According to Europol, organised crime will continue to target vulnerable persons for exploitation, 
with  increasing  targeting  of  EU  citizens.  Legal  business  structures  will  be  targeted  on  an 
unprecedented scale, both as targets for infiltration and victims of the crime (Europol, 2017).     

According to the report on future trends in organised crime, increased socio-economic disparities 
within and outside the EU will facilitate migration, mobility pressure and THB in this context – the 
larger these disparities become, the more lucrative THB will be. Higher demand for cheap labour 
will result in higher levels of THB for labour exploitation. The EU’s economic stagnation and relative 
decrease  in  prosperity  may  create  immigration  pressure  on  EU  citizens  in  struggling  Member 
States, which will in turn create opportunities for THB of EU citizens outside the EU. As Europol 
has noted, ‘OCGs may respond to an increasing demand for the sexual exploitation of European 
women  in  countries  with  emerging  middle  classes’  (Europol,  2017).  The  Commission’s  second 
progress report identifies migration as one of the socio-economic vulnerability factors that make 
people fall prey of traffickers (European Commission, 2018d). It is important to note that although 
traffickers take advantage of vulnerabilities, including immigration pressures,  vulnerabilities do 
not alone result in trafficking. Trafficking is driven by the huge profits it renders to OCGs. 

2.2.7. Recommendations 

There are two principal ways in which data collection and estimation on THB (for various types of 
exploitation) could be improved in the EU:  

• 

First, the Commission’s data collection on THB provides a sound basis for establishing 
the number of identified and presumed victims, but an additional step is needed in order 

62 

 
 
EUROPEAN COMMISSION 

to account for the full extent of the phenomenon – a reliable estimate is required of 
the hidden population that is not registered and therefore not included in the 
statistics (European Commission, 2018c; European Commission, 2020b).  

•  Various methods for estimation of hidden populations have been suggested and 
successfully applied in many other fields, such as problem drug use (EMCDDA & 
Pompidou Group, 1997). Similar approaches might be discussed, agreed and eventually 
supported by the Commission for producing estimates of the hidden population of THB 
victims at Member State level and ultimately on EU-level. Reliable estimates of this 
population will eventually allow more accurate estimates, not only for THB for sexual 
exploitation, but also for the other THB sub-markets. 

•  Second, there is a clear lack of systematically collected data on the annual revenues per 
victim for the different forms of THB. Collecting such data – especially from identified 
victims – could greatly facilitate future estimation of the THB market. Currently 
information on revenues generated by victims is collected within financial investigations 
related to THB cases, when police or judicial authorities trace finances and assets of 
perpetrators. The Commission might consider requesting that Member States’ police 
and/or judicial authorities collect or report this data along with the number of 
registered victims. 

The key findings from this study and the related recommendations are summarised in the table 
below.  

Table 2.13: Recommendations – THB market 

Key finding 

Recommendation 

Actor 

Member States, particularly 
police and judicial 
authorities  

EU Anti-Trafficking 
Coordinator 

European Commission  

The European Commission collects 
data on the number of registered 
victims of THB, which provides the 
basis for the lower boundary 
estimate of THB for sexual 
exploitation at the Member State 
level.  

However, there is no agreement on 
how best to account for the hidden 
population of victims, and the only 
available proxy for monetising 
these estimates is the revenues 
generated through sex work.   

There are no secondary data 
sources available for reliably 
estimating the revenues generated 
through THB for reasons other than 
sexual exploitation (i.e. labour 
exploitation, forced begging, organ 
removal or participation in criminal 
activity).  

Consideration to be given to how 
best to estimate the hidden 
population of THB victims on EU-
level by developing further the 
range of methodologies currently 
available. This will improve 
estimation of potential number of 
victims of THB for various forms of 
exploitation, including for sexual 
and labour exploitation.  

Member States should 
systematically report to the 
European Commission and the EU 
Anti-Trafficking Coordinator 
information on revenues generated 
through THB, which is currently 
collected by police or judicial 
authorities in the course of their 
investigations.  

2.3.  Smuggling of migrants  

Quentin Liger, Optimity Advisors  

Key findings: 

•  According to the estimates produced for this study, the annual revenues derived from 
the smuggling of migrants in the EU range from €165 million to €278 million (€221 
million). 

• 

This estimate is lower than previous ones, reflecting the lower number of irregular 
migrants seeking to enter the EU since the peak of 2015 (FRONTEX, 2020).  

•  A diverse range of actors within migrant-smuggling networks perform a variety of 

roles, from small local facility-based operations to larger criminal networks. Over time 
groups have become more structured and hierarchical, with a more developed use of 
new technologies including encrypted messaging systems (such as Telegram) or the 
dark net. 

63 

 
EUROPEAN COMMISSION 

• 

The phenomenon of  migrant smuggling is not expected to subside in the coming 
years. However, historically the number of migrants smuggled, their country of origin 
and the routes they have taken have evolved. While migration and smuggling routes 
change on a regular basis in response to external factors, hubs where the demand 
and supply of smuggling services meet are rather more stable over time. These hubs 
are often located in important metropolitan areas. 

This Annex provides a comprehensive overview of smuggling of migrants in the EU, building upon 
the summary provided in Section 2.3 of the main report.   

The smuggling of migrants stems from the demand from some populations to irregularly cross 
borders  due  to  circumstances  including  war,  persecution  and  economic  hardship.  The  limited 
range of legal channels that is available for migration fuels the market for smuggling services. 
Smuggling of migrants typically occurs when and where borders are fixed, relatively impermeable 
and protected by a border bureaucracy, which can include border-crossing points, border guards, 
passport  controls,  entry  visas  and  stamps  on  passports  when  entering  or  leaving  a  country 
(Mountz,  2010).  Smuggling  of  migrants  is  driven  by  a  demand  for  and  supply  of  smuggling 
services to circumvent existing regulation (UNODC, 2018a): traditionally, there have been buyers 
(migrants) and sellers (smugglers) with access to good information about the market, who were 
free to join or leave the market and could access resources relatively easily, with relatively low 
investment and disinvestment consequences (on the Mediterranean). In parallel, some smugglers 
benefitted from their knowledge of the regions crossed – for instance, this was particularly the 
case of the Tuaregs in  the  Sahel region  of  Africa.  This  trend  has changed  in recent years  –  in 
Niger for instance, the smuggling of migrants was an activity often carried out by Tuaregs, but 
the flow of irregular migrants was curbed, partly through initiatives financed by the EU (Comolli, 
2019). 

The  smuggling  of  migrants  is  –  according  to  the  UNODC  (2018a)  – a  crime  involving  the 
procurement for financial or other material benefit of illegal entry of a person into a State of which 
that person is not a national or resident. 

2.3.1. Previous  revenue  estimates  of  the  EU  market  for 

smuggling of migrants 

The literature  search identified five studies that  contained  prior estimates of  the EU  market in 
smuggling of migrants (as opposed to the phenomenon in other geographical areas).  

According to the 2018 UNODC Global Study on Smuggling of Migrants, in 2016 a minimum of 2.5 
million migrants were smuggled globally, for an economic return of  between $5.5 billion and 7 
billion (United States Dollars (USD)) (UNODC, 2018a). At the European level, the 2016 figure for 
the three Mediterranean routes (the main channels of irregular migration into the EU) stood at 
375,000 migrants and a total revenue of between $320 million and $550 million (USD). These 
estimates only relate to the crossing of the Mediterranean Sea into the EU. In order to have a 
more holistic picture, the volume and revenue from migrants smuggled within Africa to the north 
African shore was estimated at 480,000 migrants per year, for a total revenue of between $1.06 
billion and $1.514 billion (USD) (UNODC, 2018a). According to a joint Europol-INTERPOL Report 
on Migrant Smuggling Networks, the annual turnover of the smuggling of migrants to the EU was 
worth an estimated $6.6 billion (USD) in 2015 alone (Europol-Interpol, 2016).  

In both studies, the figures used detection at borders as a proxy for irregular migration, estimating 
that  roughly  90%  of  people  detected  have  been  smuggled.  The  figure  stems  from  Europol’s 
assessment  that  over  90%  of  irregular  migrants  travelling  to  the  EU  have  used  facilitation 
services. The share of migrants irregularly entering the EU by air is expected to be significantly 
lower than by sea, but the detection rates are much lower. Furthermore, to-date no method has 
been devised to assess secondary movements within the EU, partly due to the free movement 
principle  within  the  Schengen  area68.  This  is  despite  the  fact  that  smuggling  within  the  EU  is 
known to occur, in particular between Austria and Germany or in the English Channel towards the 
UK (Europol, 2018a). 

68 Once  a  person  has  entered  the  Schengen  area,  the  absence  of  border checks  at  frontiers  makes  it very 
difficult  to  trace  them.  Some migrant  purposefully provide fake  names  when  first recorded  in order  not  to 
have to ask asylum in the first country or arrival in line with the Dublin principle.  

64 

 
 
 
EUROPEAN COMMISSION 

Several publications also  provide interesting data on  the prices  paid  by  smuggled migrants on 
certain legs of the migration route, which allows for a relatively good level of granularity in valuing 
the market. These data generally stem from ethnographic research with smuggled migrants, and 
show the variation in price linked to the route, the season of travel and the mode of transport. 
For  instance,  the  cost  of  being  smuggled  from  Pakistan  to  Western  Europe  can  vary  between 
$3,000 for a land journey to over $18,000 by air (UNODC, 2015b). Similarly, the passage from 
Morocco  to  Spain  can  vary  between  €500  on  a  toy  inflatable  boat  to  €3,000  using  a  jet  ski 
(FRONTEX, 2018). The table below provides a compilation of price-per-passage for routes to or 
on the way to the EU. 

Table 2.14: Price per passage for route to or on the way to the EU 

Price per passage 

Type of transport 

Leg 

Turkey–Greece 

Turkey–Bulgaria  

Morocco–Spain 

€1,000–€2,000 

€2,500–€3,000 

€500–€1,000 

Bangladesh–Europe 

€12,000–€18,000 

Malta–Italy 

Eritrea–Libya/Egypt 

€1,000 

€3,700 

Somalia–Egypt 

€1,800–€3,200 

Agadez (Niger)–Libyan coast 

€1,800–€2,800 

France–UK 

Libya–Italy 

€4,500–€6,900 

€460–€2,300 

India–Europe  

€14,000–€27,500 

Afghanistan–Europe 

€9,100–€13,800 

Pakistan–Europe 

Pakistan–Europe 

Source: UNODC (2018a). 

€2,800–€7,300 

€11,000–€16,500 

sea 

land 

land/sea 

air 

sea 

land 

land 

land 

sea 

sea 

air 

land 

land 

air 

2.3.2. Quality of prior revenue estimates  

The literature highlights the difficulties of assessing the size of the market for the smuggling of 
migrants. The route taken by migrants to reach their destination can be divided into several legs. 
For  instance,  a  prospective  irregular  migrant  leaving  West  Africa  will  first  be  smuggled  to  the 
Mediterranean  coast,  before  finding  passage  across  the  Mediterranean  Sea  into  the  EU,  from 
where another smuggler might be paid to assist with the secondary movement of the migrant to 
the final country of destination. Estimates of the volume and revenue of smuggling is therefore 
better undertaken by looking at the routes taken by migrants being smuggled. A second difficulty 
relates to the quick adaptation of smugglers’ networks to new situations, which means the routes 
are constantly evolving (European Commission, 2014b).  

All the studies identified used the same method of calculation. They start by assessing the total 
number of irregular migrants detected at the border of the EU and multiply these figures by the 
price  of  smuggling.  The  number  of  detected  irregular  migrants  is  a  robust  indicator  used  by 
Europol to assess the number of smuggled migrants. It is reliable because most arrivals are by 
sea and there are facilities – especially in Italy, Greece, Spain and Malta – to detect and count 
the number of migrants. Second, the migrants arriving do not avoid detection, merely seeking to 
arrive on the territory of the EU. 

The other benefit of using this method is that there is an important granularity of data relating to 
the first place of arrival in the EU, the route taken by the smuggled migrants, and their country 
of origin. The main shortcoming of the estimates is that they refer solely to migrants entering the 

65 

 
EUROPEAN COMMISSION 

EU and do not provide any estimate of secondary movement69 – a phenomenon that is recognised 
as being underreported. 

The estimates hold certain caveats. The aim of the UNODC report was to better understand the 
phenomenon of the smuggling of migrants, including routes, push- and pull-factors, and volume. 
Much of the quantitative data presented in the UNODC study do not relate solely to smuggling of 
migrants or solely to migrants whose passage to the EU has been facilitated. The study also tries 
to estimate the magnitude and revenue from selected smuggling routes, but for many routes it 
was not possible to collect sufficient evidence to estimate the number of smuggled migrants or 
the  income  from  smuggling.  Therefore,  the  global  figures  presented  by  UNODC  represent 
minimum  values  for  the  magnitude  of  and  criminal  revenues  from  the  smuggling  of  migrants 
(UNODC, 2018a). 

69 Secondary movement refers to the phenomenon of migrants who – for various reasons – move from the 
country  in  which  they  first  arrived,  to  seek  protection  or  permanent  resettlement  elsewhere  in  the  EU  or 
Schengen area. 

66 

 
 
EUROPEAN COMMISSION 

Table 2.15: Prior studies estimating the size or revenue from smuggling of migrants in the EU 

Citation 

Year(s) of 
estimate 

Data source(s) 

Countries included 
in estimate 

Disaggregated 
at Member 
State level?  

Estimate 
produced (size)  

Estimate produced 
(revenue) 

1 

Europol-Interpol 
(2016) 

2015 

2 

UNODC (2018a) 

2012-2016 

3 

Europol (2018a) 

2018 

Number of migrants 
entering the EU 
(detections of illegal 
border-crossings) 

Number of migrants 
entering the EU 
(detections of illegal 
border-crossings) 

Number of migrants 
entering the EU 
(detections of illegal 
border-crossings) 

EU 28  

EU 28 

EU 28 

2014 

Interviews with migrants 

4 

Optimity Advisors 
(2014) in 
European 
Commission 
(2015) 

Italy, Greece, 
Bulgaria, Hungary 
(plus additional 
research in the 
United Kingdom, 
France, Spain, 
Belgium, the 
Netherlands, 
Germany, Poland, 
Sweden) 

No 

No 

No 

No 

1 million irregular 
migrants 

$5 billion (USD) 

375,000 smuggled 
migrants 

$320 million (USD) to $550 
million (USD) 

91,699 arrivals 

€190 million 

N/A 

Price of leg to smuggled 
migrant: 

$1,000 (USD) to $8,000 
(USD) for Turkey–Greece leg 

$500 (USD) to $2,500 (USD) 
for Libya–Italy leg 

5 

FRONTEX (2019) 

2017, 2018 

Data reported by border 
and coastguard agencies 

EU 28 

No, but by route  150,114 (2018) 

N/A 

204,750 (2017) 

67 

 
 
EUROPEAN COMMISSION 

2.3.3. Methodology for estimating revenues in this study  

The methodological approach we adopted in this study for estimating the market revenues from 
the smuggling of migrants  involved  collecting data on  detection of  illegal border-crossings and 
cross-referencing this data with the reported price of various legs of the journey.  The summary 
of the approach for measuring the revenue from smuggling of migrants in the EU is outlined in 
the table below. 

Table 2.16: Summary of approach for estimating the revenues from the 
smuggling of migrants  

Summary of approach  Demand-based estimate of the smuggling of migrants using information on 

detections of illegal border-crossings and price paid to smugglers for various 
legs of the journey. 

Rationale 

The estimates provide information on the revenue from the smuggling of 
migrants towards the EU, divided by major routes.  

Scope and coverage 

Geographical scope: EU-level estimate and estimate by main routes  

Year(s) of estimate: 2018, updated to 2019 values  

Data sources 

Data on number of illegal border-crossing detections have been 
extracted from FRONTEX risk-analysis data (FRONTEX, 2018).  

Key steps 

Rationale for 
approach 

Limitations and 
caveats of this 
approach 

The price of smuggling operations according to specific routes and modus 
operandi was sourced from various publications, in particular UNODC 
(2018a), Optimity Advisors (2015) and journalistic sources (Coles & Nasralla, 
2015; Leinez, 2019). 

- 

- 

- 

Data on detections of illegal border-crossings along the EU’s external 
borders by different migratory routes, nationalities of migrants 
detected, etc. was extracted from FRONTEX’s risk analysis. Data is 
presented per migratory route towards the EU. The sum of the 
routes can therefore be said to represent the total number of 
detections at the EU’s external borders. 

Based on findings in the literature (Europol, 2018a; UNODC, 2018a) 
and interviews, it was assumed that 90% of detected migrants 
irregularly crossing the EU’s external borders (from Step 1) used 
facilitation services, and therefore paid for an illegal service. A 90% 
factor was therefore applied to the figures from Step 1. 

Data on the price of smuggling per route and leg of the route was 
applied to the figures. FRONTEX data (from Step 1) provides the 
nationality of the migrants and in some cases the route (land, sea or 
air). It was assumed that migrants departed from their country of 
nationality, and we attempted to build the costs accordingly.  

As an example, for a migrant from Cote d’Ivoire detected on the 
central Mediterranean route, the reported price of smuggling 
between Agadez and the Libyan coast (between €1,800 and €2,800) 
was added to the price of travel between Libya and Italy (€460 to 
€2,600).  

Given the price data are often presented as a range, we calculated the lower, 
higher and average revenue from the journeys.  

For each route, the assessment of market revenue used the following 
formula: 

𝑀𝑎𝑟𝑘𝑒𝑡 𝑣𝑎𝑙𝑢𝑒
= 𝑁𝑢𝑚𝑏𝑒𝑟 𝑜𝑓 𝑑𝑒𝑡𝑒𝑐𝑡𝑒𝑑 𝑖𝑙𝑙𝑒𝑔𝑎𝑙 𝑚𝑖𝑔𝑟𝑎𝑛𝑡 𝑐𝑟𝑜𝑠𝑠𝑖𝑛𝑔𝑠

∗ 𝑆ℎ𝑎𝑟𝑒 𝑜𝑓 𝑑𝑒𝑡𝑒𝑐𝑡𝑒𝑑 𝑚𝑖𝑔𝑟𝑎𝑛𝑡𝑠 𝑤ℎ𝑜 𝑝𝑎𝑖𝑑 𝑓𝑜𝑟 𝑡ℎ𝑒𝑖𝑟 𝑗𝑜𝑢𝑟𝑛𝑒𝑦 𝑡𝑜 𝑏𝑒 𝑓𝑎𝑐𝑖𝑙𝑖𝑡𝑎𝑡𝑒𝑑  (

∗ 𝑃𝑟𝑖𝑐𝑒 𝑓𝑜𝑟 𝑡ℎ𝑎𝑡 𝑟𝑜𝑢𝑡𝑒 

𝑎𝑠𝑠𝑢𝑚𝑒𝑑 𝑡𝑜 
𝑏𝑒 90%

)

Available information on the revenue from smuggling is not comprehensive 
and does not allow a systematic overall calculation for a smuggling operation. 
Generally, the best information is available on price paid by migrants for 
smuggling services. These values heavily depend on the distance of the 
smuggling trajectory, number of border crossings, geographical conditions, 
means of transport, risk of detection, the use of fraudulent travel or identity 
documents, and other factors.  

While it does provide an overall figure and some granularity, this method has 
the following limitations: 

68 

 
 
EUROPEAN COMMISSION 

- 

- 

- 

- 

The cost of smuggling operations is highly elastic and it is likely that 
the cost of smuggling varies according to demand (Optimity 
Advisors, 2015). Given the limited availability of data, the prices 
used in this study have been applied regardless of when they were 
developed, meaning that the results might have limited applicability 
over time. 

The price of smuggling operations also varies according to the safety 
and comfort of the journey (for instance, the cheapest sea crossing 
might be on an old boat whose main aim is to reach international 
seas, while a more expensive crossing on the western Mediterranean 
route might be on a jet ski). The data availability meant that our 
method could not account for these differences.  

This method does not consider secondary and tertiary movements 
within the EU. At the time the research was undertaken, there were 
little data on secondary movements within the EU and to the UK. 
Furthermore, the methodology used does not allow for a granular 
assessment of the revenues of the smuggling of migrants along the 
Western Balkan routes. 

This method does not consider the number of irregular migrants 
using smugglers to enter the EU via air. In this case, the cost of the 
operation is likely to be mainly related to the procurement of fake or 
fraudulent documents.  

While the data from FRONTEX is the best available basis for estimating the 
number of migrants smuggled into the EU, it is not perfect. First, not all 
irregular migrants detected used smuggling services; second, not all irregular 
migrants are detected (and therefore included in the data). 

2.3.4. Revenue  estimates  of  the  EU  market  for  smuggling  of 

migrants  

The table below presents the estimates of smuggling of migrants at the EU-level and for different 
smuggling routes. The results show that: 

• 

• 

The estimated revenue from the smuggling of migrants in the EU ranged from around 
€213 million to €363 million.  

The Eastern Mediterranean route constituted the largest market share at between €81 
million and €122 million. 

A sensitivity analysis shows that unsurprisingly, the figures vary proportionally if the assumption 
of migrants paying for their journey changes from 90% to 70%, providing a low, high and mid 
estimate of €165 million, €221 million and €278 million respectively.  

Table 2.17: Revenue estimates of the EU smuggling of migrant market 

EU Member State 

Revenue estimates (€ million) 

Mid 

Low 

High 

28 EU Member States*  

287.97 

212.78 

363.15 

Western African route 

Western Mediterranean route 

Central Mediterranean route 

Western Balkan route 

Eastern Mediterranean route 

Black Sea Route 

Circular Route 

Eastern European route 

1.03 

68.40 

70.53 

33.56 

101.72 

0.00 

4.18 

4.36 

0.69 

49.07 

45.60 

24.45 

81.34 

0.00 

4.18 

4.36 

1.38 

87.73 

95.46 

42.66 

122.10 

0.00 

4.18 

4.36 

Notes: *While the smuggling routes do not provide a clear breakdown of estimates per Member State, they do include all detections at the 
external borders of the Union. Estimates were produced for 2018 for the 28 EU Member States, updated to 2019 values using Eurostat’s HICP 
(Eurostat, 2020b). The estimates by route are the original 2018 estimates.  

The map below provides a representation of the main routes operated by smugglers and used by 
irregular migrants. The routes presented here are in line with the nomenclature used by FRONTEX.  

69 

 
 
EUROPEAN COMMISSION 

Figure 2.1: Geographical representation on the main smuggling routes 

Source: Researchers’ construction. 

2.3.5. Criminal actors and modus operandi  

Table 2.18: Smuggling of migrants – Market actors 

Level of OCG involvement 

Difficult to assess, but increasing 

Size and composition of OCGs 

N/A 

Modus operandi of OCGs 

Network model  

Poly-criminality of OCGs 

Links to document fraud and THB  

Other key actors  

Other individuals involved in criminal activities (in a non-
organised way), other individuals or groups not involved in 
criminal activities 

The smuggling of migrants is a complex field often involving different smugglers,  facilitators 
and organisations who have a variety of motives. The concept and definition of a smuggler can 
be hard to pinpoint. Siegel provide an ethnographic assessment of the views geld by migrants of 
migrant  smugglers,  and  the  complexities  of  relationships  between  migrants  and  smugglers 
(Siegel, 2019). 

The organisation and size of smuggling operations vary. According to the UNODC, some 
smugglers provide limited small-scale services, whereas other smugglers belong to large and well-
organised hierarchical criminal operations with transnational links and the capability of organising 
sophisticated  smuggling  passages  (UNODC,  2018a).  According  to  Optimity,  the  business  of 
smuggling  usually  functions  as  a  network  model  of  OCGs,  with    communication  links  between 
smaller groups of actors/facilitators to enable movement of people from one country to another, 
from  source  to  destination  (Optimity  Advisors,  2015).  There  may  be  multiple  OCGs  within  a 
country and networks can span borders or have links with other OCGs across borders. Networks 
cluster to form hubs where the intensity of smuggling activities is greatest (Optimity Advisors, 
2015). 

According to a study by Tiniti & Reitano, there is a diverse range of actors within a network, 
who  perform  a  variety  of  roles  in  the  smuggling  of  migrants:  smugglers/top  men, 
recruiters, guides, drivers or skippers, spotters/messengers, money collectors, forgers (passports 
/  formal  documents),  suppliers  (boat  makers,  boat  owners,  car/bus  owners),  corrupt  policy 
officials (immigration officials), corrupt service providers (train conductors, etc.) and enforcers. 
Their role and function usually vary according to the type and scale of the smuggling network in 

70 

Western African routeWestern Mediterranean routeCentral Mediterranean routeEastern Mediterranean routeWestern Balkan routeBlack Sea routeEastern European routeCircular route 
 
 
EUROPEAN COMMISSION 

which they are  involved, and according  to the range of services  provided  to migrants (Tiniti & 
Reitano, 2016). 

The market for the smuggling of migrants is a flexible one due to low barriers to entry, 
low skills and (relatively) low capital requirements (Optimity Advisors, 2015). A study by 
Campana (2017) found that costs to the smugglers of monitoring agents and clients are also likely 
to be modest, particularly in comparison with THB. Furthermore, given the low barriers to entry, 
the market entails low levels of organisational complexity. Independent operators often work on 
behalf of friends and family members, or are migrants themselves trying to reach a destination 
(Sanchez,  2018).  A  law  enforcement  representative  interviewed  highlighted  how  as  migration 
enforcement and criminalisation increase, smuggling activities are increasingly being facilitated 
by local operators, who specialize in the provision of specific tasks (such as Hawala, crossing a 
specific border, etc.)70. 

According  to  a  law  enforcement  representative71,  there  has  been  an  increase  in  the 
involvement  of  criminal  networks  over  time.  Groups  have  become  more  structured  and 
hierarchical,  with  a  more  developed  use  of  new  technologies  –  including  encrypted  messaging 
systems (such as Telegram) or the dark net. On the other hand, low-profile facilitators – such as 
lorry drivers – who are part of the criminal chain work for different criminal organisations in a less 
structured way. Another trend is the increased use of violence and reckless techniques to extract 
a profit. A number of contributions from Member States to Europol highlight behaviours putting 
the lives of migrants at risks. 

When  OCGs  are  involved  in  the  smuggling  of  migrants,  they  are  often  also  active  in 
other  crime  areas,  especially  document  fraud  and  THB.  It  is  also  possible  that  OCGs 
specialised  in  the  smuggling  of  migrants  cooperate  with  OCGs  involved  in  other  crime  areas 
(Europol, 2018a). 

Modus operandi  
Optimity’s study show how from a supply-side perspective, smugglers (sellers) tend to advertise 
their business where migrants (buyers) can be easily reached, such as in neighbourhoods where 
diaspora  communities  live,  in  refugee  camps  or  via  various  social  networks  online  (Optimity 
Advisors, 2015). The study suggests that smugglers’ proactive recruitment and misinformation 
increase the number of migrants who are willing to buy smuggling services. From a demand side 
perspective, evidence suggests that conflicts, civil unrest and security issues in countries of origin 
often result in a huge growth in the number of irregular migrants and corresponding demand for 
smuggling services (Optimity Advisors, 2015). 

According to the same source, the business of smuggling is best described as a network model, 
with  a  network  of  communication  links  between  smaller  groups  of  actors/facilitators  to  enable 
movement of people from one country to another, from source to destination (Optimity Advisors, 
2015). There may be multiple networks within a country and networks can span borders and/or 
have links with other networks across borders. Networks cluster to form hubs where the intensity 
of smuggling activities is greatest.  

Smuggling of  migrants  is different  to  THB.  In  the  case  of  smuggling,  the  person  is  seeking  to 
cross a border (and willingly pays for the service). In the case of THB people do not necessarily 
cross  a  border  (but  can  be  trafficked  within  their  own  country),  and  are  victims  of  a  criminal 
offence – their consent to such a criminal act is irrelevant. This is not to say that smuggling is not 
dangerous. In 2016 alone, 4,581 people died at sea on the Central Mediterranean route (UNODC, 
2018a). This figure only reflects the human cost for one route and does not consider the likely 
high number of deaths on the routes from the countries of origin to the Mediterranean coast.  

2.3.6. Future trends and dynamics  

Table 2.19: Smuggling of migrants – Future trends 

Future trends and dynamics 

Evolving routes, but stable hubs. Numbers likely to be 
closer to those from 2018 than the 2015 peaks.  

70 Interview with law enforcement representative, 19 March 2020 (#67). 
71 Interview with law enforcement representative, 19 March 2020 (#67). 

71 

 
 
EUROPEAN COMMISSION 

Impact on market and criminal 
finances  

Likely to remain the same. 

Five studies were identified in the literature review that included information on the future trends 
and dynamics in the smuggling of migrants in the EU. These studies focus on migration trends 
over the coming years.  

According  to  the  International  Centre  for  Migration  Policy  Development  (ICMPD),  given  the 
situation in countries of provenance, the phenomenon of the smuggling of migrants is not 
expected to subside in the coming years (ICMPD, 2020). However, the number of migrants 
smuggled, their country of origin and the routes they have taken have evolved over time. This is 
expected to continue in the coming years. One prediction by the ICMPD is that should the peace 
process  in  Libya  achieve  an  end  to  the  conflict  and  bring  political  stability,  the  central 
Mediterranean route might lose importance. On the other hand, Europol expects ongoing turmoil 
in Syria, Iraq and Iran (which is still hosting over 2.5 million refugees from Afghanistan) to keep 
the  eastern  Mediterranean  route  as  a  focus  of  the  smuggling  of  migrants  (Europol,  2018a). 
Smuggling of migrants from Africa is expected to continue (Europol, 2018a). Furthermore, the EU 
SOCTA report expects an increase in the number of fraudulent documents being used as part of 
a wider increase in the abuse of legal channels to enter the EU (Europol, 2017). While migration 
and smuggling routes change on a regular basis in response to external factors, hubs where the 
demand  and  supply  of  smuggling  services  meet  are  rather  more  stable  over  time 
(UNODC, 2018a). These hubs are often located in important metropolitan areas. 

It is important to note that the referenced studies were conducted before the outbreak of COVID-
19.  While  the  impact  of  the  global  pandemic  on  the  market  for  the  smuggling  of  migrants  is 
unknown, it is likely that the increasing limitation in cross-border travel will have lasting 
effects on the market. According to the Global initiative against transnational organised crime 
(2020), the difficulties may stem from: 

• 

• 

Increased pressure on smugglers operating in their communities to cease operations in 
order to reduce the risk of contagion. 

Increased vulnerability as ‘tested’ routes are closed and alternatives must be found. The 
report provides the example of the closure of the weekly convoy between Agadez and 
Dirkou in Niger, which has been cancelled due to the pandemic. This will drive the price 
and risk of the operations. 

•  A temporary increase in the stationary migrant population. Migrants caught by border 
closures during their journey will be forced to remain where they are until restrictions 
are eased. This equates to a high risk of humanitarian disaster if the virus, or indeed 
other illnesses, spread in camps. 

2.3.7. Recommendations 

There are three principal ways in which data collection and estimation on smuggling of migrants 
could be improved in the EU:  

• 

From the perspective of the number of migrants being smuggled, data on detections at 
borders are generally considered to be of very high quality. For reasons that range from 
the political to the humanitarian, border agencies are considered to have a high 
detection rate of irregular migrants crossing the external borders of the EU. 
Furthermore, these data are reported on a monthly basis by law enforcement authorities 
as well as by the high number of border- and coast-guards involved in data collection. 
The number of secondary and tertiary movements is much harder to assess for reasons 
linked to the absence of border checks within the Schengen area.  

•  A more thorough assessment and compilation of the price of smuggling operations could 
be developed. Unlike other markets presented in the report, the supply of services for 
the smuggling of migrants involves many people. For instance, a migrant setting off 
from West Africa might use one network to cross the Sahel region, and another to cross 
the Mediterranean Sea. As such, data on the price of smuggling could be collected as a 
useful resource to assess the size of the market more precisely. A more systematic 
collection of price data would allow for more granular analysis by transport type (and 
level of safety). 

72 

 
 
EUROPEAN COMMISSION 

•  A more granular analysis could also be undertaken by considering the interplay between 
demand and supply and the impact these factors have on the price of services offered to 
migrants. Given the relative stability of the hubs where smugglers operate, this could be 
done by increasing data collection in these places.  

The key findings from this study and the related recommendations are summarised in the table 
below.  

Table 2.20: Recommendations – Smuggling of migrants 

Key finding 

Recommendation 

Actor 

Member States 

European Commission 

Member States should 
systematically report information 
on price of smuggling services to 
the European Commission. Data 
collection at hubs where smugglers 
operate – which remain relatively 
stable – may be a potential 
approach.  

Frontex and Europol maintain data 
on the price paid by smuggled 
migrants, but this information is 
not public. 

Data from FRONTEX on detected 
illegal border-crossings provide a 
good basis for estimating 
smuggling of migrants by sea to 
Europe via different routes because 
detection rates are known to be 
high (even though not all irregular 
migrants are detected).  

However, the best available proxy 
for monetising these estimates is 
price paid by migrants for 
smuggling services, which is known 
to be highly variable depending on 
demand (due to high price 
elasticity) and safety and comfort 
of the journey. Also, available price 
data is sparse and cannot account 
for this variability.  

2.4.  Fraud 

Fraud is defined as ‘a deliberate act of deception intended for personal gain or to cause a loss to 
another party’ (European Anti-Fraud Office, 2019). There are numerous types of fraud including 
excise fraud, VAT fraud and missing trader intra-Community (MTIC) fraud, payment fraud, food 
fraud, identity fraud and IPR infringements or counterfeit goods.  

For  the  purpose  of  this  study  we  focus  on  three  prominent  types  of  fraud:  food  fraud,  IPR 
infringements  (counterfeit  goods)  and  missing  trader  intra-Community  (MTIC)  fraud.  Card 
payment fraud is examined separately in relation to cybercrime in Section 2.8 of the main report 
and Annex 2.8.  

2.4.1. MTIC fraud 

William Phillips, RAND Europe 

Key findings: 

•  According to estimates that have been produced by EY (2015) and Frunza (2019) and 
adjusted for inflation to 2019 values, the annual revenues derived from the Missing 
Trader Intra-Community (MTIC) fraud market in the EU range between €51 billion 
and €104 billion.   

• 

The wide range of these figures reflects the difficulty in producing an accurate 
estimate in this market and hence, the resulting shortage of estimates. Frunza’s 
estimate is the only known estimate that uses a top-down methodology, but is high 
compared to other estimates – such as EY's, which uses a bottom-up approach.  

•  A high level of sophistication, organisation and cross-country coordination is required 

for Missing Trader Intra-Community (MTIC) fraud to take place; hence, OCG 
involvement is likely. There is evidence of both large OCGs, as well as local and 
small-scale initiatives. 

•  Some individual actors are involved but tend to act as part of larger criminal 

networks. Legitimate businesses can also become involved in fraudulent activity. 

73 

 
EUROPEAN COMMISSION 

• 

There is expected to be a movement towards less tangible goods and services – such 
as carbon credits, cloud computing and other online-based products – as well as 
rapidly consumed goods, such as food. There is also expected to be movement into 
the green energy market, as this sector continues to grow. 

This  Annex  provides  a  comprehensive  overview  of  MTIC  fraud  in  the  EU,  building  upon  the 
summary provided in Section 2.4.1 of the main report.   

Value  added  tax  (VAT)  is  a  consumption  tax  that  is  applied  to  the  final  consumer  when  they 
purchase a good or service. According to a report by the Commission, VAT fraud can be defined 
as  the  deliberate  evasion  of  this  tax;  this  type  of  organised  fraud  includes  both  intra-  and 
international  transactions  (Poniatowski  et  al.,  2019).  According  to  Europol,  the  most  common 
form of VAT fraud is Missing Trader Intra-Community (MTIC) fraud (Europol, 2020e).  When goods 
and services are traded from one EU Member State to another, they are VAT-exempted in the 
Member State of departure. Fraudsters take advantage of this by trading goods from one Member 
State to another and subsequently do not pay VAT from final sales of those goods to the relevant 
tax authority. They then disappear; hence the notion of ‘missing trader’ (Poniatowski et al., 2019). 
There is also a more complex form of this fraud, called carousel fraud. As with MTIC fraud, goods 
are purchased from a Member State or  imported from a third country, but they are fictitiously 
sold through multiple companies within one or more Member States before being the subject of a 
final sale in another Member State or third country. The first company in the chain does not pay 
VAT to the tax authority, then disappears. The companies that finally resale or export these goods 
claim back the VAT reimbursement – even though VAT was not paid to the tax authority in the 
first place (Europol, 2020e).  

2.4.1.1. Previous revenue estimates of the EU market for MTIC 

fraud  

The literature search and expert interviews identified 15 studies that contained prior estimates of 
the  VAT  fraud  market  in  the  EU.  Eleven  of  these  sources  estimated  MTIC  fraud,  two  sources 
estimated MTIC / VAT fraud (failing to distinguish between the two) and two sources estimated 
VAT fraud. Nine of these sources were at the EU-level; six of them estimated MTIC fraud within 
the UK.  

There are two main types of VAT fraud estimation methods: top-down and bottom-up methods 
(European  Commission,  2018b).  Top-down  methods  are  more  macro-oriented,  using 
aggregated indicators, such as national accounts data. The estimation centres on measuring the 
variance of economic variables or by analysing the links between economic indicators and proxies 
of fraud. Bottom-up methods use individual-level data as opposed to macro data, from sources 
such  as  tax  returns  and  risk  registers.  This  can  include  micro-economic  data  collected  at  the 
household or firm level during audits (Borselli, 2011). Statistical techniques are then applied to 
determine the amount of missing VAT that could be attributed to fraud. 

Frunza (2016,  2019)  provides the only  methodology that  estimates the size  of the  MTIC fraud 
market  from  scratch.  These  studies  used  a  top-down  panel-regression  model  to  link  the  VAT 
collected by Member State to their trade gap, using data from Eurostat on collected VAT revenue, 
intra-EU  trade  gaps,  intra-EU  imports  and  intra-EU  exports  (Frunza,  2019).  Also  used  was  an 
option-pricing model to establish the market revenue from MTIC fraud. In this method, the main 
indicator of fraud is when a nation’s actual imports exceed the expected economic level, meaning 
that the MTIC fraud revenue is proportional to the unexpected difference in imports.  

Savona & Riccardi (2015) used Borselli’s (2011) estimate of the proportion of VAT fraud that is 
attributable  to  MTIC  fraud  and  applied  this  to  the  VAT  gap  calculations  from  the  EU’s  annual 
report. Borselli estimated VAT fraud based on Eurostat statistics on external trade flows and data 
on specific  fraudulent schemes, but little further detail is given  on the methods used  (Borselli, 
2011).  Ernst  &  Young  (EY)  used  two  methods  to  develop  estimates  of  MTIC  fraud  in  the  EU 
(Fearing et al., 2015). Firstly, they used the Commission's estimate of the VAT gap (Barbone et 
al., 2013) to estimate the proportion of the gap that can be attributed to MTIC fraud. Secondly, 
they directly asked Member State tax authorities to estimate the percentage of the VAT gap that 
is comprised of MTIC fraud, which they then applied to the European Commission’s 2011 estimate 
of the VAT gap. 

74 

 
 
EUROPEAN COMMISSION 

The United Kingdom’s tax authority – Her Majesty’s Revenue and Customs (HMRC) – creates a 
UK-specific estimate of MTIC fraud on an annual basis  (HM Revenue & Customs, 2019). HMRC 
uses data from the Office for National Statistics’ (ONS) National Accounts ‘Blue Book 2018’ on UK 
total expenditure (including indicators such as household consumption and capital expenditure on 
housing)  and  consumer  trend  data  to  calculate  the  VAT  gap  (HM  Revenue  &  Customs,  2019). 
However,  due  to  operational  reasons,  HMRC  does  not  disclose  the  exact  methodology  for 
producing  MTIC  estimates.  These  estimates,  as  well  as  others  from  Levi  (2014),  CSD  (2015), 
Europol (2013a) and Fedeli & Forte (2011) do not write about their methodologies in great enough 
detail to be discussed here. 

2.4.1.2. Quality of prior revenue estimates  

Because of the complexity of the fraudulent schemes, it is challenging to attribute VAT revenue 
losses  to  VAT  and  MTIC  fraud.  Consequently,  estimating  the  scale  of  MTIC  /  VAT  fraud  is  a 
challenging  task.  Since  inter-Member  State  transactions  are  involved,  there  is  a  high  risk  of 
misattributing a VAT loss to the wrong country, or to double-count it. Figures for each individual 
Member State cannot simply be added up, as this will amplify the double-counting risk (European 
Commission, 2018b). Thus, estimates in the literature are rare. As a result, most of the literature 
in this area refers to the VAT gap, but not specifically to VAT or MTIC fraud (European Commission, 
2018b).  The  VAT  gap  is  a  much  broader  term  that  encompasses  several  other  non-fraudulent 
concepts such as insolvencies, bankruptcies, maladministration and tax optimisation  (European 
Commission, 2019d). 

The main drawback with many of the previous estimates is that most of them do not disclose their 
methods in enough detail, making it difficult to ascertain the quality of the estimates. Of those 
that do report a method, in many cases the method simply relies on using estimates from previous 
studies  as  inputs.  Those  estimates  that  have  been  used  as  inputs  tend  to  not  have  methods 
detailed. Frunza’s method is one of only two original estimates that have been calculated from 
scratch and the method reported, with the other being EY (2015). Further, Frunza’s method is 
also one of only two methods to disaggregate figures by Member State. The other is the study by 
Savona & Riccardi (2015), however their calculation relies on previous estimates. EY’s method of 
surveying tax authorities is useful as it gathers information on the opinions of various Member 
States.  However,  thorough  statistical  analysis  was  not  performed,  and  only  eight  survey 
responses were used to produce the EU-wide estimate.  

An advantage of Frunza’s top-down method is that it uses data from Eurostat, which is publicly 
available and has enough granularity to enable analysis across the EU. However, this is also a 
limitation,  as  the  data  is  reported  by  EU  countries  so  could  be  prone  to  error  or 
underrepresentation. Another limitation of the model is that it relies on the assumption that prior 
to 2009, MTIC was lower. 

75 

 
EUROPEAN COMMISSION 

Table 2.21: Prior studies estimating the size or revenue of the VAT / MTIC fraud market in the EU 

Citation 

Year(s) of 
estimate 

Sub-
market 

Data source(s) 

Countries 
included in 
estimate 

Disaggregated at 
Member State level?  

Estimate produced  

Borselli (2011)  N/A – an average 
annual estimate is 
given 

VAT fraud 

Not disclosed 

EU 27 (excluding 
HR) 

No 

1 

2 

Europol 
(2013a) 

3 

EY (2015) 

N/A – an average 
annual estimate is 
given 

N/A – an average 
annual estimate is 
given 

MTIC fraud  Not disclosed 

MTIC fraud 

Estimated based on data from the 
Commission's VAT gap report (Barbone et 
al., 2013) 

EU 

EU 

3 

EY (2015) 

2011 

MTIC fraud  Member State tax authorities were asked 

EU 26 

4 

Fedeli and 
Forte (2011) 

N/A – an average 
annual estimate is 
given 

how much of the VAT gap was attributable to 
MTIC fraud 

VAT fraud 

The International VAT Association 

EU 28 

5 

Frunza (2016) 

2013 

MTIC fraud 

Eurostat 

5 

Frunza (2016) 

2014 

MTIC fraud 

Eurostat 

 6 

Frunza (2019) 

2015 

MTIC fraud 

Eurostat 

EU 28 

EU 28 

EU 28 

7 

8 

9 

HM Revenue & 
Customs 
(2012) 

HM Revenue & 
Customs 
(2013) 

HM Revenue & 
Customs 
(2014) 

2010–2011 

MTIC fraud  VAT gap estimated using consumption 

UK 

expenditure data with tax receipts; how MTIC 
fraud was calculated is not declared 

2011–2012 

MTIC fraud  VAT gap estimated using consumption 

UK 

expenditure data with tax receipts; how MTIC 
fraud was calculated is not declared 

2012–2013 

MTIC fraud  VAT gap estimated using consumption 

UK 

expenditure data with tax receipts; how MTIC 
fraud was calculated is not declared 

No 

No 

No 

No 

Yes 

Yes 

Yes 

N/A 

N/A 

N/A 

€20 billion to €35 
billion in lost revenue 
per year 

€100 billion in lost 
revenue 

€45 billion to €53 
billion in lost revenue 

€46.32 billion in lost 
revenue 

€60 billion to €100 
billion in lost revenue 
per year 

€82.484 billion in lost 
revenue 

€93.531 billion in lost 
revenue 

€99.037 billion in lost 
revenue 

£0.5 billion to £1 
billion in lost revenue 

£0.5 billion to £1 
billion in lost revenue 

£0.5 billion to £1 
billion in lost revenue 

76 

 
 
EUROPEAN COMMISSION 

Citation 

Year(s) of 
estimate 

Sub-
market 

Data source(s) 

Countries 
included in 
estimate 

Disaggregated at 
Member State level?  

Estimate produced  

10  HM Revenue & 
Customs 
(2015) 

11  HM Revenue & 
Customs 
(2016) 

12  HM Revenue & 
Customs 
(2018) 

2013–2014 

MTIC fraud  VAT gap estimated using consumption 

UK 

expenditure data with tax receipts; how MTIC 
fraud was calculated is not declared 

2014–2015 

MTIC fraud  VAT gap estimated using consumption 

UK 

expenditure data with tax receipts; how MTIC 
fraud was calculated is not declared 

2015–2016 

MTIC fraud  VAT gap estimated using consumption 

UK 

expenditure data with tax receipts; how MTIC 
fraud was calculated is not declared 

13  Levi (2014) 

2012 

14  Levi et al. 

(2013) 

N/A – an average 
annual estimate is 
given 

VAT/MTIC 
fraud 

VAT/MTIC 
fraud 

Not disclosed 

Not disclosed 

EU 

EU 

N/A 

N/A 

N/A 

No 

No 

15  Savona & 

2011 

MTIC fraud 

Riccardi (2015) 

The authors have applied a percentage (from 
Borselli (2011)) to the VAT gap figures in 
Barbone et al. (2013) 

EU 26 (excluding 
CY, HR) 

Yes 

£0.5 billion to £1 
billion in lost revenue 

£0.5 billion to £1 
billion in lost revenue 

<£0.5 billion in lost 
revenue 

€20 billion in lost 
revenue 

€20 billion in lost 
revenue 

€29.329 billion in lost 
revenue  

Note: All revenue estimates presented in this table reflect the original years for which they were produced. They have not been adjusted for inflation, as we have done for the final estimates used in the current study. 

77 

 
 
EUROPEAN COMMISSION 

2.4.1.3. Methodology for estimating revenues in this study 

According  to  our  assessment,  estimates  published  by  Frunza  (2019)  are  the  best  available  to 
date. The Eurostat data used in Frunza’s analyses provide the requisite level of granularity for 
analysing  differences  across  the  28  EU  Member  States.  This  approach  was  validated  by  the 
research  team  in  an  interview  with  a  market  expert72.  However,  it  is  also  noted  that  these 
estimates are relatively high when compared with some of the other estimates (as shown in Table 
2.2). On this basis, we decided to use the estimates produced by EY  (2015) as a lower bound. 
These estimates were chosen as they come from one of the few studies that produce an original 
estimate and explain their method. For the purposes of this study these estimates are used and 
discussed alongside findings gathered from interviews with experts and stakeholders on market 
actors  and  future  trends  and  dynamics.  It  is  also  worth  noting  that  these  estimates  actually 
represent revenue losses in the VAT market, not revenues gained by OCGs. However, unlike in 
other markets, it is likely that the entirety of the revenue loss is directly related to the revenues 
of the criminal actors involved in the fraud. This is because there are no factors that may create 
differentiation between these two figures – such as pricing or sales of illicit products – as there 
are in other illicit markets. This reasoning was ratified by a market expert73. A summary of the 
approach used in this study for estimating the revenue from MTIC fraud and the limitations of this 
approach is outlined in the table below.  

Table 2.22: Summary of approach for estimating revenues from MTIC fraud 

Summary of approach  Using figures from Frunza (2019) – which employs a macro top-down 

approach – and EY (2015), which employs a Member State survey approach. 

Rationale 

Given the recency of Frunza’s estimates; there is little value in re-producing 
them. The use of Eurostat data in Frunza’s analyses are useful in that they 
provide the requisite level of granularity for analysing differences across the 
28 EU Member States. This approach was validated by the research team in 
an interview with a market expert74. However, it is noted that this is a large 
estimate, so we use EY’s estimates to provide a suitable range. 

Output 

MTIC VAT losses in the EU. The proportion of the VAT gap that is estimated to 
be attributable to MTIC fraud. 

Scope and coverage 

Geographical scope: Estimates for all 28 EU Member States  

Year(s) of estimate: 2015, updated to 2019 values 

Sub-markets: MTIC fraud 

Data sources 

Limitations and 
caveats of this 
approach 

Member State survey data; Eurostat data: Collected VAT revenue, intra-EU 
trade gaps, intra-EU imports and intra-EU exports.  

Frunza’s estimates are only as reliable as the data provided to Eurostat, and 
may be subject to underreporting, thus represent a lower boundary estimate. 
EY’s method is based upon the survey responses of just eight Member States, 
so despite a weighted average being used, it may not be representative.  

2.4.1.4. Revenue estimates of the EU MTIC fraud market 

Table 2.23  presents the estimates of the MTIC  fraud  market  in the 28 EU  Member States. We 
provide a lower bound estimate (obtained from a study by EY, 2015) and an upper bound estimate 
(obtained from Frunza, 2019). According to these figures, adjusted for inflation to 2019 values, 
annual revenues derived from MTIC fraud ranged between €51 billion and €104 billion. 

• 

The total annual revenue lost to MTIC fraud in the EU was as much as €104 billion 
(upper bound). The Commission estimated the VAT Gap to be €152 billion in the same 
year, suggesting that over 65% of the VAT gap could be attributed to MTIC fraud. 
However, EY’s estimate of €51 billion suggests MTIC fraud is around a quarter of the 
VAT gap (calculated in 2011 to be €193 billion) (Barbone et al., 2013). 

• 

The estimates differ substantially across Member States, according to Frunza’s 
estimates. Italy has by far the highest amount of MTIC fraud at €28 billion, followed by 

72 Interview with private-sector expert, 14 February 2020 (#6).  
73 Interview with private-sector expert, 14 February 2020 (#6). 
74 Interview with private-sector expert, 14 February 2020 (#6).  

78 

 
 
EUROPEAN COMMISSION 

Germany (€15 billion) and then Spain (€12 billion). Luxembourg has the lowest MTIC 
fraud (€37 million), followed by Malta (€47 million) and Slovenia (€56 million).  

The five most populous countries in the EU (Germany, UK, France, Italy, Spain) are 
responsible for MTIC fraud worth €69 billion (two-thirds of the total EU amount).  

To fully determine the extent of MTIC fraud within certain countries, it is also useful to 
consider how large the MTIC fraud is relative to the total VAT collected in the country, 
according to Frunza’s Member State-level estimates.  

• 

• 

•  Romania leads the way in this regard, with MTIC fraud losses comprising 43% of total 

collected VAT revenue. Italy, which has the highest absolute amount of MTIC fraud, has 
MTIC fraud losses making up 26.9% of VAT revenue. Central, Eastern and Southern 
European countries show a trend of having high MTIC fraud figures as a proportion of 
collected VAT.   

• 

In contrast, Northern European countries such as Sweden (2.7%), Finland (1.9%), 
Luxembourg (1.0%) and the Netherlands (the lowest at 0.8%) tend to have lower 
proportions.  

To  fully  determine  the  extent  of  MTIC  fraud  within  certain  countries,  it  is  useful  to  consider  a 
different metric: how large the MTIC fraud is relative to the total VAT collected in the country. 
This is shown in Figure 2.2.  

• 

• 

• 

There is a great deal of variation amongst Member States. Central and Eastern 
European countries feature prominently at the top of Figure 2.2, with seven countries 
featuring in the top ten (while the other three are Southern European countries). 
Romania leads the way, with MTIC fraud losses comprising 43% of total collected VAT 
revenue. Italy, which has the highest absolute amount of MTIC fraud, has MTIC fraud 
losses making up 26.9% of VAT revenue.  

The bottom of the graph is dominated by Northern European countries such as Sweden, 
Finland, Luxembourg and the Netherlands (the lowest at 0.8%), with the addition of one 
Eastern European country – Slovenia.  

There does seem to be some geographic trend to these estimates, with MTIC fraud 
featuring more prominently as a proportion of VAT revenue in Central, Eastern and 
Southern European countries. However, when it comes to absolute revenues from MTIC 
fraud, this is an EU-wide phenomenon. The five most populous countries in the EU 
(Germany, UK, France, Italy, Spain) are responsible for MTIC fraud worth €69 billion 
(two-thirds of the total EU amount).  

Table 2.23: Revenue estimate of the EU MTIC fraud market 

EU Member State 

Annual revenue, adjusted for inflation, 2019  
(€ million) 

Low  
(EY, 2015) 

High  
(Frunza, 2019) 

28 EU Member States 

27 EU Member States (excluding UK) 

26 EU Member States (excluding HR, 
CY) 

- 

- 

50,858 

Austria 

Belgium 

Bulgaria 

Croatia 

Cyprus 

Czech Republic 

Denmark 

Estonia 

Finland 

France 

103,992 

96,767 

103,271 

1,163 

824 

512 

457 

264 

3,231 

1,119 

103 

374 

6,014 

79 

 
 
EUROPEAN COMMISSION 

EU Member State 

Annual revenue, adjusted for inflation, 2019  
(€ million) 

Low  
(EY, 2015) 

High  
(Frunza, 2019) 

Germany  

Greece 

Hungary  

Ireland 

Italy  

Latvia 

Lithuania 

Luxembourg 

Malta 

Netherlands 

Poland 

Portugal  

Romania 

Slovakia 

Slovenia 

Spain 

Sweden 

UK 

15,319 

4,667 

3,322 

570 

28,083 

359 

1,190 

37 

47 

379 

6,329 

1,687 

5,962 

1,304 

56 

12,240 

1,155 

7,225 

Notes: Estimates produced by Frunza for 2015, updated to 2019 values using Eurostat’s HICP (Eurostat, 2020b). Estimates produced by EY 
for 2011, updated to 2019 values using Eurostat’s HICP (Eurostat, 2020b). 

Figure 2.2: MTIC VAT loss (% of total VAT revenue)  

Romania
Lithuania
Greece
Hungary
Italy
Czechia
Slovakia
Poland
Latvia
Cyprus
Spain
Bulgaria
Portugal
Croatia
Germany
Malta
Estonia
Ireland
Denmark
Austria
France
UK
Belgium
Sweden
Finland
Slovenia
Luxembourg
Netherlands

0%

5%

10%

15%

20%

25%

30%

35%

40%

45%

Source: Research team’s analysis of estimates produced by Frunza (2019). 

80 

 
 
EUROPEAN COMMISSION 

2.4.1.5. Criminal actors and modus operandi 

Table 2.24: MTIC fraud – Market actors 

Level of OCG involvement 

Size and composition of OCGs 

Modus operandi of OCGs 

Poly-criminality of OCGs 

Other key actors  

High. A level of sophistication, organisation and cross-
country co-ordination is required for MTIC fraud to take 
place; hence, OCG involvement is likely.  

Mixed. There is evidence of both large OCGs, and local and 
small-scale initiatives being involved. 

MTIC fraud funds are routinely transferred outside of the 
EU to bank accounts and jurisdictions protected from EU 
authorities. There is some level of investment in legitimate 
businesses to help facilitate fraud (such as logistic 
companies) and to launder money (cash-intensive 
businesses, such as nightclubs and restaurants). 

MTIC fraudsters have been known to apply their 
knowledge and infrastructure to other types of financial 
crimes, such as investment fraud and excise fraud. There 
are also links to THB, terrorism, property crime, extortion, 
drug trafficking, goods smuggling, illicit tobacco trade and 
loan-sharking. 

Some individual actors are involved, but tend to act as 
part of larger criminal networks. Legitimate businesses can 
also become involved in fraudulent activity. 

We identified 18 studies in the literature review that included information on key actors in the EU 
VAT and MTIC fraud markets. Savona & Riccardi (2015) state that VAT fraud in its simplest sense 
can be carried out by a whole range of actors, from individuals to extremely structured criminal 
organisations.  However,  when  it  is  scaled  up  to  incorporate  cross-border  transactions,  as  is 
necessary for MTIC fraud, the very nature of the fraud is organised, since companies (legitimate 
and/or  bogus)  need  to  be  set  up  in  multiple  countries.  According  to  an  interview  with  a  law 
enforcement representative75, this means that OCGs are  likely to play a significant role in 
the  VAT  fraud  market.  The  involvement  of  legitimate  companies  is  covered  by  the  Council 
Framework definition of OCG. Hence, despite legitimate actors not being traditional ‘mafia-style’ 
organisations, they still constitute a type of OCG.  

To successfully carry out an  MTIC fraud  scheme, technical knowledge,  organisational  structure 
and people power may be required76. Savona & Riccardi (2015) note that schemes with even a 
small degree of complexity may require a specialist workforce, division of labour and legal experts. 
A VAT fraud market expert77 stated that since MTIC fraud is a cross-country scheme, it requires 
inter-country connections, involving several people working together. Borselli (2011) and Mills et 
al. (2013) ratify this, claiming that MTIC fraud schemes are by their very nature organised, due 
to the sophistication required to facilitate them. According to Savona & Riccardi (2015) the larger 
the revenues, the more complex the scheme required, and the more transnational transactions 
involved, the greater the potential revenues for the criminals involved. 

Borselli argues that OCGs are attracted to engage in VAT fraud in its various forms due to the 
‘large sums available at relatively low risk’ (Borselli, 2011). Lamensch & Ceci (2018) agree 
with this point of view, reporting on a case of carbon-emissions VAT fraud where an initial €100 
million  investment  could  be  turned  into  €600  million  in  a  matter  of  hours.  In  the  case  of  the 
carbon-emissions market, the OECD reports that Europol estimated as much as 90% of the entire 
market could be fraudulent, mostly due to OCG involvement (OECD, 2016). 

The size of the OCGs involved in MTIC fraud is a point of contention. An interviewed VAT fraud 
market  expert78  believes  that  most  VAT  fraud  is  likely  undertaken  by  local  and  small-time 
initiatives,  as  opposed  to  traditional  crime  groups.  Europol  estimated  that  as  little  as  2%  of 
criminal  actors  could  be  responsible  for  as  much  as  80%  of  the  fraud,  suggesting  that  large 
organisations may be responsible for much of the crime (European Court of Auditors, 2015). As 
with many estimates of the size of the fraudulent market, it is not clear how this estimate was 

75 Interview with law enforcement representative, 11 March 2020 (#15). 
76 Interview with law enforcement representative, 11 March 2020 (#15). 
77 Interview with private sector expert, 14 February 2020 (#6). 
78 Interview with private sector expert, 14 February 2020 (#6). 

81 

 
 
 
EUROPEAN COMMISSION 

calculated and whether it was evidence-based. This Europol  estimate  was also  reported to  the 
research  team  during  interviews  with  stakeholders79.  The  nature  of  VAT  fraud  does  vary,  with 
some forms of fraud primarily involving paperwork and requiring little people power (e.g. labour 
is not required to help ship physical goods). In this sense, it is very possible for a large amount 
of fraud to be carried out by a relatively small number of people. 

On the other hand, a point upon which there is more agreement is the nature of the actors and 
leaders  behind  MTIC  fraud  schemes.  All  three  VAT  fraud  interviewees80  identified  the  UK  as 
particularly prominent contributors of MTIC fraud actors within the EU. In terms of ethnicity, two 
interviewees81 identified British nationals of Asian ethnic origin, such as British-Pakistani, British-
Indian and British-Bangladeshi, as being ethnic groups involved in this type of crime. According 
to a VAT fraud market expert82, the countries where the fraud is planned and where the VAT is 
defrauded can differ. For example, despite a lot of MTIC fraud leaders originating from the UK, 
the UK is relatively unaffected by MTIC fraud compared to other countries (see Table 2.23). As 
we  have  seen  from  the  estimates  in  Figure  2.2,  MTIC  fraud  seems  to  be  more  highly 
concentrated in Southern and Eastern European countries such as Italy and Romania83. 

According to one MTIC fraud expert84 the actors in MTIC fraud schemes tend to hire people within 
the EU to run the fraudulent companies: organising the movement of goods, looking at invoices 
and signing tax declarations, etc. This can be done by just a handful of employees; in some cases, 
the companies have just one or two employees. The expert mentioned how sometimes, young 
vulnerable  men  who  do  not  belong  to  an  OCG  and  are  just  looking  to  make  some  money  are 
identified by the leaders and masterminds of the crime – known as the ‘directors’. These ‘directors’ 
instruct the targeted individuals as to how to establish a company and operate as a front for the 
company. This sometimes means that the ‘front person’ has very little knowledge of what is going 
on. One interviewee85 also stated that these directors may not even live within the EU, instead 
opting  to  live  in  tax  havens  outside  the  EU  where  profits  can  be  better  protected  from  the 
authorities. 

However, sometimes large OCGs are involved, although less seems to be understood regarding 
the extent of their involvement. Savona & Riccardi (2015) identified the main OCGs known to be 
involved in organised VAT fraud as Chinese OCGs, Cosa Nostra (Italy), 'Ndrangheta (Italy), other 
Italian  OCGs,  Eastern  European  OCGs,  other  Western  OCGs  and  Russian/Georgian  OCGs. 
Although little further information was provided, this seems to be consistent with some of the 
countries  where  MTIC  fraud  relative  to  total  VAT  revenue  is  particularly  high  (Eastern  and 
Southern Europe) (Frunza, 2019; Poniatowski et al., 2019).  Regarding recent litigations where 
VAT fraud had been suspected, de la Feria (2018) stated that eastern Member States have been 
the most prominently involved, providing further evidence of high levels of MTIC fraud in Eastern 
Europe. However, a law enforcement representative interviewed mentioned that the actors who 
carry out the crimes within the EU can be from a variety of backgrounds. According to one law 
enforcement interviewee86, if an OCG is involved, that OCG will usually use people from their own 
nationality/ethnicity for fraudulent activity. 

There is also a link between VAT and MTIC fraud and wider criminal markets. According to multiple 
sources (de la Feria, 2018; European Court of Auditors, 2015) and expert interviews87 at least 
some of the proceeds from VAT fraud are likely to be invested in other criminal activity, 
such as THB and even terrorism (Lamensch & Ceci, 2018). Case studies provided examples where 
VAT fraud revenues were used to finance activity in property crime, extortion, drug trafficking, 
goods smuggling, illicit tobacco trade and loan-sharking (CSD, 2015). One interviewee88 cited the 
shadow banking system, loan-sharking and drug trafficking as very closely linked crimes. Our law 
enforcement interviewee89 said that MTIC fraudsters were likely to also be involved in other types 

79 Interview with law enforcement representative, 11 March 2020 (#15). 
80 Interview with market expert, 14 February 2020; Interview with National / Member State expert, 26 March 
2020 (#62); Interview with law enforcement representative, 11 March 2020 (#15). 
81  Interview  with  private-sector  expert,  14  February  2020  (#6);  Interview  with  law  enforcement 
representative, 11 March 2020 (#15). 
82 Interview with private-sector expert, 14 February 2020 (#6). 
83  Interview  with  private-sector  expert,  14  February  2020  (#6);  Interview  with  law  enforcement 
representative, 11 March 2020 (#15). 
84 Interview with National / Member State expert, 26 March 2020 (#62). 
85 Interview with law enforcement representative, 11 March 2020 (#15). 
86 Interview with law enforcement representative, 11 March 2020 (#15). 
87 Interview with private-sector expert, 14 February 2020 (#6). 
88 Interview with private-sector expert, 14 February 2020 (#6). 
89 Interview with law enforcement representative, 11 March 2020 (#15). 

82 

 
 
EUROPEAN COMMISSION 

of financial crimes – such as investment fraud and excise fraud – since they may already have 
the required expertise and knowledge of the financial system. Overall, the available evidence is 
mixed,  suggesting  that  proceeds  from  MTIC  fraud  are  invested  into  individual  lifestyles  – 
sometimes  outside  the  EU  –  as  well  as  into  other  areas  of  crime,  be  that  general  criminality, 
specialist financial crime or even terrorism. 

2.4.1.6. Future trends and dynamics  

Table 2.25: MTIC fraud – Future trends 

Future trends and dynamics 

Movement towards less tangible goods and services – such 
as carbon credits, cloud computing and other online-based 
products – as well as quickly consumed goods, such as 
food. Movement into the green energy market. 

Impact on market and criminal 
finances  

MTIC fraud becomes harder to trace, meaning high profits 
at a relatively low risk.  

Seven  studies  were  identified  in  the  literature  review  that  included  information  on  the  future 
trends and dynamics in the VAT/MTIC fraud market in the EU. According to Lamensch and Ceci 
(2018),  over  the  past  10  years  carousel  fraud  schemes  have  largely  involved  goods  that  are 
physically  small  but  of  high  monetary  value,  such  as  mobile  phones,  precious  metals  and 
computer  parts.  However,  there  is  an  emerging  trend  towards  fraudulently  trading  goods 
and services such as carbon credits and cloud computing that are less tangible. This may 
have come about because the intangible nature of these products requires less people-power to 
facilitate  and  allows  them  to  be  transferred  around  Europe  at  a  much  faster  rate,  which  also 
makes  them  increasingly  harder  to  trace;  hence  they  are  more  profitable  at  minimal  risk.  As 
reported  earlier  in  this  review,  OECD  (2016)  reported  that  as  much  as  90%  of  the  carbon-
emissions market may be fraudulent.  

An  interviewed  VAT fraud market expert mentioned that  more MTIC fraud  can be expected on 
goods and services  being  traded  online, using cryptocurrencies to settle  trades. According to 
Borselli  et  al.  (2015),  trading  over  the  internet  minimises  the  risk  of  detection,  makes  any 
potential intervention significantly more challenging and makes it harder to trace the goods or to 
physically locate the organisations that are responsible. Additionally, due to the profitability seen 
on the carbon-emissions market, Borselli et al. (2015) speculate that there will be an increase in 
fraud in data traffic, digital services and telecommunications. Further, Lamensch & Ceci (2018) 
reported evidence of VAT fraudsters moving towards goods that are consumed at a quicker rate, 
such as food, since their fast consumption makes them difficult to trace. Fraudsters have proven 
themselves to be quick to react to the market, committing fraud on all types of goods when an 
opportunity has been present, with the carbon-emissions market being a prime example of this. 
An interviewed MTIC fraud expert90 expects to see more MTIC fraudsters moving into the green 
certificate  market,  as  EU  countries  continue  to  invest  more  heavily  in  greener  energy, 
presenting more opportunities to MTIC fraudsters. However, Lamensch & Ceci (2018) note that 
MTIC fraudsters appear to act opportunistically. They follow trends in the economy and demand 
patterns, and are sector-agnostic, meaning all sectors are potentially vulnerable.  

KPMG (2016) noted that further consideration should be made of the potential consequences of 
Brexit.  The  UK’s  departure  from  the  single  market  has  reduced  the  number  of  countries  with 
which OCGs can trade goods VAT-exempt. It is likely that this will simply displace more VAT fraud 
into other countries, rather than reducing it overall (KPMG, 2016). However, further risk might 
ensue if the UK government attempts to boost international trade through possible changes in 
VAT and tax policy, since fraudsters may take advantage by developing new ways to set up VAT 
fraud schemes (KPMG, 2016).  

2.4.1.7. Recommendations 

There are two principal ways in which data collection and estimation on VAT/MTIC fraud could be 
improved in the EU:  

• 

First, the evidence from the literature shows that details on estimation methods are 
scarce. Hence, the first area that could be improved is simply to encourage more 
sources to release details of the methodologies used. For example, the UK 

90 Interview with National/Member State expert, 26 March 2020 (#62). 

83 

 
 
 
EUROPEAN COMMISSION 

government conducts a thorough estimate of MTIC fraud every year, however they do 
not disclose their methods. Being able to compare methods would allow other 
researchers and tax professionals to apply these methods to their own data, generating 
a wider pool of estimates to work with.  

•  Secondly, access to more granular data could be improved. This is an area for 

which there has already been some progression: in 2017, the Commission announced 
the launch of the Transaction Network Analysis (TNA) tool (European Commission, 
2019c). Using the tool, national tax authorities can share VAT registration data on their 
domestic traders with other EU Member States. The hope is that this will enable 
authorities to more closely and accurately monitor intra-EU trade, helping to detect 
irregularities (UK Parliament, 2018). This can be done by summing up the intra-
community acquisition (ICA) of the companies that go on to default on VAT payments 
(European Commission, 2018b). The ICA is declared by companies that import goods 
from another EU country, to both state that the initial trade is VAT-exempt, as well as to 
register that further selling of goods is now subject to taxation.  

The key findings from this study and the related recommendations are summarised in the table 
below.  

Table 2.26: Recommendations – MTIC fraud 

Key finding 

Recommendation 

Actor 

Estimating the size of MTIC fraud in 
the EU is an incredibly complex 
task, hence there are relatively few 
methodologies and estimates in the 
literature. Several Member State 
tax authorities do estimate MTIC 
fraud for their own country, 
however details of methodologies 
are not publicly accessible. 

Member States should publish their 
methodologies, to allow for 
replication. 

Member State tax 
authorities 

European Commission 

Member State tax authorities 
should systematically report the 
VAT registration data of their 
domestic traders to the 
Commission, enabling tax 
authorities to detect irregularities 
on an EU-wide basis. This will help 
EU-level authorities to more 
reliably identify and measure MTIC 
fraud. 

2.4.2. IPR infringements 

William Phillips, RAND Europe and Rajeev Gundur, Flinders University 

Key findings: 

• 

• 

• 

Estimates of criminal revenues from intellectual property rights (IPR) infringements 
are limited, and those that exist are susceptible to limitations and biases that result in 
an underestimate.  

In the IPR infringements market, estimates of loss to legitimate industry – rather 
than of criminal revenues – prevail. Loss-based estimates are not the same as 
revenues, and therefore cannot be directly compared to other criminal markets 
examined in this study for which revenue estimates have been produced. 

The production, transportation and sale of counterfeit goods is a complex process, and 
is  often  undertaken  by highly  organised  and  hierarchically  structured  OCGs.  Smaller 
actors are also involved, but often work with – or as part of – larger organisations via 
informal networks. 

•  Corrupt officials with inside knowledge of customs or original intellectual property rights 
have been known to be involved in IPR infringements, as are legitimate businesses that 
can be used to disguise illicit activity.  

• 

Trade  in  counterfeits  via  the  internet  is  expected  to  increase.  Further,  technological 
developments may make it easier and cheaper to manufacture counterfeits. Improved 
railway connections between the EU and China may enable easier transportation. 

84 

 
 
EUROPEAN COMMISSION 

This  Annex  provides  a  more  comprehensive  overview  of  IPR  infringements  in  the  EU,  building 
upon the summary provided in Section 2.4.2 of the main report.   

Intellectual property rights (IPR) are the ‘protections granted to firms and/or individuals who are 
the creators of ideas, products, or methods that allow the creators/inventors a period of time in 
which  they  can  earn  exclusive  returns  on  these  intangible  and  tangible  products  as  a  way  of 
rewarding them for the risky investment they initially made’ (Hoorens et al., 2012, p. vii). As of 
2019,  the  EU  Intellectual  Property  Office  (EUIPO)  estimated  there  were  353  IPR-intensive 
industries in the EU economy (EUIPO, 2019c). These IPR-intensive industries, alongside others 
that supply them with goods and services, are estimated to account for nearly 40% of the jobs in 
the EU, and to generate about 45% of the total economic activity in the EU (EUIPO, 2019c).  

Four principal types of IPR infringements can be distinguished: 

•  Trade secret theft – the theft of non-public technologies, methods, plans, processes or 
other sensitive information that give an enterprise its competitive advantage (CREATe & 
PwC, 2014). 

•  Copyright infringement – occurs when copyrighted materials are distributed outside 
authorized channels and without payment to the copyright holder. Copyright theft 
includes illicitly acquiring or using (‘pirating’) computer software, videogames, movies, 
television shows, music and published materials (CREATe & PwC, 2014). 

•  Trademark infringement – occurs when a producer fabricates an item that simulates 
a brand to which they do not own the IPR. An example is that of copied pharmaceutical 
goods, which is estimated to make up 0.84% of the entire market for pharmaceutical 
imports (OECD-EUIPO, 2020).  

•  Patent theft – occurs when a producer copies and sells a patented invention (i.e. 

counterfeits the invention), without the patent owner's permission or without paying any 
licensing fees (Levi et al., 2013). In technical terms, ‘counterfeit’ goods refer to cases of 
trademark infringement and ‘pirated’ goods refer to cases of copyright infringement 
(Bekhouche, 2018).  

However,  different  types  of  IPR  violations  often  overlap  with  one  another  and  the  term 
‘counterfeiting’  is  widely  used  to  refer  to  general  IPR  violations  (Bekhouche,  2018). 
Counterfeiting indicates the selling of products that are deceptive, including articles sold as a 
legitimate product when they are not, such as adulterated medications (EUIPO, 2016c; Hall et al., 
2017;  Lavorgna,  2014;  Spink  et  al.,  2013),  and  mislabelling  or  misrepresenting  the  origin  of 
geographical indications (Cook, 2013; EUIPO, 2017e). Counterfeit or fraudulent food has not been 
examined here – see separate discussion in Section 2.4.3.  

2.4.2.1. Previous 

revenue  estimates  of 

the  EU 

IPR 

infringements market 

The desktop research identified 22 studies published from 2010 that provided some estimates of 
IPR infringements in the EU context. The estimates included those measuring revenues generated 
through the trade in IPR infringements or goods within the EU (five studies, as shown in Table 
2.27) and those measuring the economic and social impact of this type of crime (losses or costs) 
(13 studies). The focus in this study is on criminal revenues, thus loss-based studies are discussed 
separately under Section 2.4.2.3.  

Estimates  that  used  assumptions  of  the  proportion  of  the  legal  trade 
that is comprised of counterfeiting  
A  study  by  Calderoni  et  al.  estimated  revenues  from  the  illegal  counterfeit  market  in  Italy 
(Calderoni et al., 2014). The methodology involved identifying the economic sectors in Italy that 
were most at risk of counterfeiting and calculating their legal annual turnovers, by referring to 
the IPERICO database (which collects information on categories of counterfeited goods that are 
seized by law enforcement agencies). Next, it was assumed that between 5% and 10% of total 
trade is a counterfeit market, and this proportion was applied to total turnover for each sector. 
These assumptions were based on the work of KPMG, and according to the authors are consistent 
with estimates produced by the European Commission, the WCO and the OECD (KPMG, 2003). 
Savona  &  Riccardi  (2015)  replicated  this  methodology,  but  supplemented  the  estimates  with 

85 

 
 
EUROPEAN COMMISSION 

Eurobarometer survey data from 2011 on the proportion of consumers in each EU 27 country who 
declared they are strongly willing to accept counterfeit products.  

Estimates that used a demand-sided approach 
A study by Camerini et al. (2015) used a demand-side approach to estimate the total actual 
and  potential  consumer  spend  on  counterfeit  goods  in  secondary  markets  in  the  EU  –  that  is, 
where  consumers  were  aware  they  were  purchasing  counterfeit  goods.  To  derive  the  actual 
expenditure  on  counterfeit  goods  the  study  multiplied  data  on  total  household  consumption 
(from Household Budget Surveys conducted by Eurostat in 2010) by data on the share of people 
who intentionally purchased counterfeit articles in the prior 12 months (using data from Office for 
Harmonization in the Internal Market (OHIM; now EUIPO). To derive the potential expenditure 
the study multiplied total household consumption data (also from Eurostat) by data on the share 
of people willing to buy counterfeit products (also from OHIM, now EUIPO). The results were then 
multiplied by the propensity to purchase a specific type of counterfeit product. The formula for 
this  calculation  is  provided  in  the  box  below.  Savona  &  Riccardi  (2015)  also  replicated  this 
methodology to produce estimates. 

Box 3: Formula for calculating revenue using demand-side approach 

As per Camerini et al. (2015), the simple formula for estimating counterfeit markets in the EU is as 
follows: 

Where:  

AEij= HCij * Ci * Pj 
PEij= HCij * PCi * Pj 

AEij  =  actual  expenditure  on  intentional  consumption  of  counterfeit  products  in  country  i  for 
market j  
PEij  =  potential  expenditure on  intentional  consumption  of  counterfeit  products  in  country  i for 
market j  
HCij = total household consumption in country i of market j  
Ci  =  percentage  of  actual  consumers  of  counterfeit  products  in  country  i  (actual  contextual 
propensity)  
PCi = percentage of potential consumers of counterfeit products in country i (potential contextual 
propensity)  
Pj = propensity to consume counterfeit products related to the type of product j (market specific 
propensity) 

Estimates of revenues from illegal internet protocol television  
A  study  by  EUIPO  (2019b)  estimated  the  revenues  generated  from  illegal  internet  protocol 
television (IPTV), i.e. unauthorised delivery of live and on-demand streaming of television content 
online (EUIPO, 2019b). The study estimated two elements of illegal IPTV: (1)  number of users 
involved in copyright-infringing IPTV consumption in the EU 28 Member States; and (2) the illegal 
revenues  generated  by  unauthorised  IPTV-subscription  providers.  The  first  estimate  used  data 
from the Eurostat household survey (2018) for the overall share of the population that watches 
internet  streamed  television,  and  the  EUIPO  IP  Perception  Study  (2017d)  survey  for  Member 
State-level  data  on  IPTV  piracy.  The  second  estimate  used  data  from  Eurostat  to  define  the 
average household size in EU countries. In addition, detailed analysis of a sample of suspected 
infringing websites was carried out. An initial dataset based on a list of suspected unauthorised 
IPTV websites and data on their annual global traffic was provided by the Software Security and 
Media Technology Company, Irdeto. The formula for estimating the revenue generated is provided 
in the box below.  

Box 4: Formula for calculating revenue from IPTV 

As per EUIPO (2019b), the simple formula for estimating revenue generates from illegal IPTV is as follows: 

𝑅𝑒𝑣𝑒𝑛𝑢𝑒 𝑔𝑒𝑛𝑒𝑟𝑎𝑡𝑒𝑑 𝑏𝑦 𝑢𝑛𝑎𝑢𝑡ℎ𝑜𝑟𝑖𝑧𝑒𝑑 𝐼𝑃𝑇𝑉 𝑝𝑟𝑜𝑣𝑖𝑑𝑒𝑟𝑠 (𝑅𝐼𝑃𝑇𝑉,𝑖) = 𝑃𝑜𝑝𝑢𝑙𝑎𝑡𝑖𝑜𝑛 𝑤𝑎𝑡𝑐ℎ𝑖𝑛𝑔 𝑢𝑛𝑎𝑢𝑡ℎ𝑜𝑟𝑖𝑧𝑒𝑑 𝐼𝑃𝑇𝑉 
(𝑁𝑃−𝐼𝑃𝑇𝑉,𝑖) ÷ 𝐴𝑣𝑒𝑟𝑎𝑔𝑒 𝐻𝑜𝑢𝑠𝑒ℎ𝑜𝑙𝑑 𝑠𝑖𝑧𝑒 (𝐻𝑖 ) × 𝑆ℎ𝑎𝑟𝑒 𝑜𝑓 𝑝𝑜𝑝𝑢𝑙𝑎𝑡𝑖𝑜𝑛 𝑝𝑎𝑦𝑖𝑛𝑔 𝑓𝑜𝑟 𝑢𝑛𝑎𝑢𝑡ℎ𝑜𝑟𝑖𝑧𝑒𝑑 𝐼𝑃𝑇𝑉 𝑚𝑜𝑛𝑡ℎ𝑙𝑦 
𝑠𝑢𝑏𝑠𝑐𝑟𝑖𝑝𝑡𝑖𝑜𝑛 (𝑆𝑔,𝑖) × 𝐴𝑣𝑒𝑟𝑎𝑔𝑒 𝑀𝑜𝑛𝑡ℎ𝑙𝑦 𝑠𝑢𝑏𝑠𝑐𝑟𝑖𝑝𝑡𝑖𝑜𝑛 𝑃𝑟𝑖𝑐𝑒 (𝑃𝑔,𝑖) 

Where: 

RIPTV,i  –  stands  for  the  revenue  generated  by  unauthorised  IPTV-subscription  providers  in  a 
particular EU Member State. This is the resulting indicator obtained by combining the four factors 
described below.  

86 

 
EUROPEAN COMMISSION 

NP-IPTV,i – stands for the population engaged in unauthorised IPTV consumption in a particular 
EU Member State.  

Hi – stands for the average number of adult equivalents in the household in every Member State. 
This data is provided by Eurostat. One paid subscription per household is considered in order to 
adjust  paid  subscription  estimation  per  household  instead  of  an  individual  person  level.  This 
approach results in a more conservative consumer spending estimate. Average household size in 
the EU 28 is 1.62.  

Sg,i – represents the share of population that is willing to pay for a monthly unauthorised IPTV 
subscription.  This  is  the opposite  to  an  option  to  stream  IPTV  for free,  e.g.  from websites  that 
allow  direct  streaming  for  certain  channels.  This  share  is  computed  based  on  a  sample  of  460 
websites  that  are  suspected of providing  unauthorised  IPTV  services.  The  sample  was selected 
based on analysis and multiple discussions with cybersecurity experts in the field. It consists of 
the most-visited websites for unauthorised IPTV services in the European Union, selected based 
on  a  comprehensive  search  algorithm.  The  sample  allows  figuring  out  the  proportions  of  the 
internet  traffic  directed  towards  different  types  of  unauthorised  providers,  such  as  subscription 
IPTV and free-of-charge IPTV streaming. 

Pg,i  –  represents  the  average  unauthorised  IPTV  monthly  subscription  price.  The  prices  are 
deducted based on data collection for 460 suspected unauthorised IPTV-providing websites, and 
varies based on four geographical regions (see EUIPO (2019b) for details). 

Seizure data 
A study by OECD/EUIPO (2019) used customs seizure data to estimate the imports of counterfeit 
and  pirated  products  into  the  EU.  This  study  excluded  domestically  produced  and  consumed 
counterfeit and pirated products.  

2.4.2.2. Quality of prior estimates 

Limitations of estimates that used assumptions of the proportion of the 
legal trade that is comprised of counterfeiting  

The approach to estimating counterfeit goods markets employed by Calderoni et al. (2014) and 
Savona & Riccardi (2015) assumed that between 5% and 10% of the legal market is comprised 
of counterfeit goods. There is little transparency around the selection of these proportions and 
thus the estimates produced may have limited reliability.  

Limitations of demand-based estimates 
The best available methodology is demand-based, as per Camerini et al. (2015) and Savona & 
Riccardi  (2015).  However,  there  are  several  limitations  of  these  approaches  that  cause  an 
underestimation of the market: 

•  Consumer surveys, which are a key input of these estimates, are susceptible to self-

reporting biases such as underreporting and recall problems. There are also questions 
around the representativeness of the samples (Camerini et al., 2015).  

• 

These estimates measured secondary markets in which purchasers of counterfeit goods 
are fully aware, as opposed to primary markets where the counterfeit products are sold 
to unsuspecting customers (Camerini et al., 2015).  

Further, in the case of the approach taken by Camerini et al. (2015), the estimate only covers a 
subset of markets, and the market-specific propensity is calculated using the results of a survey 
from Spain, which is then extrapolated to all other Member States.  

Limitations of estimates using seizure data 
There are a number of limitations of studies that have used seizure data to estimate market value:    

•  First, seizure data represents only a fraction of the problem. Such data are 

valuable for providing a basis for understanding the range of products that might be 
impacted by counterfeiting, but do not provide a good measure of the magnitude of the 
problem. This is because enforcement data reflect an unknown fraction of the total 

87 

 
EUROPEAN COMMISSION 

amount of counterfeiting that actually occurs, and also reflect the subset of cases in 
which people/organizations are caught.  

•  Second, retail price is often not equivalent to sale price, and there are 

variations by sector and product type. The seizure values that are applied in these 
studies (e.g. by OECD/EUIPO, 2019) are typically ‘replacement values’ or the retail price 
of the original good. It is inappropriate to use such values when estimating revenues 
(i.e. the focus of this study) for two reasons:   

-  Unauthorised goods are often not sold at a price that is equivalent to the 

authorised good. For example, they will often be sold much more cheaply and 
thus the amount of money going to key actors is considerably lower than the 
retail price. This is particularly the case where customers knowingly purchase an 
unauthorised good (i.e. the secondary market).  

- 

It may make sense to use retail value for producing an estimation if the 
substitution rate is 100%. However, previous research has shown that this 
substitution rate varies considerably by product type, and we know that some 
people buy counterfeit goods knowingly and do so because they are cheaper, 
thus making this assumption flawed.  

• 

Third, seizure data captures revenues being generated by actors outside the EU. 
This study focused on understanding revenues generated by actors operating within the 
EU, whereas seizure data is typically not confined to goods sold by EU actors.  

88 

 
EUROPEAN COMMISSION 

Table 2.27: Prior estimates of IPR infringements in the EU 

Sub-market(s) 

Data source(s) 

Citation 

Year(s) 
of 
estimate  

1  Calderoni et 
al. (2014) 

2008 

Clothing, accessories of clothing, footwear, electrical 
equipment, IT equipment, CD, DVD, tape, toys, 
glasses, watches and jewels, perfumes and 
cosmetics.  

2  Camerini et 

2010 

al. (2015) 

3  Savona & 

2010 

Riccardi 
(2015) 

3  Savona & 

2010 

Secondary markets (e.g. consumers who are aware 
they are buying counterfeit goods) of clothing; 
footwear; food and non-alcoholic beverages; games, 
toys, and hobbies; information and communication 
technology; recorded media; household appliances; 
jewellery, clocks, and watches; perfumes and articles 
for personal care; pharmaceutical products and 
medications.   

Top 10 business sectors sensitive to counterfeiting: 
Retail sale of computers; telecommunications, 
electrical household appliances; music and video 
recordings; games and toys; clothing; footwear and 
leather goods; cosmetic and toilet articles; watches 
and jewellery. 

Riccardi 
(2015) 

4  EUIPO 

(2019b) 

2018 

Illegal IPTV 

IPERICO database on seizure of 
counterfeit goods by product 
category to determine sectors 
most at-risk of counterfeiting in 
Italy.  

Data on turnovers were 
collected from the I.STAT and 
AIDA data sets, and the data 
on employees from I.STAT. 

OHIM, Household Budget 
Surveys conducted by Eurostat. 

Data on turnover of business 
sectors were gathered from the 
annual detailed enterprise 
statistics for trade published, 
by Eurostat 

Eurobarometer survey in 2011 
on consumers’ willingness to 
accept counterfeit products.  

Eurostat household survey data 
provides indicators for the 
overall share of population 
watching internet streamed 
television. 

EUIPO IP Perception Study 
(2017d) survey. 

Analysis of a sample of 
suspected infringing websites 
was carried out. 

Countries 
included in 
estimate 

Disaggregated 
at MS level?  

Italy 

N/A 

28 EU 
Member 
States 

Yes 

27 EU 
Member 
States  

28 EU 
Member 
States 

28 EU 
Member 
States 

Yes 

Yes 

Yes 

Estimate 
produced 
(value)  

€3,028 million 
(minimum) 
€6,055 million 
(maximum)  

Total consumer 
spend over  
10 markets is 
€9 billion 

€21,356 million 
to €41,353 
million 

€42,711 million 

Revenue 
generated by 
the illegal IPTV 
market:  
€941.7 million  

89 

 
 
 
EUROPEAN COMMISSION 

Citation 

Year(s) 
of 
estimate  

Sub-market(s) 

Data source(s) 

Countries 
included in 
estimate 

Disaggregated 
at MS level?  

Estimate 
produced 
(value)  

5  OECD/EUIPO 

2014–16 

35 product categories 

(2019) 

An initial dataset based on a list 
of suspected unauthorised IPTV 
websites, and data on their 
annual global traffic, was 
provided by the Software 
Security and Media Technology 
Company Irdeto. 

Customs seizure data received 
from the Commission’s 
Directorate-General for 
Taxation and Customs Union.  

28 EU 
Member 
States 

No  

€121 billion 

90 

 
 
EUROPEAN COMMISSION 

2.4.2.3. Loss-based  estimates  of  the  EU  IPR  infringements 

markets 

Estimates of loss to legitimate industry due to the IPR infringements market – rather than criminal 
revenues – prevail. Loss-based estimates are not the same as revenues, and therefore cannot be 
directly compared to other criminal markets examined in this study for which revenue estimates 
have been produced. This is because the consumption of a counterfeit good does not necessarily 
represent  reduced  consumption  of  a  legitimate  alternative.  In  some  counterfeit  markets 
consumers may never have intended to purchase the legitimate good in the first place (Hoorens 
et al., 2012, p. vii). That is, the substitution rate of a good will vary greatly depending on the 
sector.  Similarly,  other  estimates  of  loss  incorporating  wider  economic  costs,  potential  health 
impacts and consumer-surplus welfare  gains of  counterfeit good consumption and reputational 
effects are much higher than revenue estimates.  

The  table  below  shows  eight  estimates  from  EUIPO  reports  that  estimate  the  revenue  losses 
incurred by legitimate industries as a result of counterfeit activity. 

Table 2.28: Prior estimates of revenue losses to legitimate industry 

Sector 

Revenue 
losses from 
IPR 
infringements 
(€ million) 

Toys and games   1,427 

Jewellery and 
watches  

1,892 

Handbags and 
luggage  

1,581 

EU Member States 
covered 

Year of 
estimate 

Reference 

Data from 20 MS used, 
but estimate has been 
scaled up to reflect EU 
28 

Data from 18 MS used, 
but estimate has been 
scaled up to reflect EU 
27 (excluding Croatia) 

Data from 20 MS used, 
but estimate has been 
scaled up to reflect EU 
28 

Annual 
estimate 
(based on 
data from 
2007–2012) 

Annual 
estimate 
(based on 
data from 
2007–2012) 

Annual 
estimate 
(based on 
data from 
2007–2012) 

EUIPO (2015) 

EUIPO (2016b) 

EUIPO (2016a) 

Recorded music   170 

19 MS 

2014 

EUIPO (2017b) 

Spirits and wine 

1,260 

Pharmaceuticals  10,188 

Pesticides  

1,313 

Smartphones  

4,212 

Tyres and 
batteries  

2,426 

EUIPO (2016d) 

EUIPO (2016c) 

EUIPO (2017a) 

Data from 19 MS used 
for spirits and data from 
24 MS used for wine, but 
estimate has been scaled 
up to reflect EU 28 

Annual 
estimate 
(based on 
data from 
2008–2013) 

Annual 
estimate 
(based on 
data from 
2008–2013) 

Annual 
estimate 
(based on 
data from 
2009–2014) 

Data from 19 MS used, 
but estimate has been 
scaled up to reflect EU 
28 

Data from 24 MS used, 
but estimate has been 
scaled up to reflect EU 
28 

26 MS (excluding Malta 
and Bulgaria) 

Data from 24 MS used 
for tyres and data from 
20 MS used for batteries, 
but estimate has been 
scaled up to reflect EU 
28 

2015 

EUIPO (2017c) 

2010–2015 

EUIPO (2018) 

91 

 
 
 
 
 
 
 
 
EUROPEAN COMMISSION 

2.4.2.4. Market actors and modus operandi 

Table 2.29: IPR infringements – Market actors 

Level of OCG involvement 

Size and composition of OCGs 

Modus operandi of OCGs 

Poly-criminality of OCGs 

Other key actors  

A high level of organisation is required to operate the 
supply chain, from manufacturing to transportation, 
storage and retail. There are some smaller actors, but they 
often work with larger organisations via informal networks.  

OCGs have been identified as being highly organised and 
having a hierarchical structure, typically consisting of 
around 12 members. However, this varies by market.   

Goods are mostly manufactured outside of the EU. 
Smuggling, corruption, exploitation of free-trade zones 
and fraud are some of the methods used to avoid the 
authorities. Sometimes, counterfeits are assembled when 
inside the EU. A growing proportion of counterfeits is being 
sold over the internet.  

Counterfeiters are involved in other crimes such as money 
laundering, drugs trafficking and fraud. Some OCGs use 
counterfeiting to fund other crime. The same distribution 
routes, storage facilities and production locations are 
sometimes used for both counterfeits and other 
commodities.  

Corrupt officials with inside knowledge of customs or 
original IPRs. Legitimate businesses are used to disguise 
illicit activity.  

We identified 18 studies in the literature review that included information on key actors in the IPR 
infringements  market  in  the  EU.  These  studies  showed  there  is  a  high  level  of  OCG 
involvement. According to a joint report from the EUIPO & Europol (2019) OCGs play a major 
role  in  the  production  and  transportation  of  counterfeit  goods  throughout  the  EU,  and  ‘most 
criminal activity involving counterfeiting is undoubtedly performed by OCGs’. According to Savona 
& Riccardi (2015), putting together an effective supply chain of counterfeit goods requires a high 
degree of organisation and investment that means counterfeit criminals tend to operate as part 
of OCGs. That being said, Savona & Riccardi (2015) state that there are many small groups of 
criminals,  usually  involved  in  a  whole  range  of  other  illicit  activities,  that  play  a  vital  role  in 
endpoint distribution and retail of counterfeits within the EU. According to EUIPO & Europol (2019) 
and Hall et al. (2017), these criminal actors can work independently, form ad hoc groups, or are 
part of loosely structured networks that act opportunistically. EUIPO & Europol (2019) report that 
only a limited number of known OCGs are active in counterfeiting within the EU, however, it is 
believed they are involved across the entire process, giving them a  dominating presence in the 
EU counterfeiting market.  

There are many drivers behind why OCGs choose to engage in the counterfeiting market. Savona 
&  Riccardi  (2015)  comment  that  counterfeiting  can  be  very  profitable  due  to  high  consumer 
demand,  and  low  production  and  distribution  costs.  Chaudhry  and  Zimmerman  (2012),  EUIPO 
(2020a) and EUIPO (2020b) claim that the high profitability of counterfeiting means that OCGs 
use it as a means to generate revenues to finance other organised crime activity. For OCGs 
involved in other areas of illicit activity, Treadwell (2012) claims that counterfeiting may be an 
easy market to move into, as they may already have the infrastructure and contacts in place as 
a  result  of  other  illegal  endeavours.  Further,  booming  international  trade  has  made  it  more 
challenging to trace the origins of goods due to increasingly complex supply chains and delocalised 
production.  Papadouka  &  Haenlein  (2017)  state  that  Free  Trade  Zones  (FTZs)  give  OCGs  the 
ability  to  store  and  distribute  their  goods  tax-  and  duty-free.  There  also  tends  to  be  limited 
domestic authority  presence  and  other  weak  inspection procedures in FTZs, resulting in a  low 
risk  of  being  caught.  According  to  Savona  &  Riccardi  (2015),  another  key  driver  of  OCG 
involvement in counterfeiting is the internet, which has enabled OCGs to reach a wider audience. 
Further, the legal penalties associated with counterfeiting are relatively less severe, meaning they 
are failing to deter OCGs from engaging in counterfeiting. OCG involvement and relatively low 
legal  penalties  may,  at  least  partially,  be  a  result  of  public  and  law  enforcement  attitudes 

92 

 
 
EUROPEAN COMMISSION 

towards  counterfeiting,  as  reported  by  EUIPO  (2020a).  Interviewees91  commented  that 
counterfeiting may be considered less of a priority than other crimes like illicit drugs and THB, 
both by law enforcement and the general public.  

Due to a wide range of factors  – such as cross-country differences in regulations and differing 
commercial techniques – OCG structures ‘vary largely in terms of size, reach, organisation 
and legality’ (Hall et al., 2017). According to EUIPO & Europol (2019), most OCGs known to be 
involved in counterfeiting have an organised, hierarchical structure. Evidence suggests there 
are leaders, designated subordinates and managed groups, each responsible for different parts of 
the counterfeiting process (EUIPO & Europol,  2019). The identified OCGs tend to consist of 12 
members, with 5–6 core members (EUIPO & Europol, 2019). However, this varies depending on 
the  market.  A  report  by  OECD-EUIPO  (2020)  on  counterfeit  pharmaceuticals  found  that  OCGs 
typically have between 3 and 10 members. Some actors were also part of ‘larger well-established 
hierarchical  groups  and  sophisticated  international  networks  with  elusive  structures’  (OECD-
EUIPO,  2020). Hall  et  al.  (2017)  describe  many  pharmaceutical  counterfeiters  as  belonging  to 
‘loosely structured networks’.  

However, the evidence does seem to be consistent concerning the OCGs that are involved. The 
EU  Organised  Crime  Threat  Assessment  (2011)  (Europol,  2011)  notes  Chinese  OCGs  as 
particularly  active  in  the  production,  transport  and  distribution  of  counterfeit  goods.  Several 
sources noted in-depth involvement of Chinese OCGs (Calderoni et al., 2014; Godart, 2010; Hall 
et al., 2017; Savona & Riccardi, 2015)92. This is logical given that China is the main source of 
counterfeit items across almost all product categories, with 73% of all counterfeits seized by EU 
customs  coming  from  China;  other  Asian  countries  such  as  Hong  Kong  and  Vietnam  are  also 
prominent sources (EUIPO & Europol, 2019). Europol (2017a) notes that OCGs of Asian origin are 
particularly prominent in the EU. They share some similarities in that they are bound together by 
ethnic  ties,  have  an  extensive  network  of  contacts  and  have  a  very  disciplined  structure  and 
hierarchy.  Other  notable  OCGs  involved  in  counterfeiting  include:  the  Camorra,  the  Japanese 
Yakuza,  the  Russian  Mafia,  North  African  OCGs,  other  Asian  OCGs,  Eastern  European  OCGs, 
Russian/Georgian OCGs and Turkish OCGs (Calderoni et al., 2014; Godart, 2010; Hall et al., 2017; 
Savona & Riccardi, 2015)93. 

There is strong evidence that OCGs operating in counterfeiting are also active in other criminal 
markets.  According  to  various  sources,  OCGs  linked  to  IPR  crime  tend  to  also  be  involved  in 
crimes such as drug trafficking, THB, fraud and money laundering. Four sources identified links 
to  the  funding  of  terrorist  organisations  (Chaudhry  &  Zimmerman,  2012;  Dégardin,  Roggo,  & 
Margot, 2014; EUIPO, 2020b; Europol, 2017a; Godart, 2010). IPR crime can be linked to other 
forms of crime in two main ways: other criminal activity can be used to facilitate IPR crime (or 
vice versa), or OCGs can engage in different criminal activities that are relatively independent of 
each other – known as ‘parallel’ activities (EUIPO, 2020b). OCGs operating distribution networks 
have  been  known  to  use  these  methods  to  transport  more  than  one  type  of  product,  for 
example, counterfeit goods and drugs (EUIPO & Europol, 2019). This would be an example of a 
parallel activity. According to a joint Europol-EUIPO report, drug trafficking is the most common 
type of criminal activity to occur alongside IPR infringements (EUIPO, 2020b). Savona & Riccardi 
(2015) note that using the same labour, logistics, storage and transportation resources to move 
both counterfeits and other commodities effectively duplicates revenue streams at little additional 
cost. The means to manufacture both illicit drugs and counterfeit pharmaceuticals can be similar 
and according to a law enforcement representative we interviewed94, raids frequently find both 
illicit drugs and counterfeit pharmaceuticals on the same premises. Illicit synthetic drugs can have 
similar manufacturing methods to counterfeit pharmaceuticals, and counterfeiters are also known 
to use the same routes to traffic cocaine, marijuana and heroin (EUIPO, 2020b). 

Additionally, in order to facilitate counterfeit crime, other illicit activities may take place (EUIPO, 
2020b).  These  include  ‘knock-on’  crimes  such  as  customs  and  VAT  fraud  (Godart,  2010), 
corruption of officials95 and document fraud, and crimes that are undertaken in order to facilitate 
counterfeiting. Counterfeiters may use these crimes in order to facilitate the sale of their goods. 
Commonly,  administrative  documents  are  forged  to  show  authenticity  or  to  establish  a  fake 

91 Interview with international-level stakeholder, 19 March 2020 (#24); Interview with EU-level stakeholder, 
(#18). 
92 Interview with EU level stakeholder, (#18); Interview with international-level stakeholder, 19 March 2020 
(#24). 
93 Interview with international-level stakeholder, 19 March 2020 (#24). 
94 Interview with European level stakeholder, 11 March 2020 (#16). 
95 Interview with European level stakeholder, 11 March 2020 (#16). 

93 

 
 
EUROPEAN COMMISSION 

country of origin (EUIPO, 2020b). Naturally, this type of document fraud is linked to excise and 
VAT fraud, as goods are traded between countries without declaring VAT or paying excise duties. 
Two  interviewees96  also  noted  the  connection  of  counterfeit  manufacturing  with  environmental 
crime.  The  OECD-EUIPO  (2020)  notes  that  illegal  disposal  of  the  by-products  of  counterfeit 
manufacturing  and  the  use  of  counterfeit  pesticides  can  produce  wider  environmental  harm. 
Further,  the  proceeds  from  counterfeiting  can  be  used  to  fund  other  illicit  activity.  As 
mentioned earlier in this review, compared to many other illicit activities, counterfeiting yields 
high rewards for relatively low risk. OECD/EUIPO (2019) and an interviewee97 noted that some 
criminals  use  counterfeiting  as  a  means  to  generate  vast  sums  of  money  to  fund  other  illicit 
activities.  

Aside  from  OCGs,  other  actors  are  instrumental  to  facilitating  the  activities  of  the  IPR 
infringements  market.  Corruption  of  officials  is  one  example  that  is  a  common  strategy 
employed by OCGs across several markets. According to an expert interviewee98, there have been 
cases  whereby  customs  employees  cooperate  with  criminals  by  giving  information  on  what 
quantities and prices appear suspicious, so that OCGs can make the necessary arrangements to 
avoid detection. Godart (2010) also highlights the role of individuals with inside knowledge of the 
original IPRs who may be corrupted for vital information about the original products. The same 
interviewee  mentioned  the  case  of  legitimate  shop  owners  who  knowingly  sell  counterfeits 
provided  by  OCGs.  According  to  Hall  et  al.,  counterfeit  pharmaceuticals  in  particular  is  a  sub-
market that involves ‘the constant and normalised blurring of the boundaries between legal and 
illegal businesses’ (Hall et al., 2017). Because of the complexity of the supply chain, there are 
numerous  opportunities  for  legitimate  actors  to  engage  in  opportunistic  crime.  In  an 
analysis  of  cases  in  the  UK  and  the  Netherlands,  Hall  et  al.  (2017)  found  that  a  lot  of 
pharmaceutical counterfeiting was done by individuals and groups who already had infrastructure 
in place. They owned legitimate businesses – such as pharmacies or gyms – and had the business 
networks and payment facilities already in place to use their legitimate operations to hide illicit 
activity from the authorities.  

Modus operandi 
Europol (2015a, 2017a) reports that OCGs often rely on manufacturers from outside the EU 
(predominantly China and other Asian countries) to produce counterfeit goods, before organising 
importation and distribution within the EU. According to a joint report from the OECD and EUIPO, 
the  majority  of  IPR-violating  items  are  still  likely  to  be  shipped  in  bulk  (OECD/EUIPO,  2017). 
Benoit reports that IPR-violating items are frequently shipped along licit supply chains, concealed 
in licit shipments, or smuggled using traditional smuggling techniques, making them difficult to 
detect (Godart, 2010; Hall et al., 2017). An IPR infringements expert interviewee99 added that 
OCGs can use their own transportation means and can infiltrate the legitimate distribution 
chain. European Union (2019) reports that the most common transport modes in terms of number 
of  cases  detained  are  postal,  air  and  express  transport,  but  sea  transport  by  container  is  the 
largest in terms of number of articles. OECD/EUIPO (2019) report that increasing amounts of 
counterfeits are being shipped by postal services due to growing demand online. Smaller 
shipments help counterfeit traffickers avoid detection, since individual packages are more costly 
for  authorities  to  stop  and  check.  As  stated  by  Chaudhry  and  Zimmerman  (2012)  and 
OECD/EUIPO (2017, 2018), some illicit entrepreneurs may leverage the lack of regulation in FTZs 
to  conceal  the  origins  of  their  products,  produce  IPR-infringing  goods,  reintroduce  counterfeit 
products into the licit supply chain and circumvent tariffs and other regulatory measures of the 
destination country. 

According to Europol (2015a), a popular method used by counterfeiters is to import goods into 
the EU without any labels or branding – which for most goods (excluding ones where safety 
regulations are not met, such as pharmaceuticals) is technically legal. IPR-infringing branding is 
then added inside the EU. A related technique is that of ‘drop shipping’, when goods are imported 
from outside the EU to an EU country with relatively fewer controls. The products are then shipped 
onwards  to other EU  countries and  have their  postal stamps altered  to  give  the appearance 
that  they  originated  inside  the  EU.  Europol  (2017a)  state  that  goods  shipped  from  other  EU 
Member  States  are  perceived  as  being  less  likely  to  be  intercepted  by  the  authorities.  Some 
counterfeit goods are even manufactured within  the  EU; Chaudhry and Zimmerman (2012) 
say that the increasing availability of modelling, printing and scanning technologies is enabling 

96 Interview with European level stakeholder, 11 March 2020 (#16); Interview with EU level stakeholder, 

(no date) (#18). 

97 Interview with European level stakeholder, (no date) (#18). 
98 Interview with international-level stakeholder, 19 March 2020 (#24). 
99 Interview with international-level stakeholder, 19 March 2020 (#24). 

94 

 
 
EUROPEAN COMMISSION 

this. One interviewee100 said that in the absence of owning a shop, some OCGs directly sell their 
goods to consumers or try to push them onto small shops. According to another stakeholder101, 
there  are  four  main  ways  that  OCGs  can  get  their  products  into  the  stores  of  retailers:  by 
threatening to use violence or other coercive means, owning retail outlets whereby they can easily 
stock counterfeit goods in place of legitimate ones, engaging in loan-sharking to ensure they have 
leverage over businesses who have borrowed money from them, and by infiltrating the logistics 
network supplying the goods. 

Godart (2010) notes other methods that OCGs can use to get their goods into circulation within 
the EU: forged documentation to cover illegal imports, front companies created to trick authorities 
into thinking a shipment is legal, corruption of public officials, corruption of individuals linked to 
the genuine rights holders and the exploitation of illegal immigrants inside the EU. A Commission 
report states corruption is more likely where wages for workers and government officials are low 
and where bureaucracy is high (European Commission, 2018e). According to Chouvy, corruption 
can  help  criminal  actors  gain  access  to  overruns,  stolen  goods,  and  the  ability  to  engage  in 
blatantly  illicit  behaviour,  such  as  the  theft  of  products  from  the  licit  supply  chain  or  the 
introduction of counterfeit goods into it (Chouvy, 2013). 

2.4.2.5. Future trends and dynamics 

Table 2.30: IPR infringements – Future trends 

Future trends and dynamics 

Impact on market and criminal 
finances  

More counterfeits are expected to be sold via the internet. 
Technological developments may make it easier and 
cheaper to manufacture counterfeits. Expanded railway 
connections between the EU and China may enable easier 
transportation.  

OCG involvement in streaming services has started to 
offset reduced revenues from hard copies of films and 
music. Expanded railway connections with China are 
expected to reduce transportation costs for counterfeiters. 
Economic recession could allow OCGs to capitalise on 
increased demand for cheaper, branded alternatives.  

We identified 16 studies in the literature review that included information on the future trends 
and dynamics in the IPR infringements market in the EU. These studies showed that the internet 
has  changed  the  counterfeiting  market.  European  Union  (2019)  reports  that  supply  chains  for 
smaller products (and product volumes) have been transformed since transportation logistics can 
now be facilitated through the postal system. Consequently, direct-to-end-user postal shipping is 
increasingly common as users become more comfortable with e-commerce. According to Hall et 
al.  (2017)  and  Schneider  and  Maillefer  (2015)  it  is  possible  for  criminal  actors  and  legitimate 
citizens to directly contact producers of IPR-violating goods and receive their products through 
direct shipping, using standard post and courier services. Further, the IP Crime Group (2019) in 
the UK notes that counterfeiters are increasingly using e-commerce and other online platforms 
– such as Facebook, Instagram, Twitter, Gumtree, Amazon and Alibaba – to sell their products. 
EUIPO  &  Europol  (2019)  state  the  trade  in  counterfeits  is  expected  to  increasingly  take  place 
online, and counterfeiters are expected to exploit this by using marketing strategies that will be 
‘better directed at the ever-increasing number of internet and particularly, social media users’. 

In addition, the increase in internet speeds and advances in mobile technology have meant 
that  some  formerly  common  physical  media  carriers,  such  as  DVDs  and  CDs,  have  become 
obsolete  as  they  are  now  commonly  streamed  directly  from  the  internet.  Consequently,  as 
reported by Eisend, consumers can acquire unauthorised copies without the need to engage in 
any shipping logistics (Ablon et al., 2014; Eisend, 2019). Notably, software and media companies 
have responded by shifting to subscription-based services that are easy to use, thus reducing the 
incentive to use unauthorised products, although there is mixed evidence on whether these shifts 
have reduced IPR violations in music, films and television (EUIPO, 2019b). Similarly, EUIPO and 
Europol (2019) report that the growing accessibility of legal streaming opportunities has resulted 
in fewer illegal downloads. However, counterfeiters have also adapted to these technological and 
consumer trends. The UK IP Crime Group (2019) states that one-third of all UK adults accessed 
pirated content. Wider access to the internet and high-speed broadband has facilitated a rise in 
the  number  of  people  streaming  television,  film,  music  and  sports  content,  both  legally  and 

100 Interview with international-level stakeholder, 19 March 2020 (#24). 
101 Interview with EU-level stakeholder, 12 February 2020. 

95 

 
 
 
EUROPEAN COMMISSION 

illegally. Hall et al. (2017) notes that some criminals are taking advantage of this by replicating 
their own illegal versions of streaming platforms such as Now TV, Netflix and Amazon, and offering 
ways to illegally configure legitimate devices (IP Crime Group, 2019). Bijhan reports that another 
trend that is increasingly being seen is legal platforms such as Plex and social media sites that 
allow customers to post their own (including pirated) content (Bijan, 2019). 

Technology used in the production of counterfeit goods has become more accessible (Chaudhry 
&  Zimmerman,  2012;  EUIPO,  2020a).  Computer  equipment  is  constantly  improving,  making 
production methods less expensive, expanding the capacity to reverse-engineer a product and 
allowing for better quality branding and packaging. This is not just being used to counterfeit high-
quality and technical products, but also mundane everyday goods, such as toiletries and batteries 
(EUIPO, 2020a). This would also enable more manufacturing to be done from inside the EU, which 
would then make exporting to the final consumer easier. The UK IP Crime Group (2019) says an 
increase in counterfeit production from within the UK has already been seen, with counterfeiters 
manufacturing, assembling together, re-packaging and adding on branded labels, trademarks and 
logos as opposed to importing directly from China. Further, Europol (2017a) note there are future 
technology developments that have the potential to shape the counterfeiting market; 3D printing 
is one such technology that may be used to produce more sophisticated counterfeit products in 
the near future.  

Rail connections between Europe and China have been improving for years and will continue to 
do so with the expansion of the China Belt and Road Initiative (Europol, 2017a). Rail freight costs 
half the price of air freight and is twice as fast as shipping, meaning rail is poised to be a ‘logical 
choice  for  many  counterfeit  consignments’  in  the  future  (Europol,  2017a).  This  brings  further 
opportunities for OCGs, as counterfeits can be sent from China and arrive at EU borders in Eastern 
Europe where checks are less stringent, before making their way into the rest of Europe. Further, 
the IP Crime Group (2019) notes that in China, transnational railway management systems are 
becoming increasingly vulnerable to OCG cyberattacks. Criminals are able to hack into database 
information-management systems, and there is evidence of OCGs developing new concealment 
techniques that are especially suited for freight trains as a result (IP Crime Group, 2019). 

Demographic  and  socio-economic  changes  may  also  affect  the  demand  for  counterfeit 
products.  OECD/EUIPO  (2016)  notes  that  economic  conditions  and  resulting  budget  concerns 
could affect demand for counterfeits. If people can no longer afford the genuine items, they may 
be more likely to switch to more affordable counterfeit substitutes instead. This is what is known 
as demand in the secondary market – whereby consumers knowingly purchase counterfeits. This 
is especially the case in the wake of the COVID-19 crisis, whereby many people will face budgetary 
constraints as a result of inevitable difficult economic conditions (Gopinath, 2020). Clifford (2010) 
reported  that counterfeiters may respond  to  socio-economic changes  by  manufacturing lesser-
known  brands  and  cheaper  products,  given  that  people’s  demand  may  fall  for  more  upmarket 
products. In addition, EU Member States, alongside many other developed countries, have seen 
a gradual ageing of the population. Godart (2010) stipulates that there may be an increase in the 
demand for pharmaceuticals as a result, which could increase the opportunities for counterfeiters 
to further exploit this market.   

A very recent trend has been observed in the midst of the ongoing COVID-19 crisis. The Anti-
Counterfeiting  Group  (2020) and  EUIPO  (2020a)  have  noted  the  growing  supply  of  counterfeit 
face  masks,  hand  sanitisers,  testing  kits,  thermometers,  cleaning  products,  indoor  sports 
equipment  and  even  COVID-19  treatment  drugs.  According  to  an  expert  interviewee102, 
counterfeiters  will  ultimately  follow  market  trends  and  use  any  opportunity  to  make  money, 
leveraging the latest technological developments, consumer trends and economic conditions. This 
means the trade of counterfeit goods is a dynamic activity, with OCGs looking to capitalise on any 
potential new profit opportunities, no matter what the product is (OECD/EUIPO, 2019). 

2.4.2.6. Recommendations 

There  are  several  ways  in  which  data  collection  and  estimation  on  IPR  infringements  could  be 
improved in the EU:  

•  Chaudhry and Zimmerman (2012) argue there needs to be more detailed market 

research on specific product categories, due to the high level of distinction between 
different counterfeit sectors. For instance, studies need to be designed differently if they 

102 Interview with international-level stakeholder, 19 March 2020 (#24). 

96 

 
 
EUROPEAN COMMISSION 

are estimating the amount of illegal movie streaming, compared to the demand for 
counterfeit pharmaceuticals. Substitution rates, ethical concerns and health and safety 
concerns all vary from market to market, hence the need for sector-specific research 
designs. 

•  More detailed surveys and studies on how consumers feel about counterfeited products 

in different contexts could be used to inform more granular and accurate demand-
based estimates. The methodology used by Camerini et al. for estimating the 
propensity to consume counterfeit products relies on data from a Spanish survey, which 
was extrapolated to all other EU Member States (Camerini et al., 2015). Using data 
from more detailed, country-specific surveys – such as EUIPO (2017d) and EUIPO 
(2019a) – could help to generate more accurate country-specific estimates of criminal 
revenues.   

•  Sullivan et al. (2017) argue that a more harmonised definition of what constitutes 

a counterfeit good is needed. Agreeing on a definition that is consistent across 
Member States will enable better data collection and researchers to study the 
counterfeit markets more effectively.  

• 

• 

Further, law enforcement authorities of some Member States do not make their 
information on internal detentions available to the rest of the EU, creating huge gaps 
in the available seizure data (EUIPO, 2019e).  

In addition, seizure data is collected primarily for non-statistical purposes, by individuals 
with poor knowledge of statistics, meaning the data is not as easy to use for 
statistical analysis purposes as it could be (Butticè et al., 2018).  

Table 2.31: Recommendations – IPR infringements market 

Key finding 

Recommendation 

Actor 

Member States 

European Commission 

Academic sector  

Estimates of the criminal revenues 
from IPR infringements are limited, 
and those that exist are susceptible 
to limitations and biases that result 
in an underestimate.  

In the IPR infringements market, 
estimates of loss to legitimate 
industry rather than criminal 
revenues prevail. Loss-based 
estimates are not the same as 
revenues, and therefore cannot be 
directly compared to other criminal 
markets examined in this study for 
which revenue estimates have been 
produced. 

Sector-, product- and country-
specific research designs should be 
utilised to provide more accurate 
estimates (for example by 
considering market-specific 
aspects, such as substitution rates 
and differences by demographics 
and countries). 

Consumer surveys conducted at 
the Member State level would 
improve demand-based estimates.  

A harmonised EU definition of a 
‘counterfeit good’ may enable more 
standardised data collection and 
analysis.  

2.4.3. Food Fraud 

William Phillips and Susie Lee, RAND Europe 

Key findings: 

•  Due to the lack of available data, no revenue estimates have been produced for food 

fraud. 

•  OCG involvement in food fraud is believed to be high, although the available evidence 

suggests it mostly consists of legitimate food operators engaging in fraudulent 
activity. However, there have been instances where large and well-known OCGs 
– such as the Camorra – were involved in food fraud. 

• 

In the future, growing amounts of trade in fraudulent food is expected to take place 
online. There is also evidence that specific fraud types – such as mislabelling of non-
organic foods as organic, and halal fraud – will increase. Further, more advanced 
production and counterfeiting methods are expected to be developed. 

97 

 
 
 
EUROPEAN COMMISSION 

This  Annex  provides  a  comprehensive  overview  of  food  fraud  in  the  EU,  building  upon  the 
summary provided in Section 2.4.3 of the main report.   

Food fraud is a collective term used to encompass the deliberate substitution, addition, tampering 
or  misrepresentation  of  food/feed,  food  ingredients  or  food  packaging,  as  well  as  false  or 
misleading statements about a product for economic gain (Spink & Moyer, 2011). For the purposes 
of  this  report,  we  also  include  counterfeit  food  products  in  this  analysis.  These  intentional 
infringements may risk public health through poisoning from hazardous chemicals or unsanitary 
conditions. But even without harm to public health, they can threaten the proper functioning of 
the internal food market by undermining consumer confidence. 

The EU legislation refers to ‘suspicions of intentional actions taken by businesses or individuals 
for the purpose of deceiving purchasers and gaining an undue advantage therefrom, in violation 
of  the  EU  relevant  rules’  to  distinguish  a  case  of  fraud  from  an  unintentional  regulatory  non-
compliance  (European  Commission,  2019).  In  some  Member  States,  food  fraud  can  also  be 
referred to as ‘food crime’, of which  OCG activity is believed to  be a major component (NFCU, 
2016). 

2.4.3.1. Previous  revenue  estimates  of  the  EU  Food  fraud 

market 

The literature search identified two studies that contained prior estimates of the food fraud market 
in the EU.  A study  by the European Union  Intellectual Property Office  (EUIPO)  estimated  the 
revenue from geographic indications (GI) infringements across 17 EU Member States 
(EUIPO, 2016). GI infringements are one of the most common types of food fraud in  the agri-
food sector, and are referred to as the voluntary practice of misrepresenting the location of the 
item by mislabelling the product. The estimates relied upon domestic sales and imports data, the 
wholesale revenue from all GI products of EU origin, and intra-EU trade statistics103. The size and 
the extent of infringement were estimated by using Member State data on GI market controls 
reported by Member States, and by sampling approximately 100,000 products checked between 
2012–2015  by  trained  inspectors  of  the  EU  for  GI  compliance.  Lastly,  the  average  additional 
premium  that  consumers  are  willing  to  pay  for  GI  products  was  calculated  by  taking  the  ratio 
between the price of a GI product and non-GI product, separately for each product class (e.g. 
wines, beers,  cheese,  etc.). To  obtain  the total GI infringement in a country, the infringement 
rate of each product class was weighted by the share of that product class of total GI product 
consumption in the country. A similar procedure was undertaken to obtain the total infringement 
within the EU.  

The  second  study  was  a  joint  publication  by  Europol-Interpol  (2017)  that  used  information  on 
seizures collected from investigations into high-risk entities across the supply chain of food and 
beverages (i.e. production, transport, distribution and selling points) to estimate the revenue 
from the food fraud market in 67 countries including 24 EU Member States.  

2.4.3.2. Quality of prior revenue estimates  

Compared to estimating the costs associated with food fraud, estimating the revenues generated 
through fraudulent food activities can be difficult. This is because there are not only multiple types 
of food fraud but also, within one type (e.g., mislabelling), food products with different premiums 
underlie differences in values when mislabelled. For example, infringing GI for wine yields higher 
revenue than for beer because there is a higher premium paid for wine (EUIPO, 2016). Only two 
studies were identified that provided an estimate of food fraud in the, EU and neither covered the 
EU  28.  A  food fraud expert interviewed as part of  the  study noted that estimating the market 
revenue for food fraud is extremely difficult because the market is complex and hidden. It was 
noted that to obtain the market revenue, a shared definition of food fraud – and more inspections 
–  among  EU  Member  States  would  be  needed.  Estimation  of  market  revenue  for  sub-markets 
would be relatively easier; however, data is fragmented104. 

The EUIPO (2016) study  only examined the revenue from one sub-market of food fraud:  false 
labelling or GI infringement. Hence, the report underestimates the revenue from the food fraud 
market in its entirety. A report produced by Europol and Interpol (2017) covers many countries 
around  the  globe,  including  24  EU  Member  States.  However,  the  data  is  not  disaggregated 

103 The consultation done for the Commission (DG AGRI) in 2012 by the consulting firm AND International. 
104 Interview with EU-level stakeholder, 12 February 2020 (#5).  

98 

 
 
EUROPEAN COMMISSION 

sufficiently to provide an understanding of the EU Member States as distinct from other regions. 
The major limitation of this study is its reliance on seizure data, which is known to fluctuate over 
time  in  response  to  law  enforcement  operations  and  effectiveness.  Moreover,  seizure  data  is 
influenced by the detectability of the product, but the location of the seizure may not be the final 
destination  of  the  products.  For  food  fraud,  it  is  understood  there  are  limited  inspections  and 
enforcement  activity105;  which  means  that  the  estimates  produced  are  particularly  likely  to  be 
considerable undercounts.  

105 Interview with EU-level stakeholder, 12 February 2020 (#5). 

99 

 
 
EUROPEAN COMMISSION 

Table 2.32: Prior studies estimating the size or revenue of the food fraud market in the EU 

Citation 

Year(s) of 
estimate 

Sub-market 

Data source(s) 

Countries 
included in 
estimate 

Disaggregated 
at Member State 
level?  

Estimate produced (revenue) 

1 

EUIPO (2016) 

2012 to 2015 

GI infringements 
(all products) 

2012 to 2015 

2012 to 2015 

2012 to 2015 

2012 to 2015 

2012 to 2015 

2012 to 2015 

2012 to 2015 

2 

Europol and 
Interpol (2017) 

Dec 2017 to Mar 
2018 

GI infringements 
(wine) 

GI infringements 
(spirits) 

GI infringements 
(cheeses) 

GI infringements 
(fresh meat and 
meat products) 

GI infringements 
(beers) 

GI infringements 
(fruit, vegetables 
and cereals) 

GI infringements 
(other) 

All products 

Dec 2017 to Mar 
2018 

Alcohol and 
alcoholic 
beverages 

Data on wholesale 
revenue from GI 
products in the EU 
(collected by the 
AND Consulting 
company); 
Member State 
data on GI market 
controls; sampling 
of GI infringement 
by EU-trained 
inspectors 

17 EU Member 
States 

No 

No 

No 

No 

No 

No 

No 

No 

Seizure data 
collected from 
participating 
countries during 
the 4-month 
operation period. 

67 countries 
globally, including 
24 EU Member 
States 

Partially 

Partially 

The EU GI infringement market is 
totalled at €4.3 billion, and estimated 
to generate revenues of 
approximately €2.3 billion due to the 
premium price paid by consumers 

€2.182 million infringing market 

€811.6 million infringing market 

€644.7 million infringing market 

€402.3 million infringing market 

€1.2 million infringing market 

€94.0 million infringing market 

€277.1 million infringing market 

The revenue from the food fraud 
market, based on seizure data, was 
totalled at €67.7 million globally.  

€11.1 million fraud market; largest 
share in Italy (64%), followed by 
Russia (30%). (Only the countries 
with over 10% share are shown 
here). 

100 

 
 
 
 
EUROPEAN COMMISSION 

Citation 

Year(s) of 
estimate 

Sub-market 

Data source(s) 

Countries 
included in 
estimate 

Disaggregated 
at Member State 
level?  

Estimate produced (revenue) 

Dec 2017 to Mar 
2018 

Non-alcoholic 
beverages 

Dec 2017 to Mar 
2018 

Sugar and sweet 
products 

Dec 2017 to Mar 
2018 

Mixed food 
products 

Dec 2017 to Mar 
2018 

Meat and meat 
products 

Dec 2017 to Mar 
2018 

Dec 2017 to Mar 
2018 

Dairy products 

Food 
supplements/ 
additives 

Dec 2017 to Mar 
2018 

Fruits, vegetables, 
legumes 

Dec 2017 to Mar 
2018 

Cereals, grains, 
and derived 
products 

Dec 2017 to Mar 
2018 

Condiments/ 
sauces 

Dec 2017 to Mar 
2018 

Seafood 

Dec 2017 to Mar 
2018 

Dec 2017 to Mar 
2018 

Coffee/tea 

Cooking oil  

Partially 

Partially 

Partially 

Partially 

Partially 

Partially 

Partially 

Partially 

Partially 

Partially 

Partially 

Partially 

€0.14 million fraud market; largest 
share in Spain (73%) followed by 
Indonesia (20%). 

€1.6 million fraud market; largest 
share in Hungary (37%), followed by 
Lithuania (29%), Sweden (22%). 

€1.46 million fraud market; largest 
share in Italy (48%). 

€27.9 million fraud market; largest 
share in Italy (91%). 

€9.4 million fraud market; largest 
share in Italy (90%).  

€49,000 fraud market; share of the 
revenue by countries not reported. 

€0.74 million fraud market; largest 
share in Belarus (41%), followed by 
Indonesia (21%) and Spain (16%).  

€0.69 million fraud market; largest 
share in Jordan (35%), followed by 
Indonesia (34%) and Italy (22%). 

€0.58 million fraud market; largest 
share in Indonesia (95%). 

€1.8 million fraud market; largest 
share in Portugal (14%), followed by 
Spain (18%) and Switzerland (13%). 

€0.28 million fraud market; largest 
share in Indonesia (98%). 

€0.77 million fraud market; largest 
share in Italy (84%). 

101 

 
 
 
 
EUROPEAN COMMISSION 

2.4.3.3. Methodology for estimating revenues in this study  

The literature review of prior estimates found limited to no secondary data-sources to enable a 
calculation of the food fraud market across the 28 EU Member States. This finding was confirmed 
in interviews with market experts106. As such, no estimates of market revenue for food fraud have 
been produced in this study. The remainder of this chapter will discuss opportunities for improving 
data collection and estimation, and present results from the qualitative analysis on market actors 
and future trends and dynamics. 

2.4.3.4. Criminal actors and modus operandi 

Table 2.33: Food fraud – Market actors 

Level of OCG involvement 

Size and composition of OCGs 

OCG involvement is believed to be high in food fraud, however the 
available evidence suggests it mostly consists of legitimate food 
operators engaging in fraudulent activity. 

Largely unknown. However, there are instances where large and 
well-known OCGs – such as the Camorra – have been involved in 
food fraud. 

Modus operandi of OCGs 

OCGs may use the set-up of legitimate food business operators to 
infiltrate parts of the food and drink supply chain.  

Poly-criminality of OCGs 

The infrastructure of a food business may be used to cover the 
importation of contraband from other illegal markets, such as drugs 
or illegal wildlife. Connections between food fraud and other 
counterfeiting activities have been discovered in recent years. 

Other key actors  

It is suspected that most cases of food fraud are instigated by 
(initially) legitimate food-business operators. 

Four studies were identified in the literature review that included information on the key actors in 
food  fraud  in  the  EU.  These  studies  contained  reports  of  OCG  involvement,  yet  details  of  the 
degree of OCG involvement in food fraud, across and within the EU Member States – are not well 
known.  

A recent assessment from the National Food Crime Unit (NFCU) reports that OCG involvement in 
the food fraud market is not yet common, at least in the UK (NFCU, 2016). An interviewed food 
fraud expert107 claimed that most actors involved in food fraud are  food businesses and 
food  business  operators  engaging  in  fraudulent  activity  in  order  to  gain  a  market 
advantage over their rivals. Lord et al. described food fraud as more of an endogenous problem, 
whereby fraudulent opportunities arise within the legitimate food system as a part of legitimate 
actors’ normal behaviour (Lord et al., 2017). The phenomenon of business operators introducing 
fraudulent  food items  into  the  supply  chain  in  order  to  cut  costs  is  termed  ‘industrial  drift’.  In 
these cases, there was little evidence to suggest actors were linked with other criminal activities 
or illicit markets. However, it was also acknowledged that the market may be at risk of increasing 
OCG presence because it presents low barriers to entry and the controls are light. Furthermore, 
OCGs are known to be involved in food fraud and there are many  examples of this, as reported 
by EUIPO (EUIPO & Europol, 2019). The NFCU reported that more than 20 OCGs are known to 
have links to food crime (NFCU, 2016). A possible driver of increasing OCG involvement in food 
fraud is its relative lack of risk. Lord et al. note that compared to other criminal markets – such 
as drug trafficking – methods of detection in food fraud are less sophisticated and the penalties 
for being caught  are  less severe, meaning  food  fraud  offers large potential rewards  at  a lower 
level of risk (Lord et al., 2017). 

The actors in food fraud do not necessarily represent the typical conceptions of OCGs, such as 
hierarchical mafia-style groups (although such groups are also known to be involved to at least 
some  degree).  The  evidence  suggests  that  many  of  the  market  actors  are  legitimate  business 
operators, who use fraudulent means to conduct their business.  

106 Interview with EU-level stakeholder, 12 February 2020 (#5). 
107 Interview with EU-level stakeholder, 12 February 2020 (#5). 

102 

 
 
 
EUROPEAN COMMISSION 

Modus operandi 
There are multiple ways that food fraud can be committed. According to PricewaterhouseCoopers 
(PwC),  product  ingredients  can  be  swapped  for  cheaper,  lower  quality  alternatives;  product 
packaging  can  contain  false  information;  and  the  branding  of  legitimate  and  recognisable 
companies can be illegally copied (PwC, 2016). EUIPO reported that a common modus operandi 
for  OCGs  operating  in  the  fake  wine  market  involves  placing  low-quality  wine  inside  bottles 
labelled  with  the  branding  of  legitimate,  expensive  producers  (EUIPO  &  Europol,  2019). 
Sometimes, pure alcohol is added to the wine in order to match the alcohol percentage of the 
legitimate product. Further, products can be substituted for cheaper versions, targeted at markets 
for  which  there  is  low  discernment108.  For  example,  counterfeit  Italian  products  –  such  as 
prosciutto  and  olive oil  – could  be  marketed in  countries  such  as  China,  where  the  chances  of 
detection may be lower. This can be done by both criminal enterprises and otherwise legitimate 
operators109.  However,  as  demonstrated  from  Operation  HYGIEA,  a  joint  EU-Asian  customs 
operation to seize counterfeit goods, not only high-quality goods are being counterfeited, but also 
day-to-day basic items, meaning almost all goods types are at risk of being counterfeited (OLAF, 
2019). 

According to an interviewed expert110,  there is limited  evidence of food  fraud overlapping with 
other  criminal  markets.  In  part,  this  is  because  the  lack  of  traditional,  mafia-type  OCG 
involvement in food fraud means there is naturally less of a connection with markets that have a 
higher  level  of  OCG  involvement.  However,  the  interviewee111  mentioned  that  criminal 
organisations have been known to invest their profits from other criminal markets into some types 
of food crime, simply to make money. Further, other sources do find evidence of poly-criminality. 
The NFCU report notes that a small number of food businesses are believed to have links to OCGs 
whose  main  activity  is  not  in  itself  related  to  food  fraud  (NFCU,  2016).  An  expert  interviewee 
noted that OCGs may exploit national or EU funding for the agri-food sector, committing other 
types  of  financial  fraud  (Masini,  2018).  EUIPO  reported  a  case  whereby  an  Italian  criminal 
organisation  operating  their  own  fraudulent  slaughterhouse  used  forged  documents  to  claim  a 
€900,000  subsidy  from  the  Italian  government  to  invest  in  their  business  (EUIPO  &  Europol, 
2019). OCGs may also exploit infrastructure surrounding a food business to cover the importation 
of contraband, such as drugs or illegal wildlife (NFCU, 2016). According to an EUIPO report, law 
enforcement authorities who detect fraudulent food products regularly find links with the wider 
counterfeit  goods  market  (EUIPO  &  Europol,  2019).  Counterfeit  car  parts,  clothing,  cosmetics, 
electronic  goods,  pharmaceuticals,  tobacco  and  toys  have  all  been  discovered  alongside 
counterfeit  food  products  in  recent  raids.  This  is  because  OCGs  sometimes  use  the  same 
production  locations  and  distribution  routes  for  both  food  and  other  counterfeit  goods.  (IPR 
infringements and counterfeit goods are discussed in Section 2.4.2.) 

2.4.3.5. Future trends and dynamics 

Table 2.34: Food fraud – Future trends 

Future trends and dynamics 

Growing online presence; specific fraud types, such as 
mislabelling of non-organic foods as organic, and halal 
fraud; more sophisticated production and counterfeiting 
methods. 

Impact on market and criminal 
finances  

This is expected to increase revenues for criminals 
operating in the food fraud market. 

Seven  studies  were  identified  in  the  literature  review  that  included  information  on  the  future 
trends and dynamics in food fraud in the EU. These studies showed that although food fraud is 
not a new type of crime, the motivation for food fraud may be growing (Codex Alimentarius 
Commission, 2017). This is in part owing to: 

•  The economic crisis in 2008, after which the estimated losses due to food fraud 

increased by 20% according to Gee and Button (2019).  

•  Changing structures in the legitimate food supply-chain. The Codex Alimentarius 

Commission cite the following: the growing length and complexity of supply networks, 

108 Communication with expert advisor to the study, 15 June 2020.
109 Communication with expert advisor to the study, 15 June 2020. 
110 Interview with EU-level stakeholder, 12 February 2020 (#5). 
111 Interview with EU-level stakeholder, 12 February 2020 (#5). 

103 

 
 
 
 
EUROPEAN COMMISSION 

the concentration of buying groups and retailers into very few multi-national chains with 
strong buying power, the advent of refrigerated systems enabling the shifting and long-
term storage of large quantities of perishable foods, and the rapid development of 
technology providing tools for criminals to make illegitimate deals and set up 
communication networks.  

One  of  the  interviewees112  identified  the  online  food  market,  especially  for  alcohol  and  food 
supplements,  as  an  emerging  platform.  E-commerce  may  be  attractive  to  criminals  because 
opening new websites and temporary accounts is easy113. The interviewee also noted that food 
fraud  involving  e-commerce  may  include  criminal  activities  by  OCGs.  According  to  Food  Fraud 
Advisors (2017), emerging trends in fraudulent activities in the agri-food sector include: growing 
incidences of halal fraud (as reported by the BBC), and counterfeiting middle-range foods rather 
than luxury foods. Regarding the latter, recent Interpol-Europol operations discovered counterfeit 
chocolates and sweets (Europol-Interpol, 2017). The expert interviewee also commented that the 
mislabelling of non-organic foods as organic is a major trend, especially on food products imported 
from outside the EU. This may also extend to the use of additives used in foodstuffs to lower costs 
or  enhance  flavour  etc.,  but  not  disclosed  on  labelling  due  to  their  potential  negative  health 
implications or illegality114. Another interviewed expert 115 claimed that OCGs may move into food 
types where there is low awareness from authorities. The interviewee spoke of a case whereby 
fraudulent  tomatoes  and  potatoes  were  sold  by  OCGs  across  Italy  and  Germany,  which  went 
undetected due to the inconspicuous and low-priority nature of the goods involved. 

According to EUIPO, there is also evidence that criminal actors are generally  becoming  more 
sophisticated  and  professional  (EUIPO  &  Europol,  2019).  Law  enforcement  authorities  are 
increasingly  reporting  the  use  of  counterfeit  packaging  materials,  security  rings  and  labels,  as 
well as more sophisticated production methods. Authorities have seized infrastructure – such as 
machines,  corks  and  security  rings  – used  for  fraudulent  alcohol  bottling.  In  the  past,  food 
fraudsters would refill the real packaging with fake products, however there is evidence that food 
fraudsters now operate their own production lines. EUIPO reports that up to one-seventh of all 
produce  from  some  known  legitimate  alcohol  production  lines  is  fraudulent  (EUIPO  &  Europol, 
2019). 

2.4.3.6. Recommendations 

There  are  three  principal  ways  in  which  data  collection  and  estimation  on  food  fraud  could  be 
improved in the EU:  

• 

First, one interviewee116 emphasised the need to achieve a situation where all 28 
Member States consistently and systematically report the inspections that have 
been made within their country, through the Administrative Assistance and 
Cooperation System or by other means. This will enable the creation of a centralised 
EU-wide database of all records of food fraud activity.  

•  Second, advanced data-analytics techniques may be used to increase detection 

rates. Marvin et al. built a Bayesian Network model that uses data on past food fraud 
cases to predict future cases (Marvin et al., 2016). Using data from Rapid Alert for Food 
and Feed and some data from cases in the US, the model was able to predict the type of 
food fraud 91.5% of the time. The model only predicts the type of food fraud, but the 
authors state that given access to more data (such as monitoring and customs data), 
the model would be able to predict food fraud of any product coming in from any 
country. The authors note that their model could be used to help authorities design 
monitoring and control measures to more effectively identify food types that are at an 
increased risk of fraud, using data on the origin, price and demand of the food. This 
would improve the likelihood of detecting food fraud, generate more cases and data, 
and allow better estimation of market size. 

• 

Third, EU-wide operations such as that of Operation OPSON should continue to 
be employed (Europol, 2019a). The resulting enhanced cooperation and vast amount 
of seized goods are further data points that can help in estimating the true size of the 
market. It is understood there is relatively limited inspection and enforcement activity 

112 Interview with EU-level stakeholder, 12 February 2020 (#5). 
113 Interview with EU-level stakeholder, 12 February 2020 (#5).  
114 Communication with expert advisor to the study, 15 June 2020. 
115 Interview with international-level stakeholder, 19 March 2020 (#24). 
116 Interview with EU-level stakeholder, 12 February 2020 (#5). 

104 

 
 
EUROPEAN COMMISSION 

undertaken in food compared to other illicit markets117, therefore increasing the number 
of operations targeting food fraud may also result in more cases being detected.   

The key findings from this study and the related recommendations are summarised in the table 
below.  

Table 2.35: Recommendations – Food fraud market 

Key finding 

Recommendation 

Actor 

Member States 

European Commission 

The complexity of the market and a 
lack of data means it is not possible 
to come up with an accurate 
estimate of the market size. 

Food fraud is largely undertaken by 
legitimate food businesses seeking 
to cut costs, with traditional OCG 
involvement less common 
compared to other markets. 

There is evidence that food fraud 
will increasingly take place online 
and that counterfeit food 
manufacturing methods are 
becoming more sophisticated. 

Member States should consistently 
and systematically report food 
inspections that have been made 
within their country, enabling the 
creation of an EU-wide database of 
all records of food fraud activity. 

Identifying more cases of food 
fraud will also allow for better 
estimation. Two ways this could be 
done are via advanced data 
analytics and by increasing the 
scope of large-scale operations, 
such as OPSON.  

2.5.  Environmental crime 

The  European  Commission  defines  environmental  crime  as  ‘acts  that  breach  environmental 
legislation and cause significant harm or risk to the environment and human health’ (European 
Commission, 2020a). According to Europol, the best-known offences of environmental crime are:  

• 

• 

• 

• 

Illicit waste trafficking involving the improper collection, transport, recovery or 
disposal of waste. 

Illicit wildlife trafficking involving the killing, destruction, possession or trade of 
specimens of protected wild fauna. 

Illegal operation of a plant in which a dangerous activity is carried out, or in which 
dangerous substances or preparations are stored.  

Production, importation, exportation, marking or use of ozone-depleting substances 
(Europol, 2020b).  

This project focuses on illicit waste and illicit wildlife trafficking in the EU.  

2.5.1. Illicit waste  

Shann Hulme and Susie Lee, RAND Europe and Lorenzo Segato, REACT  

Key findings: 

•  According to the original estimates produced in this study, the annual revenues 
derived from the illicit waste market in the EU range between €4 billion and €15 
billion (mid-point estimate of €9.5 billion).   

•  Comparing these estimates with a previous Commission-funded study – known as the 
BlockWaste project – that used the same methodology, the study finds there has 
been a growth in the market for both hazardous and non-hazardous waste.  

• 

There is known to be some OCG involvement in the illicit waste market, particularly 
small, loosely structured groups typically involved in the international shipment of 
waste from the EU.  

•  White-collar professionals are key criminal actors in the illicit waste market, exploiting 

their awareness of the complex waste management system and loopholes in 
regulations.  

117 Interview with EU-level stakeholder, 12 February 2020 (#5). 

105 

 
 
EUROPEAN COMMISSION 

• 

The illegal shipment of end-of-life vehicles and e-waste is expected to increase, and 
the overall size of the illicit waste market is also expected to grow in the context of 
the recent Chinese ban on waste imports from foreign countries.  

The illicit waste  market involves the  illegal  trading and disposal of waste outside of regulatory 
frameworks set by national and international waste laws  (Europol, 2013b). This can occur with 
other forms of waste crime, such as deliberate misclassification of waste or operation of illegal 
waste management sites. 

This Annex provides a comprehensive overview of the illicit waste market in the EU, building upon 
the summary provided in Section 2.5.1 of the main report.   

2.5.1.1. Previous  revenue  estimates  of  the  EU  illicit  waste 

market 

The literature search identified two studies containing prior estimates of the illegal waste market 
in the EU since 2010. A study by Calderoni et al. (2014) – and a subsequent study by Meneghini 
et  al.  (2017)  known  as  the  BlockWaste  project  – both  employed  indirect/residual  methods  for 
estimation. In this approach, the amount of waste generated was compared with the amount of 
waste  legally  managed,  thus  deriving  the  ‘gap’  or  the  amount  of  waste  disappearing  from  the 
legal market, which was assumed to be a result of illegal disposal. Because the amount of waste 
legally managed is the sum of waste treated and stored, a method was proposed to adjust the 
amount by yearly changes in stored waste and legally traded waste. The average price of illegally 
sold waste was then multiplied to derive a revenue estimate. 

The study by Calderoni et al. focused on the Italian illegal waste market, which – as the authors 
observed – is somewhat different from illegal waste markets in other parts of Europe in that it 
has a high presence of Italian OCGs (Calderoni et al., 2014). This study utilised data on special 
waste118 production and management119 from the Italian Institute for Environment Protection and 
Research to estimate the volume of illegally traded special waste in Italy over the period 2007 to 
2010. The study used the price of the legal services of waste management and then estimated 
illegal market price by dividing by 3 and 5, based on previous observations by Massari & Monzini 
(2004)  and  Vander  Beken  et  al.  (2007).  The  study  also  distinguished  between  hazardous  and 
non-hazardous  waste120  (European  Parliament,  2008;  United  Nations  Environment  Programme 
[UNEP], 2019). 

The  BlockWaste  project  built  upon  the  methodology  employed  by  Calderoni  et  al.  to  generate 
estimates for the illegal waste market across 23 EU Member States from 2010 to 2014 (Meneghini 
et al., 2017; Suvantola et al., 2017). Data on waste generation, management, and transboundary 
shipments  was  obtained  from  Eurostat’s  Environmental  Data  Centre  on  Waste,  and  data  on 
country-specific legal waste operations – especially of the quantity of waste stored – was further 
obtained by contacting national statistical agencies and environmental statistical authorities. Five 

118 Special waste is ‘the waste generated by production activities’ (The Council of the European Union, Council 
Directive  1999/31/EC  on  the  Landfill  of  Waste).  It  is  distinguished  from  municipal  waste,  waste  from 
households or waste similar to household waste by nature or composition. Special waste represented more 
than  80%  of  the  total  waste  produced  in  Italy  in  2010,  and  is  particularly  attractive  to  criminal  operators 
because it guarantees higher profits.   
119 The amount of waste legally managed was calculated as the sum of the waste subject to final operations 
(recovery and disposal) and the stock, where the stock was the difference between stored waste in a given 
year and stored waste in the previous year. Of note, in the BlockWaste project the amount of waste legally 
managed  was  calculated  as  the  amount  of  waste  treated minus  the  amount of waste  legally  traded.  Here, 
waste treated is described as the total amount of waste subject to final treatment operations, similar to that 
defined  by  Calderoni  et  al.  (2014),  but  incineration  is  added  to  recovery  and  disposal  as  examples  of 
operations.     
120 Any types of waste can be either hazardous or non-hazardous. In general, hazardous waste poses a greater 
risk to the environment and human health and thus requires a stricter control regime, although its absolute 
amount  is  less  than  non-hazardous  wastes.  The  properties  that  render  waste  hazardous  are  laid  down  in 
Annex III of Directive 2008/98/EC and are further specified by the Decision 2000/532/EC establishing a List 
of  Waste,  as  last  amended  by  Commission  Decision  2014/955/EU  (European  Parliament,  2008).  The  Ban 
Amendment of the Basel Convention on the Control of Transboundary Movements of Hazardous Wastes and 
their  Disposal  (Basel  Convention)  bans  EU  countries  to  export  hazardous  waste  to  non-OECD  and  non-EU 
countries. The Amendment entered into force in December 2019. Some non-hazardous waste – such as paper, 
metal  or  plastic  –  is  considered  ‘green-listed’  under  the  EU  Waste  Shipment  Regulations  (EC  Regulation 
1013/2006) and shipment of this waste for recovery within the EU and OECD does not require the consent of 
the authorities (UNEP, 2019).  

106 

 
 
 
EUROPEAN COMMISSION 

EU Member States – namely Belgium, Cyprus, Luxembourg, Malta, and Slovenia – were excluded 
from  the  final  analysis,  because  these  countries  tended  to  rely  on  data  from  waste  treatment 
operators, rather than waste producers; thus, an underestimate of the amount of waste produced 
(rather than merely treated) was likely.  

2.5.1.2. Quality of prior revenue estimates 

This section focuses on assessing only the quality and limitations of the estimates produced from 
the BlockWaste project (Meneghini et al., 2017; Suvantola et al., 2017), as it is the most up-to-
date and relevant study that  captures most EU Member States. One of the contributions of the 
BlockWaste  project  was  to  make  available  a  detailed  step-by-step  guideline  for  estimating the 
amount of waste ‘disappearing’ from the legal waste market, using the publicly available Eurostat 
data. The estimation method also considered important adjustments, such as the amount of waste 
legally traded. There were some limitations of the estimates produced by BlockWaste: 

• 

First, the method is reliant upon accurate reporting by either waste producers or legal 
waste treatment facilities. Poor data collection methods and untruthful declarations may 
undermine the estimates produced (Meneghini et al., 2017).  

•  Second, the estimates rely on scarce information from only one country (Italy) on the 

price of waste that is illegally managed or disposed, thus omitting representation of the 
illegal waste markets in other countries of the EU.   

• 

• 

Third, the estimates do not capture the entire EU, as the legal waste-generation and 
management data from Belgium, Cyprus, Luxembourg, Malta and Slovenia was not 
deemed suitable for inclusion.  

Fourth, it was unclear in the methodology whether and how the amount of stocked 
waste was incorporated into the calculations. 

107 

 
EUROPEAN COMMISSION 

Table 2.36: Prior studies estimating the size or revenue of the illicit waste market in the EU 

Citation 

Year(s) of 
estimate 

Sub-market 

Data source(s) 

Countries included 
in estimate 

Disaggregated at 
Member State 
level?  

Estimate 
produced 
(revenue) 

1  Calderoni et al. 

(2014) 

2007 to 
2010 

Hazardous and 
non-hazardous 
waste trafficking 

Regional-level data on special waste production 
and management, from the Italian Institute for 
Environment Protection and Research. 

Italy 

N/A 

Italian data on legal waste management, obtained 
by contacting a waste disposal company. 

Price of the legal services of waste management 
used to yield illegal market price by dividing by 3 
and 5, according to previous observations121 that 
prices in the illegal market are between one-third 
and one-fifth of legal prices.   

2  Meneghini et al. 

(2017); 
Suvantola et al. 
(2017) 

2010 to 
2014 

Hazardous and 
non-hazardous 
waste trafficking 

Country-level data on waste generation and waste 
management for all EU Member States through 
Eurostat’s Environmental Data Centre on Waste. 

Price data obtained from Italian judicial cases, 
newspapers and research papers. 

24 EU Member 
States 

Yes 

(excluding Belgium, 
Cyprus, Luxembourg, 
Malta and Slovenia) 

€304 million to 
€507 million 
(total waste) 

€279 million to 
€466 million 
(non-hazardous 
waste) 

€25 million and 
€41 million 
(hazardous 
waste)  

€1.3 billion to 
€10.3 billion 
(non-hazardous 
waste) 

€1.5 billion to 
€1.8 billion 
(hazardous 
waste) 

121 Calderoni et al. (2014) does not include a reference for this information.  

108 

 
 
 
EUROPEAN COMMISSION 

2.5.1.3. Methodology  used 

in  this  study  for  estimating 

revenues  

To  estimate  the  revenues  of  the  illicit  waste  market  in  the  EU,  this  study  replicates  the 
methodology employed in the BlockWaste project (Meneghini et al., 2017; Suvantola et al., 2017). 
The methodology involves estimating the quantity of waste disappearing from the legal market in 
each EU Member State. If all waste disappearing from the legal market is assumed to have been 
illegally handled, this quantity can be converted into revenues using data on the price of illegally 
traded waste. Our study provides an update on the BlockWaste estimates by using more current 
data from Eurostat on waste generation, treatment and shipment.  

A summary of the approach used in this study for estimating the market revenue from illicit waste, 
and the limitations of this approach, is outlined in the table below.  

Table 2.37: Summary of approach for estimating revenues from illicit waste  

Summary of approach 

Rationale 

Output 

Indirect approach that replicates the BlockWaste methodology (Meneghini et 
al., 2017; Suvantola et al., 2017) to estimate the quantity of waste 
disappearing from the legal market. This estimate is then monetised using 
information on the price of illegally traded waste.  

Data from Eurostat represents the only available data source produced at the 
national level on waste generation and management in the EU, thus allowing 
for an estimation of the entire market.  

The annual revenue from hazardous and non-hazardous waste disappearing 
from the legal market in the EU.  

Scope and coverage 

Geographical scope: 23 EU Member States (excluding Belgium, Cyprus, 
Luxembourg, Malta and Slovenia, for which reliable data was not available)122 

Data sources 

Year(s) of estimate: 2014 to 2016 (mean value), updated to 2019 values 

Sub-markets: Hazardous and non-hazardous waste 

Data on waste generated, managed and shipped (imported and exported) 
from Eurostat’s Environmental Data Centre on Waste (Eurostat, 2020a, 
2020c, 2020d). 

Price of illegally traded waste as per the BlockWaste project (Meneghini et al., 
2017; Suvantola et al., 2017), which reflects prices charged for illegal 
trafficking in Italy. Given the limited applicability of Italian prices to other EU 
Member States, the research team made efforts to identify additional data 
sources on the price of illegally trafficked waste in Europe, such as through 
direct requests to law enforcement. Unfortunately, for the most part price 
information was not able to be shared and where it was available, it did not 
align with the categories of hazardous and non-hazardous waste as per the 
Eurostat data. As such, the estimates produced in this study should be 
interpreted with caution. One benefit of this approach is that the estimates 
are comparable with the BlockWaste project, thus are useful for providing an 
indication of changes in the market over time.   

Key steps 

The analysis replicated the steps taken in the BlockWaste project, as follows: 

1.  Retrieve data on the annual quantity of waste generated for each 

Member State from Eurostat for 2014 and 2016, and calculate mean 
value across both years.  

2.  Retrieve data on the annual quantity of legally treated waste for 
each Member State from Eurostat for 2014 and 2016, and calculate 
mean across both years.  

3.  Retrieve data on the shipments of waste (imports and exports) 

from Eurostat for each Member State for 2014, 2015 and 2016. Use 
this data to calculate legal waste traded as a mean over the years 
under analysis (i.e. 3 years): 

𝐿𝑒𝑔𝑎𝑙 𝑤𝑎𝑠𝑡𝑒 𝑡𝑟𝑎𝑑𝑒𝑑𝑖,𝑗 = 𝐼𝑚𝑝𝑜𝑟𝑡𝑒𝑑 𝑤𝑎𝑠𝑡𝑒𝑖,𝑗 − 𝐸𝑥𝑝𝑜𝑟𝑡𝑒𝑑 𝑤𝑎𝑠𝑡𝑒𝑖,𝑗 
Where: 𝑖 = 𝑀𝑒𝑚𝑏𝑒𝑟 𝑆𝑡𝑎𝑡𝑒, 𝑗 = 𝐻𝑎𝑧𝑎𝑟𝑑𝑜𝑢𝑠 𝑤𝑎𝑠𝑡𝑒, 𝑁𝑜𝑛𝐻𝑎𝑧𝑎𝑟𝑑𝑜𝑢𝑠 𝑤𝑎𝑠𝑡𝑒 

4.  Calculate the legal management of waste for each Member State 

as follows: 

122  As  per  the  BlockWaste  project,  many  of  these  countries  determine  waste  generation  based  on  waste 
treatment – thus, precluding our ability to generate a ‘gap’ estimate. 

109 

 
 
EUROPEAN COMMISSION 

𝐿𝑒𝑔𝑎𝑙 𝑤𝑎𝑠𝑡𝑒 𝑚𝑎𝑛𝑎𝑔𝑒𝑑𝑖,𝑗 = 𝑇𝑟𝑒𝑎𝑡𝑒𝑑 𝑤𝑎𝑠𝑡𝑒𝑖,𝑗   − 𝐿𝑒𝑔𝑎𝑙 𝑊𝑎𝑠𝑡𝑒 𝑇𝑟𝑎𝑑𝑒𝑖,𝑗 
Where: 𝑖 = 𝑀𝑒𝑚𝑏𝑒𝑟 𝑆𝑡𝑎𝑡𝑒, 𝑗 = 𝐻𝑎𝑧𝑎𝑟𝑑𝑜𝑢𝑠 𝑤𝑎𝑠𝑡𝑒, 𝑁𝑜𝑛𝐻𝑎𝑧𝑎𝑟𝑑𝑜𝑢𝑠 𝑤𝑎𝑠𝑡𝑒 

5.  Calculate the gap between the quantity of generated waste and the 
corresponding amount of waste legally managed, which will serve as 
an estimate for the mean amount of waste disappearing from the 
legal market over the period 2014 to 2016.  
𝑇𝑜𝑡𝑎𝑙 𝑤𝑎𝑠𝑡𝑒 𝑔𝑎𝑝𝑖,𝑗 = 𝑊𝑎𝑠𝑡𝑒 𝑔𝑒𝑛𝑒𝑟𝑎𝑡𝑒𝑑𝑖,𝑗 −  𝐿𝑒𝑔𝑎𝑙 𝑤𝑎𝑠𝑡𝑒 𝑚𝑎𝑛𝑎𝑔𝑒𝑑𝑖,𝑗 
Where: 𝑖 = 𝑀𝑒𝑚𝑏𝑒𝑟 𝑆𝑡𝑎𝑡𝑒, 𝑗 = 𝐻𝑎𝑧𝑎𝑟𝑑𝑜𝑢𝑠 𝑤𝑎𝑠𝑡𝑒, 𝑁𝑜𝑛𝐻𝑎𝑧𝑎𝑟𝑑𝑜𝑢𝑠 𝑤𝑎𝑠𝑡𝑒 

6.  Generate revenue estimates by applying price data to gap 

estimates. A lower, upper and mid-level estimate was produced for 
both hazardous and non-hazardous waste, using the following price 
indices: 

Illegal management of non-hazardous waste: Low – €9 per tonne, Mid – 
€39.50 per tonne, High – €70 per tonne 

Illegal management of hazardous waste: Low – €82 per tonne, Mid – €88.50 
per tonne, High – €95 per tonne (Meneghini et al., 2017). 

- 

The gap analysis is reliant upon accurate reporting by either waste 
producers or legal waste treatment facilities. Poor data collection 
methods and untruthful declarations may undermine the estimates 
produced (Meneghini et al., 2017). 

-  Waste treatment and management data from Eurostat was not 
reliable for five EU Member States, thus precluding us from 
producing an EU-level estimate. 

- 

- 

The estimates rely on scarce and dated information on the price of 
waste illegally managed or disposed of, and are taken from one 
country (Italy), thus are not necessarily representative of the illegal 
market in other countries of the EU. No information on prices for the 
illegal markets in other Member States were available. 

No data was available on stored or stocked waste, therefore the 
results are likely to be overestimated.  

Limitations and 
caveats of this 
approach 

2.5.1.4. Revenue estimates of the EU illicit waste market 

Table 2.38 presents the original estimates produced for this project of the illicit waste market in 
the  23  EU  Member  States  for  which  sufficient  data  was  available.  According  to  these  figures, 
annual revenues derived from illicit waste trafficking range between €3.7 billion and €15.3 billion.  

•  Annual revenues deriving from illicit non-hazardous waste trafficking (both within 
national boundaries and abroad) range between €1.7 billion and €12.9 billion. As 
similarly noted by previous research, the wide range obtained for non-hazardous waste 
may be due to the wide diversity of prices charged for illegal management of different 
types of waste (Meneghini et al., 2017). 

• 

• 

• 

For hazardous waste trafficking, annual revenues range between €2.1 billion and 
€2.4 billion.  

There are large fluctuations in the revenue estimates across Member States, which is 
consistent with the findings of Meneghini et al. (2017) and reflects the  information 
biases in Eurostat data collected from Member States on waste management. These 
limitations must be considered in interpretation of the results. 

In terms of differences across Member States, those with the highest volume of both 
hazardous and non-hazardous waste disappearing from the legal market are France, 
Italy, the UK and Germany. Those with the lowest volume of both hazardous and 
non-hazardous waste disappearing are Greece, Latvia and Croatia (for hazardous and 
non-hazardous). However, for non-hazardous waste, Austria ranks the lowest.  

•  When examining the volume of hazardous waste disappearing as a proportion of waste 
generated, the UK (64%), Slovakia (57%), Lithuania (54%) and Austria (54%) record 
the highest, whilst Bulgaria (1%), Estonia (1%) and Greece (3%) record the lowest. For 
non-hazardous waste, Latvia (30%), Portugal (29%), Lithuania (26%) and Slovakia 
(23%) record the highest, while Austria (1%), Romania (2%) and Bulgaria (3%) record 
the lowest.  

•  Consistent with previous research, hazardous waste seems to be more at risk of illicit 
waste management than non-hazardous waste. On average, between 2014 and 2016 

110 

 
EUROPEAN COMMISSION 

around 33% of hazardous and 13% of non-hazardous waste disappeared from the legal 
market.  

•  We replicated the methodology employed by Meneghini et al. (2017) and found that our 
estimates – for both hazardous and non-hazardous waste – are higher, suggesting some 
growth in the market.

111 

 
EUROPEAN COMMISSION 

Table 2.38: Revenue estimate of the EU illicit waste market 

Annual revenue, adjusted for inflation, 2019 (€ million) 

EU Member State 

Hazardous 

Non-hazardous 

Total (hazardous and non-hazardous) 

Mid 

Low 

High 

Mid 

Low 

High 

Mid 

Low 

High 

23 EU Member States* 

2,229.01 

2,065.29 

2,392.75 

7,277.61 

1,658.20 

12,896.99 

9,506.62 

3,723.49 

15,289.74 

22 EU Member States 
without UK 

1,870.49 

1,733.10 

2,007.89 

5,057.41 

1,152.33 

8,962.45 

6,927.89 

2,885.43 

10,970.34 

Austria 

Belgium 

Bulgaria 

Croatia 

Czech Republic 

Cyprus 

Denmark 

Estonia 

Finland 

France 

Germany  

Greece 

Hungary  

Ireland 

Italy  

Latvia 

Lithuania 

Luxembourg 

Malta 

Netherlands 

64.47 

59.74 

69.20 

31.00 

- 

11.24 

5.68 

51.35 

- 

20.19 

10.14 

13.73 

524.29 

322.14 

1.11 

14.62 

16.02 

- 

10.41 

5.26 

47.57 

- 

18.70 

9.40 

12.72 

485.78 

298.48 

1.03 

13.53 

14.85 

- 

12.06 

6.10 

55.12 

- 

21.67 

10.89 

14.74 

562.80 

345.81 

1.19 

15.69 

17.20 

452.64 

419.40 

485.88 

3.93 

8.94 

- 

- 

3.65 

8.28 

- 

- 

4.22 

9.60 

- 

- 

- 

155.76 

33.46 

108.39 

- 

102.70 

118.83 

-8.91 

777.10 

709.13 

96.19 

106.36 

132.52 

937.78 

31.62 

70.47 

- 

- 

7.07 

- 

35.49 

7.62 

24.69 

- 

23.40 

27.07 

-2.03 

54.94 

95.47 

66.80 

124.13 

- 

276.03 

59.29 

192.08 

- 

182.00 

210.59 

-15.80 

- 

167.00 

39.14 

159.74 

- 

122.89 

128.97 

4.82 

- 

45.91 

12.89 

72.27 

- 

42.09 

36.48 

10.69 

- 

288.09 

65.39 

247.21 

- 

203.67 

221.48 

-1.05 

177.06 

1,377.14 

1,301.39 

662.84 

1,939.94 

161.58 

1,256.69 

1,031.27 

460.06 

1,602.49 

21.92 

24.24 

30.19 

170.45 

188.46 

234.85 

97.30 

120.97 

148.54 

22.95 

37.77 

45.04 

171.64 

204.15 

252.05 

213.67 

1,661.90 

1,390.42 

633.07 

2,147.77 

7.21 

16.05 

- 

- 

56.03 

124.89 

- 

- 

35.55 

79.41 

- 

- 

10.86 

24.33 

- 

- 

60.26 

134.49 

- 

- 

42.13 

39.02 

45.21 

151.59 

34.54 

268.63 

193.72 

73.56 

313.85 

112 

 
EUROPEAN COMMISSION 

EU Member State 

Hazardous 

Non-hazardous 

Total (hazardous and non-hazardous) 

Annual revenue, adjusted for inflation, 2019 (€ million) 

Poland 

Portugal  

Romania 

Slovakia 

Slovenia 

Spain 

Sweden 

United Kingdom 

Mid 

Low 

High 

Mid 

Low 

High 

Mid 

Low 

High 

25.84 

30.02 

16.53 

23.37 

- 

97.61 

114.50 

358.53 

23.95 

27.82 

15.32 

21.65 

- 

90.44 

106.09 

332.20 

27.74 

32.23 

17.74 

25.08 

- 

104.78 

122.92 

318.33 

164.05 

123.63 

91.31 

- 

583.91 

222.18 

72.54 

37.38 

28.17 

20.81 

- 

564.14 

290.74 

219.07 

161.82 

- 

133.04 

1,034.77 

50.62 

393.75 

344.18 

194.08 

140.16 

114.68 

- 

681.51 

336.69 

96.49 

65.20 

43.49 

42.45 

- 

591.88 

322.97 

236.82 

186.90 

- 

223.48 

1,139.56 

156.71 

516.67 

384.86 

2,220.20 

505.87 

3,934.53 

2,578.73 

838.07 

4,319.40 

Notes: Estimates were produced for 2014–2016 (mean), updated to 2019 values using Eurostat’s HICP (Eurostat, 2020b).  
*It was not possible to produce estimates for BE, CY, LU, MT, SI. 

113 

 
EUROPEAN COMMISSION 

2.5.1.5. Criminal actors and modus operandi 

Table 2.39: Illicit waste – Market actors 

Level of OCG involvement 

Some degree of OCG involvement is known. 

Size and composition of OCGs 

Small, loosely structured and not centralised.  

Modus operandi of OCGs 

Mixing of hazardous/special waste with non-hazardous 
waste. 

Selling hazardous/special waste as second-hand goods. 

Fraudulent documents and reporting. 

Poly-criminality of OCGs 

Groups involved have criminal histories.  

Other key actors  

Various actors across the waste stream are also involved, 
making the profile of actors heterogenous. 

White-collar professionals such as entrepreneurs or 
brokers operating within legitimate business.  

Six studies were identified in the literature review that included information on the actors in the 
illicit  waste  market  in  the  EU.  With  the  increased  requirement  for  proper  disposal  and 
management of waste, waste producers – especially those who generate large amounts of waste, 
such  as  corporates  –  are  motivated  to  seek  waste  management  services  at  a  low  price.  This 
creates demand for cheaper services for managing waste, and opportunities for profit for criminal 
actors to undercut legal prices and illegally dispose of waste123. As noted by Calderoni et al., illegal 
waste prices can be between one-fifth and one-third of the price of legal waste prices (Calderoni 
et al., 2014). 

Given the opportunity for profit in this market, some OCG involvement is known – particularly 
in the international shipment of illegal waste from the EU (Geeraerts et al., 2015; Noel, 2018). In 
terms of the profile of OCGs, one expert interviewed124 noted that perpetrators often have criminal 
backgrounds, e.g. previous sentences for drug-related crimes, or having been found to possess 
firearms. This is consistent with an assessment conducted for the UK Environment Agency in 2018 
that found that 20 OCGs involved in the UK waste sector were involved in other crimes, including 
drugs,  financial  crimes  and  violence  (Noel,  2018)  –  though  it  should  be  noted  that  such 
backgrounds  may  have  been  part  of  the  background  to  their  detection,  prioritisation  and 
classification as OCGs. With regards to illicit disposal of plastic waste, Interpol (2020) reported a 
link between OCGs and legitimate pollution-management businesses that are used as a cover for 
illegal operations. 

Available information also underscores that many of the groups involved may be less organised, 
and  are  often  small,  loosely  structured  and  not  centralised  (Bisschop,  2012,  2017; 
Geeraerts et al., 2015; Massari & Monzini, 2004). As one of the interviewees explained, actors 
tend to be heterogenous rather than traditional, highly structured organised groups125. Various 
actors  are  involved  at different stages in the waste  cycle,  from  origin (initial transfer  of waste 
generated to waste management specialist) to transit (transportation and storage activities) and 
destination  (treatment,  recycling  and  final  disposal)  (Massari  &  Monzini,  2004).  Each  stage 
involves  different  actors,  including  waste  generators,  waste  collectors,  waste  management 
companies, transport and shipping companies, waste treatment operators, shipping agents and 
waste brokers (Rucevska et al., 2015). Across this supply chain, there is often a thin distinction 
between legal and illegal actors. 

A  consistent  theme  from  the  literature  and  interviews  with  experts  was  that  as  well  as  some 
involvement of poly-criminal OCGs, complicit white-collar professionals are central actors in 
the illicit waste market. Motivated primarily  by  the need to reduce  the otherwise  high costs of 
legal waste treatment, these  actors utilise  their  awareness of the complex waste management 
system and loopholes in regulations, to their benefit.  

123 Interview with EU-level specialist in illegal waste market, 12 February 2020 (#04). 
124 Interview with national-level specialist in waste crime intelligence, 8 April 2020 (#31). 
125 Interview with EU-level specialist in illegal waste market, 11 March 2020 (#20). 

114 

 
 
 
EUROPEAN COMMISSION 

Modus operandi 
Shipping of waste as second-hand goods is a frequent form of illegal waste shipment (Baird et 
al., 2014; Rucevska et al., 2015). Tyres taken from end-of-life vehicles (ELVs), for example, are 
sold to developing countries as second-hand even if they are too worn out to be safe and useful. 
Waste  Electrical  and  Electronic  Equipment  (WEEE)  may  also  be  disguised  as  second-hand 
goods126.  Such  illegal  activity  takes  advantage  of  the  vague  distinction  between  ‘useful’  and 
‘useless’  waste,  especially  in  electronic  waste  (Rucevska  et  al.,  2015).  In  this  way,  the  actor 
profits  three  times:  first,  by  receiving  money  in  advance  by  a  waste  producer  for  recycling; 
second,  by  selling  useful  components  from  the  waste;  third,  by  illegally  selling  useless 
components as second-hand goods to non-EU countries127. 

Another mode of illegal shipment is to mix up waste of different degrees of speciality required for 
treatment (e.g. paper and hazardous waste), and to report the mixed-up shipment as only one 
lower priced / less protected category of waste (e.g. paper). For example, a storage site may mix 
toxic substances with domestic waste (Massari & Monzini, 2004). Illegal actors  might purchase 
lands or empty houses for waste storage and dispose of the waste by burning the entire site128. 
Interviewees  consistently  highlighted  that  using  fraudulent  documents  and  reporting  was  a 
common modus operandi for concealing the illegal transportation of waste and avoiding detection.  

2.5.1.6. Future trends and dynamics 

Table 2.40: Illicit waste – Future trends 

Future trends and dynamics 

Impact on market and criminal 
finances  

Overall increase in illegal waste market is predicted, 
especially in response to the Chinese ban on waste import.  

Shipment of end-of-life vehicles and e-waste are emerging 
sub-markets within the EU. 

Changes are expected due to Brexit.  

Due to the Chinese ban, shifts in not only destination 
countries but also parties involved in trans-boundary illegal 
waste trade are likely underway.  

Money-laundering and bribery are likely to increase in 
frequency and significance. 

Three studies were identified in the literature review that explicitly discuss emerging trends in the 
illegal waste market in the EU. In a 2013 report by Europol, it was expected that the illegal waste 
market  is  growing  (Europol,  2013b),  which  seems  consistent  with  our  estimates  of  the  illegal 
waste market compared with the earlier BlockWaste estimates.  

Since the ban of solid waste imports by China in January 2018, there has been a re-routing of 
illegal waste shipments to emerging import countries, primarily located in South and South-
East  Asian  countries,  and  to  a  lesser  extent  Eastern  Europe  (Interpol,  2020)129.  This  includes 
plastic waste, which has been identified as a growing problem with regard to illicit trafficking in 
the EU and globally. Interviewees shared cases such as an instant change in such international 
shipments after the Chinese ban, with waste streams being shipped to other EU countries with 
less costs for creating illegal dumping/incineration sites (which are often disguised as a recycling 
company in paperwork). The Chinese ban has likely entailed a shift in not only the destination 
countries, but also different parties involved in the illegal trade of waste.  

A report published in 2016 observed ELVs and Waste Electrical and Electronic Equipment 
(WEEE) as emerging sub-markets within the illegal waste market (EnviCrimeNet, 2016), which 
is  consistent  with  remarks  made  by  stakeholders  interviewed  for  this  study130.  From  a  Delphi 
Study  conducted  as  part  of  the  BlockWaste  project,  experts  expected  money-laundering  and 

126 WEEE refers to electrical or electronic items that have come to the end of their useful life, and covers a 
range  of  equipment  that  uses  electricity.  Computers,  TV-sets,  fridges  and  cell  phones  are  examples.  The 
Directive on WEEE 2002/96/EC and the Directive on the restriction of the use of certain hazardous substances 
in electrical and electronic equipment 2002/95/EC address the management of WEEE in the EU.    
127 Interview with EU-level specialist in illegal waste market, 11 March 2020 (#20). 
128 Interview with national-level specialist in waste crime intelligence, 08 April 2020 (#31). 
129 Interview with national-level specialist in the shipment of waste, 3 March 2020 (#10); Interview with national-
level specialist in waste crime intelligence, 8 April 2020 (#31). 
130 Interview with national-level specialist in the shipment of waste, 3 March 2020 (#10). 

115 

 
 
 
EUROPEAN COMMISSION 

bribery to increase in frequency and significance for the illegal waste market until 2030 (Suvantola 
et al., 2017). 

2.5.1.7. Recommendations  

There are two principal ways in which data collection and estimation on the illicit waste market 
could be improved in the EU. Notably, both limitations have been discussed in previous research 
by Meneghini et al. (2017); Suvantola et al. (2017), however, little improvement seems to have 
been made. 

• 

First, systematically report information on price of illicit waste and revenues 
generated through illicit waste trafficking. There is little systematic data on the 
price of illicit waste. Current and previous estimates rely upon information gathered 
from Italian judicial files and may have limited applicability to the illegal market in other 
Member States. Moreover, the price data has a large range – particularly for non-
hazardous waste – thus the lower and upper estimates produced vary by over €10 
billion, which calls into question the reliability of such estimates. Our enquiries revealed 
that there is little willingness to share price data for the purpose of estimation. 
Moreover, even where price data is available, there tends to be a misalignment between 
the unit of that data (i.e. the price of illegally trafficked plastics, tyres, end-of-life-
vehicles, etc.) and the categorisation of the Eurostat data (i.e. hazardous and non-
hazardous), which leads to challenges for estimation.  

•  Second, address gaps and inconsistencies in reporting on waste generation and 

treatment. The Eurostat data on waste generation and management is currently only 
available up to 2016, and there remain gaps in reporting for some Member States, thus 
precluding an EU-wide estimate.  

The key findings from this study and the related recommendations are summarised in the table 
below.  

Table 2.41: Recommendations – Illicit waste market 

Actor 

Eurostat 

Member States 

European Commission 

Key finding 

Recommendation 

A gap analysis using Eurostat 
data on legal waste treatment, 
management and shipment 
provided the basis for estimating 
the amount of hazardousness 
and non-hazardous waste 
disappearing from the legal 
market, assumed due to illegal 
diversion.  

However, Eurostat data is only 
available for 23 of the 28 EU 
Member States (excluding BE, 
CY, LU, MT, SI) and data on the 
price of illegally traded waste – 
required for monetising the gap 
estimates – is only available for 
Italy.  

Address gaps and inconsistencies 
in reporting by BE, CY, LU, MT, 
SI regarding waste generation 
and treatment. 

Member States should 
systematically report information 
on revenues generated through 
illicit waste trafficking – which is 
currently collected by police or 
judicial authorities in the course 
of their investigations – to the 
European Commission. 

2.5.2. Illicit wildlife 

Susie Lee, RAND Europe 

Key findings: 

• 

The revenues from the European eel market range from €4.7 to a high of €31.4 
million. However, there is insufficient data to enable an estimate of the illicit wildlife 
market as a whole in Europe, and this estimate is a vast underrepresentation of the 
extent of the phenomenon.        

•  Actors in the illegal wildlife trade have a heterogenous profile – varying by level of 

involvement in the supply chain and by species of wildlife trafficked.   

116 

 
 
EUROPEAN COMMISSION 

• 

• 

• 

In order to effectively capture/poach, transport and ship wildlife for illegal sale, a 
certain level of skill and expertise is required. This means that actors in some wildlife 
markets include those who also operate in the legal trade.  

Transnational OCGs are known to be involved in the illegal trafficking of glass eels 
from Europe to Asia, and may work with established eel traders to facilitate diversion 
from the legal supply chain. There are also networks of poachers who covertly fish 
and supply the illegal market.  

The internet is likely to play an increasing role in facilitating the trade in illegal wildlife 
products, given the relative ease of connecting sellers to potential buyers. 

This Annex provides a comprehensive overview of the illicit wildlife trade in the EU, building upon 
the summary provided in Section 2.5.2 of the main report.   

Wildlife  crime,  or  the  illegal  wildlife  trade,  refers  to  unlawful  activities  associated  with  illegal 
exploitation  and  trade  of  wildlife  specimens,  covering  the  entire  supply  chain  from  harvesting 
entire  or  parts  from  living  organisms,  to  processing,  smuggling,  and  selling  (‘t  Sas-Rolfes, 
Challender,  Hinsley,  Veríssimo,  &  Milner-Gulland,  2019;  Interpol,  2018).  Products  range  from 
wild, biological specimens of flora, fauna and fungi for purposes ranging from food to ornaments 
to  construction  (Phelps,  Biggs,  &  Webb,  2016).  Importantly,  one  species  can  provide  multiple 
products that may be traded through different value chains. In addition, different forms or sources 
of a single product may be either legal or illegal, based on different contexts (e.g., caught within 
vs. outside of official quotas, farmed vs. wild-caught specimens, domestic vs. international trade, 
harvested within vs. outside of legally protected areas).  

Europe is a major transit region for wildlife trade between continents (e.g., reptile skins), whilst 
also being a destination (e.g., live reptiles) and source region (e.g., glass eels, birds, falcons) as 
well as both a transit and a source (e.g., rhino horn and ivory which are sourced from African 
countries  but  are  transformed  and  sold  as  antiques)  (Auliya  et  al.,  2016;  Bush,  Baker,  & 
Macdonald, 2014; Interpol, 2018). Available seizure data indicate that the main commodity types 
seized  in  the  EU  in  2018  were  medicinals  (both  animal  and  plant-derived),  corals  and  reptile 
bodies,  parts  and  derivatives  (TRAFFIC,  2020).  Of  the  total  seizure  records,  9%  reported  an 
estimated value of the commodities seized. In 2018, the top commodities with a reported value 
were  European  eels,  live  birds,  live  reptiles,  mammal  body  parts  and  derivatives,  and  ivory 
(TRAFFIC, 2020). In the box below, we introduce some of the main sub-markets. Interviewees 
noted that illicit wildlife trafficking has the potential to be a high profit crime carrying relatively 
low risk and it has received relatively little attention until recently131.  

Box 5: Main illicit wildlife markets in the EU 

European  eels:  European  eels  have  been  banned  for  trading  beyond  European  external  borders  since 
2010 (European Commission, 2014a). Due to the high demand for eels in East Asian countries, European 
eel juveniles (also known as glass eels) are smuggled at a much higher price outside of Europe to Asian 
countries, where they are farmed and reared to adulthood for consumption (European Commission, 2017b). 
Illegal  trade  of  glass  eels  occurs  mainly  in  the  four  EU  source  countries  (France,  Spain,  the  UK  and 
Portugal),  but  many  other  EU  Member  States  (such  as  Germany,  Bulgaria,  Greece  and  Hungary) 
(Sustainable  Eel  Group,  2018a)  and  neighbouring  countries  (Albania,  Macedonia,  Morocco,  and  Russia) 
(Stein et al., 2016) are believed to be used as transit countries.  

Live birds:  Illegal  killing  and  taking  of wild  birds remains a  continuing  issue  in  Europe  (Brochet et  al., 
2019). A recent assessment in 2019 indicated that motivations for illegal killing and taking of birds varies 
in Europe from food, sport and caged birds in Mediterranean Europe, sport and food in the Caucasus, and 
sport and predator control in Northern and Central Europe (Brochet et al., 2019). The EU is also a market 
for exotic birds that are non-native to the EU – mainly parrots – that are kept as pets or as caged birds 
(TRAFFIC, 2020).   

Live reptiles: The EU comprises one of the largest live reptile markets (Auliya et al., 2016). Live reptiles 
imported from across continents are sold either as pets or as part of a collection. The illegal trade of live 
reptiles involves species regulated under CITES, as well as species that are not CITES-regulated but are 
nationally protected in their country of origin, but which are often openly offered for sale in the EU (Auliya 
et al., 2016).  

Ivory: Ivory has been banned for international trade since 1989 when African elephants were transferred 
from CITES Appendix II to Appendix I. China was one of the largest buyer markets for illegally traded ivory, 

131 Interview with expert at NGO-level, 19 March 2020 (#23). 

117 

 
 
 
EUROPEAN COMMISSION 

however since introducing a ban on the ivory trade in 2017 there has been an observed decline in ivory 
demand  (WWF, 2019).  Until  the  1980s,  Europe  was  one  of  the  leading  importers  and  manufacturers  of 
ivory  globally  (UNEP  et  al.,  2013).  Europe  remains  a  key  region  for  re-exporting  illegal  ivory  products 
(UNEP et al., 2013). As of 2017, the export of raw ivory from the EU was banned, but domestic trade within 
the EU was permitted for worked ivory originally acquired before 1947 (‘antiques’) and for ivory produced 
between 1947 and 1989 with a government-issued certificate (European Commission, 2017a).   

2.5.2.1. Previous  revenue  estimates  of  the  EU  illicit  wildlife 

market 

We identified 15 studies were that provided data or estimates of the illegal wildlife trade, either 
at the EU-level or for any EU Member State. Of these, 12 used data on seizures of wildlife, one 
employed gap analysis to estimate the European eel market in the EU, and three employed survey 
methods.  Only  three  studies  monetised  volume  estimates  to  produce  an  estimate  of  market 
revenue.  

Seizure data 
There are several databases that capture information on seizures of illegal wildlife, globally and 
in the EU. These include:  

•  World Wildlife Seizures (World WISE) is a developing initiative led by the United 
Nations Office on Drugs and Crime (UNODC) that assembles global reports of wildlife 
seizure data, mainly from the following sources: United States Fish and Wildlife Service 
LEMIS system, Annual and Biennial Reports submitted by the Convention on 
International Trade in Engendered Species of Wild Fauna and Flora (CITES) parties, and 
the EU Trade in Wildlife Information Exchange (EU-TWIX).  

•  EU-TWIX132 compiles seizure records submitted by EU Member States and includes 

seizures occurring within the EU and at EU external borders. Access to the database is 
restricted to wildlife law representatives from the EU Member States. 

•  Elephant Trade Information System (ETIS) provides global data on elephant ivory 

and other elephant products based on reports from the CITES parties. 

Numerous studies have used data from these seizure databases to try to better understand the 
illicit  wildlife  market.  Global  studies  have  been  undertaken  by  the  UNODC  using  World  WISE 
(UNODC, 2016; 2020), while TRAFFIC has produced global and EU studies drawing upon EU-TWIX 
and  ETIS.  The  below  section  provides  an  overview  of  the  EU-specific  studies  that  have  used 
seizure data. The limitations associated with using seizure data to produce market estimates are 
discussed in the following sub-section 2.5.2.2.   

Multiple species: TRAFFIC has produced annual reports on the illegal wildlife market using EU-
TWIX  data  since  2012,  covering  years  2007–2011  (average)  and  annually  from  2012  to  2018 
(Mundy-Taylor, 2013; TRAFFIC, 2020). The most recent report used data from 2018 and is the 
only one of these studies to produce information on the value of goods seized (earlier reports only 
reported the number and volume of wildlife seized). The main commodity types seized in the EU 
in 2018 were medicinals (both animal- and plant-derived), corals and reptile bodies, parts and 
derivatives (TRAFFIC, 2020). Of the total seizure records, 9% reported an estimated value of the 
commodities seized. In 2018, the top commodities with a reported value were  live  eels (€1.9 
million), followed by live birds (€127,000), live reptiles (€81,000), mammal body parts and 
derivatives (€64,000) and ivory (€53,000) (TRAFFIC, 2020). It is unclear exactly what the price 
information related to (i.e. legal or illegal market prices). This was verified by the project team in 
an interview133.   

Caviar: Available seizure data indicates some degree of illegal trade of caviar in the EU, mostly 
from countries close to the Caspian Sea. According to an analysis by TRAFFIC of the EU-TWIX 
database, 7.87 tonnes of illegal caviar were seized by EU authorities during the years 2010 and 
2016  (Harris  &  Shiraishi,  2018).  The  Member  States  with  the  highest  total  number  of  seizure 
records were Germany, followed by France, which is consistent with findings from years 2001 to 
2010 (van Uhm & Siegel, 2016). However, 81% of the seizure records during 2010 and 2016 did 

132  EU-TWIX  was  established  in  2005  and  has  been  helping  connect  enforcement  agencies  across  Europe 
(through the mailing list) and centralising data on CITES-listed species seizures submitted by EU enforcement 
agencies from all 27 EU Member States and the UK (through the EU-TWIX database).  
133 Interview with EU-level expert in wildlife crime, 19 March 2020 (#25). 

118 

 
 
EUROPEAN COMMISSION 

not include information on the country of origin. Where the information was provided, the most 
frequently reported countries of origin were Hungary, followed by Ukraine and Russia, while Iran 
is also one of the most frequently reported countries of origin in both EU and US seizure records. 

The price of illegally traded caviar is also not clear. According to a recent survey from TRAFFIC 
on illegal caviar markets in Bulgaria and Romania, prices of caviar varied considerably (£0.4–£4 
(GBP)  per  gram)  and  did  not  necessarily  correlate  with  source  type  and  authenticity  of  caviar 
(Jahrl, 2013).  

Ivory: Lau et al. (2016) examined seizure data from the ETIS database, with a specific focus on 
seizures made in the UK and reported by the UK to ETIS. There were 154 seizure records between 
2010 to 2014, equivalent to 345.5 kg of raw ivory. This number was dwarfed by a total of 110 kg 
ivory seized in 2015 alone.  

Live  reptiles:  In  the  Netherlands,  3,074  live  reptiles  were  seized  between  2004  and  2017, 
according to data from the Netherlands Enterprise Agency (Janssen & Leupen, 2019). Information 
on the total revenue from the seized live reptiles was not available. 

Gap analysis 
The Sustainable Eel Group (SEG) calculated the discrepancy between the quantities of European 
glass  eels  required  to  meet  the  legal  market  demand  (for  restocking  programmes  and 
aquaculture use) and the declared European catch in two fishing seasons (2015/16 and 2016/17). 
This discrepancy would reflect the amount of glass eels not traceable from the legal market.  

𝐿𝑒𝑔𝑎𝑙𝑙𝑦 𝑐𝑎𝑢𝑔ℎ𝑡  − 𝐿𝑒𝑔𝑎𝑙𝑙𝑦 𝑑𝑒𝑚𝑎𝑛𝑑𝑒𝑑 = 𝑈𝑛𝑡𝑟𝑎𝑐𝑒𝑎𝑏𝑙𝑒 𝑓𝑟𝑜𝑚 𝑡ℎ𝑒 𝑙𝑒𝑔𝑎𝑙 𝑚𝑎𝑟𝑘𝑒𝑡   

In each of the two seasons, the proportion of untraceable eels was some 50% (30 tonnes) of the 
declared European catches. To derive the monetary revenue from trafficked glass eels, this ‘gap’ 
estimate  was  combined  with  information  provided  by  DUPAN  –  the  Dutch  foundation  of  eels’ 
traders, farmers and professional fisherman – on the illegal price of immature eels at a different 
production stage (i.e. raw filet and wholesale filet typically sold on the Asian market, rather than 
live glass eels exported from Europe)134.   

The  study  applied  three  other  ‘gap’  scenarios,  which  generated  alternative  calculations  for  the 
amount of untraceable glass eels. The first considered the quantity of eels proved by enforcement 
operations  in  the  fishing  season  2016/2017  (i.e.  8  tonnes);  the  second  considered  the 
approximate  quantity  of  eels  ‘guesstimated’  by  Spanish  enforcements  for  season  2016/2017, 
alongside illegal, underreported and unregulated (IUU) fishing of glass eels (i.e. 60 tonnes); and 
the third considered the quantity of eels that circulates as persistent rumour every season (i.e. 
100 tonnes).  

Ad hoc survey methods 
Wild  birds:  A  study  on  the  illegal  killing  of  wild  birds  was  based  on  a  questionnaire  survey 
conducted  between  2016  and  2017  among  national  experts  of  28  countries  and  one  territory 
(Faroe Islands) from Northern and Central Europe and the Caucasus (Brochet et al., 2019). The 
experts were asked to provide mean estimated numbers of individual birds illegally killed/taken 
per year. The findings suggested that between 0.2 million and 0.8 million birds in Central Europe 
and between 0.06 million and 0.2 million birds in Northern Europe are killed or taken illegally per 
year.  

Ivory:  The  Lau  et  al.  (2016)  study  of  the  UK  ivory  market  included,  in  addition  to  analysing 
seizure data, data collected through physical and online market surveys in April 2016, with a focus 
on the antiques sector. Compared to 2004, fewer individual market stalls in London were offering 
ivory for sale. The authors raise some possible reasons, including the emergence of online sales 
and/or stricter legislation; however, due to the difference in survey methods employed in 2004 
and the Lau et al. study, the comparison should be interpreted with caution.   

Multiple  species:  A  study  conducted  by  the  International  Fund  for  Animal  Welfare  (IFAW) 
surveyed online wildlife markets operating in France,  Germany, Russia and the UK  over a six-

134 SEG used the following parameter/values: 1 kg glass eels (3,500 pcs) – when grown in modern aquaculture 
– produces 1,260 kg live eels (400 g/pcs, 10% mortality considered), and subsequently 592 kg of raw fillet 
and 387 kg of processed eel kabayaki fillet. The following values are considered: raw fillet at wholesale level 
= €12/kg; processed fillet at wholesale level = €36/kg; processed fillet at consumer level = €60/kg. 

119 

 
 
EUROPEAN COMMISSION 

week  period  in  2017.  The  research  team  surveyed  online  marketplaces  and  social  media 
platforms, focusing on freely available wildlife products from searches on the internet. The sales 
identified during the study period were evaluated at approximately €3,639,588.06 across the four 
countries  examined  –  €769,886,  €1,242,499  and  €981,024  for  France,  Germany  and  the  UK 
respectively. 

2.5.2.2. Quality of prior revenue estimates 

Limitations of seizure data 
Seizure data can be useful for understanding aspects of illicit markets such as the modus operandi 
of traffickers and trade routes135. However, relying on seizure records to assess the magnitude 
and economic revenue from the illicit wildlife market can be hindered for several reasons.  

• 

First, items seized often depend on which species are considered endangered. 
Some species may be under national control but are not currently CITES-listed (UNODC, 
2016). CITES-listed species also change over time.  

•  Second, the degree of effort to detect and intervene in wildlife trafficking 

changes over time. Importantly, such effort could also differ by relevant authorities 
depending on political will, available resources and a variety of other factors. As one of 
the expert interviewees described, seizures are made when we ‘look for them’ (UNODC, 
2016). Countries that dedicate more efforts to seizing wildlife trafficking consequently 
report more seizure incidents, which do not necessarily indicate a larger magnitude of 
trafficking. To the contrary, trafficking could be higher in countries with lower 
interdiction capacity. Moreover, countries often inspect more on imports than on 
exports. This tendency can result in less information available for origins of 
commodities, especially if trade routes span multiple countries (UNODC, 2016).  

• 

Third, inconsistency and insufficient information on commodities undermine the quality 
and usability of seizure data for generating estimates. Because commodities and their 
mode of transit are diverse in illicit wildlife, a variety of measurement units are used by 
different reporting bodies. For example, one seizure incident could involve different 
volumes depending on where and when the seizure was made (e.g. milligram, kilogram, 
pills, animal carcasses, etc). It becomes near impossible to standardise these metrics. 
Comparison between commodities is further complicated due to vast differences in 
price: for example, one seizure incident of medicinal products has different significance 
than one seizure incident of glass eels, of which the unit value is much higher. For the 
majority of seizures, price information is not available, and even if available, the 
information may only capture a single step within the longer value chain, and differ 
across years.   

The limitations of seizure data were explicitly acknowledged by several interviewees with expertise 
in the illicit wildlife trade. Moreover, in their World Wildlife Crime Report the UNODC (2016) states: 
‘Given  this  level  of  volatility in  both  the  seizure  record  and  what  is  known  about  the 
underlying markets, it is nearly impossible to give an accurate and consistent estimate 
of the criminal revenues generated by wildlife trafficking.’ 

Limitations of gap analysis  
The study by SEG endeavoured to capture the volume, and its associated economic revenue, of 
the entire illegal European eel market. The collection of data across two fishing seasons allowed 
comparison  of  the  estimated  amount  of  untraceable  glass  eels  over  time,  and  thus  made  the 
estimate more robust to temporal fluctuations136.  

One limitation of the estimates produced from the SEG study is that the ‘gap’ analysis was reliant 
upon  accurate  reporting  of  eel  catches  by  fisheries  and  of  market  demand  by  survey 
respondents. Another limitation is that the analysis only captured the amount of glass eels being 
diverted from those legally caught, because it takes  the discrepancy between declared catches 
and legal demand. The analysis thus does not reflect any data on the illegal fishing or poaching 
of glass eels (bolded in the formula below). This means that the economic revenue from the illegal 
glass eel market estimated by the SEG study is likely to be an underestimate, especially given 
that the illegal trade is sourced from both legally and illegally caught glass eels. 

135 Interview with international-level expert on environmental crime, 4 March 2020 (#09).  
136 SEG is conducting annual market surveys and expect to publish reports regularly to trace trends in the 
illegal glass eel market.  

120 

 
 
EUROPEAN COMMISSION 

𝑈𝑛𝑡𝑟𝑎𝑐𝑒𝑎𝑏𝑙𝑒 𝑓𝑟𝑜𝑚 𝑡ℎ𝑒 𝑙𝑒𝑔𝑎𝑙 𝑚𝑎𝑟𝑘𝑒𝑡  + 𝑰𝒍𝒍𝒆𝒈𝒂𝒍𝒍𝒚 𝒄𝒂𝒖𝒈𝒉𝒕 = 𝐼𝑙𝑙𝑒𝑔𝑎𝑙𝑙𝑦 𝑡𝑟𝑎𝑑𝑒𝑑 𝑔𝑙𝑎𝑠𝑠 𝑒𝑒𝑙𝑠  

The amount of illegally caught glass eels is currently unknown. Based on Europol’s estimation that 
approximately 100 tonnes of eels were trafficked from EU to China during the 2017/18 season 
(Europol,  2018b),  it  can  be  guesstimated  that  approximately  70  tonnes  of  eels  were  illegally 
caught,  if  we  account  for  the  30  tonnes  of  glass  eels  disappearing  from  the  legal  market  as 
estimated by the SEG study.  

The use of price data on fillet means that the economic revenues estimated by the SEG study 
reflect those accrued further down in the value chain, where glass eels have been grown to full 
size and sold for consumption. For the purpose of understanding the economic revenue from the 
glass eels illegally traded within the EU, we update the estimates by applying a range of prices 
for illegally traded glass eels in Europe.   

Limitations of ad-hoc survey methods 
Ad-hic  survey  methods  could  be  a  useful  technique  especially  for  understanding  the  trends  or 
patterns in the illegal wildlife market, such as the studies on the UK antique ivory market and the 
cyber  wildlife  trade.  However,  market  surveys  are  often  conducted  in  a  selected  number  of 
markets for a short period of time, which may not represent the entire cycle of an illegal wildlife 
market.  For  instance,  IFAW’s  study  on  online  wildlife  trade  excluded  closed  or  private  groups, 
password-protected websites and the dark net, and was conducted over a six-week period. As in 
seizure  data,  distinguishing  legal  versus  illegal  products  in  the  markets  is  challenging  for  data 
collected from market surveys. Lastly, the questionnaire survey method employed in the Brochet 
et al. (2019) on the study of illegal killing of wild birds, yields data derived from ad hoc reporting 
and/or detection, rather than systematic monitoring. Survey methods for understanding the illegal 
wildlife market could therefore underestimate the actual size and revenue from the market.

121 

 
 
 
EUROPEAN COMMISSION 

Table 2.42: Prior studies estimating the size or revenue of the illicit wildlife market in the EU 

Citation 

Year(s) 
of 
estimate 

Sub-
market 

Data source(s) 

Countries 
included in 
estimate 

Disaggregated at 
Member State 
level?  

Estimate 
produced (size) 

Estimate produced 
(revenue) 

1  TRAFFIC 

2018 

(2020) 

Various 
species 

2  Sustainable 

Eel Group 
(2018b) 

2016 to 
2017 

European 
eels 

Seizure records submitted in the 
2018 Annual Illegal Trade Reports 
(including information on 
prosecutions) submitted to the EU-
TWIX database by EU Member 
States 

Data on the amount of glass eel 
catches declared (questionnaires 
sent out by SEG to national 
agencies across Europe and 
obtained from France, Spain, 
Portugal and UK)  

Research paper on the estimate of 
annual recruitment of glass eels  

Inputs from the Dutch foundation 
of eel traders on the price of eels 
at different production stages 

EU 28 

No 

N/A 

€2.3 million 

No 

8.8–127.6 tonnes 

Four EU Member 
States – France, 
Spain, Portugal, 
UK 

Live eels (€1.9 million) 
Live birds (€127,000) Live 
reptiles (€81,000) Mammal 
body parts and derivatives 
(€64,000) Ivory (€53,000) 

Between €188 million and 
€2.27 billion 

3  Harris & 
Shiraishi 
(2018) 

2010 to 
2016 

Caviar 

Seizure data from EU-TWIX 
database 

EU 28 

No 

7.87 tonnes 

N/A 

4  Brochet et al. 

(2019) 

2016 to 
2017 

Birds 

Survey of national experts 

Central Europe 

Yes 

4 

2016 to 
2017 

Birds 

Survey of national experts 

Northern Europe 

Yes 

5  Lau et al. 
(2016) 

2010 to 
2014 

Ivory 

Seizure data from ETIS database 

UK 

Yes 

N/A 

N/A 

Between 0.2 
million and 0.8 
million birds are 
killed or taken 
illegally per year  

Between 0.06 
million and 0.2 
million birds are 
killed or taken 
illegally per year 

345.5 kg raw ivory 
equivalent 

N/A 

122 

 
 
EUROPEAN COMMISSION 

Citation 

Year(s) 
of 
estimate 

Sub-
market 

Data source(s) 

Countries 
included in 
estimate 

Disaggregated at 
Member State 
level?  

Estimate 
produced (size) 

Estimate produced 
(revenue) 

6 

IFAW (2018) 

2017 

6 

6 

7 

Janssen & 
Leupen 
(2019) 

2017 

2017 

2004 to 
2017 

Various 
species 

Various 
species 

Various 
species 

Live 
reptiles 

Online survey during 6-week 
period 

Online survey during 6-week 
period 

France 

Germany 

Online survey during 6-week 
period 

UK 

Yes 

Yes 

Yes 

N/A 

N/A 

N/A 

€769,886 

€1,242,499 

€981,024 

Seizure data from the Netherlands 
Enterprise Agency 

The Netherlands 

Yes 

3,074 live reptiles 

N/A 

Note: All revenue estimates presented in this table reflect the original years for which they were produced. They have not been adjusted for inflation, as we have done for the final estimates used in the current study. 

123 

 
 
 
EUROPEAN COMMISSION 

2.5.2.3. Methodology for estimating revenues in this study 

The literature review identified no prior studies that have estimated the illicit wildlife market in its 
entirety in the EU. This reflects the lack of comprehensive and reliable data sources enabling such 
calculations to be made. Several estimates have been produced of the size or revenue of markets 
for individual species. These estimates have mainly used seizure data or ad-hoc surveys, both of 
which  are  susceptible  to  limitations  that  deem  them  unsuitable  inputs  for  reliable  market 
estimates at the EU- and Member State-level.  

One  study  by  the  SEG137  employed  gap  analysis  to  estimate  the  volume  of  European  eels 
disappearing  from  the  legal  market,  or  diverted  from  the  legal  supply  chain  in  the  EU.  Our 
appraisal of this methodology concluded that the gap estimates produced by SEG represent the 
most suitable input for assessing the magnitude of the European eels market at the EU-level.  

On this basis, we utilised the gap estimates produced by SEG and combined this with updated 
information on the illegal price of glass eels that are trafficked live from Europe. This results in an 
estimate of the revenue of the illegal market for European eels’ in the EU. The revenue estimate 
that we produced is slightly different from SEG’s because we focused on the price of eels trafficked 
from Europe, whereas SEG used illicit prices when eel fillet is sold on the destination markets of 
Asia.    

Focusing on European glass eels is but one sub-market of the illicit wildlife markets in the EU. 
However, available evidence suggests some OCGs are involved in European eel trafficking, which 
highlights its importance as a focal point (European Commission, 2018d)138. A summary of the 
approach used in this study for estimating the revenue from illegal glass eels and the limitations 
of this approach is outlined in the table below.  

Table 2.43: Summary of approach for estimating revenues from illegal glass 
eels 

Approach 

Indirect estimate of the economic revenue from the illegal market for 
European glass eels that are exported live from the EU. The approach draws 
upon the ‘gap’ estimates produced by the Sustainable Eel Group – of the 
amount of European glass eels disappearing from the legal market – 
combined with information on the price of trafficking live glass eels from 
Europe.     

Rationale 

The rationale for this approach is as follows: 

• 

• 

• 

Currently, there is no reliable data for estimating the market revenue for 
the illegal trafficking of wildlife species other than European eels in the 
EU.  

There is evidence that OCGs are involved in trafficking live glass eels 
from Europe to Asia (Europol, 2017).   

Previous estimates by the Sustainable Eel Group have used price 
information for eel (raw and filleted) sold in Asian markets. The scope of 
this study is to understand the illicit revenues generated within Europe. 
There is considerable value added to glass eel once it is trafficked from 
Europe to Asia, where glass eels are grown to full size and filleted.  

Output 

Economic revenue from the illegal market for live European glass eels 
trafficked from Europe to Asia for fishing seasons 2015/16 and 2016/17.  

Scope and coverage 

Sub-market: European eels 

Geographical scope: EU-level estimate – however, information on the ‘gap’ 
is based upon surveys of fishing authorities in the four source countries: 
France, Spain, Portugal and UK.  

Year: Average of the 2015/16 and 2016/17 fishing seasons, updated to 2019 
values. 

Data sources 

The volume of glass eels trafficked was estimated by the volume that was 
untraceable from the legal market, averaged across the two fishing seasons 
considered. The amount untraceable was calculated by taking the 

137 SEG is the leading international organisation seeking to accelerate the conservation and management of 
the European eel. Its methodological approach to producing gap estimates was verified with market experts 
interviewed in this study.  
138 Interview with expert at NGO-level, 19 March 2020 (#25). 

124 

 
 
EUROPEAN COMMISSION 

discrepancy between the quantities demanded by legal market demand and 
the declared European catch, averaged across the two fishing seasons 
considered.  

𝐿𝑒𝑔𝑎𝑙𝑙𝑦 𝑐𝑎𝑢𝑔ℎ𝑡  − 𝐿𝑒𝑔𝑎𝑙𝑙𝑦 𝑑𝑒𝑚𝑎𝑛𝑑𝑒𝑑 = 𝑈𝑛𝑡𝑟𝑎𝑐𝑒𝑎𝑏𝑙𝑒 𝑓𝑟𝑜𝑚 𝑡ℎ𝑒 𝑙𝑒𝑔𝑎𝑙 𝑚𝑎𝑟𝑘𝑒𝑡   

We chose the estimated quantity (30 tonnes) derived from a scenario that 
considers the approximate quantity of eels that remained untraceable in the 
Sustainable Eel Group’s market surveys for season 2015/16 and 2016/17.  

The price data were obtained from recent media reports and interviews with 
market experts. According to a report in the UK, glass eels were priced at 
more than £1,000/kg for illegal shipping in 2019 (BBC, 2019). Another report 
mentions that illegal glass eels can fetch up to £4,000/kg (Rana, 2018), while 
the price of glass eels legally traded is about £150/kg. The range of €1,200– 
€1,500/kg was reported in another source as the price of immature European 
eels sold in East Asia for the years around 2015 (European Commission, 
2016c), and the €2,000/kg figure was estimated for the fishing season 
2018/19 by Europol (Europol, 2019b). The expert consulted139 shared 
anecdotal information that €300/kg is paid for fisherman and €150–€800/kg 
is paid overall for illegal trade. The expert acknowledged that the illegal trade 
price could reach higher depending on annual supply of glass eels. From this 
information, we decided to use the price range of €150 to €1,000/kg.  

We multiplied the average estimated volume of glass eels untraceable from 
the legal market during the fishing seasons 2015/16 and 2017/18, by the 
lower (€150) and upper (€1,000) boundary of price range. The mean of €150 
and €1,000 (€575) was also used to produce the middle value.  

𝑉𝑜𝑙𝑢𝑚𝑒 𝑜𝑓 𝑢𝑛𝑡𝑟𝑎𝑐𝑒𝑎𝑏𝑙𝑒 𝑔𝑙𝑎𝑠𝑠 𝑒𝑒𝑙𝑠  × 𝑃𝑟𝑖𝑐𝑒 𝑝𝑒𝑟 𝑘𝑔
= 𝐸𝑐𝑜𝑛𝑜𝑚𝑖𝑐 𝑣𝑎𝑙𝑢𝑒 𝑜𝑓 𝑔𝑙𝑎𝑠𝑠 𝑒𝑒𝑙𝑠 𝑢𝑛𝑡𝑟𝑎𝑐𝑒𝑎𝑏𝑙𝑒 𝑓𝑟𝑜𝑚 𝑡ℎ𝑒 𝑙𝑒𝑔𝑎𝑙 𝑚𝑎𝑟𝑘𝑒𝑡  

The estimate of the volume of glass eels ‘disappearing’ from the legal market 
in Europe is likely an underestimate, because it focuses only on diversion 
from the legal supply chain after the eels have been caught and does not 
capture illegal poaching or fishing140. 

The estimate may be subject to bias because it relies on the accurate 
reporting by national experts surveyed in the Sustainable Eel Group’s survey.  

The economic revenue from the illegal glass eels market will be an 
underestimate of the revenue attributable to the entire illegal wildlife market 
as it focuses on only one species. 

Key steps 

Limitations of this 
approach 

2.5.2.4. Revenue estimates of the EU illicit wildlife market 

Table 2.44 presents the original estimates produced for this project of the illegal European eel 
market in the EU, alongside the minimum estimates for other species – namely live birds, live 
reptiles, mammal body parts and derivatives, ivory, live mammals, live amphibians and animal-
derived medicinal products from a report produced by TRAFFIC (2020) using seizure data. The 
estimate  has  been  adjusted  for  inflation  and  are  represented  as  2019  values.  Whilst  TRAFFIC 
(2020) also reported figures for European eels (i.e. €1.9 million), our estimates for this species 
are  favoured  here  as  they  overcome  some  of  the  limitations  of  seizure  data,  such  as  its 
susceptibility to underestimation and high volatility.    

According to our figures, annual revenues derived from the diversion of European eels from the 
legal market range between €4.7 million to a high of €31.4 million. Such a wide range is mostly 
due to the fluctuating price in response to the annual variations in the supply of wild glass eels141.  

139 Interview with expert at NGO-level, 19 March 2020 (#23).
140 Interview with expert at NGO-level, 19 March 2020 (#23).
141 Interview with expert at NGO-level, 19 March 2020 (#23). For various reasons, the annual recruitment of 
European  eels  has  been  declining  from  the  early  1980s  to  a  low  point  in  2011  (Amilhat  et  al.,  2019; 
Sustainable Eel Group, 2018b). Although the declining trend seems to have stopped and some increase has 
been observed during 2011–2019, overall recruitment remains low (Amilhat et al., 2019). Supply of glass eels 
is also influenced by the availability of Japanese eels, the preferred eels over the European eels. In a year 
when Japanese eels are more supplied, there is likely a decline in the need for illegal trade of European eels. 

125 

 
 
 
 
 
 
 
 
EUROPEAN COMMISSION 

Table 2.44: Revenue estimate of one species subject to illegal trade in Europe 
– European eels  

EU Member 
State 

Annual revenue, adjusted for inflation, 2019 
(€ million) 

Sub-market 

Source 

Mid 

Low 

High 

FR, ES, PT, UK (a) 

18.05 

4.71 

31.39  European eels  New estimate 

Notes: European eel estimates were produced for 2015–2017 (mean) and the estimates from TRAFFIC (2020) were for 2018. All estimates 
have been updated to 2019 values using Eurostat’s HICP (Eurostat, 2020). 
(a) European eel estimates are derived from gap estimates produced by the Sustainable Eel Group, representing the volume of eels 
disappearing from the legal market. In Europe, there are legal fisheries of European eels in four Member States: FR, ES, PT, UK – thus, these 
estimates are comprehensive as to the estimated amount being diverted from the legal supply chain.  

2.5.2.5. Criminal actors and modus operandi 

In this section, we describe actors and modus operandi of the illegal wildlife market, not only for 
glass eels but also for other sub-markets. 

Table 2.45: Illicit wildlife – Market actors 

Level of OCG involvement 

Size and composition of OCGs 

Modus operandi of OCGs 

In order to effectively capture/poach, transport and ship 
wildlife for illegal sale, a certain level of skill and expertise 
is required. This means that actors in some wildlife 
markets include those who also operate in the legal trade.  

Transnational OCGs are known to be involved in the illegal 
trafficking of glass eels from Europe to Asia, and may work 
with established eel traders to facilitate diversion from the 
legal supply chain. There are also networks of poachers 
who covertly fish and supply the illegal market. 

Asian-based OCGs have been known to send ‘fish mules’ 
to smuggle eels by suitcases who – whilst ethnically Asian 
– may have legitimate European passports.   

Document fraud facilitates the smuggling of illegal wildlife 
products by disguising them as legal products. 

Poly-criminality of OCGs 

Little known. 

Other key actors  

Individuals involved in sourcing wildlife products (e.g. eel 
fisheries) may also take part in illegal trade.  

We identified 13 studies in the literature review that included information on the key actors in the 
illegal wildlife market in the EU. Based on these studies and interviews with market experts, it 
appears that the degree of OCG involvement differs by sub-markets, and its poly-criminality is 
little known. Various actors are likely involved at different stages of the supply chain for different 
wildlife products because the commodity (i.e. wildlife) is sourced from natural resources, hence 
depending on the wildlife products, a heterogenous profile of actors may be required.  

European  eels:  Existing  information  indicates  the  clear  presence  of  transnational  OCGs  in 
smuggling eels out of Europe (TRAFFIC, 2020; UNODC, 2020)142. According to Europol’s report in 
2019,  individuals  from  four  different  OCGs  were  arrested  by  the  Spanish  Civil  Guard.  Their 
activities spread across France, Spain and Portugal – the main source countries of glass eels in 
the EU. A market expert noted that Asian-based OCGs would send ‘mules’  to smuggle eels by 
suitcases,  and  that  these  people  could  be  ethnically  Asian  but  possess  European  passports143. 
However,  it  is  also  important  to  note  that  legal  traders  may  be  involved  at  various  points  of 
smuggling glass eels. For example, according to the market expert interviewed144, preparing live 
glass eels for shipping in cargo in a good condition would require some degree of knowledge  of 
fisheries,  suggesting  the  possibility  that  actors  involved  in  legal  trading  of  fish  occasionally 
participate in the trafficking of glass eels. According to UNODC (2020) networks of poachers also 
acquire glass eels through clandestine fishing and supply these to the illegal market.     

Ivory: In a report published in 2017, Pro Wildlife and other organisations suggested that OCGs 
may be involved in ivory trading in Europe, given the recent trend of an unprecedented number 

142 Interview with expert at NGO-level, 19 March 2020 (#25). 
143 Interview with expert at NGO-level, 19 March 2020 (#23). 
144 Interview with expert at NGO-level, 19 March 2020 (#23). 

126 

 
 
 
EUROPEAN COMMISSION 

of large seizures – e.g. shipments of at least 800 kg, as defined by the Elephant Trade Information 
System (ETIS) – in the EU since the end of 2015 (Pro Wildlife & and other organisations, 2017). 
However, larger seizures may also reflect increased enforcement effort and awareness, especially 
given the growing attention on ivory issues, mainly linked to the increase in poaching in Africa 
and the increased illegal trade and seizures globally (Environmental Investigation Agency (EIA), 
2020).  

Wild  and  exotic  birds:  Since  2005  there  has  been  a  trade  ban  on  wild  birds  to  counter  the 
spread of avian flu (Cardador et al., 2018). This resulted in a trade shift from wild-caught birds 
to  captive-bred  birds,  and  there  is  some  evidence  that  the  ban  may  have  increased  financial 
incentives for poaching or encouraged OCG involvement  (Cardador et al., 2018; Ribeiro et al., 
2019). In 2018, TRAFFIC (2020) reported on a case involving the illegal trafficking of toucans, 
parrots and macaws in the European region. The 2019 study by Brochet et al. provides evidence 
for the continuation of the illegal killing of wild birds in Europe, but the magnitude of illegal trade 
involving these birds and information on main actors are still little known (Brochet et al., 2019). 

Live  reptiles:  Market  experts  discussed  the  possibility  of  OCG  involvement  in  supplying  live 
reptile  products  for  ‘collectors’,  because  the  sourcing  of  exotic  animals  requires  specialist 
knowledge of the animals and their ecology, as well as liaising with poachers in the country of 
origin, the mules/couriers and the final destinations. Other actors in the illegal live reptile market 
in the EU involve reptile breeders145. 

Modus operandi  
European eels: With regard to illegal poaching, UNODC (2020) indicates that poachers use hand 
nets,  trap  nets  or  small  trawling  nets  to  fish  glass  eels  covertly  at  night.  The  market  expert 
interviewed146 described two main modes of smuggling eels that have been illegally poached or 
diverted from the legal supply chain. First, transport via air by hiding live glass eels in oxygenated, 
wet plastic bags, packed in suitcases and transported to Asia  (Europol, 2018b; UNODC, 2020). 
OCGs  operating  as  ‘fish  mules’  have  been  observed  concealing  eels  in  suitcases  and  declaring 
them  as  other  types  of  fish  (Europol,  2019b;  UNODC,  2020).  Second,  cargo  shipment,  either 
declared as other seafood products or hidden under other seafood exports. 

Ivory: Compared to other regions, Europe has notably low legal ivory prices. This might drive 
companies  specialised  in  collecting  ivory  items  to  be  involved  in  illegal  re-exporting  to  Asia 
(Sosnowski et al., 2019). Internet sales are also considered to facilitate marketing of illegal ivory 
in the EU,  with law enforcement facing difficulties in regulating the  sale of illegal ivory on, for 
example, internet auction sites (UNEP et al., 2013).  

Live reptiles: There are two main modes for the illegal trafficking of reptiles in the EU. First, a 
common mechanism for importing CITES-listed reptiles is to falsely report them as captive-bred 
reptiles,  thus  increasing  the  likelihood  that  a  trade  permit  will  be  granted  (Sina  et  al.,  2016). 
Second, non-CITES listed reptiles may be imported into the EU after being illegally poached from 
their habitats, typically third countries. Because there is no legal instrument within the EU that 
would require operators placing these animals on the market to produce due-diligence in relation 
to the original obtainment or harvesting, technically these reptiles become ‘legal’ once they enter 
the EU.  

2.5.2.6. Future trends and dynamics 

Table 2.46: Illicit wildlife – Future trends 

Future trends and dynamics 

Increased reliance on internet-based trade. 

Impact on market and criminal finance 

‘Blackwashing’ in caviar. 

Internet could facilitate trading in illegal wildlife products, 
given the relative ease of connecting sellers to potential 
buyers. 

The ‘blackwashing’ strategy could sustain the demand for 
‘illegally-sourced’ caviar.   

Within each sub-market of the illegal wildlife market in the EU, information on emerging trends is 

145 Interview with EU-level enforcement on illegal wildlife, 11 March 2020 (#21). 
146 Interview with expert at NGO-level, 19 March 2020 (#23). 

127 

 
 
 
EUROPEAN COMMISSION 

relatively  lacking.  Three  studies  identified  in  the  literature  review  included  information  on  the 
future trends and dynamics in the illegal wildlife market in the EU (European Commission, 2016b; 
IFAW, 2018; Sina et al., 2016).  

Two  studies  highlight  the  increased  prominence  of  internet-based  trade  in  illegal  wildlife 
products (IFAW, 2018; Sina et al., 2016). According to these studies, online advertisements via 
social media such as Facebook147 are actively used for promoting wildlife products that could have 
been illegally sourced. Except for the Czech Republic, sellers are not required by law to present 
supporting documentation on the legitimacy a wildlife item. This situation exacerbates the existing 
difficulty of distinguishing legal from illegal wildlife trade over the  internet. According to one of 
the two studies, conducted by the International Fund for Animal Welfare (IFAW), there has been 
an  increased  trend  of  wildlife  traffickers  turning  to  the  dark  net  in  response  to  increased 
enforcement  mainly  targeting  the  open  internet  space  (Interpol,  2017;  Roberts  &  Hernandez-
Castro, 2017). According to IFAW, even if trade occurs offline, the  internet could also facilitate 
the connection between sellers and buyers (IFAW, 2018).   

2.5.2.7. Recommendations  

The illegal wildlife market is one of the most difficult to estimate in terms of  its size and value. 
This is evidenced by the lack of available secondary data and the limited number of studies that 
have  attempted  to  do  so.  Current  understandings  of  the  market  rely  on  seizure  records  (as 
reported by various agencies: Environmental Investigation Agency (EIA), 2020; TRAFFIC, 2020; 
UNODC, 2020), which have high volatility that render them unsuitable for market estimates.   

Future efforts should be made to improve the measurement of the illegal wildlife trade in 
the  EU,  through  additional,  primary  data  collection.  One  approach  might  be  to  conduct 
comprehensive market ‘occupancy’ surveys for different species, as described by Barber-Meyer 
(2009). 

The key findings from this study and the related recommendations are summarised in the table 
below.     

Table 2.47: Recommendations – Illicit wildlife market 

Key finding 

Recommendation 

Actor 

Efforts should be made to improve 
the measurement of the illegal 
wildlife trade in the EU, through 
additional, primary data collection. 
One approach might be to conduct 
comprehensive market ‘occupancy’ 
surveys for different species. 

Member States, including police 
and judicial authorities, customs 
authorities  

European Commission  

There are no secondary data sources 
available for reliably estimating the 
revenues generated through the 
illegal wildlife trade in the EU. 
Current knowledge is predominantly 
reliant upon seizure data, which has 
high volatility rendering it unsuitable 
for market estimates.   

The revenues generated through the 
illegal trade of European eels – one 
sub-market of the illegal wildlife 
market in the EU – can be estimated 
by using gap analysis of the amount 
of eels disappearing from the legal 
market in the four source countries 
in the EU (France, Spain, Portugal 
and the UK).  

147  For  example,  global  wildlife-related  foundations  and  NGOs  have  partnered  with  technology  companies 
– such as eBay, Microsoft, Tencent, Facebook, Etsy and Instagram – to bring down the online illegal trade in 
threatened species (WWF, n.d.).  

128 

 
 
 
 
 
 
EUROPEAN COMMISSION 

2.6.  Illicit firearms 

Quentin Liger, Optimity Advisors 

Key findings: 

•  According to the estimates produced in this study, the annual revenues derived from 
the illicit firearms market in the EU range from €274 million to €754 million (€408 
million). 

• 

• 

• 

• 

The new estimate has a wider range than the previous estimate of between €370 
million to €493 million. 

The illicit firearms market does not necessitate a high level of organisation and 
therefore does not necessarily have to be undertaken by OCGs. There are two broad 
categories of actors involved in the supply of illicit firearms: single individuals 
involved in small-scale commerce, and large operators able to systematically and 
periodically move large quantities of arms and ammunitions (Savona & Riccardi, 
2015).  

In line with the relatively low value of the overall market, illicit firearms trafficking 
does not generate high revenues, and is often a secondary source of income for 
traffickers. 

Flobert weapons are expected to continue to be widely available in the European 
market. Creation of 3D-printed firearms is expected to increase, while current and 
former conflict areas (in particular the former Yugoslavia and the Donbass region) are 
expected to continue being important sources of firearms.  

This Annex provides a comprehensive overview of the illicit firearms market in the EU, building 
upon the summary provided in Section 2.6 of the main report.   

The revised firearms directive defines illicit trafficking as ‘the acquisition, sale, delivery, movement 
or transfer of firearms, their essential components or ammunition from or through the territory 
of one Member State to that of another Member State if any one of the Member States concerned 
does not authorise it’ (European Parliament, 2017). 

The firearms market has several particularities. Firearms are durable goods with a long lifespan. 
As such, an important share of the items that are illegally trafficked originated either legally, or 
from existing stockpiles (mainly stemming from the fall of the Soviet Union, the wars of Yugoslav 
dissolution and the breakdown  in law and  order  in  Albania in 1997). For this reason, the illicit 
production of firearms is far less important than for other illicit markets (except for the emerging 
use  of  3D  printing).  Another  important  source  of  firearms  entering  the  illegal  market  is  the 
conversion of non-lethal-purpose weapons (such as alarm and signal weapons), or firearms that 
were  improperly  deactivated.  If  the  deactivation  did  comply  with  the  strict  standards  of 
deactivation  (as  provided  for  by  the  Commission  Implementing  Regulation  (EU)  2015/2403), 
reactivation is often a relatively easy process.  

An important aspect of the firearms market is its heterogeneity. Instead, ‘illicit markets exist at 
a regional level as discretely constructed sectors of availability and flow’ (Bourne, 2013). This was 
highlighted  by  the  2020  UNODC  study,  which  empirically  showed  that  reported  illicit  firearms 
trade was mostly local (either within one country or with neighbouring ones), at least in the case 
of countries reporting data, which included 16 EU Member States. This stems from (i) the relative 
difficulty of trafficking firearms compared to other illicit goods; and (ii) the relatively low demand 
for firearms in the reporting countries. 

According to a law enforcement representative, demand for firearms is not homogenous: ‘different 
types of criminals want firearms for different reasons, want different types of firearms and have 
different  access  to  acquisition  methods’148.  Criminal  networks  can  access  firearms  in  different 
ways: 

148 Interview with law enforcement representative, 28 April 2020.

129 

 
 
 
 
EUROPEAN COMMISSION 

•  Some established OCGs have established a stock of firearms over the years that can be 

sold or lent to criminals who are part of – or close to – the group. 

•  Smaller gangs often use the services of specialised firearms traffickers who either have 
connections to source countries (often in the Western Balkans) or, in some cases, have 
stashes of firearms readily available149. 

Terrorists and terrorist organisations are another driver of the firearms market. The terrorist 
attacks  using  firearms  in  2015  in  Paris  have  put  this  category  high  on  the  political  agenda, 
although it has long existed.  

A third group that plays a role in the illicit firearms market are owners of illicit firearms who 
have no link to criminality or terrorism. In this case, firearms remained in the possession of 
the owners after a change of legislation or were inherited by the owners.  

Box 6: Terrorism and firearms 

Media reports following a number of terrorist attacks in France sought to  identify the provenance of the 
firearms used by the terrorists, and provide an interesting cross-section of where firearms originated from. 
One of the firearms used by Mohammed Merah during the Toulouse shootings in France in 2012 was a Colt 
registered in 1944 (FranceTVinfo, 2016). According to the legal inquest, some of the firearms used by the 
Kouachi brothers – perpetrators of the Charlie Hebdo shooting – bore Yugolsav army marks and are likely 
to  have  originated  from  the  Western  Balkans  (Duquet,  2016).  At  least  one  of  the  firearms  used  by  the 
Bataclan attackers appears to have been imported in separate pieces before being assembled in France 
(Duquet,  2016).  Amedy  Coulibaly,  who  carried  out  the  Hypercacher  attacks  in  January  2015,  used 
reactivated automatic rifles that had been sold as acoustic expansion weapons in Slovakia (Florquin & King, 
2018).  Finally,  a  failed  attack  on  a  police  convoy  in  Paris  was  undertaken  using  a  legally  held  firearm 
(Florquin & Desmarais, 2018). 

2.6.1. Previous  revenue  estimates  of  the  EU  illicit  firearms 

market 

The  literature  search  identified  24  relevant  publications  (including  edited  volumes  containing 
several relevant chapters). These publications provided either quantitative information – such as 
the size of the market and the revenue from firearms being trafficked – or qualitative data on the 
flows and modus operandi of trafficking, or trends. While some studies cover all or some Member 
States, there is a clear focus on Italy, Belgium and Scandinavian countries, reflecting the location 
of  the  research  institutes  carrying  out  work  on  illicit  firearms  (the  Flemish  Peace  Institute  in 
Belgium,  Transcrime  in  Italy,  the  Peace  Research  Institute  Oslo  and  Stockholm  International 
Peace Research Institute in Scandinavia).  

Existing estimates stem from two primary data sources: number of seizures and the number 
of unregistered firearms. Studies seeking to assess the revenue from firearms trafficking have 
typically used the revenue from the legal firearms trade in order to estimate the illegal trade. 

To reach a figure of between €370 million to €493 million, Transcrime used Italian seizure data 
and extrapolated it to the EU 28 (Transcrime, 2015c). This supply-side estimate was built on 
the revenue from seizures in Italy and assumed that they represented between 8% and 10% of 
the total revenue from illicit firearms traded in the country.  

Demand-side estimates were based on a range of between 10% to 20% of the revenue from 
firearms  produced  and  net  imports  in  the  country.  Given  data  on  legal  firearms  sales  were 
available through Eurostat, the share of 10% to 20% was extrapolated to all other EU Member 
States. The source of the 10% to 20% assumption in the Transcrime study is not clear.  

2.6.2. Quality of prior revenue estimates  

There are several limitations to prior estimates of firearms trafficking. The main shortcomings of 
approaches that utilize seizure data include: 

• 

First, there is a risk of underrepresentation given the difficulty in assessing the share of 
illicit firearms seized. 

149 Interview with law enforcement representative, 28 April 2020.

130 

 
 
 
EUROPEAN COMMISSION 

•  Second, there is a risk of over-representation in some Member States with a high 

number of existing firearms. 

• 

Finally, scaling up the number of firearms seized does not allow for the assessment of 
the share of trafficked weapons. 

The main shortcomings of approaches using data on unregistered firearms include: 

• 

First, the method requires assessment of the number of unregistered firearms, which, 
by definition, is difficult. Estimates are partly based on survey and self-reporting, a 
method that has limitations (Karp, 2018). 

•  Second, the methods only allow for the assessment of unregistered firearms (stock) 
rather than the flow of illicit trade – even less so the share of the trade which is 
trafficked. 

Studies  seeking  to  estimate  the  revenue  from  illegal  firearms  trafficking  that  assume 
between 10 and 20% of the legal firearms trade was attributable to illicit activities have typically 
failed to provide methodological explanation for how these estimates were derived (Calderoni et 
al., 2014; UNODC, 2010). 

Assessing the illicit market for firearms in the EU is notoriously difficult and there are some general 
points to be made about the quality of the studies that do exist. First, in-depth research into 
the  scale  of  the  problem  is  lacking.  Policy  attention  has  grown  over  the  years  as  firearms 
changed from being a problem specific to criminal groups to one affecting the population at large. 
This is partly due to the perceived relatively small size of the issue compared to other violent or 
organised criminal activities in the EU. According to Duquet, ‘firearms-related homicides in Europe 
are among the lowest in the world’ (Duquet, 2018). With 0.012 homicides by guns per 100,000 
in the EU (compared to 4.46 in the US, 8.2 in South Africa or 20.7 in Brazil for instance (IHME, 
2018)), firearms were not perceived as one of the biggest threats to the general population. In 
addition, large-scale illicit firearms trafficking is quite exceptional in the EU and the illicit firearms 
market is considered to be modest in size (Duquet, 2018). This has changed over the past decade 
as  terrorist  attacks  have occurred  in  which  perpetrators  used  firearms  to  seek  to  kill  as  many 
people as possible (such as the Utøya attacks in 2011 in Norway,  and the 2015 Paris attacks). 
The  second  difficulty  relates  to  geographical  considerations,  with  the  bulk  of  research 
undertaken either in the USA or in post-conflict zones. As such, the estimates found in the 
literature tend to focus on aspects that are related to but different than firearms trafficking, such 
as the ownership of firearms used for terrorist purposes. 

Table 2.48: Price of illicit firearms 

Alarm 
weapon 

Handgun  Pistol 

Kalashni
kov 

Shotgun 

Sub-
machine 
gun 

Glock 

Price (€) 

400 

70 

Austria 

Belgium 

Bulgaria 

Croatia 

Cyprus 

Czech Republic 

Denmark 

Estonia 

Finland 

500–750 

1,000–
1,500 

2,000–
2,500 

1,000–
2,000 

100–250 

100–300 

475 

2,000–
2,350 

France 

300–425 

1,000–
2,000 

1,000–
1,500 

1,000–
1,750 

300–650 

1,000–
2,000 

1,850 

Germany  

4,500 

131 

 
  
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
EUROPEAN COMMISSION 

Alarm 
weapon 

Handgun  Pistol 

Kalashni
kov 

Shotgun 

Sub-
machine 
gun 

Glock 

Price (€) 

500–
1,100 

1,700 

2,000 

1,000–
2,000 

3,000 

Greece 

Hungary  

Ireland 

Italy  

Latvia 

Lithuania 

Luxembourg 

Malta 

Netherlands 

300–400 

1,000–
1,500 

1,000–
1,500 

1,500–
3,000 

1,500–
3,000 

3,000 

Poland 

Portugal  

Romania 

70–135 

250–
1,875 

200 

2,500 

Slovakia 

Slovenia 

Spain 

Sweden 

500 

2,000 

United Kingdom 

2,300 

800–
1,250 

3,990–
4,845 

3,000–
7,000 

6,800–
7,950 

Source: Duquet (2016)

132 

 
  
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Citation 

Year(s) 
of 
estimate 

1  Karp (2018) 

2017 

EUROPEAN COMMISSION 

Table 2.49: Prior studies estimating the size or revenue of illicit firearms in the EU 

Sub-market 

Data source(s) 

Countries 
included in 
estimate 

Disaggregated 
at Member 
State level?  

Estimate produced 
(size)  

Estimate 
produced 
(revenue) 

The study focuses on 
the number of civilian-
held firearms overall, 
rather than specifically 
on firearms trafficking 

National firearms registration 
statistics 

General population surveys about 
firearm ownership (available for 
56 countries/territories) 

230 countries 
and territories, 
including all 28 
EU Member 
States 

Yes 

Volume of firearms 

N/A 

857 firearms held by 
civilians globally 
(64.2 million in the 
EU – data is 
disaggregated by 
country) 

2  European 

2013 

Commission 
(2014b) 

The study focuses on 
the illicit market for 
firearms (including the 
domestic market)  

3  UNODC 
(2015c) 

2010 to 
2013 

The study seeks to 
develop empirical 
knowledge on illicit 
firearms trafficking 
(both domestically and 
cross-border) by 
compiling data from 
judicial and police 
authorities  

4  UNODC 
(2010) 

2008 

Experts’ estimates of civilian 
holdings 

Where none of these was 
available, analogous comparisons 
based on estimates for 
comparable countries 

Seizure data 

Police or judicial authority data 
on seizures and questionnaires 

Annual seizures report 
questionnaire, asking primarily 
for aggregate data on firearms, 
their parts and components and 
ammunition seized during 2010–
2013 

The significant seizures report 
questionnaire, asking primarily 
for detailed information about 
significant individual incidents 
related to trafficking seizures 

Using data from the Small Arms 
Survey (2009) and applying ‘the 
most commonly cited estimate 
for the size of the illicit market is 

Seven Member 
States (DK, EE, 
FR, EL, LT, PT, 
UK) 

Yes, for seven 
Member States 

Yes, for 13 
Member States 

48 countries, 
including 13 EU 
Member States 
(BE, CZ, DE, EE, 
EL, ES, FI, FR, 
LT, LV, PL, RO, 
SE)  

Volume of firearms 

N/A 

81,000 firearms 
trafficked in the EU 
(and 67 million 
unregistered 
firearms)  

Volume of firearms 

N/A 

18,683 firearms 
seized in 12 Member 
States (CZ, DE, EE, 
EL, ED, FI, FR, LT, 
LV, PL, RO, SE)  

Global estimate 

Global estimate  

N/A 

Revenue from 
illicit market 

$170 million 
(USD) to $320 

133 

 
 
 
EUROPEAN COMMISSION 

Citation 

Year(s) 
of 
estimate 

Sub-market 

Data source(s) 

Countries 
included in 
estimate 

Disaggregated 
at Member 
State level?  

Estimate produced 
(size)  

5  Calderoni et 
al. (2014) 

2010 

6  Savona & 

2012 

Riccardi 
(2015) 

10%–20% of the licit market’ 
which is not sourced 

Data stem from previous 
research at the provincial level 
on the number of confiscated 
firearms provided by law 
enforcement authorities 

IT 

Extrapolation from Calderoni et 
al. (2014)  

IT 

IT 

IT 

N/A 

N/A 

Estimate 
produced 
(revenue) 

million (USD) 
per annum 
globally 

Revenue from 
illicit market 

€70 million to 
€141 million in 
Italy 

Revenue from 
illicit market 

Illicit market in 
the EU worth 
€247 million to 
€493 million  

134 

 
 
 
 
EUROPEAN COMMISSION 

2.6.3. Methodology for estimating revenues in this study  

The methodological approach we adopted for estimating the market revenue from illicit firearms 
in  this  study  built  upon  the  approaches  by  Transcrime  and  UNODC,  using  information  from 
Eurostat  on  the  total  revenue  from  firearms  produced  in  the  EU,  which  was  combined  with 
information on the price of firearms on the illicit market.  

The summary of the approach for measuring the economic revenue from illicit firearms in the EU 
is outlined in the table below.  

Table 2.50: Summary of approach for estimating revenues from illicit 
firearms sales 

Summary of approach  Supply-based estimates refined with available information on price and type 

of firearms trafficked. 

Output 

Estimation of the price of illicit firearms sales in the EU. 

Scope and coverage 

Geographical scope: EU-level and 28 Member States.  

Data sources 

Year(s) of estimate: 2012 for production data, 2018 for seizures, 2012–
2018 for price data. 

Production data stems from Eurostat, as quoted in the evaluation of the 
firearms Directive150.  
Seizure data is taken from the United Nations Office on Drugs and Crime’s 
data portal. 

Data on unregistered civilian-held firearms from the Small Arms Survey 
(Karp, 2018). 

Data on the price of firearms is mainly extracted from the Flemish Peace 
Institute publications; and in one case from a journalistic source (Duquet, 
2018). 

Key steps 

The following steps were followed: 

1.  Data on the number of firearms (units) produced in the EU served as 
a basis for the estimates. The number of units produced per 1,000 
population was calculated and applied to Member States where no 
production data was available. 

2.  United Nations Office on Drugs and Crime data on the share of seizure 
per type of firearms was applied to (1) to build an assumption of the 
type of firearms being trafficked. Where no data was available, the 
average was used. This provided a breakdown by type of firearms. 

3.  A factor of 10% was applied to (1) to derive the share of production that 
can be deemed to enter the illicit market. In the absence of alternatives, 
this factor – used by the UNODC (2010) – has the advantage of allowing 
for a comparison of this estimate with previous ones.  

4.  Price data was applied to (3) for each type of firearm (i.e. pistol, 

shotgun, sub-machine gun, etc.). Given the price difference due to the 
type of firearms and the location, this was done both as a range (low, 
high and mean estimate) as well as per Member State. Where no data 
was available, we used either the price of a similar type of firearm, or 
that of a similar country (based on population size and geographical 
location).  

𝐹𝑖𝑟𝑒𝑎𝑟𝑚𝑠 𝑝𝑟𝑜𝑑𝑢𝑐𝑡𝑖𝑜𝑛 ∗ 10% ∗ 𝑃𝑟𝑖𝑐𝑒 (𝑓𝑜𝑟 𝑒𝑎𝑐ℎ 𝑡𝑦𝑝𝑒 𝑜𝑓 𝑓𝑖𝑟𝑒𝑎𝑟𝑚) 

Data on seizures is becoming more comparable and comprehensive, thanks to 
the work undertaken by UNODC. However, the data is still very patchy as all 
countries  do  not  report  data,  and  even  when  they  do,  their  own  data  is  not 
always  reliable  (for  a  thorough  explanation  of  the  issues,  see  in  particular 
Duquet, 2016). Even if seizure data was comprehensive, it would only reflect 
the share of the market intercepted by law enforcement, which is likely to only 
represent a small share of the overall revenue from the market.  

Taking a supply-based estimate, while far from perfect, can provide some 
insights into the type of firearms being trafficked. As such, the estimates 
applied here may provide more insights for the point of view of the 
methodology, than the results themselves.  

Rationale 

150 Study in view of a report evaluating the implementation of Regulation 258/2012.

135 

 
 
 
 
EUROPEAN COMMISSION 

The challenge of assessing the revenue from firearms trafficking is to use 
existing data while strengthening the robustness of the assumption made. 
The main criticism of the approach taken by the UNODC (2010) and 
Transcrime (2015) stems from the 10% to 20% factor applied on licit sales of 
firearms. However, it has not been possible to provide a more accurate factor. 
The proposed method allows us to add a layer of information in this method 
by adding a level of granularity linked to the types of firearms being illegally 
traded.  

Our method has the following limitations: 

- 

Production data cannot be closely correlated to the illegal sale of 
firearms, which is likely to result in an underestimate of the market.  

-  While providing a level of granularity to the estimate, the data on 

seizure used in (2) is based on a relatively small sample. 

- 

- 

The 10% factor applied in (3), whilst used in previous research, is 
very tenuous. 

The price data applied in (4) varies a lot between lower and upper 
estimates and geographies. Furthermore, data is not currently 
available for all Member States. 

Limitations and 
caveats of this 
approach 

2.6.4. Revenue estimates of the EU illicit firearms market 

The table below presents the estimates of the illicit firearms market at the EU-level and for each 
of the 28 EU Member States. The results show that: 

• 

The annual revenue from the illicit firearms market in the EU comprised between €274 
million and €754 million (with the mid estimate standing at €408 million). 

•  Due to reporting inaccuracies, the estimates appear to underestimate the revenue from 
the market in some countries (such as France or Belgium) and overestimate that of 
others (as is the case of Austria). 

• 

The range of estimates is very wide, even though the methodology only provides for a 
range linked to the price of firearms. This reflects how the revenue from firearms in the 
overall assessment of the market can vary between locations (up to a tenfold increase). 

Given the lack of robustness surrounding the 10% factor used, we undertook a sensitivity analysis 
using a 5% and 20% factor. The figures vary proportionally to a mid, low and high estimate of 
€193.55 million, €129.91 million and €356.75 million respectively for 5% and €774.21 million, 
€519.62 million and €1,417 million respectively for 20%. 

Table 2.51: Revenue estimates of the EU illicit firearms market 

EU Member State 

Revenue estimates (€ million) 

Mid 

Low 

High 

28 EU Member States 

27 EU Member States without UK 

408.09 

324.555 

273.69 

219.174 

Austria 

Belgium 

Bulgaria 

Croatia 

Cyprus 

Czech Republic 

Denmark 

Estonia 

Finland 

France 

Germany  

85.38 

5.11 

0.33 

25.88 

0.29 

15.59 

9.17 

2.24 

8.29 

0.89 

52.57 

3.22 

0.24 

12.82 

0.20 

9.72 

6.32 

1.54 

5.72 

0.54 

31.25 

25.57 

753.96 

528.571 

141.28 

9.62 

0.28 

23.88 

0.51 

26.08 

16.36 

3.99 

14.79 

1.46 

50.24 

136 

 
 
EUROPEAN COMMISSION 

EU Member State 

Revenue estimates (€ million) 

Mid 

Low 

High 

Greece 

Hungary  

Ireland 

Italy  

Latvia 

Lithuania 

Luxembourg 

Malta 

Netherlands 

Poland 

Portugal  

Romania 

Slovakia 

Slovenia 

Spain 

Sweden 

7.50 

6.60 

5.80 

58.82 

3.27 

4.77 

0.18 

0.31 

5.16 

4.11 

3.79 

46.65 

2.25 

3.29 

0.12 

0.24 

13.46 

11.03 

15.64 

86.24 

5.83 

8.52 

0.33 

0.45 

29.53 

19.80 

60.96 

0.80 

3.88 

4.94 

2.81 

0.21 

3.35 

7.35 

0.42 

2.68 

3.08 

1.46 

0.15 

2.47 

5.08 

0.90 

6.98 

8.27 

3.12 

0.19 

5.04 

13.13 

225.38 

United Kingdom 

83.54 

54.51 

Note: Estimates were produced for 2012–2018 (mean) and updated to 2019 values using Eurostat’s HICP (Eurostat, 2020b).  

2.6.5. Criminal actors and modus operandi 

Table 2.52: Illicit firearms – Market actors 

Level of OCG involvement 

Low 

Size and composition of OCGs 

Modus operandi of OCGs 

Often with links to source market, in particular to the 
Western Balkans 

Ant trade (relatively small shipments) current and former 
warzones 

Conversion of Flobert firearms   

Poly-criminality of OCGs 

Very high, in particular with illicit drugs trafficking. 

Other key actors  

Collectors  

We identified 24 studies in the literature review that included information on the key actors in 
firearms  trafficking  in  the  EU.  From  the  demand-side  these  studies  showed  that  two  main 
categories of actors fuel demand for illicit firearms: criminals and terrorist organisations.  

In terms of supply, firearms trafficking does not necessitate a high level of organisation 
and therefore does not necessarily have to be undertaken by OCGs. Transcrime identified 
two broad categories of actors involved in the supply of illicit firearms: single individuals involved 
in small-scale commerce, and large operators able to systematically and periodically move large 
quantities  of  arms  and  ammunitions  (Savona &  Riccardi,  2015).  In  line  with  the  relatively  low 
revenue from the overall market, illicit firearms traffic is not very profitable, and often represents 
a secondary source of revenue for traffickers.  

Modus operandi 
Firearms are sourced from the following channels: 

•  The Western Balkans region is a major source of firearms in the EU. There is only 

speculation as to the exact size of the stock of firearms in the region, but it is clearly an 
important source of firearms and other weapons (including RPGs, hand grenades, etc.). 

137 

 
 
EUROPEAN COMMISSION 

•  Floberts are weapons sold legally in some Member States (such as Slovakia or the 
Czech Republic). They can either be purpose-built alarm weapons, or genuine lethal 
weapons that have been deactivated to be sold legally. According to a Europol official, 
they can be reactivated ‘in a matter of minutes’ and are currently one of the main 
sources of firearms in the EU (Savona & Riccardi, 2015). 

•  Postal services (fast parcels) – including the illegal import via postal parcels of 

firearms in pieces, originating from the USA – is a medium that is currently without the 
slightest possibility of detection. It can also include non-finished pieces without 
markings, which are therefore untraceable. A variation on this is the import of firearms 
that are 80% finished and require final drilling and assembly by the buyers (Europol, 
2017). 

•  Post-conflict countries. There is currently a high supply of weapons to the Ukraine 
due to the conflict situation in the country, so in future the risk that this will be a 
hotspot – similar to the Western Balkans – is high. One Europol official mentioned that 
there are early signs that some groups involved in the selling of firearms in the country 
are buying and converting Floberts before selling them in the EU. 

•  3D printing does not represent many cases and is not a current problem, but is an 
increasing one. The use of firearms using 3D-printed parts in the far-right Halle 
synagogue shooting shows that it should not be taken lightly. Real additive 
manufacturing is still in its infancy, but this method is expected to increase in popularity 
as firearms become more difficult to procure via other methods. 

•  Dark net is important, but is not the main means of trafficking. It provides a 
marketplace for those who are not connected to existing sources of firearms.  

In non-war zones, including the EU, firearms trafficking is closely linked to other (transnational) 
criminal  activities,  including  drug  smuggling,  other  forms  of  trafficking  and  terrorism  (Duquet, 
2016). According to the EU SOCTA, 45% of OCGs are poly-criminal. Most of them require some 
firearms, which makes the firearms market important as an enabler rather than in terms of the 
revenue it represents. 

2.6.6. Future trends and dynamics  

Table 2.53: Illicit firearms – Future trends 

Future trends and dynamics 

Increase in Floberts, 3D-printed firearms (or parts of 
firearms), and new stockpiles of firearms at the EU 
borders (Ukraine). 

Impact on market and criminal 
finances  

N/A 

Five studies were identified in the literature review that included information on the future trends 
and dynamics in illicit  firearms trafficking in  the  EU. These  studies showed several trends  that 
have emerged and are likely to continue. 

The first trend relates to the increased availability of Flobert weapons on the market since 
the  revision  of  the  Firearms  Directive  (European  Parliament,  2017).  The  Directive  targets 
deactivated firearms and acoustic-expansion weapons, but is less clear on Flobert firearms, which 
can  either  be  purpose-built  or  converted.  According  to  the  FPI,  this  leaves  arms  dealers  who 
owned  large  stocks  of  firearms  that  were  deactivated  according  to  older  standards  with  the 
opportunity to convert them into Floberts and sell them legally (Duquet & Goris, 2018). According 
to one law enforcement representative151, this trend is likely to continue until there is a significant 
change in the legislation of Member States that allow the sale of Floberts.  

While 3D printed firearms do not currently represent many cases, the falling price of printers 
will make it easier for them to be manufactured. A related problem is that the technology has the 
potential to create firearms that cannot be detected at security portals. 

The use of the dark net is another trend that has already started and is likely to continue. A 2017 
study by RAND investigated in detail the use of the dark net in the illicit firearms market.  The 
dark net appears to allow individuals with no connection to OCGs to source firearms, as was the 

151 Interview with law enforcement representative, 28 April 2020.

138 

 
 
 
 
EUROPEAN COMMISSION 

case in the 2016 Munich shootings. Online markets of firearms are not expected to become an 
important source of firearms in the future, but are likely to continue allowing otherwise criminally 
‘unconnected’ individuals to procure them (Persi Paoli et al., 2017). 

Finally, conflict areas have traditionally been a source of illicit firearms. Although 25 years have 
elapsed since the Dayton Agreement ending the war in the former Yugoslavia, and 20 years have 
passed  since  the  1997  pyramid  crisis  in  Albania,  the  Western  Balkans  is  still  a  key  source  of 
firearms in the EU. A Europol representative152 highlighted the risk of the seeing stocks of weapons 
building in Ukraine as a result of the war in Donbass: ‘it could be the new Bosnia’.  

2.6.7. Recommendations 

Given  the  shortcomings  and  limitations  in  the  method  used  to  estimate  the  size  of  the  illicit 
firearms market, several steps could be taken to improve data collection: 

•  Data on seizures could be more robust. As a follow-up to its 2015 study on firearms, the 

UNODC has initiated the systematic collection and publication of data on its online data 
portal. The number of Member States reporting data increased by three to 16 for the 
2020 study. Until countries systematically report data, this tool will only be partially 
useful. In our view, it is likely to become a key instrument for researchers in the future.  

• 

• 

• 

Production data is also hard to come by and patchy. 2012 is the last year from which 
data was available for a wide spectrum of Member States. In the past, the Norwegian 
Initiative on Small Arms Transfers (NISAT) provided a useful proxy (Norwegian Initiative 
on Small Arms Transfers, n.d.). NISAT data provided a comprehensive trade database 
aggregating several sources. Unfortunately, the database ceased being updated in 2017 
due to lack of funding. Ensuring a source of information on firearms production 
or trade would be beneficial. 

Information on the price of firearms has become more readily available, mainly 
through research linked to terrorism. The FPI’s publication is a valuable source that will 
soon be complemented on a project undertaken by Europol which will provide greater 
insight. 

The firearms market is very reactive. As an example, Flobert firearms153 started 
appearing on the market in 2016 and are now seen as one of the biggest firearms-
related security problems in the EU (Duquet & Goris, 2018). Legally sold in countries 
such as Slovakia, manufacturers and dealers must register the sales of these firearms. 
One Europol official154 mentioned that in the case of one seller, over 70% of sales were 
done using fake, stolen or lost ID, which makes it very likely they were destined for the 
criminal market. A thorough analysis of these weapons registers would provide 
valuable insight into the illicit firearms market, including the share of legally sold 
firearms being used by criminals and the volume of these sales, as well as where they 
are sold. 

The key findings from this study and the related recommendations are summarised in the table 
below.  

152 Interview with law enforcement representative, 10 March 2020 (#65).
153 Low calibre pistols that can be easily converted to fire live ammunition. 
154 Interview with law enforcement representative, 28 April 2020. 

139 

 
 
 
 
 
EUROPEAN COMMISSION 

Table 2.54: Recommendations – Illicit firearms market 

Key finding 

Recommendation 

Actor 

Member States should systematically 
report on firearms seizures using the 
UNODC online data portal.  

Efforts to improve information on the 
price of illegal firearms should continue 
to be strengthened, such as by Europol 
and the FPI.  

Member States 

UNODC 

Europol 

FPI  

Data from Eurostat on the legal 
production of firearms, combined 
with information from UNODC on 
seizure per type of firearm, provides 
the basis for estimating the illicit 
firearms market in the EU and its 
Member States.   

However, the estimate is reliant upon 
a tenuous assumption that 10% of 
firearms produced enter the illicit 
market. Production data is not up-to-
date and there is no ongoing data 
collection. Price data is improving 
mainly due to terrorism-related 
research, although it is not 
consistently available across all 
Member States.     

2.7.  Illicit tobacco  

Jirka Taylor, RAND Corporation and Fook Nederveen, RAND Europe 

Key findings: 

•  According to the estimates produced in this study, the annual revenues derived from 
the illicit cigarette market in the EU range between €8 billion and €10 billion (€8.3 
billion). This is somewhat lower than previous EU-wide estimates. 

• 

• 

This estimate is very sensitive to assumptions about the ratio between the price of 
licit and illicit products, and replicates parameters used in previous research. It is also 
limited to cigarettes. There are insufficient data to extend this market estimate to 
cover additional tobacco products, although the cigarette estimate can be assumed to 
express most of the total illicit market. 

It is widely assumed that OCGs play a dominant role in the illicit tobacco market. 
Typically, these groups are characterised as flexible, loosely structured, informal 
networks of criminals involved in production, transport, import, wholesale and retail. 

•  Other actors involved in the illicit trade include legitimate international transport and 
import/export companies, suppliers of materials needed to produce tobacco, and 
legitimate tobacco manufacturers. 

•  Ongoing trends that may affect the future include a move towards smaller shipment 

sizes and an increase in illicit domestic manufacturing. Products other than cigarettes 
are also expected to increase their market share. 

This Annex provides a comprehensive overview of the illicit tobacco market in the EU, building 
upon the summary provided in Section 2.7 of the main report.   

According  to  the  international  Framework  Convention  on  Tobacco  Control,  illicit  tobacco  trade 
refers to ‘any practice or conduct prohibited by law and which relates to production, shipment, 
receipt, possession, distribution, sale or purchase including any practice or conduct intended to 
facilitate such activity’ (WHO FCTC, 2014). While numerous definitions and characterisations can 
be offered, generally there are five principal sources of illicit tobacco (Antonopoulos & Hall, 2016): 

1.  Counterfeiting, or the manufacture of fake branded tobacco products; 

2.  Bootlegging, which involves buying tobacco products in countries with low excise duties 

in volumes that exceed customs regulations; 

3.  Large-scale smuggling of untaxed tobacco products; 

4.  Diversion from legitimate supply chains; and 

140 

 
 
 
EUROPEAN COMMISSION 

5.  Illicit manufacturing of tobacco products. 

Other important definitions frequently used in the context of illicit tobacco markets include tax 
avoidance,  tax  evasion  and  ‘illicit  whites’  (also  referred  to  as  ‘cheap  whites’).  The  latter  are 
cigarettes manufactured legally in one jurisdiction but sold in another jurisdiction where they are 
not authorised for sale. A high-profile example is cigarette brand Jin Ling, manufactured in the 
Kaliningrad area (Russia) and illegally exported to the EU. 

For  the  purposes  of  this  study,  in  line  with  the  Tobacco  Product  Directive,  the  illicit  market  of 
tobacco  products  covers  all  products  in  which  tobacco  is  one  of  the  components  (European 
Parliament, 2014). Most prior analytical work and methodological tools in this area are primarily 
geared towards cigarettes, reflecting their predominant share in both licit and illicit consumption. 
Correspondingly, this project will put substantial emphasis on estimates pertaining to illicit trade 
in cigarettes, but no tobacco product is excluded from the scope of this study. 

2.7.1. Previous  revenue  estimates  of  the  EU  illicit  tobacco 

market 

The literature search identified  two regular EU-wide estimates  of the EU  illicit tobacco  market. 
These  were  produced  by  Euromonitor  and  KPMG.  KPMG’s  work  has  been  elaborated  on  by 
Transcrime to produce additional and more detailed estimates. Alongside these EU-wide efforts, 
Project Pricing Policies and Control of Tobacco in Europe (PPACTE) produced an estimate covering 
most, but not all, EU Member States. We also identified academic and government-led studies, 
but none of these matched the scope and regularity of the Euromonitor and KPMG estimates. 

Several methodologies have been used to estimate the size of the illicit tobacco market, including: 

•  Discarded pack survey – Discarded cigarette packs are collected in a given area to 

arrive at a sample of packs that is representative of the overall consumption of 
packaged cigarettes in that area. Analysis of the packs and other collected data (and 
sometimes a set of assumptions) are used to determine the illicit share.   

•  Consumer survey – Tobacco consumers are directly asked about their smoking 

behaviour in a survey. Researchers can decide to also ask users can to present or 
surrender their tobacco product for inspection.  

•  Tax gap analysis – Recorded tax-paid sales are compared to self-reported 

consumption (e.g. measured through user surveys), with the difference attributable to 
illicit trade.  

2.7.2. Quality of prior revenue estimates  

Existing estimates of the size of the illicit tobacco market are based on a variety of methods, each 
with  strengths  and  limitations.  In  this  section  we  discuss  the  quality  of  –  and  methodological 
considerations surrounding – existing estimates155. Note that in the discussion below, we do not 
discuss  the  quality  of  Euromonitor’s  estimates,  as  there  are  few  details  available  on  its 
methodology. For that reason, Euromonitor’s estimates are excluded from further consideration, 
in line with other researchers who have questioned their validity (Blecher et al., 2015; Stoklosa 
& Ross, 2014). 

EU-wide estimates 
Project Stella – discarded pack survey 
Methodologically, discarded pack surveys – as used for the Project Stella estimates (KPMG, 2019)  
–  have  three  principal  limitations.  First,  Project  Stella’s  estimates  only  cover  illicit  trade  in 
cigarettes. While cigarettes currently appear to represent the lion’s share of illicit trade of tobacco 
products, other products are left out of the scope of the estimate. Theoretically, the method can 
be  applied  to  any  product  that  comes  in  packs  and  are  able  to  be  collected  and  examined; 
however, in practice the method has been confined to cigarettes. Second, for some products the 
method can only yield indirect information on their legal status. While it is able to identify products 
that  were  found  in  a  member  state  in  which  they  cannot  be  sold  legally,  it  cannot  directly 

155 For a detailed discussion of methods and data sources that have been or could be used to assess illicit 
trade with tobacco products, see RAND Europe (forthcoming), ‘Study to identify an approach to measure the 
illicit market for tobacco products’. Santa Monica, CA: RAND Corporation. RR-4448-EC. 

141 

 
 
EUROPEAN COMMISSION 

determine whether the products were brought to the jurisdiction legally (e.g. as part of travellers’ 
allowance).  To  address  this,  Project  Stella  estimates  the  share  of  illicit  products  among  the 
identified non-domestic packs by making assumptions about the plausible volume of legal cross-
border importation of cigarettes based on data on international traffic flows, commuting patterns 
and other information. The precision of these assumptions is, however, impossible to determine. 
And third, the method is susceptible to sampling biases. Care needs to be taken to ensure that 
the areas selected for pack collection yield a sample that is broadly representative of consumption 
patterns across the population as a whole. For instance, overinclusion in the collection sample of 
places heavily frequented by tourists, which may result in an overestimate of the illicit trade as 
more foreign packs may be collected. 

Despite  these  shortcomings,  a  discarded  pack  survey  is  regarded  as  a  comparatively  robust 
method  for  estimating  the  illicit  trade  of  cigarettes.  Two  features  of  Project  Stella,  however, 
further complicate the assessment of the quality of its estimates. First, the research is funded by 
the tobacco industry, which introduces a conflict of interest. This is compounded by the fact that 
tobacco companies provide additional input in the form of verifying the authenticity of collected 
samples and identifying counterfeits. This process is not reviewed by an independent third party. 
Second, Project Stella offers relatively little detailed information about principal components of its 
research design. This includes sampling design (e.g. location and timing) and data collection as 
well as details on the identification of the share of illicit non-domestic packs. For these reasons, 
existing reviews of Project Stella generally agree that the method is a sound approach towards 
generating  plausible  estimates,  but  criticise  the  lack  of  transparency  and  the  inability  to 
independently verify the research (Gallagher, 2017). 

Transcrime – regional disaggregation 
Based on the results of KPMG’s work, Transcrime (Calderoni, 2014) developed a methodology to 
produce sub-national estimates of the volume of illicit trade. First applied in the Italian context, 
the method divides the national illicit market reported by KPMG among a country’s regions, based 
on the distribution of smoking prevalence (as reported in national surveys). Further, to reflect the 
fact  that  the  prevalence  of  illicit  consumption  is  unlikely  to  be  the  same  in  each  region,  each 
regional revenue was adjusted by the share of non-domestic packs found in a given region. Based 
on  these  estimates  of  regional  illicit  consumption,  estimates  of  regional  illicit  revenue  were 
calculated using the price of an illicit pack obtained via a review of open sources and press releases 
and interviews with stakeholders (such as industry experts and criminal justice representatives). 

Since  Transcrime’s approach  draws  heavily on KPMG’s analyses  and their underlying data, the 
same quality considerations apply156. In addition, to design a proxy for the differences in illicit 
consumption  across  individual  regions,  the  method  uses  the  regional  share  of  identified  non-
domestic packs. This approach leaves out illicit domestic packs, the presence of which may also 
vary across regions. The reason for  this omission is understandable  as the  underlying  data  on 
discarded packs did not identify illicit domestic packs. As discussed above, future discarded pack 
collection  efforts  may  be  able  to  address  this  gap  by  drawing  on  data  from  the  EU  track  and 
traceability (T&T) system. 

Project PPACTE – consumer survey with pack inspection 
The estimate produced by Project PPACTE relied on a face-to-face consumer survey asking about 
the sources of tobacco products in participants’ possession. As part of the interview, participants 
who self-identified as cigarette smokers were invited to show researchers their latest purchased 
pack of cigarettes or hand-rolled tobacco. The pack was subsequently inspected by researchers 
for  signs  of  illicit  origin  (e.g.  inappropriate/missing  health  warning  or  tax  stamp/banderole,  or 
extremely low price). 

The combination  of  consumer surveys and  pack inspections represents a comparatively robust 
methodological approach (IARC, 2012). Consumer surveys have the potential to yield rich data 
about individuals’ smoking behaviour and provide more information about illicit behaviour (e.g. 
sources, price  paid) beyond whether  it takes place  or  not. Surveys are  also  more  effective  for 
discerning  tax  evasion  and  tax  avoidance.  The  method  can  draw  on  standardised  research 
instruments and can be applied comparatively across many contexts. While the Project PPACTE 
study was limited to cigarettes and hand-rolled tobacco, consumer surveys can be applied to any 
tobacco products. 

156 Similarly to KPMG, Transcrime also received funding for their work from the tobacco industry. 

142 

 
 
EUROPEAN COMMISSION 

Consumer  surveys,  however,  have  a  number  of  limitations  as  well.  Chief  among  them  are 
respondent  biases  that  may  result  in  underreporting  of  both  licit  and  illicit  consumption. 
Techniques  have  been  developed  to  mitigate  this  but  underreporting  remains  a  major  risk,  as 
acknowledged  by  Project  PPACTE  (Joossens  et  al.,  2014).  Further,  obtaining  a  representative 
sample may be difficult, particularly since heavy smoking and illicit tobacco consumption may be 
disproportionately prevalent among hard-to-reach populations. The combination of surveys with 
pack  inspection  can  mitigate  survey  limitations  as  it  involves  analysis  of  physical  evidence. 
However, even pack inspection can be subject to respondent biases as some respondents may be 
unwilling to submit a pack for inspection, particularly if they know it is illicit. Additionally, unless 
a  pack  is  surrendered  to  the  research  team  for  further  analysis,  the  verification  of  the  pack’s 
genuineness will not involve a forensic inspection, and so very sophisticated counterfeits may not 
be caught. Correspondingly,  Project PPACTE noted their interviewers were unable to verify the 
genuineness of the tax stamps on the packs they submitted. 

In  summary,  there  are  four  existing  estimates  of  illicit  tobacco  market  at  the  EU-level,  each 
drawing  on  different  methodologies.  Estimates  produced  by  Euromonitor  are  based  on  an 
inscrutable approach that precludes an assessment of its quality. Estimates produced by KPMG 
are based on a methodology that is generally regarded as robust and capable of producing high-
quality  numbers.  KPMG’s  work  is  also  repeated  on  an  annual  basis  in  a  generally  consistent 
manner, and is based on large sample sizes. However, details on the method’s operationalisation 
have not been published, precluding replication and thorough examination, and the research effort 
is  not  free  of  conflict  of  interest  due  to  its  funding  from  the  tobacco  industry.  Transcrime’s 
additional estimates are based on the same data as KPMG’s estimates, and therefore share the 
same limitations. Lastly, Project PPACTE draws on an alternative combination of methods, which 
is also regarded as comparatively robust. However, this work was a one-off effort and is now a 
decade old. Lastly, a common limitation of all these estimates is their focus on cigarettes. As such, 
while illicit trade of cigarettes likely represents a very large share of the illicit market in tobacco 
products, these estimates still do not achieve full coverage of the illicit market. 

National efforts 
Several existing national-level studies have also employed the discarded pack methodology and 
consumer surveys. Similar methodological observations discussed above apply to these studies 
as well. A number of other methods have been used by other authors; these are discussed in turn 
below. 

Tax gap analysis 
A number of analyses employ a comparison between tax-paid sales and self-reported consumption 
(also referred to as ‘tax gap analysis’). The idea behind this method is to compare official data on 
how many tobacco products were sold in a given jurisdiction during a certain period (typically a 
year)  with  information  on  self-reported  consumption,  typically  obtained  via  general  population 
surveys, with the difference (i.e. excess consumption) attributable to illicit trade. The principle 
advantage of this approach is that the method is conceptually clear and relatively straightforward 
in terms of resources needed. Unlike a discarded pack survey, tax gap analysis  can capture all 
tobacco  products  (and  thus  theoretically  the  entire  illicit  market),  and  disaggregations  by 
individual  product  types  may  also  be  possible,  depending  on  the  availability  of  requisite  input 
data. 

A primary challenge to tax gap analysis is the necessity to rely on self-reported consumption data, 
which exposes the method to a variety of respondent biases that may result in underreporting of 
actual consumption. This would then translate into an underestimate of the total size of the illicit 
market.  For  that  reason,  existing  assessments  agree  that  the  method  is  more  suitable  for  the 
monitoring  of  trends  over  time  (assuming  the  direction  and  magnitude  of  any  biases  remain 
broadly the same over time), rather than for producing absolute estimates of the size of the illicit 
market. Further, input data irregularities – such as temporal biases in sales data – may result in 
misestimations of the illicit trade. Legal cross-border traffic also represents a challenge in that 
consumption by non-residents is typically not captured in national survey data, and private legal 
exportation/importation may also impact the precision of the estimate. Lastly, while the general 
principle of the method is the same in every country, data may not be readily comparable across 
national contexts, which presents an additional challenge for constructing an EU-wide estimate. 

Within-country analysis of sales 
One  national-level  estimate  of  the  illicit  market  by  Lakhdar  (2008)  employed  a  within-country 
sales analysis. The principle behind this method is a comparison of sales growth rates among a 

143 

 
EUROPEAN COMMISSION 

country’s regions, and an assumption that applying the growth rate experienced by the region 
least impacted by illicit trade to the entire country produces an estimate of sales expected in the 
absence of illicit trade. The difference between this expected revenue and actual recorded sales 
is then inferred to represent the volume of illicit trade in the country. 

The main advantage of this method is that it is conceptually straightforward and builds on existing 
data, so it is therefore relatively easy to implement. However, there is a fundamental limitation 
to the method in that it builds on an assumption that the growth rate of sales across all regions 
would be the same in the absence of the black market, which is unlikely to be the case. As such, 
the method is unlikely to produce a precise estimate, and has not been used extensively in existing 
literature.  

144 

 
EUROPEAN COMMISSION 

Table 2.55: Prior studies estimating the size or revenue of the illicit tobacco market in the EU 

Citation 

Year(s) of 
estimate 

Sub-market 

Data source(s) 

Countries 
included in 
estimate 

Disaggregated at 
Member State 
level?  

Estimate produced 
(size)  

1  Prieger and 

2012 

Cigarettes 

Kulick (2018) 

Mix of sources, driven by 
expert opinion 

2  KPMG (2019) 

2018 

Cigarettes 

Principal data source 
discarded pack survey, 
complemented by sales data 
and traffic modelling 

25 EU countries 
(LU, CY and MT 
excluded) 

Yes 

EU 28 

Yes 

Estimate 
produced 
(revenue) 

N/A 

77.3 billion cigarettes 
(12.2% of total 
consumption) 

Overall proportion of illicit 
packs: 8.6% 

N/A 

3  Transcrime 
(2015a) 

2012 

Cigarettes 

KPMG work, cigarette price 
data, expert input 

EU 28 

Yes (sub-regional as 
well) 

No new estimate 

4  Gallus et al. 

2010 

(2014); Joossens 
et al. (2014) 

Cigarettes and 
hand-rolled 
tobacco 

Consumer survey with pack 
inspection 

17 EU 
countries157 (and 
Albania) 

Yes 

Overall proportion of illicit 
packs: 6.5% (ranging 
from 0% in PT to 37.8% 
in LV) 

€9.4 billion 
(range:  
€7.8 billion to 
€10.5 billion) 

N/A 

157 The countries covered in the study were AT, BG, HR, CZ, UK (England only), FI, FR, EL, HU, IE, IT, LV, PL, PT, RO, ES, SE. 

145 

 
 
 
EUROPEAN COMMISSION 

2.7.3. Methodology for estimating revenues in this study  

Our  methodological  approach  consisted  of  two  parts.  First,  we  updated  previous  estimates 
produced by Transcrime (2015b) by drawing on the latest edition of results developed as part of 
KPMG’s Project Stella (KPMG, 2019). This source provides information on illicit consumption as a 
share  of  overall  consumption  in  2018  in  all  EU  Member  States,  based  on  a  series  of  industry-
sponsored discarded pack surveys. Second, we monetised these results using the latest available 
information on the price of licit cigarettes sold in the EU.  

The  updated  monetised  estimate  assumes  a  relationship  between  the  price  of  licit  and  illicit 
products,  i.e.  how  much  cheaper  illicit  products  are  compared  to  their  licit  counterparts.  The 
estimate presented below uses the same assumption as that employed in previous studies on this 
topic – that the illicit price is two-thirds of the licit price (KPMG, 2019; Transcrime, 2015b). The 
true revenue from this parameter is difficult to establish as it depends on many factors, such as 
circumstances of the illicit sale and any quantity discounts, and can be expected to vary across 
contexts. Still, the limited available insights on this topic suggest that the value selected for our 
estimate is not unreasonable. The ratio between the price of illicit and licit products reported in 
various contexts in existing literature (albeit not from the EU) is broadly comparable158. For the 
price of licit products, the updated estimate used the following inputs: 

• 

• 

• 

For the low estimate: price of a 20-cigarette pack of the cheapest brand as reported by 
WHO (2018 data)159. 

For the mid estimate: weighted average price (WAP) of cigarettes reported by EC (2018 
data)160. 

For the high estimate, price of a 20-cigarette pack of a premium brand as reported by 
WHO (2018 data). 

A  summary  of  the  approach  used  in  this  study  for  estimating  the  market  revenue  from  illicit 
tobacco –and the limitations of this approach – is outlined in the table below.  

Table 2.56: Summary of approach for estimating revenues from illicit tobacco  

Summary of approach  Demand-based estimate based on 1) estimated share of illicit consumption of 

cigarettes; 2) assumed illicit-to-licit price ratio; and 3) volume of legal sales 

Rationale 

Builds on the only comparable EU-wide estimate of illicit consumption of 
cigarettes 

Replicates and updates previous estimates based on the same methodology  

Output 

Annual retail revenue from illicit cigarettes in the EU 

Scope and coverage 

Geographical scope: EU-level and Member State-level  

Year(s) of estimate: 2018, updated to 2019 values 

Sub-markets: Headline estimate covers only cigarettes; exploratory estimate 
covering fine-cut tobacco also produced 

Data sources 

Data on the extent of illicit consumption reported by Project Stella 

Data on legal sales and prices in the EU reported by the EC 

Key steps 

Data on the estimated extent of illicit consumption is applied to the weighted 
average price of legal cigarettes along with an assumed ratio of illicit-to-licit 
prices. The lower boundary of the estimate is based on the price of the 
cheapest pack of cigarettes, the upper boundary is based on the price of a 
premium pack. The formula for the calculation of the Member State-level 
estimate of illicit revenue 𝑅𝑖 is: 

𝑅𝑖 = 𝐶𝑖 × 𝑃𝑙 × 𝑃𝑟 

158 Recent examples of values reported in existing literature include 0.59 in Australia (KPMG, 2018), 0.65 in 
Mexico (Juarez & Shigematsu, 2019) and 0.62 and 0.67 in Ukraine and Russia, respectively (Brown et al., 
2017).  
159 Exchange rates for non-euro countries for 2018 were taken from excise duty tables reported by DG TAXUD 
(European Commission, 2019b). 
160 Note that in six Member States (EE, EL, FI, FR, LT and LV), the weighted average price reported by the EC 
was  lower  than  the  price  of  the  cheapest  pack  reported  by  WHO.  In  these  six  instances,  we  used  WHO-
reported values for both the ‘low’ and the ‘mid’ estimates. The weighted average price is provided in units of 
1,000  cigarettes.  Our  estimate  assumes  this  quantity  is  perfectly  distributed  into  packs  containing  20 
cigarettes. 

146 

 
 
EUROPEAN COMMISSION 

Where: 

𝐶𝑖 is the volume of illicit consumption 
𝑃𝑖 is the price of legal cigarettes  
𝑃𝑟 is the ratio between the price of licit and illicit products 
The EU-level estimate is calculated as the sum of all Member 
State-level estimates. 

Limitations and 
caveats of this 
approach 

The estimate: 

- 

- 

- 

is based on data funded by the tobacco industry, and thus is not free 
of conflict of interest;  

incorporates assumptions about key parameters on which there is 
little evidence, such as the illicit-to-licit price ratio; and  

captures only trade with cigarettes, leaving out other, albeit less 
prevalent, tobacco products. 

2.7.4. Revenue estimates of the EU illicit tobacco market 

The table below presents the estimates of the illicit tobacco market at the EU-level and for each 
of the EU Member States. The results show that: 

• 

• 

• 

The revenue from the illicit market with cigarettes in the EU in 2018 was approximately 
€8 billion. This estimate is very sensitive to assumptions about the ratio between the 
price of licit and illicit products, and replicates parameters used in previous research 
(Transcrime, 2015). 

There are substantial differences across individual Member States. The largest illicit 
market for cigarettes is in the UK, followed by France, Italy and Germany. Together 
these four countries account for two-thirds of the European illicit cigarette market by 
revenue. 

There are insufficient data to extend this market estimate to cover additional tobacco 
products, although the cigarette estimate can be assumed to express most of the total 
illicit market. 

Update and monetisation of previous estimates 
Table 2.57 presents the results of the updated estimate of the cigarette market broken down by 
individual  Member  States.  Using  the  weighted  average  price  of  cigarettes,  the  overall  revenue 
from the market is approximately €8 billion. By far the largest national markets are in the UK and 
France,  driven  in  both  countries  by  both  comparatively  high  prices  of  cigarettes  and  high 
estimated prevalence of illicit consumption. Using the price of the cheapest cigarette pack instead 
of the weighted average price does not alter the overall results by much. By contrast, using the 
price of premium products increases the revenue estimate closer to €10 billion. 

The updated headline revenue is slightly lower than the 2012 estimate produced by Transcrime, 
which put the revenue from the EU cigarette market at €9.4 billion (range €7.8 billion to €10.5 
billion).  This  difference  is  broadly  reflective  of  the  estimated  decrease  in  the  illicit  trade  of 
cigarettes in recent years – for instance, through its series of successive estimates, KPMG reported 
that the overall volume of illicit consumption decreased from 57 billion cigarettes in 2014 to 44 
billion in 2018 (KPMG, 2019). Still, there is a large overlap between the ranges of the Transcrime 
and the updated headline estimates. 

Table 2.57: Revenue estimates of illicit cigarettes 

EU Member State 

Revenue estimates (€ million) 

Mid 

Low 

High 

28 EU Member States 

27 EU Member States 
without UK 

Austria 

Belgium 

Bulgaria 

8,309.15 

6,190.19 

93.25 

101.20 

45.31 

8,012.62 

5,954.33 

89.31 

94.67 

40.84 

1,0087.48 

6,985.64 

111.64 

113.60 

49.90 

147 

 
EUROPEAN COMMISSION 

EU Member State 

Revenue estimates (€ million) 

Mid 

Low 

High 

Croatia 

Cyprus 

Czech Republic 

Denmark 

Estonia 

Finland 

France 

Germany  

Greece 

Hungary  

Ireland 

Italy  

Latvia 

Lithuania 

Luxembourg 

Malta 

Netherlands 

Poland 

Portugal  

Romania 

Slovakia 

Slovenia 

Spain 

Sweden 

41.22 

14.49 

110.85 

30.59 

16.23 

94.22 

28.90 

12.86 

110.23 

27.62 

16.23 

94.22 

50.65 

16.59 

138.04 

34.12 

23.86 

107.27 

2,038.49 

2,038.49 

2,117.91 

514.29 

513.51 

64.24 

257.38 

635.81 

47.88 

56.04 

1.56 

10.67 

134.89 

440.97 

52.96 

448.52 

38.55 

50.80 

279.37 

56.93 

488.82 

513.51 

61.02 

255.60 

534.29 

47.88 

56.04 

1.42 

9.95 

131.43 

428.53 

48.14 

445.56 

34.53 

44.87 

247.23 

52.12 

601.62 

605.67 

73.63 

311.83 

734.65 

58.70 

66.71 

1.80 

11.17 

153.33 

554.32 

60.18 

509.22 

48.10 

59.34 

309.04 

62.76 

United Kingdom 

2,118.95 

2,058.30 

3,101.84 

Notes: Estimates were produced for 2018 and updated to 2019 values using Eurostat’s HICP (Eurostat, 2020b). Please note that for some, 
but not all, countries input parameter data are available for 2019. However, given the possible relationship between the model parameters, 
we opted to use 2018 values for all input data in order to achieve a unified reference year. 

The table above presents the result of the main estimate of the revenue of the illicit market. In 
the  following  sections,  we  present  two  additional  considerations  and  reflections  on  themes 
pertaining to efforts to estimate the revenue of the illicit tobacco market. 

Examining the relationship between licit and illicit prices 
As discussed above, when considering the results of the updated headline estimate, it is important 
to note its sensitivity to the value of the ratio of illicit to licit prices. To illustrate, changing the 
value of this parameter from 0.67 to 0.59 (a value recently reported by KPMG in Australia) reduces 
the overall revenue estimate by almost €1 billion. 

Furthermore, it is likely that, unlike in the headline estimate, the revenue from the illicit-to-licit 
price ratio is the same across individual national markets or types of illicit products. For instance, 
it  is  reasonable  to  assume  that  at  least  some  counterfeit  products  are  sold  at  a  price  that  is 
identical to the price of a legal product if deception is maintained in the supply chain. In fact, a 
notably lower price may be counterproductive, due to its potential to arouse suspicion. 

148 

 
 
EUROPEAN COMMISSION 

Since the Stella dataset includes an estimation of the proportion of counterfeit products as a share 
of total illicit consumption, it is possible to estimate by how much the overall revenue from the 
market changes, depending on the extent of deception pertaining to counterfeit products161.  

Table  2.58  presents  the  results  of  applying  three  different  deception  levels:  a)  perfect  (100% 
deception, i.e., where all counterfeit products are sold as if they were genuine); b) high (75% 
deception); and c) some (50% deception). The table shows that incorporating deception into the 
estimations has only a limited impact. Even the most dramatic scenario of perfect deception for 
all counterfeit products increases the revenue from the overall headline estimate by only about 
6%. 

Table 2.58: Exploration of differential illicit-to-licit price ratio for counterfeit 
products, 2019 

Revenue estimate (€ million) 

Mid 

Low 

High 

8790.45 

8488.51 

10696.14 

8668.19 

8367.44 

10541.09 

8545.93 

8246.37 

10386.04 

Perfect (100%) 
deception 

High deception 
(75%) 

Some deception 
(50%) 

Notes: Estimates were produced for 2018 and updated to 2019 values using Eurostat’s HICP (Eurostat, 2020b). 

Examining the illicit market for other tobacco products 
The illicit market  for  cigarettes represents only a subset (albeit very large) of the overall illicit 
market for tobacco products. Regrettably, there are currently no high-quality large-scale data on 
the  extent  of  the  illicit  consumption  of  tobacco  products  other  than  cigarettes,  precluding  the 
construction of a robust estimate for additional tobacco products. 

Still, it may be helpful to engage in an analytical exercise to offer at least an indication of what 
may be obscured by the inability to construct an estimate for other tobacco products. As indicated 
by  multiple  experts  consulted  for  this  study,  fine-cut  tobacco  (used  in  what  are  referred to  as 
‘roll-your-own cigarettes’) is generally considered the second-most important trafficked product, 
after boxed cigarettes. This is also reflected in a 2017 Eurobarometer on ‘Attitudes of Europeans 
towards tobacco and electronic cigarettes’, which found that in spite of the dominant preference 
for  boxed  cigarettes  across  the  EU,  hand-rolled  cigarettes  are  also  used  by  29%  of  smokers 
(European Union, 2017). The EC publishes data on the sales of fine-cut smoking tobacco as well 
as its price across the EU162. It is possible to apply the two key parameters from the cigarette 
estimate  (share  of  illicit  consumption  and  illicit-to-licit  price  ratio)  to  these  data  on  fine-cut 
smoking tobacco163. While this application of the key parameters is almost certainly not reflective 
of reality, this exercise provides at least a very broad indication of the volume of the illicit fine-
cut tobacco market if it broadly resembled that of boxed cigarettes.  

Table 2.59 presents the results of this exploratory estimation exercise. It shows that if the share 
of illicit consumption of fine-cut tobacco in each Member State was similar to that of cigarettes, 
and  identical  assumptions  could  be  made  about  the  illicit-to-licit  price  ratio,  the  EU-wide  illicit 
market for fine-cut tobacco would be valued at approximately €658 million. This corresponds to 
approximately 8% of the headline estimate for the cigarette market. In this exploratory estimate, 
France  has  the  largest  illicit  market  in  fine-cut  tobacco,  stemming  from  comparatively  high 

161 Caution is required as currently the only available data on the extent of counterfeit consumption in the EU 
come  from  industry-sponsored  studies,  which  rely  on  the  tobacco  industry  to  verify  the  authenticity  of 
collected samples. This makes the results impossible to scrutinise and subject to strong conflict of interest. 
162  Price  data  are  available  only  for  a  subset  of  EU  Member  States.  For  the  purposes  of  this  exploratory 
estimate, we divided countries with missing data into two groups – EU15 and newer member states – and 
used an average price reported in these respective groups, weighted by the volume of sales in each country. 
Note that using an EU-wide average for all countries with missing data or unweighted group averages would 
result in only a very minor upward revision of results. 
163 Note that since there is no existing estimate of the absolute volume of illicit packs of fine-cut tobacco, we 
applied the parameter of the share of illicit consumption to legal domestic sales of fine-cut tobacco, as reported 
in EC releases for consumption of fine-cut tobacco. In addition to other limitations, this approach ignores legal 
importation as well as exportation of tax-paid products. 

149 

 
 
 
EUROPEAN COMMISSION 

tobacco prices as well as a high assumption of illicit consumption. Germany, by far the largest EU 
market  for  licit  fine-cut  tobacco,  has  a  comparatively  lower  estimated  revenue  from  the  illicit 
market, primarily due to a much smaller estimated share of illicit consumption in the country. 

Table 2.59: Exploratory revenue estimates of the illicit fine-cut tobacco 
market in the EU, 2019 

EU Member State 

Revenue estimates (€ million) 

28 EU Member States 

27 EU Member States (excluding 
UK) 

Austria 

Belgium 

Bulgaria 

Croatia 

Cyprus 

Czech Republic 

Denmark 

Estonia 

Finland 

France 

Germany  

Greece 

Hungary  

Ireland 

Italy  

Latvia 

Lithuania 

Luxembourg 

Malta 

Netherlands 

Poland 

Portugal  

Romania 

Slovakia 

Slovenia 

Spain 

Sweden 

UK 

658.45 

524.48 

3.30 

34.59 

0.93 

0.80 

1.06 

4.03 

0.81 

0.49 

7.28 

180.88 

76.30 

58.53 

19.14 

6.36 

21.80 

0.82 

1.22 

2.67 

0.21 

41.66 

26.28 

2.65 

0.44 

1.04 

1.91 

28.80 

0.50 

133.97 

Notes: Estimates were produced for 2018 and updated to 2019 values using Eurostat’s HICP (Eurostat, 2020b). 

2.7.5. Criminal actors and modus operandi 

Table 2.60: Illicit tobacco – Market actors 

Level of OCG involvement 

Size and composition of OCGs 

OCGs are assumed to accrue a large share of the revenue, 
but no concrete estimates exist. 

Actors involved are typically flexible, loosely structured, 
informal networks of criminals that collaborate on an ad-

150 

 
EUROPEAN COMMISSION 

Modus operandi of OCGs 

Poly-criminality of OCGs 

Other key actors  

hoc basis, which may or may not meet the definition of 
OCGs. 

Smuggling unlicensed or counterfeit products into the EU, 
smuggling legitimate products within the EU, 
manufacturing unlicensed or counterfeit products within 
the EU, or diverting products from the legitimate supply 
chain. 

OCGs may use established smuggling routes to trade other 
illicit goods, such as illicit drugs, weapons or diamonds. 
They may also engage in e.g. THB, forgery of documents 
and money-laundering. 

International transport and import/export companies, and 
legitimate tobacco manufacturers. 

We identified 37 studies in the literature review that included information on the key actors in the 
illicit tobacco market in the EU.  These studies showed that it is widely assumed OCGs play a 
dominant role in the illicit tobacco market. Claims about high levels of OCG involvement are 
made  by  for  example  the  EU  (European  Commission,  2011,  2013,  2016a,  2017c,  2018a; 
Michalopoulos, 2017), international organisations (OECD, 2008; WHO, 2015) and academic and 
non-academic  researchers  (Borkowski  &  Twomey,  2019;  Melzer  &  Martin,  2016;  Tracit,  2019) 
alike. Several characteristics of the illicit tobacco trade underpin this assumption, such as: 

•  Smuggling or bypassing customs agencies of countries through which the illicit tobacco 
is trafficked can be challenging, given the sheer size and bulkiness of shipments, which 
may require participation of highly organised groups (Melzer & Martin, 2016); 
Transcrime (2015a) found that 94.8% of seized cigarettes were smuggled and 
distributed by large-scale actors who were typically part of transnational criminal 
networks. At the same time, these groups accounted for less than one-quarter (23%) of 
all actors reported to be involved in the illicit tobacco trade. 

•  According to Europol, illegal tobacco factories in the EU that have been detected and 

closed down by national law enforcement and customs agencies, as well as 
organisations such as OLAF and Europol, are often run by well-established OCGs (EUIPO 
& Europol, 2019; KPMG, 2019). 

• 

The OECD (2008) reports that trading and distribution networks often have very 
complex and sophisticated logistics and finances, requiring planning and organisation. 

Box 7: Attractiveness of illicit tobacco trade to OCGs 

The illicit tobacco trade is considered to be attractive for a variety of reasons: 

- 

- 

- 

- 

It is perceived as a low-risk, yet high-reward source of revenue, as criminal sanctions are 
often lenient (particularly in comparison to other forms of illicit trade) and law enforcement 
powers or capacity are often limited or deployed to other higher priority tasks (Allen, 2012; 
Borkowski & Twomey, 2019; CSD, 2015; Ellis, 2017; Interpol Office of Legal Affairs, 2014; 
Johnston et al., 2016; Melzer & Martin, 2016; Skinnari & Korsell, 2016; Transcrime, 2019; WCO, 
2015)164. Moreover, Transcrime (2019) found evidence that differences in sanctions between EU 
Member States have an impact on the routes traffickers decide to use. Relatedly, illicit tobacco 
thrives in areas where levels of corruption are high (Ellis, 2017; Tracit, 2019; Vujović, 2015)165. 

It can be an appealing well-paid alternative source of income for people under poor socio-
economic conditions, such as people living in places where unemployment is high 
(Antonopoulos & Hall, 2014; Johnston et al., 2016; Vujović, 2015). Similarly, it may be an 
attractive complimentary revenue stream to small legitimate businesses struggling to break 
even or make profits (Antonopoulos & Hall, 2014; Skinnari & Korsell, 2016)166. 

The trade in tobacco is – unlike for example illegal drugs – dominated by legal supply chains 
because tobacco itself is not an illegal substance, and illicit trade represents only a fraction of 
the global total. This means distribution can be done more openly, commonly predicated on 
movements and resources involved in legal supply chains (CSD, 2015; FATF, 2012; OECD, 
2008; Skinnari & Korsell, 2016). 

According to the WCO and Interpol, seizures of illegal tobacco consignments rarely lead to the 
prosecution of the individuals who plan and direct operations (Interpol Office of Legal 
Affairs, 2014; WCO, 2015). 

164 Interview with academic expert, 19 February 2020 (#7). 
165 Interview with EU-level representative, 23 March 2020 (#27). 
166 Interview with academic expert, 19 February 2020 (#7). 

151 

 
 
 
EUROPEAN COMMISSION 

- 

- 

- 

Production costs are considered very low (after an initial investment in manufacturing and 
packaging equipment) (Interpol Office of Legal Affairs, 2014; Melzer & Martin, 2016)167. This is 
mainly a result of the fact that tax makes up the lion’s share of the retail price of tobacco 
products (OECD, 2008; WCO, 2015). At no stage does the production process require 
sophisticated technology. 

Counterfeited products have a ready market, as it is very difficult for the consumer to 
distinguish a counterfeited pack from a genuine product based on physical inspection alone 
(Melzer & Martin, 2016; WCO, 2015). 

Purchasing and consuming illicit tobacco can be socially accepted as it is often perceived 
as a minor, victimless crime and an economic necessity because of high prices of genuine 
products, a fact that is sometimes blamed on the government (Ellis, 2017)168. 

However, very few of the identified studies go beyond the simple statement that OCGs have a 
strong presence  in the  illicit  tobacco market. Indeed,  few publications specifically examine the 
precise extent of OCG involvement, and substantiate this with evidence beyond mere anecdotal 
reasoning. In fact, several publications reviewed were critical of this representation of the illicit 
market. For example, Caneppele et al. found that most of the criminological literature argued that 
most forms of illicit trade in tobacco could actually be run by individuals (Caneppele et al., 2013). 
Similarly, Antonopoulos & Hall concluded that the illicit tobacco trade in the UK did not appear to 
be dominated by stable, hierarchal OCGs, but instead stated that the trade is ‘a very organic  and 
fragmented business, which does not require a great degree of sophistication and management 
of  finance  and  resources’  (Antonopoulos  &  Hall,  2016).  This  observation  was  seconded  by  an 
expert  interviewee  in  this  study,  who  noted  that  large  groups  with  formal  structures  were 
extremely rare169. 

Despite the lack of evidence for the presence of highly organised, hierarchical OCGs involved in 
the illicit tobacco market and the fragmented and decentralised nature of this market, individual 
criminals and groups of criminals tend to operate in networks. Typically when the nature of OCG 
involvement  in  this  market  is  discussed,  these  groups  are  characterised  as  flexible,  loosely 
structured informal networks of criminals involved in production, transport, import, wholesale and 
retail, where membership is undefined, collaboration is based on mutual benefit of individuals and 
is  sometimes  without  specific  objectives  (Antonopoulos  &  Hall,  2016;  CSD,  2015;  Ellis,  2017; 
Interpol Office of Legal Affairs, 2014; KPMG, 2017; Transcrime, 2015a). These networks generally 
extend  beyond  national  borders,  including  both  internal  and  external  EU  borders  (Chionis  & 
Chalkia,  2016).  Often  the  groups  involved  in  the  illicit  trade  of  tobacco  are  small  OCGs  or 
opportunistic, independent criminal entrepreneurs who co-exist and collaborate, often on an ad-
hoc basis, to maximise their mutual profits (Antonopoulos & Hall, 2016; Interpol Office of Legal 
Affairs, 2014; Savona & Riccardi, 2015). There do not appear to be major barriers to entry; hence 
illicit trade with tobacco products is open to a variety of different actors. These actors operate 
using  different  models,  rely  on  various  sources  of  financing  and  represent  a  wide  variety  of 
nationalities and age groups (Di Nicola & Terenghi, 2016; L'Hoiry, 2012). Business relations rely 
on trust and social or acquaintanceship ties (L'Hoiry, 2012). Gounev & Bezlov (2010) distinguished 
three types of networks that are typically found in the illicit tobacco supply chain in the EU:  

•  Large criminal networks, which usually include a dozen trading companies that take 
advantage of the suspension of taxation in the transfer of goods through duty-free 
zones and ports. Goods get ‘lost’ in the many transits they pass through and are then 
smuggled and distributed by the criminal network involving wholesalers and retailers. 

•  Counterfeiting networks, which illegally produce tobacco on EU territory.  

•  Networks of warehouse owners, where bootleggers can store their illicit products. 

In  addition,  Gounev  &  Bezlov  (2010)  reported  that  wholesale  brokers  between  sellers  and 
wholesalers play an important role by securing transit of goods (including for example through 
payment  of  bribes).  The  operations  of  these  middle-men  are  the  most  hidden  from  law 
enforcement, according to a Swedish study (Skinnari & Korsell, 2016). Transcrime developed a 
similar  characterisation  with  three  groupings  of  criminal  actors  involved  in  the  illicit  trade  of 
tobacco:  1)  large-scale,  transnational  criminal  networks;  2)  medium-scale  traffickers;  and  3) 
small-scale, independent smugglers (Savona & Riccardi, 2015; Transcrime, 2019). The networks 
involved in illicit  tobacco trade  typically involve the first,  but may  involve medium-  and small-
scale actors for smuggling and/or distribution as an integral part of their network. Reflecting on 
such  categorisations,  one  interviewee  offered  a  qualification  that  large  international  networks 

167 Interview with EU-level representative, 30 March 2020 (#29). 
168 Interview with academic expert, 19 February 2020 (#7). 
169 Interview with academic expert, 19 February 2020 (#7). 

152 

 
 
 
EUROPEAN COMMISSION 

rarely conform to a ‘traditional’ mafia-style conceptualisation of OCGs, but are instead much more 
likely to involve legitimate businesses in their criminal activities170. Similarly, the Center for the 
Study of Democracy (CSD) found that large operations are usually funded by legal businessmen 
with  links  to  legal  tobacco  manufacturers,  transport  businesses  and  import/export  company 
owners. These  criminal ties  were often based on  ethnic,  business, familial, neighbourhood  or 
prison links (CSD, 2015). These themes were also discussed by Transcrime, who found that half 
of all actors involved in the illicit trade in tobacco products are Eastern European, predominantly 
from  Romania,  Lithuania  and  Poland  (Savona  &  Riccardi,  2015).  These  countries  are 
geographically  located  at  the  external  borders  of  the  EU.  About  one-quarter  were  non-EU 
European actors, such as Ukrainians, Moldovans and Belarusians. One interviewee also noted the 
involvement of  Polish groups in  illegal manufacturing schemes, including those  not necessarily 
located on Polish territory171. 

The second biggest group of actors from the EU involved in the illicit tobacco trade were found to 
be from Southern EU Member States, mainly Greece, Italy and Spain. Transcrime’s data showed 
that  the  latter  group  were  relatively  more  involved  in  large-scale  trade  operations  (closely 
following actors from Eastern European Member States as the most prevalent group), whereas 
the  small-  and  medium-scale  trade  was  dominated  by  actors  from  Eastern  European  Member 
States  and  non-EU  Europeans.  These  data  were  based  on  information  from  seizures  by  law 
enforcement,  through  which  it  cannot  be  determined  whether  the  individuals  involved  were 
individual  smugglers  or  members  of  OCGs  (Savona  &  Riccardi,  2015).  Rather,  seizures  were 
reported as cases and do not describe the  number of people involved  or their nationality172.  A 
more recent Transcrime report found that the OCGs involved in large-scale cigarette smuggling 
are mainly active in Russia, Ukraine and Belarus (Transcrime, 2019). In addition, the report notes 
that OCGs were widely present in Albania, Bulgaria, Romania, Kosovo, North Macedonia, Greece 
and Turkey, harnessing their multi-ethnic makeup to operate on an international level. 

It is not surprising that most of these countries are geographically located at the Eastern border 
of the EU, as Europol and EUIPO reported that illicit cigarettes are mainly produced in Ukraine, 
Belarus, Moldova and  Russia (EUIPO & Europol, 2019; Gounev & Bezlov, 2010). Counterfeited 
cigarettes on the other hand mainly originate from China and, to a lesser degree, Vietnam. There 
are established links between criminal networks supplying the European illicit tobacco market and 
China and countries that were formerly republics of the Soviet Union (Gounev & Bezlov, 2010). 
At the same time, one interviewed expert cautioned against concluding that any particular national 
groups specialise in smuggling, and observed that a large number of European nationalities were 
involved in smuggling activities. 

Poly-criminality by groups involved in illicit trade in tobacco has been noted by a number 
of sources. According  to Europol and  the EU  Intellectual Property Office,  OCGs trading in illicit 
tobacco  are  sometimes  also  involved  in  migrant  smuggling,  drug  trafficking,  forgery  of 
documents,  tax  offences  and  money-laundering  (EUIPO  &  Europol,  2019)173.  Additional 
complementary criminal activities mentioned by other sources include fuel laundering, trafficking 
of  people,  alcohol,  weapons,  diamonds,  timber  and  antiquities,  counterfeit  luxury  clothes, 
counterfeit medical products, and stolen goods – such as cars – and establishing illegal gambling 
dens (Allen, 2012; Chionis & Chalkia, 2016; CSD, 2015; Di Nicola & Terenghi, 2016; Ellis, 2017; 
FATF, 2012; OECD, 2008; Savona & Riccardi, 2015; Transcrime, 2019).  

OCGs use established smuggling routes to trade different illicit goods (Ellis, 2017). When 
the  opportunity  arises,  tobacco  smugglers  may  decide  to  engage  in  the  trade  of  other  illicit 
products, as well as the other way around when traffickers of, say, narcotics decide to use their 
trade  routes  to  smuggle  illicit  tobacco.  According  to  Interpol,  smugglers  often  do  not  limit 
themselves to the trafficking of a single illegal commodity (Interpol Office of Legal Affairs, 2014). 
CSD also found that tobacco smugglers rarely switch to other commodities altogether, but rather 
invest in other criminal activities (CSD, 2015). Illicit tobacco has sometimes been used by aspiring 
smugglers  as  a  low-risk  entry  product  to  fund  other,  riskier  illicit  activities  that  require  bigger 
financial investments (Ellis, 2017; Interpol Office of Legal Affairs, 2014). Transcrime found that 
the three main trafficking routes that tobacco smugglers use to traffic illicit tobacco into Europe 
are all known to be used for other illegal products as well, including the trafficking of drugs and 
human beings (Transcrime, 2019).  

170 Interview with academic expert, 11 February 2020 (#13). 
171 Interview with EU-level representative, 18 March 2020 (#28). 
172 Interview with academic market expert, 11 February 2020 (#13). 
173 Interview with EU-level representative, 18 March 2020 (#28). 

153 

 
 
EUROPEAN COMMISSION 

Several authors have linked revenues from  illicit tobacco to  funding  terrorist  organisations 
(ASH Scotland, 2016; EUIPO & Europol, 2019; European Commission, 2016a; Melzer & Martin, 
2016; National Research Council, 2015; Savona & Riccardi, 2015; Tracit, 2019). For this reason, 
Europol  regards  illicit  tobacco  smuggling  and  other  excise  fraud  as  an  enabler  and  source  of 
revenue  from  other crime  (Europol, 2020d). However, it is often  unclear to  what  extent these 
groups are directly involved in the tobacco smuggling and how important this revenue stream is 
to fund their operations. 

Several other actors can be involved in the illicit trade of tobacco products. For example, tobacco 
trafficking  commonly  involves  legitimate  international  transport  and  import/export  companies, 
whose involvement is crucial in handling the sheer volume of smuggled goods174. Other legitimate 
businesses that may be involved, knowingly or unknowingly, could be the suppliers of materials 
needed to produce tobacco, such as filters175. In addition to these actors, a number of publications 
in the peer-reviewed literature argued that legitimate tobacco manufacturers may also be directly 
and  indirectly  involved  in  the  illicit  tobacco  market  (ASH  Scotland,  2016;  CSD,  2015;  Maftei, 
2012; National Research Council, 2015; Tracit, 2019; US National Cancer Institute & WHO, 2016; 
WHO, 2015; WHO FCTC, 2014). Based on large quantities of internal tobacco industry documents, 
WHO  concluded  that  tobacco  manufacturers  have  used  illicit  trade  to  promote  their  brands, 
increase their market shares, open closed markets and prevent governments from increasing duty 
fees  and  taxes  on  tobacco,  and  introducing  standardised/plain  packaging  (WHO,  2015;  WHO 
FCTC, 2014). In a 2000 civil action, the Commission accused Philip Morris International (PMI), RJ 
Reynolds  and  Japan  Tobacco  International  (JTI)  of  an  ‘ongoing  global  scheme  to  smuggle 
cigarettes,  launder  the  proceeds  of  narcotics  trafficking,  obstruct  government  oversight  of  the 
tobacco industry, fix prices, bribe foreign public officials, and conduct illegal trade with terrorist 
groups  and  state  sponsors  of  terrorism’  (US  District  Court,  2000).  Two  cases  have  since  been 
settled by paying large fines. 

In  its  2016  annual  illicit  tobacco  trade  report  (then  called  Project  SUN),  KPMG  concluded  that 
OCGs were found to be using increasingly diverse trade routes and modus operandi (KPMG, 
2017).  Ellis  distinguishes  three  ways  in  which  OCGs  are  involved  in  illicit  tobacco  trade  (Ellis, 
2017): 

• 

• 

smuggling legitimate products within the EU; 

smuggling unlicensed or counterfeit products into the EU; and 

•  manufacturing unlicensed or counterfeit products within the EU. 

Due  to  tax  differences,  smuggling  legitimate  products  within  the  EU  (i.e.  tax  evasion)  can  be 
lucrative.  This  can  have  several  manifestations.  For  example,  operators  of  established 
manufacturers may use their surplus tobacco-manufacturing capacity to create additional genuine 
but  unregistered  products,  which  can  then  be  smuggled  to  other  markets  (OECD,  2008).  CSD 
found three additional ways of smuggling legitimate products within the EU (CSD, 2015). Firstly, 
by stealing shipments of legitimate products, e.g. from supermarkets, kiosks or other retail outlets 
(CSD, 2015). Secondly, legally produced tobacco products can also be resold online, typically in 
a different market where excises are higher to maximise profits. And thirdly, although this may 
apply less to OCGs, individuals or small groups of entrepreneurs may purchase small quantities 
of tobacco products (sometime exceeding customs regulations) abroad (e.g. on holiday), where 
tobacco  prices  are  lower,  and  then  resell  these  products  on  the  black  market  of  their  home 
country. Existing data suggest that cross-border importation within the EU is relatively common. 
While not necessarily indicative of the extent of illicit trade – as a large share of importation may 
be for personal consumption – a flash Eurobarometer in 2008 found that one-third of EU citizens 
who travelled to another EU country returned with cheap cigarettes (Eurobarometer, 2009). 

Trafficking  tobacco  from  outside  the  EU  usually  involves  the  shipment  of  containers 
through legitimate distribution systems (L'Hoiry, 2012). Criminals can either set up a new 
legitimate  import/export  company  or  use  existing  international  transport  companies  that  are 
willing to occasionally  ship illegal tobacco  or  ‘look the  other way’  (Chionis & Chalkia, 2016)176. 
Therefore, legitimate businesses are, wittingly or unwittingly, usually involved in this type of illicit 
tobacco  trade  (CSD,  2015)177.  Containers  are  predominantly  shipped  via  land  and  maritime 

174 Interview with EU-level representative, 18 March 2020 (#28). 
175 Interview  with  academic  expert,  19  February  2020  (#7);  Interview  with  academic  expert,  11  February 
2020 (#13). 
176 Interview with Member State-level representative, 21 April 2020, (#92). 
177 Interview with EU-level representative, 23 March 2020, (#27). 

154 

 
 
EUROPEAN COMMISSION 

routes.  Complex  and  frequently  changing  transit  routes  with  falsely  declared  destinations  and 
fake  companies  are  used  to  make  it  complicated  for  the  authorities  to  keep  track  of  the 
products178. Special economic zones and particularly FTZs are often involved to avoid stringent 
regulatory checks (Holden, 2017)179. Typically, some containers will be loaded with genuine excise 
goods under temporary suspension schemes imported from outside the EU, and documentation 
is switched during transit for containers with illicit products (Europol, 2017; WCO, 2015). When 
large volumes of illicit tobacco are smuggled, criminals use a wide variety of tactics to conceal 
their  criminal  activities,  including  activities  such  as  using  cover  loads  or  drones  (EUIPO  & 
Europol, 2019; OECD, 2008; WCO, 2015), yachts (Melzer & Martin, 2016) and courier and airmail 
parcel  services  or  the  internet  (OECD,  2008);  and  establishing  registered  import  and  export 
businesses  (Borkowski &  Twomey, 2019;  Ellis, 2017)  with frequent use  of straw ownership180. 
Furthermore,  OCGs  have  engaged  in  bribing  customs  officials,  hacking  transit  systems  and 
undervaluing  goods  (Transcrime,  2019).  One  interviewee  explained  that  OCGs  involved  in  the 
manufacture  of  illicit  tobacco  are  rarely  involved  in  the  distribution  or  selling  of  the  goods,  to 
avoid  the  risk  of  being  caught  and  limit  who  knows  what181.  Rather,  several  different  groups 
– including legitimate businesses – work together in a coordinated way, each taking care of one 
part of the supply chain.  

Harder to detect is small-scale smuggling of smaller quantities by a large number of participants. 
This is an increasingly organised activity known as ‘ant-smuggling’, which allows OCGs to spread 
the  risks  of  seizures  over a  larger  number  of  consignments  (KPMG,  2019;  US  National  Cancer 
Institute & WHO, 2016). KPMG found that the number of seizures of shipments by  truck,  van, 
train and ships declined, whilst personal and car seizures increased in number and volume (KPMG, 
2019). Domestic illegal production appears to be on the rise in the EU, which reduces transport 
costs for the criminals and helps them avoid the heavy border controls at the EU’s external border. 
Risks associated with importing raw materials are significantly lower than the final product. Ellis 
found that OCGs acquire raw materials both within Europe (mainly in Italy, Greece, Spain, Poland 
and  Bulgaria)  and  outside  Europe  due  to  lower  prices,  accessibility  and  sometimes  for  quality 
considerations (Ellis, 2017). Machinery is widely available and is acquired either within Europe or 
Asia (FATF, 2012; Gounev & Bezlov, 2010). According to KPMG,  OCGs are increasingly focused 
on  local  manufacture  rather  than  importing  illicit  tobacco  from  outside  the  EU  (KPMG,  2019). 
Moreover,  to  avoid  detection  and  seizure  of  the  entire  operations,  the  different  stages  of 
manufacturing  (drying  tobacco,  cutting,  manufacturing  the  end  product,  and  packaging)  are 
increasingly  conducted  in  different  geographical  locations.  The  Organisation  for  Economic  Co-
operation and Development (OECD) found in 2008 that domestic illegal production was mainly 
located  in  Germany,  Poland,  the  Netherlands,  the  Czech  Republic  and  Greece  (OECD,  2008). 
According to one interviewee, illicit manufacturers operate in a cell-like manner, using production 
lines  of  limited  size.  Security  approaches  employed  by  illicit  manufacturers  include  limiting 
knowledge about production plants to a narrow group of people, as well as technical features such 
as CCTVs, mobile phone jammers and soundproofing182. 

2.7.6. Future trends and dynamics  

Table 2.61: Illicit tobacco – Future trends 

Future trends and dynamics 

Ongoing trends that may affect the future include a move 
towards smaller shipment sizes and an increase in illicit 
domestic manufacturing. Products other than cigarettes are 
also expected to increase their market share. 

Impact on market and criminal 
finances  

A move towards other tobacco products would diversify the 
market/consumption patterns. 

We identified 10 studies in the literature review that included information on the future trends 
and dynamics in the illicit tobacco market in the EU.  

•  According to Borkowski & Twomey, the prevalence of illicit cigarette smuggling in the EU 

has remained broadly stable since 2005 (Borkowski & Twomey, 2019). What has 

178 Interview with EU-level representative, 18 March 2020, (#28). 
179 Interview with EU-level representative, 23 March 2020, (#27). 
180 Interview with EU-level representative, 18 March 2020, (#28). 
181 Interview with EU-level representative, 18 March 2020, (#28). 
182 Interview with EU-level representative, 18 March 2020,(#28). 

155 

 
 
 
EUROPEAN COMMISSION 

changed are the size of shipments and the preferred modus operandi of criminals 
engaged in the illicit tobacco trade.  

•  Smuggling of legitimate products in large quantities seems to have decreased; ‘cheap 
whites’ started dominating large-scale seizures; and the presence of illicit tobacco 
factories with large production capacities operating on EU territory has increased183. It is 
possible the future will see a continuation of these trends.  

• 

• 

Products other than cigarettes are also expected to increase their market share, with 
possible implications for the illicit trade184.  

Further deepening of cross-border trade and diversified shipments (e.g. e-commerce 
parcels) may make controls more difficult and could strain resources185.  

2.7.7. Recommendations 

Based on the findings above, there appear to be three principal gaps in current data that hamper 
efforts to produce national and EU-wide estimates of the illicit tobacco market:  

• 

First, currently, the only available EU-wide data on the extent of illicit consumption of 
tobacco products are produced in a manner that is not free of conflicts of interest due to 
reliance on funding from tobacco manufacturers, and use methods that precludes the 
verification and replication of its results. This makes the key input data impossible to 
scrutinise, and by extension, problematic to use. The Commission is currently in the 
process of exploring possibilities to conduct independent market estimates that 
would potentially draw on a combination of methods and make use of newly available 
T&T data186, which would go a long way towards plugging this first gap. 

•  Second, there is little systematic data on the price of illicit products at various stages of 

the illicit supply chain. As a result, it is impossible to develop a good understanding of 
how the proceeds for the illicit trade accrue to various types of participants, including 
OCGs. It also necessitates the use of broad assumptions, the appropriateness of which 
is currently impossible to assess. Sparse and limited individual data points on this topic 
can be found in existing literature; however, these are wholly insufficient to capture the 
variety of contexts in which illicit tobacco products are sold, nor the variety of factors 
that influence the price of illicit products. 

• 

Lastly, while several studies have been conducted on illicit trade of cigarettes, much less 
is known about illicit trade in other tobacco products. Some existing studies, for instance 
those based on a tax gap methodology, include other tobacco products in their scope 
due to their inability to distinguish individual tobacco products, but very little research 
and data collection has been dedicated specifically to illicit trade in tobacco products 
other than cigarettes. This is perhaps understandable as cigarettes represent the lion’s 
share of tobacco consumption and will continue to do so for some time. However, the 
share of other tobacco products (as well as other smoking products not containing 
tobacco) is projected to grow in the future, and data collection and research efforts 
should reflect this trend. 

The key findings from this study and the related recommendations are summarised in the table 
below.  

Table 2.62: Recommendations – Illicit tobacco market 

Key finding 

Recommendation 

Actor 

The basis for estimates of the illicit 
tobacco market is industry-
sponsored discarded pack surveys, 
combined with data on the legal 
sale and prices of tobacco from the 
European Commission.   

However, the estimates rely upon 
assumptions about the illicit-to-licit 

OLAF should continue to explore 
possibilities for generating 
independent market estimates that 
would potentially draw on a 
combination of methods and make 
use of newly available T&T data. 
These estimates should attempt to 

Member States 

OLAF 

European Commission  

183 Interview with EU-level representative, 18 March 2020 (#28); Interview with EU-level representative, 30 
March 2020 (#29); Interview with Member State-level representative, 21 April 2020 (#92). 
184 Interview with EU-level representative, 18 March 2020 (#28). 
185 Interview with EU-level representative, 23 March 2020 (#27). 
186 For more information, see: https://ec.europa.eu/health/tobacco/tracking_tracing_system_en  

156 

 
 
EUROPEAN COMMISSION 

Key finding 

Recommendation 

Actor 

price ratio, for which there is 
currently limited evidence 
available.  

There is currently no high-quality 
large-scale data on the extent of 
the illicit consumption of tobacco 
products other than cigarettes, 
precluding the construction of a 
robust estimate for additional 
tobacco products. 

cover a range of tobacco products 
and not be limited to cigarettes.  

Member States should 
systematically report information 
on the price of illegal tobacco and 
its determinants – which is 
currently collected by police and 
judicial authorities in the course of 
their investigations – to OLAF.  

2.8.  Cybercrime activities 

Fook Nederveen and Erik Silfversten, RAND Europe 

Key findings: 

• 

• 

The absence of commonly agreed definitions and taxonomies of cybercrime hinder the 
identification, reporting and monitoring of cybercrime trends, and make it difficult to 
understand the true scope of the phenomenon. 

There are severe challenges associated with estimating the revenues from the 
cybercrime market. No prior estimates of the total revenue of the EU cybercrime 
market were identified by this study.  

•  Reliable EU-wide data on card payment fraud is collected by the European Central 

Bank, which includes both online and offline fraudulent activity. The data shows that 
card payment fraud amounts to at least €1.8 billion. Card-not-present fraud, which is 
more likely to be conducted by online or virtual means, accounts for 73% of this 
revenue, and this share is growing.  

•  Groups of cybercriminals operate in varying structures, depending on the crime they 

are committing. Cybercriminals increasingly specialise, commercialise and collaborate 
in their operations, creating a more complex cybercrime supply chain. However, 
organisation may not equal organised crime. The level of OCG involvement is very 
difficult to establish in this market. 

• 

Future trends may include more offerings, more diverse products and services, 
increased specialisation and more integrated/comprehensive packages of cybercrime-
as-a-service.  

This Annex provides a comprehensive overview of cybercrime activities in the EU, building upon 
the summary provided in Section 2.8 of the main report.   

There is no clearly articulated, globally accepted definition of cybercrime and many different 
definitions  have  been  put  forward  by  practitioners  and  researchers.  According  to  Europol, 
cybercrime  can  be  perceived  as  criminal  acts  that  are  committed  online  by  using  electronic 
communications networks and information systems (European Commission, 2019a). Additionally, 
cybercrime is often divided into two overarching categories: 

• 

• 

cyber-enabled crime, which refers to existing crimes that have been transformed in 
scale or form using the internet (e.g. online fraud, online trade in counterfeits, etc.); 
and 

cyber-dependent crime, which uses a digital system as both target and means of an 
attack (e.g. malware, ransomware, distributed denial of service (DDoS) attacks, etc.).  

The concept of cybercrime encompasses a vast range of crimes, and cybercrime taxonomies are 
as  plentiful  and  contested  as  the  definition  of  cybercrime.  The  absence  of  commonly  agreed 
definitions  and  taxonomies  hinders  the  identification,  reporting  and  monitoring  of  cybercrime 
trends, and makes it difficult to understand the true scope of the phenomenon.  

Within  the  context  of  this  study,  the  analysis  of  the  illicit  cybercrime  market  included  two 
components:  

157 

 
 
EUROPEAN COMMISSION 

• 

card fraud (card present and card not-present (CNP))187; and 

•  Cybercrime-as-a-Service (CaaS). 

The  study  did  not  include  an  examination  of  child  exploitation  materials  and  child  abuse 
perpetrated  online,  as  the  available  evidence  suggests  that  there  is  little  OCG  involvement  in 
these crimes188. Moreover, the online sale of illegal goods like drugs, firearms and tobacco will 
also be excluded, as they are already covered in the other markets examined as part of this study 
(and it is important to avoid double-counting). 

Card fraud refers to a broad set of activities, including:  

• 

• 

• 

• 

counterfeit, lost and stolen, and mail-not-received fraud (intercepted cards); 

identity (ID) fraud (theft of card credentials and account takeover); 

false ATM fraud; 

phishing, pharming, hacking and carding189;  

•  3D-Secure fraud; 

• 

• 

device manipulation, including point-of-service (POS) terminal and ATM breaches, 
manipulation of consumer’s Personal Computers (PCs) and mobile phones; and 

data breaches into processing or card data-storage infrastructure (Nets, 2019). 

Within the context of this study, attention has been placed on card-not-present fraud, which is 
more likely to be conducted by online or virtual means. 

CaaS refers to tools, resources or services to conduct or engage in cybercrime being offered for 
sale, either through direct contacts between sellers and buyers or through organised marketplaces 
(often found on the dark net). CaaS is not a homogenous concept and can refer to the trade in a 
wide variety of cyber-related product and service offerings, hacking tools, hacking services, and 
supporting  enablers  such  as  bullet-proof  hosting  services.  Table  2.63  features  an  overview  of 
common  CaaS  products  and  services  offered  in  CaaS  marketplaces.  Within  the  context  of  this 
study,  the  variety  of  offerings  makes  it  challenging  to  analyse  market  dynamics  and  sizes,  as 
different research studies utilise varying definitions of CaaS and include different products and 
services in their analysis. 

Table 2.63: Overview of common CaaS products and services 

Category 

Definition 

Examples 

Initial Access Tools 

Enable a user to perform arbitrary 
operations on a machine in order to 
then deliver Payloads; can automate 
the exploitation of client-side 
vulnerabilities.  

Exploit kit (hosted or as-a-service) 

Zero-day vulnerabilities (and 
weaponised exploits) 

Payload Parts and 
Features 

Goods and/or services that create, 
package, or enhance Payloads to 
gain a foothold into a system. 

Payloads 

Imparts malicious behaviour, to 
include destruction, denial, 
degradation, deception, disruption, 
or data exfiltration. 

Packers 

Crypters 

Binders 

Obfuscation/evasion 

Botnet for sale 

Enabling Services 

Assists a user in finding targets or 
driving targets to a desired 
destination in order to use an Initial 

SEO Services 

Spam services 

187  Card  present  fraud  has  been  included  in  the  cybercrime  market,  rather  than  under  a  separate  fraud 
category, as the studies estimating its scope and magnitude are typically conducted in parallel with CNP fraud 
(such as by the ECB). 
188 The aspect of this market that has the most involvement from organised crime is live-streaming. However, 
the organised crime groups are situated in non-EU countries, primarily in Asia.   
189 Carding is a form of credit card fraud where a stolen credit card is used to charge prepaid cards.

158 

 
 
 
 
 
 
EUROPEAN COMMISSION 

Category 

Definition 

Examples 

Access Tool and/or Payload; Attack 
vectors and scaling methods. 

Pay-per-install and affiliates 

Phishing and spear-phishing services 

Services to drive/find traffic 

Fake website design and development 

Full Services (as-a-
service) 

Package of Initial Access Tools, 
Payloads, and Payload Parts and 
Features to conduct attacks on a 
customer’s behalf; can provide the 
full attack lifecycle. 

Hackers for hire 

Botnets for rent 

Doxing 

DDoS as a service 

Enabling and 
Operations Support 
Products 

Ensure that Initial Access Tools and 
Hacking Services (Enabling or Full 
Service) will work as needed, are set 
up correctly, and can overcome 
‘speedbumps’ or obstacles. 

Infrastructure (e.g. leasing services, 
virtual private network (VPN) services, 
bulletproof hosting, compromised sites 
and hosts) 

Cryptanalytic services (e.g. password 
cracking, password hash cracking) 

CAPTCHA breaking 

Source: Adapted from Ablon et al. (2014). 

2.8.1. Previous revenue estimates of the EU cybercrime market  

The literature search identified no studies that contained prior estimates of the revenue from the 
cybercrime market in the EU. However, three publications were identified that explicitly included 
an estimate of total revenues generated through card fraud and/or CaaS.  

The  European  Central  Bank’s  (ECB)  estimates  of  card  fraud  in  Single  Euro  Payments  Area 
countries  are  based  on  the  data  countries  collect  through  their  oversight  framework  on  card 
payments schemes (CPSs)  (ECB, 2018). These  CPSs must  report on volumes and  revenues  of 
transactions and fraudulent transactions. The report summarizes data collected from 22 CPSs – 
including schemes such as Visa Europe and MasterCard Europe – and the disaggregation of the 
reporting and the use of common definitions allows the ECB to calculate total numbers. The ECB 
card fraud data are useful in establishing general trends in prior years, but less so in capturing 
dynamic changes, as the data are outdated by the time they are published190. 

Though  not  focusing  on  the  EU,  McGuire  (2018)  estimated  the  global  revenues  of  all 
cybercrime191 by estimating and then adding up five of the most lucrative categories of revenue-
generating activities, namely:   

• 

• 

• 

• 

• 

illicit, illegal online markets;  

trade secrets and IP theft;  

data trading;  

crimeware and Cybercrime-as-a-Service (CaaS); and  

ransomware (McGuire, 2018).  

To calculate the estimates of these separate categories, McGuire used recent estimates (on sub-
categories) produced by other researchers. The resulting overall estimate is limited to a number 
of  activities  and  the  revenues  are  often  invisible;  the  author  suggests  the  study’s  findings 
represent  ‘a  highly  conservative  estimate  –  the  real  figure  is  likely  to  be  significantly  higher’ 
(McGuire,  2018,  p.  45).  Moreover,  lower  point  estimates  in  revenue  ranges  were  selected  to 
compensate for the costs associated with the criminal activities, which the author acknowledged 
‘is a somewhat arbitrary approach, but since other attempts to estimate the costs of engaging in 
cybercrime have not been convincing…, it is probably as good as any other’ (McGuire, 2018). 

Often, publications that present market revenue estimates are not clear or transparent about the 
sources of their estimates192. In general, the estimates produced are inconsistent and are often 

190 Feedback provided by expert advisor to the study.  
191 Note  that  McGuire’s  definition  of  cybercrime  is  much  wider  than  the  scope  of  this  case  study  (which  is 
limited to card fraud and Caas.
192 For example, a report by UK Finance (2019, p.4), which  merely states ‘criminals successfully stole £1.2 
billion through fraud and scams in 2018’ (UK Finance, 2019).

159 

 
 
 
 
 
EUROPEAN COMMISSION 

produced by stakeholders with a vested (commercial) interest in the outcomes (Anderson et al., 
2013; Moore et al., 2009). Estimates usually include a selection of a wide variety of activities and 
services,  use  different  data(sets)  and  different  methodologies  of  varying  quality,  and  have 
different levels of transparency about their approach.   

Existing  estimates  commonly  have  a  global  or  national-level  focus.  An  estimate  specifically 
focused on the EU was not found in the literature. Some studies estimate the size of sub-sections 
of markets, e.g. estimating profits and losses in underground markets.  One example of such a 
study is a UK Home Office study from 2018 that estimated earnings of buyers of stolen financial 
data from samples of transactions from the open web and dark web, using a sample of 18 forums 
and 15 shops hosted on the clear and dark web (HOSAC, 2018).  

However, all these estimates have significant caveats and should be approached with caution as 
to  their  accuracy  and  validity.  It  is  noteworthy  that  the UK  Home  Office  Costs  of  Cyber  Crime 
Working  Group  concluded  that  ‘no  estimate  of  the  overall  cost  of  cybercrime,  that  could  be 
interpreted  with  a  high  level  of  confidence,  was  identified  in  the  literature’  (HOSAC,  2018). 
Measurements of the costs (rather than focusing on revenues) of cybercrime are faced with the 
same challenges and are equally controversial (Lewis, 2018). In fact, the estimates found in the 
literature are predominantly focused on costs (which are likely to be an order of magnitude higher 
than  the  revenues  generated  by  cybercrime).  For  example,  Detica  &  Cabinet  Office  (2011) 
developed a causal model to map the impact of cybercrime on the UK economy, which produced 
an estimate that was widely  questioned for  its reliability and accuracy  (Anderson et al., 2013; 
HOSAC, 2018). To provide an overview of the evidence on actual costs, what can reasonably be 
estimated and which figures can be gauged only based on assumptions, Anderson et al. (2013) 
produced  a  set  of  highly  caveated  estimates  for  a  number  of  separate  lucrative  cybercrime 
activities  (Anderson et al., 2013). In a follow-up article in 2019, Anderson et al. explained how 
others had added the separate costs categories and presented it as a total for global cybercrime, 
ignoring the authors’ warning that this would be ‘entirely misleading’ without the provided context 
and the authors’ caveats and cautions (Anderson et al., 2019). 

2.8.2. Quality of prior estimates 

There  are  severe  challenges  associated  with  estimating  the  economic  revenue  from  the 
cybercrime  market  and  the  total  annual  revenue  generated  by  OCGs.  First,  research  into  the 
economics of cybercrime focuses almost exclusively on the costs of cybercrime  rather than the 
value or revenues generated by cybercriminals. Second, the field of cybercrime research suffers 
from an overall lack of reliable data and data sources – particularly authoritative and longitudinal 
studies.  Much  cybercrime  activity,  especially  in  relation  to  CaaS,  takes  place  in  online 
marketplaces (both on the open internet and the dark web) that are challenging to identify, access 
and collect data for. These types of marketplaces are also highly dynamic and fluid, with markets 
regularly  being  closed,  taken  down  by  law  enforcement,  or  overtaken  by  new  entrants.  A 
significant portion of trade within this market is also done using privacy-enhancing or privacy-
preserving technologies,  which  make  it challenging  or  impossible to access certain information 
(e.g. use of the TOR network, encrypted messaging, VPNs, cryptocurrencies, etc.). 

Lastly, even when research is conducted into the costs or economics of cybercrime, it tends to 
suffer from a range of challenges and limitations, including: 

•  Contested or varying definitions. As previously noted, this research field suffers from 
contested definitions and conceptual confusion of key concepts and factors of analysis. 
This includes the conceptualisation of ‘cybercrime’, which products or services are 
included in analysis of CaaS, or simply the use of different terms for the same concept 
across different studies. It also extends to non-cybercrime specific factors of analysis, 
including defining ‘costs’ or ‘revenue’. Studies have employed different definitions of 
cost, meaning that they ultimately measure conceptually different things, or try to 
measure cost for differing cybercrimes, which ultimately makes meaningful comparative 
analysis challenging. It may also mean that certain costs, revenues or types of 
cybercrime are inaccurately analysed or even not measured at all.  

• 

Inconsistent research approaches and results. A range of methods have been used 
to analyse the cost of cybercrime and the revenue from cybercrime markets, including 
costs in anticipation, costs as a response, and costs as-a-consequence, which also utilise 
different factors of analysis such as annual cost, cost by attack/incident, cost by sector, 
victim losses, etc. More concerningly, even when studies employ similar methodological 
approaches, they have reached significantly varied and inconsistent results. A study by 

160 

 
EUROPEAN COMMISSION 

the UK Home Office highlighted that estimates for the annual cost of cybercrime to the 
UK public sector provided by methodologically similar studies ranges from £1.2 million, 
to £3 billion, to £27 billion – which significantly questions the reliability and accuracy of 
these approaches (HOSAC, 2018). The lack of a common or consistent approach and 
criteria for conducting this type of research has resulted in standalone studies that are 
rarely comparable, and are often only relevant in a particular context. 

•  Methodological weaknesses and over-reliance on survey data. A survey is a 
common method used by studies seeking to estimate the cost or revenue from 
cybercrime, which are often subject to methodological weaknesses such as a lack of 
random probability sampling. There is also a range of challenges in relying on surveys 
as the primary source of evidence in relation to costs or revenue from cybercrime. 
Firstly, surveys typically collect unverified, self-reported data and assumptions. 
Secondly, surveys are often only representative of a fraction of the ecosystem surveyed. 
Cybercrime costs may also be highly concentrated within a population, meaning that 
representative sampling of the population does not result in a representative sampling 
of costs (Florencio & Herley, 2011). Thirdly, surveys results can be skewed by extreme 
responses from a few respondents. For example, Florencio & Herley illustrated how a 
single individual claiming $50,000 in losses in an n=1,000-person survey can result in 
an estimated $10 billion loss over the population; or how one unverified claim of $7,500 
in phishing losses turns into an estimate of $1.5 billion in total losses (Florencio & 
Herley, 2011). Fourthly, exploring rare occurrences or unfamiliar factors in surveys, 
non-response error can result in incorrect data being captured (through dishonesty, 
exaggeration or misunderstandings). And lastly, small-scale surveys or case studies 
may be useful to provide context of the difficulties in estimating cybercrime costs or 
revenue, but they do not enable wider extrapolation of results and should not be 
interpreted as representative of cybercrime overall.  

• 

Insufficient, incorrect or biased data. Surveys are often used in the absence of 
reliable and accessible data, which highlights the challenges associated with the 
insufficient and fragmented nature of data related to costs or revenue from cybercrime. 
There is a vast amount of cybercrime data generated by various organisations, little of 
which is relevant to the costs or revenue from cybercrime. Moreover, data sharing 
protocols are lacking. Overall, available cybercrime-related data also tends to suffer 
from under- and overreporting, intentional or unintentional bias (e.g. response effects 
or sampling bias), or lack of cross-jurisdictional information. In relation to bias or lack of 
independent research, many research reports on the cost or revenue from cybercrime 
are published by cybersecurity companies that may have ulterior motives, such as 
overexaggerating the risks associated with cybercrime to promote a particular product 
or service (MONEYVAL, 2012). 

•  Questionable assumptions. Several studies on the cost or revenue from cybercrime 
develop their estimates based on assumptions that are not clearly explained, not 
documented or of questionable rigour. The lack of clearly documented assumptions 
makes it challenging to validate or assess the robustness of the estimates provided, or 
to reproduce the studies themselves (HOSAC, 2018).  

•  Revenues may be significantly lower than costs. Within the context of this study it 
is also worth emphasising that most research into the revenue from cybercrime focuses 
on costs. Anderson et al. (2019) emphasised that criminal revenue is significantly lower 
than direct losses and much lower than total losses, for example a botnet that ‘earned 
about $3m a year by promoting Viagra was costing about a hundred times that much, 
as it was responsible for about a third of the world’s spam in 2011 – and spam costs the 
industry about $1bn a year’ (Anderson et al., 2019). 

•  The global and border-agnostic nature of cyberspace. The ‘borderless’ nature of 

cybercrime makes it inherently difficult to assess where, geographically speaking, costs, 
revenue and value is generated, transferred or spent. The opaque nature and attribution 
complexity of cybercrime results in a relatively unsophisticated understanding of who is 
engaged in cybercrime activities or illicit markets, where they are based, and how 
money flows across these platforms and networks. While there are geographical 
communities on the internet, for example predominantly Russian or Chinese 
communities, the organisation of users engaged in illicit activities is relatively dynamic, 
fluid and skills-driven compared to ‘offline’ crime and organised crime193. 

193 Interview with cybercrime academic expert, 12 February 2020 (#12).

161 

 
 
 
EUROPEAN COMMISSION 

Table 2.64: Prior studies estimating the size or revenue of the EU cybercrime market in the EU 

Citation 

Year(s) of 
estimate 

Sub-market 

Data source(s) 

Countries included 
in estimate 

Disaggregated at 
Member State level?  

Estimate 
produced 
(size)  

1  ECB 

2016 

(2018) 

Card payment 
fraud (present 
and non-
present) 

2  McGuire 

2018 

1) CaaS  

(2018) 

2) Cybercrime 

ECB’s oversight framework on card 
payments schemes (CPSs). 

Mixed methods approach, consisting 
of interviews with cybercriminals, 
analysis of forum conversation log 
data, expert interviews and a review 
of secondary materials. 

Note: Estimates of the revenue from cybercrime and CaaS are not considered reliable, as discussed above.  

SEPA countries (EU 
28 Member States + 
EFTA countries + 
European 
microstates) 

Most data on SEPA level, 
but some data are 
available in 
disaggregated form  

17.3 million 
cases of card 
fraud using cards 
issued in SEPA 

Global 

No 

N/A 

Estimate 
produced 
(revenue) 

€1.8 billion  

CaaS 
revenues: $1.6 
billion (USD) 

Cybercrime 
revenues: $1.5 
trillion (USD) 

162 

 
 
EUROPEAN COMMISSION 

2.8.3. Methodology for estimating revenues in this study  

For the purposes of this study, we present the estimates from one of these studies – that is, the 
estimated  revenue  of  card  payment  fraud  in  the  EU  as  reported  by  the  European  Central 
Bank (ECB, 2018). As a result of ECB’s role in the oversight of card payment schemes (e.g. Visa 
Europe), the latter have to report volumes and values of (fraudulent) transactions on a country-
level, and using common definition and templates, to the ECB  (ECB, 2018). The ECB uses this 
data  –  together  with  data  shared  by  national  banks  of  the  individual  EU  member  states  on 
domestic payment-card schemes – to draw up the recurring Card Fraud Report. Fraud figures are 
categorised  as  card  present  and  card-not-present  (CNP)  payments.  The  former  includes 
transactions at ATMs and point-of-sale (POS) terminals, and further distinguishes ‘lost and stolen’, 
‘card not received’, ‘counterfeit’ and ‘other’. The latter distinguishes between ‘online’ and ‘mail or 
telephone’ fraud. 

The information published in the ECB’s Card Fraud Report covers almost all card payments made 
with  cards  issued  within  the  Single  Euro  Payments  Area  (SEPA)  and  acquired  worldwide.  This 
means  that  transactions  are  captured  to  the  extent  that  the  payment  service  provider  is 
geographically within SEPA. SEPA includes all EU member states, the UK, the four European Free 
Trade  Association  countries  and  four  microstates  with  monetary  agreements  with  the  EU. 
According to representatives of the ECB, the figures are a representative indication for card fraud 
in SEPA194.  Since the ECB card fraud data are outdated by the time they are published, the data 
are  useful  in  establishing  general  trends  in  prior  years,  but  less  so  in  capturing  dynamic 
changes195. 

A  summary  of  the  approach  used  in  this  study  for  estimating  the  market  revenue  from  card 
payment fraud and the limitations of this approach is outlined in the table below.  

Table 2.65: Summary of approach for estimating revenues from card payment 
fraud 

Summary of approach  Estimate based on data collected by the ECB on card fraud within SEPA 

Rationale 

Output 

(which are used to calculate the total revenue from card fraud and the share 
of card-not-present fraud in the EU and by Member State) 

It builds on a reliable EU-wide dataset, which is absent for any other form of 
cybercrime   

The total revenue from fraudulent transactions conducted (total card fraud 
and the proportion of card-not-present fraud) using cards issued within Single 
Euro Payments Area and acquired worldwide 

Scope and coverage 

Geographical scope: EU-level and Member State level  

Year(s) of estimate: 2016, updated to 2019 values 

Sub-markets: Card present and card-not-present fraud 

Data sources 

The European Central Bank’s Fifth report on card fraud, September 2018 

Limitations and 
caveats of this 
approach 

Only captures reported fraudulent transactions 

Delay in data availability 

Data not very detailed/high-level 

Little is known about perpetrators 

Unclear whether losses equal revenues for criminals 

2.8.4. Revenue estimates of card payment fraud in the EU 

Table 2.66 below presents the estimates of card payment fraud derived by the ECB, as well as 
the share of CNP fraud, at the EU-level and for each of the Member States. The results show that 
CNP fraud makes up 73% of the €1.8 billion total revenue from card fraud in the EU. It is therefore 
the largest category of card fraud.  

The ECB’s 2018 card fraud report noted CNP fraud was the only form of card fraud that had seen 
an increase in absolute and relative terms since the previous report (ECB, 2018). Representatives 

194 Interview with private-sector representatives, 6 May 2020 (#91).
195 Feedback provided by expert advisor to the study.  

163 

 
 
 
EUROPEAN COMMISSION 

at the ECB underlined that overall card fraud levels were stable over the past five years, but that 
the share of CNP is growing and they expected a further relative increase in future iterations  of 
the report196.  

The ECB’s 2018 card fraud report further showed that card present fraud consists for around 
two-thirds of fraud in POS transactions, and one-third at ATMs, but both are constantly reducing 
in  volume  and  proportion  (ECB,  2018).  This  is  considered  by  the  ECB  to  be  the  result  of  the 
implementation  of  several  regulatory  requirements  and  the  adoption  of  fraud  prevention  and 
detection security tools that complicate card-present fraud, including (ECB, 2018): 

• 

revision of the Payment Services Directive (PSD2), and the authorisation and 
registration requirements under this directive (e.g. strong customer authentication); 

•  migration of cards and terminals to EMV (Europay, Mastercard, and Visa – the creators) 

technical standards;  

•  wider usage of geo-blocking; 

• 

• 

• 

physical security measures at terminals; 

deactivation of the usage of the magnetic stripe for cards; 

application of guidelines on the assessment of card payment schemes introduced by the 
Eurosystem; and 

• 

implementation of 3D Secure, risk-based analysis and tokenisation. 

As  card  present  fraud  becomes  more  complicated,  CNP  fraud  is  increasingly  seen  as  easier  to 
commit197.   

The table below also shows that there is quite some difference country by country. The share 
of CNP fraud ranges from 41% of all card fraud in Portugal to 84% in Lithuania. This can partly 
be explained between differences in card usage, such as the number of cards and the number 
and  revenue  from  transactions  per  inhabitant.  Countries  with  a  large  market  for  online 
transactions, such as the UK, France, Spain and Scandinavian countries, tend to face larger CNP 
fraud shares, as there are more attack vectors198. Indeed, in the 2018 Card Fraud Report the ECB 
observed that in countries where card usage was limited, levels of fraud were relatively low. In 
addition, the report noted that in spite of being a very small percentage of all transactions made, 
cross-border transactions (both within and outside SEPA) accounted for almost two-thirds of all 
card fraud in SEPA in 2016.   

Table 2.66: Revenue estimate of card payment fraud in the EU 

EU Member State 

Annual revenue, adjusted for inflation, 
2019 (€ million) 

Proportion 
CNP 

Mid 

Low 

High 

% 

28 EU Member States 

27 EU Member States without UK 

Austria 

Belgium 

Bulgaria 

Croatia 

Cyprus 

Czech Republic 

Denmark 

Estonia 

Finland 

France 

1,816.43 

1,015.81 

21.40 

38.71 

2.99 

1.53 

1.52 

4.26 

56.74 

1.24 

22.26 

442.96 

196 Interview with private-sector representatives, 6 May 2020, (#91). 
197 Interview with private-sector representatives, 6 May 2020, (#91).
198 Interview with private-sector representatives, 6 May 2020, (#91).

73% 

81% 

75% 

61% 

71% 

76% 

66% 

72% 

63% 

62% 

73% 

164 

 
 
 
 
 
 
 
EUROPEAN COMMISSION 

EU Member State 

Annual revenue, adjusted for inflation, 
2019 (€ million) 

Proportion 
CNP 

Mid 

Low 

High 

% 

Germany  

Greece 

Hungary  

Ireland 

Italy  

Latvia 

Lithuania 

Luxembourg 

Malta 

Netherlands 

Poland 

Portugal  

Romania 

Slovakia 

Slovenia 

Spain 

Sweden 

United Kingdom 

149.95 

3.81 

2.78 

46.04 

75.74 

1.44 

0.76 

3.70 

1.47 

32.13 

6.69 

20.92 

3.61 

1.71 

1.25 

63.09 

43.12 

764.62 

66% 

77% 

74% 

82% 

69% 

66% 

84% 

69% 

71% 

74% 

56% 

41% 

67% 

79% 

62% 

66% 

70% 

77% 

Notes: Estimates were produced by the ECB (2018) for 2016 and updated to 2019 values using Eurostat’s HICP (Eurostat, 2020b). 

2.8.5. Criminal actors and modus operandi 

Table 2.67: Cybercrime – Market actors 

Level of OCG involvement 

Size and composition of OCGs 

Modus operandi of OCGs 

Poly-criminality of OCGs 

Cybercriminals increasingly specialise, commercialise and 
collaborate in their operations, creating a more complex 
cybercrime supply chain. However, the level of OCG 
involvement is very difficult to establish. Organisation may 
not equal organised crime. 

Groups of cybercriminals operate in varying structures, 
depending on the crime they are committing. Networks of 
criminals are hierarchical in nature and adopt clear roles 
based on their skillset. Participants may only know each 
other online.  

Cybercrime activities are coordinated through online 
forums. 

Cybercrime services and platforms are utilised by and 
support other forms of criminality, resulting in a platform 
economy for criminality online. 

We identified 15 studies in the literature review that included information on key actors in the 
cybercrime  market  in  the  EU.  These  studies  showed  that  in  comparison  to  conventional 
criminals,  who  are  commonly  young  men  on  the  fringe  of  society  who  suffer  from  multiple 
deprivations or drugs or alcohol abuse, cybercriminals are often educated and capable (Moore et 
al.,  2009).  Their  reason  for  resorting  to  cybercrime  may  be  a  lack  of  job  opportunities  and 
ineffective policing. Cybercrime offers significant financial gains against low risks, as attribution 
and prosecution are very difficult (Blakeborough & Correia, 2019; Levi et al., 2015; McAfee, 2018; 
McGuire,  2018;  Nagy  &  Mezei,  2016;  Nets,  2019).  Moreover,  the  cybercrime  market  is  easily 
accessible, anonymous and fast-paced. Prosecution by law enforcement is further complicated by 
the borderless activities of cybercriminals, who often operate outside their jurisdiction. 

165 

 
 
EUROPEAN COMMISSION 

The  anonymised  and  cryptographic  nature  of  the  cybercrime  market  makes  it  very 
complicated to obtain information about the characteristics of the perpetrators, their organisation 
and their modus operandi. At the same time, some studies have found cybercrime is organised 
as it is becoming more attractive as a lucrative profession for able hackers (Ablon et al., 2014; 
Chon & Broadhurst, 2014; Choo & Smith, 2008; Grabosky, 2007; Huang et al., 2018; McGuire, 
2018; Nets, 2019; Williams, 2001). 

The  Federal  Bureau  of  Investigation  (FBI)  identified  10  specialisations  that  (groups  of) 
individuals adopt in a typical cybercrime: ‘coders or programmers’, ‘distributors or vendors’, 
‘technical experts’, ‘hackers’, ‘fraudsters’, ‘hosters’, ‘cashers’, ‘money mules’, ‘tellers’ and ‘leaders’ 
(Chabinsky, 2010). Ablon et al. (2014) provide a slightly more detailed overview of the hierarchy, 
roles, skills levels and participants operating on the black market (see  

Figure 2.3: Cybercrime) (Ablon et al., 2014). The black market is characterised by easy entry, 
but Ablon et al. also note that reaching the top tiers and involvement in high-level, sophisticated 
crimes requires networking and a good reputation.  

Figure 2.3: Cybercrime  

Source: Ablon et al. (2014). 

Huang et al. (2018) developed a categorisation of six basic types of organisation structures 
typical in the execution of organised cyber-attacks, each of which have their own advantages and 
disadvantages: 

• 

‘a Swarm refers to a group of hackers who work together in viral forms that have a 
minimal, if not non-existent, chain of command; 

•  a Hub refers to the structuring scheme in which there is a core group of hackers around 

which peripheral associates gather; 

•  a Clustered Hybrid structure combines online and offline activity and typically 

operates in a similar way as [a] Hub, focusing on specific activities or methods; 

•  an Extended Hybrid structure is like the Clustered Hybrid structure but incorporates 
many associates and subgroups, while retaining a level of coordination sufficient to 
ensure the success of operations; 

• 

hierarchies refer to [a] structure reminiscent of traditional organisations as well 
as criminal groups but take advantage of online technology to facilitate activities; and 

166 

 
 
 
EUROPEAN COMMISSION 

•  an Aggregate structure refers to a loosely organised group of hackers committed only 

to temporary collaboration and often without a clear goal.’ 

Online  forums  play  an  important  facilitating  role  for  communications  and  networking  for 
collaboration  between  cybercriminals,  as  do  family  ties,  friendships  and  online  relationships 
(Huang et al., 2018). Most hacker forums have hierarchical systems. Top-down, this hierarchy is 
usually characterised by administrators at the top, followed by moderators, reviewers, reviewed 
vendors and general members (in that order). According to Huang et al. (2018) the cybercrime 
ecosystem  can  be  seen  as  ‘a  complete  cyber-threat  capability  supply  chain’,  consisting  of 
vulnerability  discovery,  resistance  operation  (avoiding  detection),  delivery  of  cyber-attacks, 
marketplace  support,  re-purposing  gains  to  enable  further  attacks,  human  resources  and 
technological support. Moreover, this level of organisation has facilitated the emergence of CaaS.  

Despite  the  increasing  complexity  of  cybercriminal  operations  through  the  division  of  labour, 
organised cybercrime seems to lack the structure and hierarchy  of conventional OCGs (Nagy & 
Mezei, 2016). There is also limited evidence that established ‘offline’ OCGs harness IT to support 
and improve their existing criminal practices (Levi et al., 2015). Rather, organised groups involved 
in  cybercrime  are  perceived  as  flexible  networks  of  diverse,  high-skilled  individuals  who  rarely 
meet  outside  of  cyberspace.  The  exploration  of  organised  crime  involvement  in  the 
cybercrime market further presents methodological challenges: 

• 

It is unclear what ‘organised’ crime refers to in the cybercrime context. Beyond 
cybercrime, definitions of organised crime have been widely discussed and contested, 
with current practices subjected to criticism for being of a ‘low standard’ or overly 
inclusive (Leukfeldt, Lavorgna et al., 2017). Within cybercrime, this field of enquiry is 
still emerging and additional information on the actors involved, their characteristics and 
modus operandi is required to enable fruitful analysis and discussion.  

•  Not unlike offline organised crime, organisation may not equal organised 

crime. Previous research has shown that many actors engaged in cybercrime or illicit 
activities online are highly networked, cooperate extensively and learn from or teach 
others as part of their criminal career. However, this type of organisation may not 
constitute organised crime as such, and there are significant indications that cybercrime 
comprises characteristics opposed to traditional notions of OCGs (e.g. fluidity, 
geographic-agnostic cooperation, non-hierarchical structures, etc.) (Hutchings, 2014; 
Wall, 2015). 

•  Convergence between cybercrime and organised crime is assumed, and lacks 
strong empirical evidence. As previously noted, several reports have made links 
between cybercrime and organised crime, often emphasising that this connection is 
increasing or deepening, but these assumptions are rarely backed by significant 
evidence-based research and analysis (Levi et al., 2015; Lavorgna & Sergi, 2016). This 
may be particularly important in relation to allocating resources to counter organised 
crime without accurate research and analysis on how to deal with emerging challenges 
posed by cybercrime.  

•  Lack of attribution and understanding of motivations. Attribution complexity 

makes it difficult, and in some instances near-impossible, to identify what type of actor 
ultimately carried out a cybercrime or illicit activity. There is a range of actors engaged 
in activities that ultimately could be considered cybercrime (e.g. individual hackers, 
‘professional’ cybercriminals, state actors, etc.) and it may be technically complex to 
understand which actor is responsible for which incident. The motivation behind 
cybercrime can equally make it difficult to understand the actors involved in crime or 
illicit activities (e.g. incidents that may seem to be criminal in nature may be conducted 
by a state). Limited empirical research has shown ‘that even if the criminal networks 
considered display the minimum set of characteristics to consider them as OC, if we only 
look at their structure and composition, they mostly fail to meet the existing definitions 
of OC when it comes to the characteristics of criminal activities carried out and social 
functions of these networks’ (Leukfeldt, Lavorgna, et al., 2017). 

A wide range of modus operandi are applied in cybercrime. Conceptually, in a typical operation 
by organised cybercrime, a leader decides on a target and assigns or hires technical experts to 
launch the attack and provide the infrastructure and resources necessary (e.g. dedicated servers, 
VPNs or botnets) (PANDA SECURITY, 2010; Positive Technologies, 2018). The technical experts 
develop malware, bots, spam, fake websites, keyloggers and social engineering strategies that 
will be used to trick victims into sharing their confidential information (such as passwords or bank 
or  credit  card  details).  Typically,  the  communication  to  the  victim  pretends  to  be  from  their 

167 

 
EUROPEAN COMMISSION 

legitimate bank (e.g. their website, telephone number or email). Potential victims are targeted 
through e.g. email, social media and fake websites. Commonly, the stolen data  is then sold to 
other cybercriminals on the black market (typically the same place as where the technical experts 
were hired), as the risk of getting caught is much lower compared to taking money directly out 
of the account. This is one method the original perpetrators use to cover their tracks, which further 
complicates investigations into (all) the people behind cybercrimes. The bank details and copied 
magnetic strips are offered on CaaS platforms (such as dark net marketplaces and forums), which 
can be used to e.g. transfer money directly, shop online or clone cards. Money transfers usually 
involve ‘cashers’ (sometimes also referred to as ‘cashiers’) to help launder the money. Cashers 
transfer money from the account of a victim to the account of a ‘money mule’, who may be tricked 
through fake job adverts into accepting the stolen funds and immediately transferring it to another 
account, taking a commission (which they may have been led to believe is legitimate), but also 
becoming personally liable for the money transfer (Moore et al., 2009; PANDA SECURITY, 2010). 
These transfers often rely on payment services such as Western Union. Other channels used by 
cashers to launder money are online poker games and auctions (Moore et al., 2009), though Levi 
(2009) noted that e-gambling was a difficult format through which to launder significant sums 
rapidly or over time. 

Cybercrime  services  and  platforms  are  utilised  by  and  support  other  forms  of 
criminality, resulting in a platform economy for criminality online (McGuire, 2018). Takedowns 
of  illicit  online  markets  have  shown  that  these  platforms  also  offer  goods  from  other  illegal 
markets, such as illegal drugs, firearms, counterfeited goods, identity and other formal documents 
and toxic chemicals. RAND Europe’s Dark Web Observatory – a database of product listings and 
vendors  collected  by  crawling  and  scraping  a  number  of  prominent  dark  web  marketplaces, 
discussion forums and other websites – shows that most products offered on the dark web are 
predominantly other criminal goods and services rather than CaaS (Table 2.68).  

Table 2.68: Dark net listings by category 

Category  

Listings  

Drugs 

Fraud 

Counterfeits 

Digital Goods 

Guides and Tutorials 

Other 

Services 

Jewellery 

Weapons 

Electronics 

Uncategorised 

375,170 

52,937 

34,001 

33,691 

29,830 

19,660 

8,630 

3,404 

1,938 

711 

43,432 

Source: RAND Corporation, Dark Web Observatory (2020). 

Other types of fraud that cybercriminals are involved in include fake lotteries, unlawful gambling 
operations, stock scams and advance-fee frauds (Moore et al., 2009; Nagy & Mezei, 2016). In 
addition, cybercrime facilitates more traditional forms of criminal activities, such as extortion and 
the distribution of imagery of sexual abuse of children (MONEYVAL, 2012). Cybercrime revenues 
have also been used to finance the operational costs of terrorist groups and their terrorist activities 
(McGuire,  2018;  MONEYVAL,  2012).  Moreover,  digital  applications  have  facilitated  money-
laundering by terrorist groups. 

2.8.6. Future trends and dynamics  

Table 2.69: Cybercrime – Future trends 

Future trends and dynamics 

Future trends may include more offerings, more diverse 
products and services, increased specialisation and more 
integrated/comprehensive packages of Cybercrime-as-a-
Service. 

168 

 
 
EUROPEAN COMMISSION 

Impact on market and criminal 
finances  

The cybercrime supply chain and attribution might become 
even more complex and the threshold of criminal activities 
online would be lowered, as fewer skills are needed to 
participate in the market. 

Eight  studies  identified  in  the  literature  review  included  information  on  the  future  trends  and 
dynamics  of  cybercrime. Together  with the foregoing account  of the cybercrime market, these 
studies showed that it is a fast-moving environment that is becoming increasingly accessible to 
a larger audience, as well as being more attractive and trustworthy. People lacking the technical 
skills to carry out cyber-attacks now have access to cybercrime tools and services through CaaS. 
Simultaneously,  cybercrime  has  become  a  more  viable  career  and  cybercriminals  are  driven 
deeper underground. In spite  of  takedowns of  a number of prominent online illegal markets  – 
such as the Silk Road and Alpha bay – cybercriminal trade has demonstrated its resilience and 
remained  on  a  relatively  stable  level  (Van  Wegberg  et  al.,  2018).  Indeed,  Décary-Hétu  and 
Giommoni (2017) found that police crackdowns on crypto markets were ineffective in enforcing 
drug laws online and lowering the volume of dark web sales, as the supply and consumption were 
only temporarily impacted, before continuing elsewhere. 

Growing internet penetration around the world increases the number of users globally and, 
therefore, the number of potential victims of cybercrime. More often than not, these new users 
have  limited  technical  skills,  making  them  vulnerable  to  cybercrime.  As  societies  are  likely  to 
become  ever  more  digitalised,  cyber-enabled  crime  could  rise  further  in  the  future.  On  top  of 
increased connectivity and more prevalent exploitable vulnerabilities, cybercriminals can leverage 
technological advances to perpetrate their crimes. Levels of anonymity, complexity of operations 
and speed may all increase in the future. Progress in automation may also reduce the necessary 
manpower to undertake  a certain criminal activity. If (international) criminal justice responses 
cannot  keep  up  with  the  increasingly  difficult  prosecution  of  cybercriminals,  cybercrime  may 
become  more  attractive  to  able  hackers.  McGuire  concluded  that  ‘both  the  legitimate  and 
illegitimate economies come together within an increasingly cyber-criminogenic world; one where 
the tools and  cultures of  information crime become blurred and interchangeable with the tools 
and cultures of an information society, and vice versa’ (McGuire, 2018). 

In the past, cybercriminals have proven their ability to quickly  adapt to changing conditions 
and incorporate innovative approaches to their criminal activities to perpetrate attacks and 
hide  their  operations  from  law  enforcement  (Levi  et  al.,  2015;  Positive  Technologies,  2018). 
Several  emerging  technologies  may  steer  cybercrime  in  a  certain  direction  in  the  future.  For 
example, artificial intelligence and machine learning are likely to increase the speed of attacks, 
whilst simultaneously making them more tailored. Autonomous devices and systems may be used, 
for  example  to  carry  out  disguised  attacks  independently  with  limited  external  control. 
Developments  in  computing  and  data  storage  technologies  could  facilitate  an  increase  in  data 
theft. The growing  volume of data collected  by  Internet of Things devices  could also introduce 
new vulnerabilities, which could be exploited on a larger scale in the future. Another example of 
an emerging technology is blockchain (and distributed ledger technologies), which cybercriminals 
could  try  to  manipulate  or  employ  in  their  operations  as  a  tool  of  storing  disruptive  or 
inappropriate content. Lastly, privacy-enhancing technologies may offer further opportunities of 
hiding identities and operating even more anonymously.  

In addition, cybercriminals increasingly work together to maximise profits. Further specialisation 
could deepen the trend  towards  a more complex  cybercrime  supply chain.  This could take  the 
shape of a ‘cybercriminal service composition as a service’ – a one-stop-shop service combining 
the services of various hackers and illicit marketplaces (Huang et al., 2018). Such specialisation, 
commercialisation and collaboration would also further complicate determining the criminals’ 
identities and, ultimately, would lower the barriers to the access to cybercrimes even further to 
increase demand and revenues. McGuire also speaks of a ‘post-crime world of criminality’ where 
‘varieties  of  criminality  that  involve  less  crime,  or  that  take  on  a  secondary  form  and  benefit 
indirectly, become more attractive in terms of revenue generation’ (McGuire, 2018). 

Other trends relating to CaaS and card fraud are: 

•  A shift is expected from advertising CaaS services on crypto markets to using specialist 
sites and forums on the open web (Ugur, 2019). Transactions are then conducted on 
encrypted communication channels, such as Telegram.  

169 

 
 
EUROPEAN COMMISSION 

• 

• 

Price levels for most cybercrime services have remained at a relatively stable level over 
the past couple of years, in spite of the wide price ranges and lack of clarity about what 
determines the price of a service or product (Gray, 2019).  

There is likely to be progression towards more sophisticated markets and a wider range 
of tools and services on offer (McAfee, 2018). 

•  A move from offering bespoke malware towards ready-made solutions, which is a more 
lucrative approach (Positive Technologies, 2018). Additionally, ransomware has seen a 
rise in popularity in recent years (McAfee, 2018). 

•  Cloud security company Armor found that sales of credentials to remove desktop 

protocol servers (offered for around €20) have risen in popularity since 2018, and are 
expected to rise further in the future (Armor, 2019). The internet-facing servers running 
the RDP server can be used as an initial entry point into the computer network of the 
targeted organisation to, for example, infect it with ransomware.  

•  Another emerging trend identified by Armor was a growth in selling cash (at a cost of 

10–12 cents per dollar), eliminating the need for stolen bank credentials and money 
mules, which has become one of the most popular services in the cybercrime market 
(Armor, 2019). Sales of articles of incorporation and sole proprietorship papers were 
also expected to rise in the future. 

•  Global card fraud losses have doubled in the past decade. However, this is not true in 
absolute numbers, as it mirrors a sharp rise in card transactions (Anderson et al., 
2019).  

• 

• 

The ECB projected a potential shift towards attacks by cybercriminals against mobile 
payments as one of the main expected threats to future security of card payments 
(ECB, 2018). Other noted potential threats were lack of resources and/or skilled 
personnel in handling fraud detection and prevention, their adaptability to emerging 
threats, limited functionality of fraud tools and inflexible regulatory regimes limiting 
preventative actions of organisations under attack. 

Payment card fraud, often conducted by fraudsters operating on an international level, 
is expected by payment-services company Nets to increasingly target cardless payments 
and businesses. More specifically, Nets believed OCGs tend to target weak point sectors, 
processing infrastructure and environments (Nets, 2019).   

2.8.7. Recommendations 

Below we discuss some general comments on areas for future development in order to improve 
future  efforts  in  measuring  the  cybercrime  market.  Many  previous  studies  concluded  that  a 
comprehensive estimate of the revenue from cybercrime is not feasible, and would perhaps be 
counter-productive  to  attempt.  Previous  efforts  to  develop  comprehensive  estimates  of  global 
cybercrime have been considered misleading199. Having said this, others who have explored these 
issues have  highlighted  good practice  and potential  considerations  for  future  research  into  the 
revenues and costs generated by cybercrime: 

•  Adopt systematic research methodologies and approaches. The Home Office 
Science Advisory Council (2018), for example, recommended applying a systematic 
research design – such as their cybercrime framework – locating the biggest gaps in this 
framework, and directing research questions toward filling those gaps in order to 
produce reliable and defensible estimates. 

•  Clearly define and scope the market segment to be estimated. Previous studies 
have attempted to generate estimates across many different types of cybercrime to 
arrive at a global estimate for cybercrime in general. This approach may be 
unproductive, as it is likely that different types of cybercrime may require different 
methodological approaches, as well as different data sources200. In order to produce 
defensible estimates, it may be more successful to engage in tailored approaches 
designed to estimate one particular type of cybercrime, rather than catch-all 
approaches. 

•  Use the best available data and ensure buy-in from data holders. When reliable 
and extensive datasets do not exist or are inaccessible, it is essential to invest in trying 

199 Interview with cybercrime academic expert, 12 February 2020 (#12).
200 Interview with EU-level official, 28 February 2020 (#11).

170 

 
 
 
 
EUROPEAN COMMISSION 

to access the best data possible. It may be the case that data useful to the estimation of 
cybercrime markets exists, but is unknown or inaccessible to researchers – for example 
data captured through law enforcement actions or takedowns. It is therefore necessary 
for researchers to work closely with other stakeholders to develop an understanding of 
the availability of data – particularly real-world data from real-world cases – and how 
this could feasibly be used in research. Valuable data for the estimation of cybercrime 
markets may also reside in private sector companies such as banks, financial institutions 
or cyber insurance providers.  

•  Leverage good practice from estimating other illicit markets. Researchers 

engaged in estimating cybercrime markets should not be oblivious to methodological 
approaches used to estimate other illicit markets and measure levels of OCG 
involvement. While cybercrime presents certain unique contextual constraints and 
challenges, there may nevertheless be valuable lessons learned or good practice that 
could improve how cybercrime market estimates could be produced in the future. 

The key findings from this study and the related recommendations are summarised in the table 
below.  

Table 2.70: Recommendations – Cybercrime market 

Key finding 

Recommendation 

Actor 

Estimates of the revenues from 
cybercrime do not exist. However, 
CNP fraud is included in the ECB’s 
reporting of card payment fraud 
(both online and offline).    

Focus future research efforts on 
specific cybercrime sub-markets 
using tailored methodological 
approaches.  

Partnerships with industry may be 
strengthened in order to access 
data for deriving estimates, as well 
as police and judicial authorities for 
accessing case information.  

Member States, particularly 
police and judicial 
authorities  

Industry  

2.9.  Organised property crime  

Alexander Gerganov, Mitch Legato and Atanas Rusev, Centre for the Study of Democracy  

Key findings: 

•  Cargo thefts and ATM physical attacks are the only organised property crimes for 

which reliable revenue estimates can be provided, although they remain niche crimes 
in the EU when compared to other forms of organised property crime.  

•  According to the estimates produced in this study, the annual revenues derived from 
the cargo theft market in the EU range between €0.1 billion and €7 billion for 2019. 
ATM physical attacks account for another €22 million in annual revenues. 

• 

The data availability does not allow for the generation of an estimate of revenues for 
other organised property crime types – such as burglaries, robberies and motor 
vehicle theft (MVT). However, upper bound estimates of losses incurred by 
households and businesses are as high as €2.5 billion from MVT, €3.4 billion from 
domestic burglary, and €0.5 billion from robbery market.  

•  Comparison of revenue estimates for both cargo theft and ATM physical attacks show 

a decreasing trend over the period 2015 to 2019. 

•  Organised property crimes are frequently carried out by mobile OCGs, which 

systematically commit a significant number of property crimes over large areas across 
Europe, and often originate from Eastern European countries.   

• 

Each organised property crime sub-market has unique actor characteristics, which 
include differing levels of organised crime involvement and skill level. Organised 
crime involvement is highest in MVTs, cargo thefts and ATM physical attacks.   

•  A growing trend faced by law enforcement in combating organised property crime is 

the increasing use of technology to facilitate and abet in criminal activities. 

171 

 
 
 
EUROPEAN COMMISSION 

This Annex provides a comprehensive overview of organised property crime in the EU, building 
upon the summary provided in Section 2.9 of the main report.   

Property crimes – or the theft or destruction of property (Europol, 2020f) – range from widespread 
crimes such as burglary, MVT and robbery to more niche crimes such as cargo theft and trafficking 
in cultural goods (Angelini et al., 2015). Due to the relative frequency of some of these crimes, 
they  are  often  investigated  as  isolated  events  carried  out  by  single  actors  or  small  disparate 
groups  (Angelini  et  al.,  2015).  However,  there  has  been  a  growing  presence  of  OCGs  and 
increasingly,  mobile  organised  criminal  groups  (MOCGs)  (Van  Daele  &  Vander  Beken,  2010) 
behind  petty  property  crimes,  which  historically  have  been  understood  and  investigated  as 
unrelated events, rather than as organised property crimes attached to a broader criminal network 
(Europol, 2017).  

This study focuses on five of the most common and profitable types of organised property crime 
in  which  OCGs  are  involved:  domestic  burglary,  MVT,  robbery,  cargo  theft,  and  trafficking  in 
cultural goods (see Glossary in main report for definitions of each) (Fell et al., 2019; Levi et al., 
2013; Mills et al., 2013). In addition, all five areas are examined due to their significant financial 
costs and increasing occurrences in the EU, and due to the nature and pattern of crimes that can 
indicate active and clear involvement from OCGs (Fell et al., 2019; TAPA, 2018). 

Cargo thefts and ATM physical attacks are the only organised property crime for which market 
revenues can be provided, given the general lack of prior methodologies and datasets for most of 
the organised property crime. The results are provided below. 

2.9.1. Previous  revenue  estimates  of  the  EU  organised 

property crime market 

The desk research did not identify any prior estimates for the market revenue from all types of 
organised property crime in the EU. Only five studies were identified with EU-wide estimates on 
specific  categories  of  organised  property  crimes,  including  MVT,  cargo  theft  and  physical  ATM 
attacks.  These  studies,  however,  provide  estimates  for  the  value  of  losses  incurred  by  the 
individuals,  households  or  businesses  due  to  those  categories  of  crime.  In  general,  estimated 
losses are not equal to the actual revenues generated by OCGs, as not all of the covered incidents 
are carried out by OCGs, and not all of the losses are directly transferable to revenues. The only 
exceptions discussed in detail below are cargo theft and ATM physical attacks, where losses could 
be used as an adequate proxy for revenues.    

In addition, costs – which are often reported in the literature – are a very different measure to 
losses as they also cover the cost of damaged property, the funds invested in insurance, societal 
costs (e.g. for the criminal justice system), and even ‘physical and emotional costs’, among many 
others (Heeks et al., 2018). Clearly only the ‘direct costs’ (i.e. the value of stolen property, but 
not that of damaged property) can be considered as contributing, although are not equal to the 
revenue of perpetrators. 

Since  no  sources  were  identified  that  estimate  the  revenues  from  organised  property  crimes, 
sources  of  direct  losses  are  discussed  below  as  potential  proxy  estimates  for  the  generated 
revenues.  

Burglary:  Estimates  for  burglary  rely  on  either  law  enforcement  data  or  crime  victimisation 
surveys,  most  of  which  do  not  differentiate  between  organised  and  conventional  crime.  A  UK 
Home Office study authored by Heeks et al. found that 695,000 domestic burglaries, both from 
OCGs and individual perpetrators, resulted in £973 million in damage or stolen property in England 
and Wales alone in 2015–2016 (Heeks et al., 2018). The average value of property stolen in the 
UK for 2015 is estimated at €1,235 per incident. 

Boerman  et  al.  (2017)  estimated  that  losses  resulting  from  burglary  of  residential  premises 
amount to approximately €175 million for 2015 in the Netherlands. The average loss per burglary 
incident was approximately €2,700. It was estimated that organised burglars (OCG and MOCG) 
are  responsible  for  approximately  €35  million  of  the  total  losses  (20%).  Finally,  the  study 
comments  that  not  all  cases  are  reported  to  the  police  and  that  according  to  data  from 
victimisation surveys, the actual number of burglaries of business premises, for example, would 
be almost 30% higher than the recorded incidents. While the sources of information are clearly 
official  databases  and  victimisation  surveys  conducted  in  the  Netherlands,  no  detailed 
methodology for producing the loss estimates was provided.  

172 

 
EUROPEAN COMMISSION 

A Home Office estimate by Mills et al. (2013) places the scale of distraction burglaries in the UK 
at £35 million for 2010–2011. The authors note that distraction burglaries are a complex type of 
crime that is typically attributed to OCGs. While they assume 100% of the incidences are OCG 
related, they admit this may be an overestimate due to some cases being caused by individuals. 
However, the estimated scale of distraction burglaries is based solely on losses  (value of stolen 
property), with the average value of property stolen estimated to be £2,040 (Mills et al., 2013)201. 
There are several similar single-country studies (e.g. Poland – see Czabański, 2009) and they all 
use  the  same  approach  to  estimating  losses  based  on  number  of  incidents  multiplied  by  the 
average  value  of  the  stolen  property  (typically  obtained  through  surveys  or  experts’ 
assessments). 

Robbery should be regarded as an umbrella term for multiple types of crimes against persons 
(‘personal robbery’) or businesses (‘commercial robbery’). The focus regarding OCGs is naturally 
on the commercial robberies,  believed to  be with  higher OCG involvement. However, available 
statistics for the number of incidents on the EU or Member State levels do not distinguish between 
personal and commercial robbery.  

Physical ATM attacks are a particular type of organised property crime including both burglaries 
and robberies, where OCGs are assumed to be the main perpetrator. The European Association 
for  Secure  Transactions  (EAST),  using  data  on  reported  incidents  compiled  by  its  national 
members in 20 Member States202, reported that in 2018 there were €36 million in losses (cash 
stolen) from 4,549 physical ATM attacks – up from  €31 million in 2017 (EAST, 2020). Europol 
similarly reports that financial losses in 2017 were over €30 million for Europe from physical ATM 
attacks, but provides no background on how this figure was arrived at (EUCPN, 2017). The latest 
data reported by EAST indicates the losses from physical ATM attacks for 2019 to be €22 million 
(EAST,  2020).  The  values  represent  the  sum  of  all  losses  reported  to  EAST,  but  since  the 
organisation  relies  on  self-reported  data  from  financial  institutions  and  independent  ATM 
deployers, it makes no representation as to their accuracy or completeness. Since the reported 
losses  are  in  cash,  no  discount  factor  is  needed  to  convert  them  to  revenues  of  OCGs  that 
perpetrated these crimes (EAST, 2020). 

MVT: Levi et al. (2013) found that in 2011 unrecovered organised MVTs amounted to a loss of 
€4.25 billion. The average value of a stolen car in the UK for 2015 was estimated by Heeks et al. 
(2018) to be €4,340. However Fell et al. (2019) estimated the average value of an unrecovered 
stolen vehicle to be £9,308 (€10,648), and argued that the unrecovered stolen vehicles are more 
easily attributed to OCGs and therefore their value accounts better for losses related to OCGs. 
Both estimates draw on the 2015–2016 ‘Crime Survey for England and Wales’. 

All identified studies that produce a monetary estimate of loss relied on the number of incidents 
(registered or estimated through victimisation surveys) to arrive at the total amount of losses. 
This  was  obtained  by  multiplying  the  number  of  incidents  by  the  average  value  of  the  stolen 
vehicle (with value usually based either on victim reports or on insurance data). Very few authors 
try to estimate the OCG level of involvement (e.g. Fell et al. (2019) assume OCG involvement in 
average MVT is 61%, but 100% for ‘car key’ burglaries).  

Cargo theft: Estimates for cargo theft have relied upon law enforcement data (Mills et al., 2013) 
and the Transported Asset Protection Association (TAPA) Incident Information Service (IIS), which 
produces  estimates  for  Europe,  the  Middle  East  and  Africa  (EMEA).  The  Transported  Asset 
Protection Authority (TAPA)  EMEA  Incident Information Service  (IIS)  is  a database of  reported 
transport-related  theft  incidents  (TAPA,  2020b),  which  compiles  industry  data  on  these 
occurrences and provides a valuation of road freight and cargo theft at the EMEA level, including 
modus operandi of offenders (Ekwall & Lantz, 2012). The TAPA EMEA IIS shows that in the months 
of October and November 2019 there were around $5.5 million worth of goods reported stolen as 
a result of cargo theft in 12 EU Member States (TAPA, 2019). TAPA estimates that in the first nine 
months  of  2019 over  €80  million  of  goods  was  stolen  across  EMEA  (King,  2019).  Additionally, 
throughout the EMEA recorded cargo thefts in the IIS indicate financial losses in 2018 totalling 
€153.8 million (TAPA EMEA, 2019). Home Office data for the UK alone (2015–2016) shows that 
cargo  theft  amounted  to  £51  million  (€59.7  million)  lost  in  1,189  incidents  (Fell  et  al.,  2019). 
According to a Europol report,  the  losses  in  EU  27 (the report was published prior to  Croatian 

201 See p. 26, footnote 32 for the exact source.  
202 AT, CY, CZ, DK, FI, FR, DE, EL, IE, IT, LI, NL, PT, RO, SK, ES, SE, CH, UK. 

173 

 
 
 
EUROPEAN COMMISSION 

ascension to the EU) from cargo thefts registered in the TAPA IIS database  alone amounted to 
€424.4 million in 2007 (Europol, 2009; Savona & Riccardi, 2015).  

While the estimates above are based on the number of cases reported to the TAPA EMEA ISS or 
registered by law enforcement authorities, Van den Engel and Prummel (2007) used a probabilistic 
model that aimed to include unreported cases of cargo theft to produce a total estimate of the 
losses.  The  model  was  based  on  the  number  of  loaded  trips  (using  data  from  Eurostat),  the 
probability of a cargo theft taking place (authors’ estimations) and the average cost of the stolen 
cargo (three cost groups based on the TAPA database). Using this approach, Van Den Engel & 
Prummel estimated that cargo theft in the EU accounts for €8.2 billion in losses for 2007 (Bulgaria, 
Greece, Malta, Romania were excluded due to lack of data) (Van den Engel & Prummel, 2007).  

FreightWatch International & Supply Chain Intelligence Center (FWI SCIC, 2016) used Van Den 
Engel & Prummel’s approach to update the estimate of the cargo theft cost in 2016, with a model 
based  on  more  recent  and  detailed  estimates  (FWI  SCIC,  2016).  Most  notably,  they  applied  a 
proprietary  risk  analysis  to  each  of  the  countries  in  the  estimate  using  a  large  variety  of 
quantitative and qualitative sources that were not available for the 2007 study. Their estimate for 
the total cost of stolen goods in 27 EU countries (except Malta) in 2013 was €11.6 billion – 41% 
higher than the 2007 estimate.  

The  applied  approach  was  not  described  in  detail.  Engel  &  Prummel  assume,  based  on  their 
analysis, that the probability for an incident to occur during a ‘short trip’ was 1 in 5,000 and for 
a  ‘long  trip’,  2  in  5,000.  FreightWatch  used  the  same  numbers  but  ‘revised’  them  ‘where 
necessary’ by conducting their  own  analysis, which ‘utilized  a large variety of  quantitative  and 
qualitative sources’. No further information was given about the methodology used. Similarly, the 
average  loss  per  incident  in  the  case  of  Engel  &  Prummel  was  based  on  TAPA  IIS  database 
categories, but no detailed algorithm was provided. FreightWatch on the other hand applied their 
own ‘conservative’ estimate of €91,000 loss per incident for 2013, which differs considerably from 
the average loss of incidents registered in the TAPA ISS database, which was €235,000 in 2013. 
No further information is provided by FreightWatch on how the €91,000 estimate was produced.   

The  UK  Home  Office  (Fell et  al.,  2019)  estimated  that  in  2015–2016  the  value  of  road  freight 
crime  in  the  UK  was  £51  million  (€60  million).  The  study  argues  that  all  road  freight  crime  is 
organised (Fell et al., 2019).  

Trafficking of cultural goods: The desk research did not identify any estimates for the market 
value of trafficking in cultural goods in the EU. One recent estimate from 2011 was identified for 
the value of this market on global level. Haken estimated that annual value of the market amounts 
annually  to  between  $3.4  billion  (USD)  to  $6.3  billion  (USD)  worldwide  (Haken,  2011).  The 
estimate was produced by taking the average of the low estimates and the average of the high 
estimates reported in prior sources (some of them dating back as far as 1999). 

2.9.2. Quality of prior revenue estimates  

The prior studies described above were subject to a quality appraisal, and the following limitations 
were identified with regards to their methodologies:   

•  Replicability and lack of data. All of the identified methodologies for burglaries and 

robberies rely on input data from crime victimisation surveys. However, recent crime 
victimisation surveys are available only for a few Member States. Criminal statistics on 
registered crime do not account for the unreported crime and do not provide 
disaggregated data for the different sub-types of organised property crime. 

• 

Losses, not revenues. One of the main limitations in estimating the value of the 
organised property crimes market stems from lack of data on actual revenues generated 
through organised property crimes. All existing methodologies provide estimates only 
for the losses resulting from various categories of property crimes. None of the 
studies indicates to what extent these losses actually correspond to the 
revenues of the perpetrators, except for cargo thefts and ATM attacks. 

•  Share of OCG-perpetrated crimes. Very few studies parse out what share of the 

crimes can actually be attributed to OCGs. It is impossible to define where organised 
property crime ends and conventional criminality begins for several of the property 
crime types, and this presents problems that can lead to both the undercounting and 

174 

 
EUROPEAN COMMISSION 

over-counting of organised property crime incidents (Crime&Tech, 2017). Given the high 
volume of some of these crimes (e.g. burglaries), this additionally exacerbates the 
problem of overcounting. For example, in all identified cargo theft estimates, 100% of 
the incidents are assumed by the authors to be carried out by OCGs due to the level of 
organisation, knowledge or sophistication required to carry out said cargo theft. This 
assumption was also confirmed by two of the interviewed experts203. 

•  Different definitions of crimes are applied across different Member State laws and 
national databases – for example, crime statistics from France do not differentiate 
between robbery and thefts without use of violence (Aebi, 2014). This can cause either 
under- or over-reporting, as some countries will have an inflated number of incidences 
based on looser definitions, and vice versa.  

•  Undercounting may stem from authorities being unaware of, or not properly recording, 

OCG cargo thefts. Furthermore, non-reporting from victims of theft who may fear 
reputational damages can result in additional undercounting (Van den Engel & Prummel, 
2007).  

•  Overcounting may stem from crimes which were not carried out by OCGs but are then 

classified as organised property crime. For example, within the Van den Engel & 
Prummel dataset, crimes were classified as organised property crime if ‘the 
circumstances of the crime suggest that the theft was well-planned and that the robbers 
know exactly what the target goods of the theft were’ (Van den Engel & Prummel, 
2007). This approach introduces both biases and assumptions into the data selection 
process that can then mar results (Van den Engel & Prummel, 2007). 

•  Discrepancies in the methodological approaches of the few prior attempts to 

produce quantitative estimates – for example some of the approaches for estimation of 
cargo thefts summarize reported cases of cargo theft, whereas others attempt to 
estimate the whole hidden cost through statistical/probabilistic methods. The former 
approach is typical for some Home Office reports (although others account for the 
crimes which are not reported to the police through victimisation surveys), and most 
notably for EU-level reports aggregating data from the TAPA EMEA IIS database (e.g. 
the Europol report from 2009). The latter is developed by Van den Engel and Prummel 
(2007). 

•  Certain aspects of identified methodologies are unclear – most notably some of 
the coefficients applied in the cargo theft methodologies are reportedly based on 
interviews with stakeholders and desk research but were not described in sufficient 
detail, and hence cannot be replicated.  

•  Unreliable methodologies – for example, Haken’s approach for producing a market 

value for trafficking in cultural goods was to simply collect various prior estimates from 
distinct time periods and produce average values out of them, without accounting for 
their underlying methodologies (Haken, 2011).    

203 Interview  with  cargo  theft  expert,  27  February  2020  (#8);  Interview  with  law  enforcement  expert,  12 
March 2020 (#19).

175 

 
 
 
EUROPEAN COMMISSION 

Table 2.71: Prior studies estimating the revenue of organised property crimes in the EU 

Citation 

Year(s) of 
estimate 

Sub-market 

Data source(s) 

Countries included in 
estimate 

Disaggregated at 
Member State 
level?  

Estimate produced 
(revenue) 

Domestic burglary  

1 

Heeks et al. (2018)  2015–2016 

All domestic 
burglaries – 
organised and non-
organised 

Data from police recorded 
crime and Crime Survey for 
England and Wales  

England and Wales 

No 

Data from police recorded 
crime and Crime Survey for 
England and Wales  

United Kingdom 

No 

£973 million (€1.05 
billion) lost in damaged 
or stolen property 

£35 million (€37.6 
million) in economic cost 

Eurostat 

EU 

No 

€4.25 billion in losses 

4 

Heeks et al. (2018)  2015–2016 

All MVT 

Data from police recorded 
crime and Crime Survey for 
England and Wales 

England and Wales 

No 

£281.5 million (€312.25 
million) lost in damaged 
or stolen vehicles 

Not specified 

Europe 

No 

€36 million in losses 

2  Mills et al. (2013) 

2010–2011  Domestic burglary – 

MVT 

3 

Levi et al. (2013) 

2011 

organised 
distraction 
burglaries 

Organised 
unrecovered vehicle 
theft 

Robbery 

5 

EAST (2020) 

2018 

Road freight and cargo theft 

6 

Europol (2009) 

2007 

Robbery – ATM 
physical attacks 

Road freight and 
cargo theft 

TAPA IIS Database 

EU 27 (Croatia not in EU)  Yes 

7 

FWI SCIC (2016) 

2013 

Road freight and 
cargo theft 

European Commission road 
transport statistics for 2013 

EU 27 (exclude Malta 
due to lack of data) 

8 

Fell et al. (2019) 

2016 

Road freight and 
cargo theft 

National Vehicle Crime 
Intelligence Service (NaVCIS) 
Freight database 

United Kingdom 

9 

Van den Engel and 
Prummel (2007) 

2004 

Road freight and 
cargo theft 

Data from 2003–2007, TAPA 
EMEA IIS database, stakeholder 

EU 27 (Croatia not in EU, 
excluded BG, EL, MT, RO 
due to lack of data) 

No 

No 

No  

€424.4 million of 
reported losses 

€11.6 billion lost from 
stolen goods 

£51 million (€60 million) 
combined value of 
vehicles and loads stolen 

€8.256 billion lost from 
stolen goods 

176 

 
 
EUROPEAN COMMISSION 

Citation 

Year(s) of 
estimate 

Sub-market 

Data source(s) 

Countries included in 
estimate 

Disaggregated at 
Member State 
level?  

Estimate produced 
(revenue) 

questionnaire, NEA-cost 
calculation models 

Cultural goods trafficking 

10  Select Committee 
on Culture, Media, 
and Sport (2000) 

Unclear 

Cultural goods 
trafficking – 
classical antiquities  

Not specified 

Europe and 
Mediterranean 

11  Haken (2011) 

Unclear 

Cultural goods 
trafficking – 
antiquities  

Not specified 

Worldwide 

No 

No 

Between £200 million 
and £300 million 
(€235.39 million and 
€353 million) a year 

Between $300 million 
and $6 billion (€273.6 
million and €5.47 billion) 
per year 

Note: All revenue estimates presented in this table reflect the original years for which they were produced. They have not been adjusted for inflation, as we have done for the final estimates used in the current study. 

177 

 
 
 
EUROPEAN COMMISSION 

2.9.3. Methodology for estimating revenues in this study  

A replicable and reliable methodology for estimating market revenues was identified only for cargo 
thefts, and not for the rest of organised property crimes. For the rest of the crimes no estimate 
for  market  revenues  were  produced  for  one  or  more  of  the  following  reasons:  they  are  not 
homogeneous  markets  (e.g.  OCG  involvement  varies  between  particular  types  of  robbery, 
burglary and MVT); incidence rates are not disaggregated for specific types of crime (e.g. type of 
burglary); losses cannot be estimated adequately; and loss estimates cannot be directly converted 
into revenues. The identified value of overall loss due to ATM attacks represents the sum of overall 
reported losses across the EU for 2019, and hence does not require further estimation. 

The methodological approach we adopted for estimating the market value of cargo thefts in this 
study  is  a  probabilistic  incidence-based  approach  suggested  by  Van  den  Engel  and  Prummel 
(2007).  The  approach  draws  on  number  of  reported  incidents,  number  of  actual  incidents  per 
5,000 trips, and average loss. The summary of the approach for measuring the market value of 
cargo theft crime in the EU is outlined in the table below. 

Table 2.72: Summary of approach for estimating revenue from cargo thefts 

Summary of approach  Reliable estimates are produced only for the cargo-theft sub-market. 

Incidence-based approach was used: number of incidents is multiplied by the 
average loss per incident. 

Rationale 

Output 

The approach fulfils the criteria for reliability and robustness and can be 
replicated, since all the required input data is available. 

The approach estimates total loss (value of stolen property), which is 
assumed to be an adequate proxy for the OCGs’ revenues for the covered 
sub-market.  

Scope and coverage 

Geographical scope: EU-level and Member State level.  

Data sources 

Year(s) of estimate: 2013–2018 for the whole EU; 2018 for Member States, 
updated to 2019 values.  

Sub-markets: only cargo theft sub-market is covered. 

Eurostat, number of loaded cargo trips for estimating the number of incidents. 
Transported Asset Protection Association (TAPA) Incident Information Service 
(ISS) database for average loss per incident estimates. Transported Asset 
Protection Association (TAPA) Incident Information Service (ISS) average 
losses per incident are: €235,000 for 2013; €205,624 for 2014; €101,256 for 
2015; €68,359 for 2016; €62,178 for 2017; and €53,625 for 2018. 

Key steps 

The methodological approach outlined for estimating the market value of cargo 
theft in this study involves the following steps: 

1.  Based on the desk research, it was concluded that the cargo theft 

market is a relatively homogenous one. 

2.  Number of registered incidents is available from the  Transported 
Asset  Protection  Association  (TAPA)  Incident  Information  Service 
(ISS) database, and actual cases could be estimated applying Engel 
& Prummel’s probabilistic approach: number of loaded cargo trips is 
extracted from Eurostat and divided into long (>300km) and short 
(<300km). Probability of an incident to occur is applied: 0.0001 for 
short trips and 0.0002 for long ones.  

3.  Average  loss  per  incident  is  available  from  the  Transported  Asset 
Protection  Association  (TAPA)  Incident  Information  Service  (ISS) 
database.  

4. 

In  this  particular  case  it  can  be  assumed  that  the  revenue  is 
somewhat  equal  to  the  value  of  the  stolen  property  (the  loss),  as 
some  experts  suggest  that  the  stolen  goods  are  sold  for  their  full 
price on eBay and similar online outlets204.  

5.  Applying the formula: 

204 Interview with cargo theft expert, 27 February 2020 (#8).

178 

 
 
 
Limitations and 
caveats of this 
approach 

EUROPEAN COMMISSION 

𝑇𝑜𝑡𝑎𝑙 𝑣𝑎𝑙𝑢𝑒 = 𝑛𝑢𝑚𝑏𝑒𝑟 𝑜𝑓 𝑖𝑛𝑐𝑖𝑑𝑒𝑛𝑡𝑠𝑖  ∗ 𝐴𝑣𝑒𝑟𝑎𝑔𝑒 𝑟𝑒𝑣𝑒𝑛𝑢𝑒 𝑝𝑒𝑟 𝑜𝑛𝑒 𝑖𝑛𝑐𝑖𝑑𝑒𝑛𝑡𝑖 

Where: i stands for Member States. The total market value is computed as the 
sum of the total revenue estimates for all Member States. 

As with any probabilistic approach, the current one has certain limitations 
stemming mainly from the assumptions that:  

- 

- 

- 

TAPA ISS average loss is representative for all incidents;  

the ratio of 1 in 5,000 short trips and 2 in 5,000 long trips is 
adequate to produce a reliable estimate of the actual number of 
incidents;  

the losses (or value of stolen property) could be turned into revenues 
without a significant discount. 

MVT, domestic burglary and robbery  
Tentative loss-based estimates were produced for MVT, domestic burglary and robbery crimes. 
These estimates are based on Eurostat data for the number of incidents and survey data for the 
average loss per incident. The results should be used with caution and only as gross guestimates 
of the value of losses incurred by households and businesses from these three types of organised 
property crimes. There are various methodological caveats inherent to these estimates, some of 
which  were  discussed  in  the  previous  section.  These  loss-estimates  cannot  be  considered  an 
adequate proxy for their corresponding market value, mainly because there is no data for these 
three  markets  on  how  losses  relate  to  revenues  of  OCGs,  since  there  is  an  unknown  discount 
factor. In addition to that, there is no reliable quantitative estimate for OCG participation in these 
markets.  

The methodological approach we adopted for estimating the value of losses from burglary, robbery 
and  MVT  in  this  study  is  an  incidence-based  approach  suggested  by  Heeks  et  al.  (2018).  The 
approach draws on number of reported incidents and average loss. The summary of the approach 
for measuring the losses from the three types of organised property crime in the EU is outlined in 
the table below. 

Table 2.73: Summary of approach for estimating losses from MVT, domestic 
burglary and robbery 

Summary of approach  Guestimates are produced for the MVT, domestic burglary and robbery 
sub-markets. Incidence-based approach was used: number of incidents is 
multiplied by the average loss per incident. 

Rationale 

The approach does not fulfill the criteria for reliability and robustness. It can 
be replicated, but losses cannot be considered an adequate proxy for 
revenues for these sub-markets, and OCG involvement cannot be estimated, 
which means that the calculated numbers include a large portion of 
conventional crimes that cannot be attributed to OCGs. These estimates are 
produced as very gross approximations of the upper bounds of losses due to 
these three types of organised property crime.  

Output 

The approach estimates total loss (value of stolen property).  

Scope and coverage 

Geographical scope: EU-level and Member State level.  

Year(s) of estimate: 2017.  

Sub-markets: MVT, domestic burglary and robbery. 

Data sources 

Eurostat, number incidents for the corresponding crimes. Available estimates 
in the literature for the average loss per crime: €3,651 average loss per 
MVT205, €2,700 average loss per burglary (Boerman et al., 2017), and €1,167 
average loss per robbery (Heeks et al., 2018). 

Key steps 

The methodological approach follows the formula below: 

𝑇𝑜𝑡𝑎𝑙 𝑙𝑜𝑠𝑠 = 𝑛𝑢𝑚𝑏𝑒𝑟 𝑜𝑓 𝑖𝑛𝑐𝑖𝑑𝑒𝑛𝑡𝑠𝑖  ∗ 𝐴𝑣𝑒𝑟𝑎𝑔𝑒 𝑙𝑜𝑠𝑠 𝑝𝑒𝑟 𝑜𝑛𝑒 𝑖𝑛𝑐𝑖𝑑𝑒𝑛𝑡𝑖 

Where: i stands for particular Member States. The total loss for EU is 
computed as the sum of the total loss estimates for all Member States. 

205 Europol, SIS-alerts art. 38(1) and 38(2) in 2018.

179 

 
 
 
EUROPEAN COMMISSION 

Limitations and 
caveats of this 
approach 

These estimates are produced only as very gross approximations of the upper 
bound of losses due to the three types of organised property crime. Reliable 
estimates for the market revenues from these sub-markets cannot be 
produced.  

2.9.4. Revenue estimates of cargo theft and ATM attacks in the 

EU 

The table below presents the estimates of cargo theft and ATM physical attacks in 2019 at the 
EU-level and for each of the EU Member States (without Malta).  

Table 2.74: Revenue estimate of cargo theft and ATM physical attacks 

EU Member State 

Cargo theft* 

ATM physical 
attacks 

Annual revenue, adjusted for inflation, 2019 (€ million) 

Mid 

Low 

High 

Low 

28 EU Member States 

3,347.85 

144.39 

6,551.32 

22 

27 EU Member States without UK 

2,970.26 

49.87 

5,890.70 

Austria 

Belgium 

Bulgaria 

Croatia 

Cyprus 

Czech Republic 

Denmark 

Estonia 

Finland 

France 

Germany  

Greece 

Hungary  

Ireland 

Italy  

Latvia 

Lithuania 

Luxembourg 

Malta 

Netherlands 

Poland 

Portugal  

Romania 

Slovakia 

Slovenia 

Spain 

Sweden 

United Kingdom 

-  

168.96 

1.37 

-  

-  

-  

0.45 

0.14 

-  

-  

2.57 

6.84 

64.00 

58.20 

34.04 

13.20 

267.10 

57.76 

9.06 

85.76 

685.84 

1,517.43 

-  

150.83 

0.36 

0.76 

5.87 

0.66 

-  

-  

-  

18.52 

-  

0.25 

8.72 

0.83 

-  

1.24 

1.29 

94.52 

93.62 

71.71 

356.40 

25.29 

41.80 

19.07 

-  

307.18 

663.46 

68.65 

110.27 

139.51 

39.51 

641.06 

200.97 

660.63 

180 

 
 
 
EUROPEAN COMMISSION 

Notes: Estimates were produced for 2013–2018 (mean) and updated to 2019 values using Eurostat’s HICP (Eurostat, 2020b). * No high 
estimate could be produced for Malta, as there are no data about the number of loaded trips in Malta in Eurostat. There are no reported cases 
of cargo-theft loss for Malta in the TAPA IIS database, therefore the low estimate is 0.    

Cargo theft 
With regard to cargo theft, the results show that the market can be as large as €6.5 billion despite 
the much smaller sum  of  the losses  (€144  million)  based on reported incidents,  which is  used 
above as a low bound.  

The source for the lower bound estimate was the TAPA IIS database, which is the best source of 
information  on  this  market  (TAPA,  2020a).  The  TAPA  IIS  report  for  2018  covers  all  EMEA 
countries.  The  total  reported  losses  (based  on  the  2,869  cases  of  reported  loss  values)  was 
€153.85 million. Of these, €136.36 million were reported in Member States as presented in  the 
table; €16.57 million were the losses from incidents in third countries (Russia, Saudi Arabia and 
South Africa). €0.91 million of losses could not be attributed to any particular country from the 
information  provided  in  the  report,  and  included  smaller  cases.  Croatia,  Cyprus,  Estonia, 
Lithuania, Luxembourg and Malta reported no cases of cargo theft to the TAPA IIS database in 
2018.  Austria,  Bulgaria,  Finland,  Greece,  Poland  and  Slovenia  reported  20  cases  in  total,  with 
losses not discussed in the TAPA IIS report. 

Larger losses are estimated for Germany, France, Poland, Spain and the UK. However, since the 
estimates use the same average loss per incident for all Member States, differences in the market 
value stem from differences in the number of incidents. These, in turn, use the same probability 
coefficients for all Member States and therefore the differences between the states reflect purely 
the number of loaded trips as reported by Eurostat. Since the probability of cargo theft occurring 
might vary between Member States, the current estimates of the levels of Member States should 
be interpreted with caution. Still, since the crimes are perpetrated by highly mobile groups, it is 
possible  that  the  incidence  rates  coincide  with  the  main  trade  routes  (as  the  results  above 
suggest). This is supported by cases registered in the TAPA IIS base during 2019 (the year after 
the above estimates), when Germany, for example, had the highest number of recorded incidents 
(one-third of the incidents registered by TAPA IIS in 2019) (TAPA, 2020a).   

While TAPA IIS is the best and only source of structured information on cargo theft, it should be 
noted  that  the  reliability  of  the  database  has  improved  greatly  during  the  last  few  years:  the 
number of cases in the database reporting loss value was only 341 in 2015, but increased more 
than three times to 1,136 in 2016, and continued to increase to 1,690 in 2017 and 2,869 in 2018. 
The latest TAPA report based average loss estimates on 3,344 cases  that reported the value of 
the stolen property in 2019. This is a very large sample for this type of crime, and even if the 
sample is not representative, the loss estimates for the last few years could be considered quite 
reliable. Previous estimates, however, could be subject to reporting bias (e.g. higher loss value 
cases  are  more  likely  to  be  reported  to  the  database,  and  to  mention  the  value  of  the  stolen 
property, than lower loss cases).    

ATM theft 
The  current  study  has  not  produced  an  estimate  for  ATM  attacks,  but  we  identified  a  reliable 
market value reported by EAST in the literature review. EAST systematically collects and publishes 
data on the number and value of reported ATM physical attacks in  the EU on an annual basis. 
According  to  their  most  recent  report  for  2019,  the overall  value  of  losses  from  reported  ATM 
physical attacks is €22 million in 2019 (EAST, 2020).  

Box 8: Estimates of the costs of organised property crime in the EU 

Tentative loss-based estimates for MVT, domestic burglary and robbery can be calculated, but should be 
used with great caution due to multiple methodological limitations of the estimates. Loss-based estimates 
are not the same as revenues, and therefore cannot be directly compared to other organised crime 
markets for which revenue estimates have been produced. 

-  MVT losses (different from revenues) are estimated to be as high as €2.5 billion (an upper 

bound estimate).  

- 

- 

Domestic burglary losses (different from revenues) are estimated to be as high as €3 billion (an 
upper bound estimate).  

Robbery market losses (different from revenues) are estimated to be as high as €462 million (an 
upper bound estimate).  

181 

 
EUROPEAN COMMISSION 

EU Member State 

Losses from organised property crimes (€ million) 

MVT 

High 

Domestic 
burglary* 

Robbery 

High 

High 

28 EU Member States 

27 EU Member States without 
UK 

2,526.27 

2,093.81 

3,389.86 

2,674.05 

Austria 

Belgium 

Bulgaria 

Croatia 

Cyprus 

Czech Republic 

Denmark 

Estonia 

Finland 

France 

Germany  

Greece 

Hungary  

Ireland 

Italy  

Latvia 

Lithuania 

Luxembourg 

Malta 

Netherlands 

Poland 

Portugal  

Romania 

Slovakia 

Slovenia 

Spain 

Sweden 

United Kingdom 

* Domestic burglary estimates do not include Ireland. 
  • 

29.23 

54.19 

8.65 

3.12 

3.51 

77.97 

0.80 

1.24 

22.27 

589.75 

197.59 

124.24 

11.59 

17.90 

532.23 

3.95 

3.65 

6.22 

1.21 

92.93 

45.46 

37.44 

10.69 

5.56 

1.97 

120.11 

90.34 

432.46 

461.91 

369.47 

3.05 

22.12 

1.82 

1.01 

0.14 

1.85 

2.38 

0.23 

1.91 

116.79 

45.34 

4.98 

0.98 

2.55 

31.87 

179.21 

11.97 

12.24 

2.49 

19.53 

109.06 

2.61 

12.88 

651.24 

314.66 

59.52 

54.79 

- 

528.72 

36.37 

3.86 

6.99 

5.73 

2.30 

134.44 

57.02 

33.21 

39.09 

4.44 

7.84 

283.77 

104.58 

715.81 

0.70 

1.27 

0.53 

0.24 

9.32 

9.47 

13.87 

3.69 

0.55 

0.28 

77.94 

10.09 

92.44 

2.9.5. Criminal actors and modus operandi 

Table 2.75: Organised property crime – Market actors 

Level of OCG involvement 

Domestic burglary – High involvement. 

Robbery – Varies between medium and high involvement, 
based on the type of robbery.  

ATM physical attacks – Almost all attacks perpetrated by 
OCGs. 

MVT – Almost all thefts of newer cars are carried out by 
OCGs. 

182 

 
 
EUROPEAN COMMISSION 

Road freight and cargo theft – Nearly all cargo thefts are 
carried out by OCGs. 

Trafficking in cultural goods – High involvement across all 
levels of trafficking cultural goods. 

On average around 3 to 5 males per operation but can be 
as many as 30 individuals. Perpetrators mostly from East 
and Southeast Europe.  

Highly adaptable groups that can move from one target 
area to another, and one crime market to another. Utilise 
criminal networks and legitimate offline and online 
channels to sell stolen goods and remain undetected by 
law enforcement. 

High levels of poly-criminality, especially within Organised 
Property Crimes sub-markets, e.g. MVT OCGs carrying out 
cargo thefts, robberies, or occasionally burglaries. 

Size and composition of OCGs 

Modus operandi of OCGs 

Poly-criminality of OCGs 

Other key actors  

Legitimate business owners. 

We identified 65 studies in the literature review that included information on the key actors in 
organised  property  crime  in  the  EU.  These  studies  showed  that  many  actors  carrying  out 
organised  property  crimes  are  MOCGs  originating  from  Eastern  European  countries  who 
systematically  commit  a  significant  number  of  property  crimes  over large  areas  across  Europe 
(Van Daele & Vander Beken, 2010). Van Daele further argues that these groups should be defined 
as mobile or itinerant since they travel from their origin countries to Western Europe to carry out 
crimes  (Van  Daele  &  Vander  Beken,  2010).  In  an  interview  with  a  law  enforcement 
representative206 they noted that EU enlargement and subsequent increase in free movement has 
provided  new  opportunities  for  criminals,  resulting  in  an  extremely  profitable  market  from 
organised property crimes in the European Union alone (Europol, 2017).  

The United Nations Office on Drugs and Crime (UNODC) notes that ‘low-profile, agile’ MOCGs are 
capable of carrying out crimes without any recognition of their involvement in a wider organisation 
(UNODC, 2010). This is in part because these criminal groups are highly mobile and commit a 
number of crimes in a region over a short duration before moving on (Europol, 2020f). In addition, 
a theft in one city does not seem connected to a theft in another, which makes organised property 
crime  a  lucrative  and  low-profile  revenue  source  (Ronchi,  2018).  OCGs  operating  in  organised 
property crime  can range from  highly hierarchical  formal groups to  informal  loose  networks of 
criminals who occasionally carry  out crimes together  (Le, 2012). Even if arrested criminals are 
most likely to be charged only with the direct crime they commit – due to ignorance of a wider 
conspiracy at play or from the inability to prove organised property crime are anything more than 
mundane  criminal  acts  (Fijnaut  &  Paoli,  2004). As  a  result,  this  insulates  those  higher  up  the 
criminal  hierarchy  from  law  enforcement,  and  protects  criminals  from  harsher  punishments 
attached  to  being  part  of  SOC,  further  highlighting  the  low-risk,  high-reward  structure  of 
organised property crime (Savona & Riccardi, 2015).  

A 2018 report by Transcrime found evidence that Albanian, Romanian and Georgian members of 
MOCGs commit organised property crime in France, Italy, Spain and the UK (Savona & Riccardi, 
2018).  A  2017  report  noted  that  MOCGs  from  Bosnia  and  Herzegovina  are  some  of  the  most 
commonly  reported  nationalities  for  organised  property  crime  in  the  EU,  and  are  involved  in 
various organised property crimes including domestic burglary and robbery (European Parliament, 
2017a). It also mentioned nationals of Serbia carrying out organised property crime in Belgium, 
France, Germany and Italy; Moldovan MOCGs in Austria, France, Germany, Latvia and Poland; 
and  Georgian  MOCGs  in  France,  Greece,  Germany,  Italy  and  Spain.  Interviews  with  experts 
echoed these findings, noting that many MOCGs travel from countries such as Belarus, Poland, 
Romania and Russia to carry out cargo theft operations in Western Europe207. Further interviews 
noted Latin America and North Africa as common origins for MOCGs208. 

The type of goods targeted by OCGs carrying out property crimes depend on both the crime and 
the organisation’s skill level. Expert interviews noted that  highly  structured organisations have 
the  skills  to  carry  out  more  lucrative,  but  riskier  property  crimes,  such  as  stealing  a  specific 

206 Interview with Spanish national-level expert, 22 April 2020 (#72).
207  Interviews  with  cargo  theft  expert,  27  February  2020  (#39);  Interview  with  law  enforcement 
representative, 12 March 2020 (#50).
208 Interviews with law enforcement representative, 22 April 2020 (#72); Interview with expert from a non-
profit organisation, 27 April 2020 (#74).

183 

 
 
 
 
 
 
EUROPEAN COMMISSION 

container from a warehouse or pieces of art from a  museum209. In contrast, loosely structured 
groups are often involved in more opportunistic property crimes – such as domestic burglaries – 
where they can steal jewellery, electronics and other items containing gold which can easily be 
sold at pawnbrokers or ‘Cash for Gold’ shops (Wollinger et al., 2018, p. 17). 

Because of the differences in each organised property crime sub-market, each market has some 
unique  characteristics,  which  include  varying  levels  of  OCG  involvement  and  differing  actor 
profiles.  Burglaries  in  the  past  were  carried  out  by  locals,  but  one  law  enforcement  expert 
estimated that between 60% and 80% of burglaries are now carried out by MOCGs from Eastern 
Europe210.  Wollinger  et  al.  found  that  these  MOCGs  comprised  of  otherwise  unemployed  men 
often working in small groups on multiple burglaries over time, ranging between the ages of 30 
and 50, and considered to be professionals with years of experience (Bezlov et al., 2011; Wollinger 
et al., 2018, p. 17). 

Conversely, due in part to individuals aging out of crime, or at least moving away from violent 
crimes,  the  average  robber  is  between  20  and  30  years  old  (Cornelius  et  al.,  2017;  HM 
Government, 2018). Additionally, the young age can be attributed to the fact that as individuals 
age they become both physically weaker and less intimidating, and as a result may shift towards 
being  an  advisor  or  financial  backer,  rather  than  an  active  participant  (Fijnaut  &  Paoli,  2004). 
Others move away from robbery because of the risk of being caught and the associated penalties 
being too high, which – according to one law enforcement representative211 – has contributed to 
the  decline in  robberies.  Most  robberies  are  carried  out  by  a  small group  but  attacks,  such  as 
some physical ATM attacks, can have as many as 10 perpetrators who act as lookouts, looters 
and ‘muscle’ (ATM Industry Association, 2014; Europol & EUCPN, 2019). 

Those carrying out physical ATM attacks closely resemble the overall profile of most OCGs in 
organised property crime, and especially those MOCGs involved in both burglary and robbery212. 
This includes having experienced criminals who utilise their skills and expertise to quickly break 
into ATMs and carry out attacks over time and across regions (Europol & EUCPN, 2019).  Whereas 
more  inexperienced,  opportunistic  criminals  may  struggle  or  fail  in  disarming  ATM  security 
mechanisms and subsequently revert to traditional property crimes (Europol & EUCPN, 2019).  

For MVT, anti-theft protections – such as electronic tracking systems or passive immobilisers – 
have resulted in a market that is challenging for the common criminal who lacks the tools or skills 
to steal cars efficiently or effectively (Savona & Riccardi, 2015). As such, this has resulted in a 
market that is dominated  by  OCGs  (Siegel, 2014)  who have access to  tools that  can  break or 
bypass  security  measures  – according  to  one  interview  with  law  enforcement213.  In  addition, 
selling a stolen vehicle requires a substantial amount of ‘legwork’ and a network of individuals to 
drive the car to a new country, alter documents and find potential buyers (Van Daele & Vander 
Beken, 2010). 

The  vast  majority  of  cargo  thefts  are  carried  out  by  OCGs,  though  with  differing  levels  of 
organisation214. Some highly skilled heists, as mentioned in an interview with law enforcement, 
include the theft of a particular pallet of valuable pharmaceutical products that was stored inside 
a warehouse containing hundreds of pallets215. The level of specificity required to carry out this 
very  focussed  theft  is  evident  that  this  was  more  than  an  opportune  crime,  and  involved 
information as to where the exact pallet was located. Other cargo theft  that requires very little 
organisation from actors relies on lax security or ‘curtain slashing’ – cutting the tarp that protects 
truck cargo – accounts for around 50% of all cargo thefts, according to Europol (Boerman et al., 
2017; Europol, 2009). Additionally, truck stops or rest areas with little to no security make it easy 
for less-skilled OCGs to steal cargo  as the driver sleeps or  when  trucks are  left unattended at 
industrial parks (Sudy et al., 2013). 

Actors  who  traffic  cultural  goods  operate  within  a  legal,  finite  and  niche  market  requiring  
specific skills and a level of knowledge to locate, loot and later transport illicit cultural goods to 
sell internationally (Campbell, 2013). As a result it can be an extremely profitable market,  and 

209 Interviews with cargo theft experts and cultural goods trafficking experts, 26 February 2020 (#38) and 27 
February 2020 (#39).
210 Interview with law enforcement representative, 8 April 2020 (#61).
211 Interview with law enforcement representative, 8 April 2020 (#61).
212 Interview with expert from non-profit organisation, 27 April 2020 (#74).
213 Interview with law enforcement representative, 8 April 2020 (#61).
214 Interview with cargo theft expert, 27 February 2020 (#39).
215 Interview with cargo theft expert, 27 February 2020 (#39).

184 

 
 
 
 
 
 
 
 
 
EUROPEAN COMMISSION 

because  punishment  is  lenient  and  rarely  ends  in  prison  sentences  there  is  little  incentive  for 
criminals to stop trafficking in a lucrative market that is less risky than either the illicit drug or 
illicit firearms market  (Chonaill  et al., 2011).  As such,  cultural goods trafficking  is increasingly 
being carried out by OCGs – although Campbell notes that the extent to which they operate in 
trafficking is difficult to measure, due in part to the fragmented and complex nature of the art 
market  (Campbell,  2013).  This  has  resulted  in  a  market  whose  value  and  profits  to  OCGs  are 
impossible to trace. Existing estimates are from 2000 or before and are both not specific to the 
EU and, more importantly, lack information on the methodological approach followed to arrive at 
their estimates. 

The involvement of OCGs depends largely on which type of crime is committed and how the goods 
are  trafficked.  This  can  further  depend  on  where  and  how  goods  are  sold,  since  there  are 
numerous  routes  for  cultural  goods  to  enter  the  market  (UNESCO,  2018).  The  United  Nations 
Educational,  Scientific  and  Cultural  Organisation  (UNESCO)  noted  that  less  valuable  or  non-
descript works may be sold relatively easily to pawn shops or brokers, but other goods require 
greater  levels  of  knowledge  or  contacts  to  appraise  or  to  gain  access  to  the  buyers’  market 
(UNODC, 2018e). According to UNESCO other forms of trafficking require even greater levels of 
connections,  to  government  officials  who  will  assist  in  forging  export  or  import  documents,  or 
corrupt law enforcement agents willing to turn a blind eye to the trafficking (UNESCO, 2018). This 
level of trafficking requires organisation and networks that can be relied on to discreetly sell or 
traffic goods, indicating, according to Renold (2018), that OCGs play a greater role in this form 
of trafficking. 

For cultural goods that are trafficked OCGs can play a role in every step of the process – from 
coercing locals to excavate or hand over cultural goods, to being the middleman who locates a 
buyer, or selling the product directly to a buyer (Chechi, 2019). Regardless of the role OCGs play 
in  the  trafficking  of  cultural  goods  there  are,  in  general,  three  ways  the  trafficked  items  are 
acquired:  theft,  illicit  excavation,  and  producing  fakes  (UNESCO,  2018).  Theft  often  involves 
professional criminals breaking into museums, places of worship and private collections to acquire 
goods (Garrett, 2019). One expert on cultural-goods trafficking stated that illegal excavations are 
often carried out by locals who may or may not be aware of the legality of their actions, and are 
often abetted by local law enforcement216.  

Modus operandi 
Burglaries most commonly occur when criminals simply break into homes when the owners are 
away, often after surveilling or ‘casing’ the property and surrounding areas (Van Daele & Vander 
Beken, 2010). Houses are chosen based on their accessibility and potential payoff, with burglars 
preferring  houses  that  have  fences  or  landscaping  that  provides  concealment  from  potential 
witnesses  (Kruize  &  Sorensen,  2018).  In  Ireland,  for  example,  criminals  have  moved  to  rural 
regions, utilising motorways and technology to carry out crimes more efficiently and with less risk 
(Agnew, 2020). Europol found that this includes using social media to track when individuals are 
away from their homes and using online navigation tools to scout neighbourhoods (Europol, 2017, 
p. 47).  

The target for robberies  has become more random, with traditional targets such as banks no 
longer being targeted by any ‘smart criminal’ – as noted by one interview with a representative 
from law enforcement217 – due to having better security and less cash. Additionally, Van Duyne 
et al. found that criminals move away from robbery by investing illicit profits in other less risky 
criminal ventures, such as drug trafficking, or opening legitimate or semi-legitimate businesses 
(Van Duyne et al., 2016). In many cases organised robberies consist of long-term professional, 
specialised criminals who come together to form short-term groups that carry out a handful of 
robberies before going their own way (Rosta'mi et al., 2018). 

Europol & the EU Crime Prevention Network (EUCPN) note that gas and explosive attacks are the 
most common physical ATM attacks, followed by in-situ attacks and rip-out/ram-raid attacks 
(Europol & EUCPN, 2019, p. 4). Gas attacks can be carried out using easily sourced hydro-carbon 
gas mixes found in welding and cutting equipment, and can be detonated with igniters found in 
consumer gas products (ATM Industry Association, 2014). Explosive attacks are carried out using 
material such as dynamite, gelignite, C4 and even grenades (Europol & EUCPN, 2019). To carry 
out such attacks the criminals gain access to the ATM by breaking or bending the shutter after a 
cash transaction, or by cutting or drilling into the ATM (ATM Industry Association, 2014, p. 11). 

216 Interview with an expert from an international organisation, 26 February 2020 (#38).
217 Interview with law enforcement representative, 12 March 2020 (#50).

185 

 
 
 
 
EUROPEAN COMMISSION 

This allows them to then place the explosive material or gas into the machine for detonation to 
gain access to the cash holder (Srinivasan et al., 2019). Conversely, rip-out and ram-raid attacks 
require much less planning and  knowledge,  with individuals often stealing a vehicle and either 
ripping the ATM out of its location or using the vehicle as a ram to gain access to the ATM before 
taking the ATM to another location where it can be broken into (Check Point, 2019). Similarly, in-
situ attacks require little  to no expertise  in  ATM  security  mechanisms and  rely  on brute  force, 
using tools to cut or break into the ATM (Europol & EUCPN, 2019). 

Unique to MVT is the variety of reasons why criminals may steal a car  (Europol, 2017). Some 
vehicles are stolen as a means to commit other crimes, with high-performance cars being stolen 
and used as getaway cars in other  organised property crimes, or vans and trucks used in ram 
attacks on ATMs (Savona & Riccardi, 2015). In other thefts the car is stolen for its resale value 
or to use218. One law enforcement representative noted that MOCGs target both high-end luxury 
vehicles and less valuable but more common models219. Additionally, cars are frequently stolen 
for their parts, which are increasingly being sold online to both EU and international customers220, 
with  one  law  enforcement  interviewee  noting  China  as  an  increasingly  popular  destination  for 
‘chopped’ parts221.  

As noted by Burges (2012), methods of cargo theft differ based on the criminals involved. 
Some  of  these  operations  involve  pre-planned  measures  to  carry  out  thefts  and  protect  the 
criminals from being identified, including using stolen cars or fake license plates, GPS and mobile 
phone jammers, and communication through walkie-talkies (Boerman et al., 2017, p. 210). Other 
cargo thefts identified by Boerman et al. (2017) and in interviews involve the would-be thieves 
pretending to be contracted cargo carriers in online freight exchange systems who pick up the 
cargo under the guise of being a legitimate business, the ruse only exposed when the goods never 
reach their destination (Boerman et al., 2017). Cargo thieves occasionally receive assistance from 
workers within the supply chain who provide route plans, information on security or PIN codes 
and forged documents, although this is rare (Boerman et al., 2017; Europol, 2009). 

Cultural goods can originate from all over the world and often make their way to or through 
Europe. As the biggest art market in terms of sales, recorded cross-border trade of artworks and 
art exported – in addition to being the second-largest importer of art – Europe is frequently at 
the  centre  of  the  trafficking  problem  (Renold,  2018).  Oosterman  mentions  that  increased  law 
enforcement focus on the trafficking of cultural goods has resulted in tightened security measures 
around  heritage  sites  to  prevent  looting  in  many  European  countries  (Oosterman,  2019). 
However, in South Eastern Europe looting remains a vexing problem, with illegal goods frequently 
found for sale on the European market (UNESCO, 2018). Other cultural goods entering Europe 
come from art-rich countries that lack adequate control mechanisms for protecting artefacts and 
historical sites. Whether this is due to regional instability in countries such as Syria and Libya, or 
due  to  a  lack  of  resources  to  effectively  protect  cultural  goods,  the  goods  rarely  stay  in  their 
country of origin (Europol, 2017). Instead they are usually moved through transit countries that 
provide pathways to a wider market, to reach the more profitable European or American markets, 
where they are sold to wealthy collectors or dealers in private or public sales (UNESCO, 2018).  

According to Gruber (2019), individuals and OCGs involved in cultural-goods trafficking often rely 
on the ignorance of buyers to obfuscate an item’s provenance, in addition to creating fake export 
documents,  import  licenses  or  certificates  of  authenticity  to  mask  the  illegal  origin  of  cultural 
goods. This has created ambiguity on the legality of pieces, creating difficulties for buyers to verify 
that pieces are legal (Shea, 2018). As a result, this can cause buyers to dismiss suspicions that a 
piece is illicit and choose to simply assume their purchases are both legal and ethical  (Gruber, 
2019).  This  makes  cultural-goods  trafficking  particularly  attractive  for  money-laundering  –  in 
which  criminals  pass  pieces  through  legitimate  auction  houses  using  fraudulent  sales  to  make 
money  ‘clean’  (Polner,  2019).  As  a  result,  Mackenzie  notes  that  this  can  make  differentiating 
between sales of legal goods and illegal goods difficult – as buyers are often unaware or indifferent 
to how a piece was acquired (Mackenzie, 2019). This level of secrecy, inherent in much of the art 
world, has created difficulties for curbing the illegal sale of cultural goods, and makes it impossible 
to know the provenance of an item (Day, 2014). This is exacerbated by the fact that once goods 
are  stolen their trajectory in the market is obscured  and their destinations  are  often  unknown 
(Gill, 2019).  

218 Interview with law enforcement representative, 22 April 2020 (#72).
219 Interview with law enforcement representative, 12 March 2020 (#50).
220 Interview with law enforcement representative, 22 April 2020 (#72).
221 Interview with law enforcement representative, 8 April 2020 (#61).

186 

 
 
 
 
 
 
EUROPEAN COMMISSION 

2.9.6. Future trends and dynamics  

Table 2.76: Organised property crime – Future trends 

Future trends and dynamics 

Increased use of technology, including Information and 
Communications Technology (ICT), to sell stolen goods 
and elude law enforcement detection. 

Increased organisation in carrying out organised property 
crimes. 

Rising profitability from trafficking cultural goods, as art 
and antiquities remain in high demand. 

Impact on market and criminal 
finances  

Continued fusion of legitimate and illegitimate businesses 
to obscure criminal gains from organised property crime. 

Growing use of internet to circumvent authorities and sell 
goods anonymously. 

We identified 30 studies in the literature review that included information on the future trends 
and dynamics in organised property crime in the EU. These studies showed differing outcomes 
based  on  the  organised  property  crime  market.  Overall  trends  in  domestic  burglary  and 
robberies indicate either a rise or no change in the number of occurrences in the last decade 
across the EU  (Europol, 2017).  For domestic burglary  this is in due  part  to the fact  that  while 
home security has improved and law enforcement becomes more accustomed to how to stop or 
deter burglars, it still remains a lucrative market (De Stercke et al., 2014). Increasing rates of 
robberies can also be partially  attributed to  improvements in  police  recording,  despite  security 
measures  taken  to  curb  robberies  (Home  Office,  2018).  Similarly,  MVT  rates  have  stabilised 
across  much  of  Europe,  however  the  number  of  recovered  cars  has  decreased,  which  Europol 
credits to professional thieves who know how to elude detection (Europol, 2020f).  

Much  like  the  other  organised  property  crimes  discussed,  trends  indicate  that  the  market  for 
trafficking of cultural goods remains strong and will continue to grow. The antiquities market 
is  a  profitable  and  relatively  safe,  recession-proof  market  in  which  supply  and  demand  will 
continue to increase in the future (Shea, 2018). One barrier is that even though most nations are 
signatories to the 1954 Hague Convention and the 1979 UNESCO Convention – or at least have 
laws that protect cultural heritage sights – these national laws often differ or are incongruent to 
the international laws related to cultural goods trafficking. A Commission study touched on these 
differences in legal systems from the source country, along with how definitions of cultural goods 
vary and different techniques and methods are used to protect and control these goods through 
domestic laws (Armbrüster et al., 2011). It also noted that a lack of experts on the subject has 
damaged some EU Member States’ ability to properly identify and curb the problem – especially 
as OCGs find more sophisticated ways to forge legal documentation of antiquities.  

One  growing  trend  faced  by  law  enforcement  in  combating  organised  property  crimes  is  the 
increasingly sophisticated methods used by the OCGs who carry out these crimes222. Some 
OCGs buy tools, which can  have legal uses, that disable car alarms  and  GPS,  or allow keyless 
entry  to  cars223.  Some  OCGs  have  used  other  techniques  that  use  jamming  or  spoofing 
technologies to facilitate cargo thefts, as mentioned in one interview with a cargo theft expert224. 
Additionally, both social media and GPS have allowed thieves across all organised property crimes 
to monitor the comings and goings of targets and plan routes without ever coming into contact 
with victims (Profiling, 2015). These technologies have allowed OCGs to carry out crimes more 
effectively and efficiently, while simultaneously lowering their criminal profile to police as they are 
able  to  mask  criminal  intentions  and  evade  capture225.  Another  trend  is  the  continued  and 
increased reliance on the use of online platforms to sell loot anonymously and remain undetected 
by law enforcement  (Wollinger et al., 2018). This is universal across  organised property  crime 
markets, as the internet is often the easiest and safest way to sell stolen goods, with sellers able 
to sell goods both within the EU and internationally (Aniello & Caneppele, 2017). 

222 Interview with cargo theft expert, 27 February 2020 (#39).
223 Interview with law enforcement representative, 8 April 2020 (#61).
224 Interview with cargo theft expert, 27 February 2020 (#39).
225 Interview with law enforcement representative, 8 April 2020 (#61).

187 

 
 
 
 
 
 
 
EUROPEAN COMMISSION 

2.9.7. Recommendations 

The  current  study  suggests  two  possible  ways  in  which  data  collection  and  estimations  of  the 
organised property crime market could be improved, although both would be costly and difficult 
to implement: 

• 

First, Eurostat currently reports numbers of incidents for robbery, MVT, domestic 
burglary and commercial burglary. If incidence rates for the sub-types of these crimes 
were also collected/reported, this would allow for estimates of organised property 
crimes for specific sub-markets – such as distraction burglary, plant theft, theft of 
cash and valuables in transit. Given the differences in legislation between Member 
States, however, this is rather unlikely to be feasible, since even current more general 
crime types – like robbery and MVT – are not considered completely reliable for 
comparisons between Member States (van Dijk et al., 2014).    

•  Second, conducting large-sample harmonised cross-country victimisation 

surveys among populations – and especially businesses – could be a much better 
source of data (albeit a costly one) for estimating OCG markets. Such surveys would 
allow the collection of detailed information about losses and improve rates of reporting 
to the police for different organised property crime types, along with other relevant 
details through which revenue estimates could be produced for more organised property 
crime sub-markets.   

The key findings from this study and the related recommendations are summarised in the table 
below.  

Table 2.77: Recommendations – Organised property crime market 

Key finding 

Recommendation 

Criminal statistics on registered property 
crime collected by Eurostat do not provide 
disaggregated data on incidents for the 
different sub-types of organised property 
crime (e.g. plant theft, theft of cash and 
valuables in transit), which would allow better 
differentiation of crimes with high OCG 
involvement from high-volume crime.  

All identified methodologies account for the 
unreported crime and rely on input data from 
crime victimisation surveys. Such surveys are 
available only for a few Member States. 

A lack of data on the ratio between monetary 
value of stolen property and revenue of 
criminals makes it impossible to estimate 
revenues of organised property crime. 

Collect incidence rates for specific types of 
organised property crime, especially the ones 
known for high involvement of OC. 

Conduct large-sample harmonised cross-
country victimisation surveys among 
populations – and especially businesses – in 
all EU Member States on a regular basis. Such 
surveys should collect detailed information 
about losses per incident and rates of 
reporting to the police for different organised 
property crime types.  

Member States should systematically report 
information on revenues generated through 
property crimes – which is currently collected 
by police or judicial authorities in the course 
of some of their investigations – to the 
European Commission. 

Actor 

Eurostat 

Member States 

European 
Commission 

188 

 
 
 
 
EUROPEAN COMMISSION 

  Serious and organised crime investment and infiltration in the 

legal economy  

3.1.  Additional  information  on  investments  by  OCGs  in  the  legal 

economy 

Shann Hulme, RAND Europe 

Key findings: 

• 

The predominant sectors of known investments by OCGs in the legal economy are 
property/real estate, transportation and construction. However, there is a lack of 
robust data to quantify such investments and it is likely that current understandings 
are not representative of the phenomenon.  

•  Cash couriers are used by OCGs for transferring proceeds generated from cash-based 

markets, such as illicit drugs, THB and illicit tobacco.  

• 

Electronic funds may be transferred by OCGs through money muling or ‘smurfing’.  

•  Cryptocurrency exchange services and mixing or tumbler services are used for 

transferring cryptocurrencies and funds earned through cybercrimes.   

This annex provides additional background from the literature review on investments by OCGs in 
the legal economy, and supports the analysis presented in Section 3.1 of the main report.  

Specifically, this annex focuses on the drivers of OCG investments.  

3.1.1. Drivers of investments by OCGs in the legal economy 

The literature review identified 14 studies conducted since  2015226  that offered information  on 
investments made by OCGs in the EU legal economy. These studies mainly relied upon country-
level case studies and information on assets that have been frozen or confiscated from OCGs by 
EU Member State authorities. There is a disproportionate focus in prior research on investments 
by OCGs operating in Italy and the Netherlands. As a result, current knowledge is biased towards 
the activities of traditional hierarchical OCGs operating in markets such as drug trafficking and 
THB; while less is known about investments made by OCGs operating in other EU Member States 
or markets.  

An analysis of the 14 studies included in the literature review identified a number of driving factors 
influencing OCGs to invest in the legal economy. These include:  

•  profit maximisation and the multiplication of revenues – such as by investing 

in high-growth markets like renewable energy and real estate.  

• 

• 

• 

• 

• 

the facilitation and concealment of ongoing illicit activities – such as 
purchasing real estate to accommodate illicit goods, such as drugs or victims of 
sexual exploitation; 

the laundering of illicit proceeds – such as through investment in cash-intensive 
businesses like bars and restaurants; 

the perpetration of fraud; 

the exertion of control over territories or sectors; and 

to strategically influence local politics, public administration and the business 
community, thus reducing potential risks and threats to the OCGs or their illicit 
businesses.  

Research has shown that while profit is to some extent a driver of investment by OCGs in the 
legal economy, this may not be the most important factor. For instance, Riccardi (2014) found 

226 The year 2015 was chosen as the cut-off for the search because the purpose was to build upon the work 
already undertaken by Transcrime, which published on this area in 2015 (Riccardi et al., 2014; Savona et al., 
2015).  

189 

 
 
 
EUROPEAN COMMISSION 

that the business sectors with the highest levels of investment and infiltration by OCGs (i.e. bars 
and  restaurants,  construction,  transportation)  were  not  necessarily  the  most  profitable.  These 
sectors and the assets available within them may be exploited by OCGs to facilitate their criminal 
activity rather than for economic gain. This has been supported by several other studies (Dugato 
et al., 2015; Ferwerda & Kleemans, 2019; Savona & Riccardi, 2015). For instance, Dugato et al. 
found that Italian OCGs tend to invest in familiar sectors where they can draw upon prior networks 
and contacts, and exert control over territories or sectors that offer some operational benefit to 
their  criminal  activities.  OCGs  invest  in  assets  and  sectors  where  they  can  utilize  previous 
experience and knowledge to reduce risks and threats, and are less likely to invest in sectors with 
high barriers to entry, high requirements for technical skills and low cash intensity (Antonopoulos 
& Hall, 2016; Ferwerda & Kleemans, 2019; Kruisbergen et al., 2015). 

3.2.  Additional  information  on  the  freezing  and  confiscation  of 

assets from OCGs 

Laura Lica-Banu, EY  

Key findings: 

•  Considerable gaps remain in the collection and availability of statistical data on assets 
that are frozen or confiscated in the EU. Data collection is not centralised, is still 
largely undertaken manually and there is no systematic collection of information 
about seized assets linked to SOC.  

•  Considering the ongoing limited availability of data, it is not possible to reliably 

ascertain the overall number and value of assets frozen or confiscated at the EU-
level.  

•  Attention should be paid to improving systems for data collection, to enable a more 

robust understanding of the extent of asset recovery in the EU.  

This annex provides additional information and data relating to asset freezing and confiscation in 
the EU, and supports the analysis presented in Section 3.2 of the main report.  

Specifically, this annex provides detail on the legal requirements for statistical data collection in 
the  EU  on  asset  freezing  and  confiscation,  and  presents  the  extracted  data  from  the  Financial 
Action  Task  Force  (FAFT)  reports  on  the  value  of  freezing  and  confiscation  orders  in  money-
laundering cases between 2014 and 2018.  

3.2.1. Legal requirements for statistical data collection in the 

EU on asset seizure and recovery 

At the European level, Directive 2014/42/EU on freezing and confiscation of instrumentalities and 
proceeds  of  crime  in  the  EU  aims  to  ease  the  freezing,  confiscation  and  recovery  process 
– including  that  of  assets  used  or  in  possession  of  OCGs  at  the  EU-level.  Relevant  acquis 
Communautaire  provisions  also  include  requirements  for  the  Member  States  to  collect  and 
maintain specific and comprehensive statistical data in criminal matters that should be periodically 
submitted to the Commission. The spectrum of the legal provisions includes:  

•  Directive 2014/42/EU: sets out the minimum rules with respect to Member States’ 

freezing and confiscation regimes. The provisions refer also to extended confiscation and 
confiscation from third parties.  

•  Regulation (EU) 2018/1805: refers to the mutual recognition of freezing orders and 

confiscation orders related to criminal offences covered by Directive 2014/42/EU, as well 
as freezing orders and confiscation orders related to other criminal offences. 

•  Council Decision 2007/845/JHA: refers to setting up Asset Recovery Offices (AROs) 

in the EU Member States in the field of tracing and identifying proceeds from, or other 
property related to, crime. When exchanging information, the requesting ARO shall 
provide specific information. 

•  Council Framework Decision 2006/960/JHA (known as the ‘Swedish Initiative’): 
provides rules for the cross-border exchange of criminal information and intelligence, 

190 

 
 
EUROPEAN COMMISSION 

ensuring that procedures for cross-border data exchanges among EU Member States are 
not stricter than those that apply to similar exchanges at national level. Annex A of the 
Decision includes the form of information exchange to be used by the competent 
authorities of the Member States in case of transmission/delay/refusal of information, 
and Annex B includes the request form for information and intelligence to be used by 
the requesting Member State authority. 

The  table  below  provides  a  summary  of  the  type  of  statistical  data  required  by  the  above-
mentioned European acts in connection to freezing and confiscation measures. 

Table 3.1: List of statistical data to be maintained by intelligence / law 
enforcement / judicial authorities of the EU Member States 

Council Framework 
Decision 
2006/960/JHA 

Type of crime or 
criminal activity being 
investigated. 

Nature of offences, 
according to art. 2 (2) 
of Council Framework 
Decision 2002/584/JHA. 

Purpose of request for 
information about the 
main persons under 
investigation or subject 
to request for 
intelligence purposes. 

Directive 
2014/42/EU 

Regulation (EU) 
2018/1805 

Council Decision 
2007/845/JHA 

Object of and the 
reasons for the request 
and the nature of the 
proceedings. 

Property targeted or 
sought (bank accounts, 
real estate, cars, yachts 
and other high value 
items) and/or natural or 
legal persons presumed 
to be involved (e.g. 
names, addresses, 
dates and places of 
birth, date of 
registration, 
shareholders, 
headquarters).  

Number of freezing 
orders executed. 

(additionally, to 
Directive 2014/42/EU) 

Number of freezing 
orders and confiscation 
orders received by a 
Member State from 
other Member States 
that were recognised 
and executed, and the 
recognition and 
execution of which were 
refused. 

Number of cases in 
which a victim was 
compensated or granted 
restitution of the 
property obtained by 
the execution of a 
confiscation order. 

Average period required 
for the execution of 
freezing orders and 
confiscation orders. 

Number of confiscation 
orders executed. 

The estimated value of 
property frozen, at least 
of property frozen with 
a view to possible 
subsequent confiscation 
at the time of freezing. 

Estimated value of 
property recovered at 
the time of confiscation. 

Number of requests for 
freezing orders to be 
executed in another 
Member State. 

Number of requests for 
confiscation orders to 
be executed in another 
Member State. 

Value or estimated 
value of the property 
recovered following 
execution in another 
Member State. 

Source: Research team’s analysis.  

In addition to these obligations, Recommendation 33 of the FATF227 and Directive (EU) 2015/849 
on  the  prevention  of  the  use  of  the  financial  system  for  the  purposes  of  money-laundering  or 
terrorist  financing  (under  the  Anti-Money  Laundering  Directive  4)  require  Member  States  to 
maintain comprehensive statistics on money-laundering and associated predicate offences. 

227 The Financial Action Task Force (FATF) is the inter-governmental body that sets international standards to 
ensure  a  co-ordinated  global  response  to  prevent  money-laundering,  organised  crime,  corruption  and 
terrorism. FATF  monitors  countries  to ensure  they  implement  the FATF Standards  fully and  effectively  and 
holds to account countries that do not comply. 

191 

 
 
 
 
 
 
 
EUROPEAN COMMISSION 

Table 3.2: List of statistical data to be maintained in money-laundering cases 

FATF Recommendations 

Directive (EU) 2015/849 

Number of cases investigated.  

Number of persons prosecuted.  

Number of persons convicted for money-laundering 
or terrorist financing offences. 

Types of predicate offences, where such 
information is available, and value in Euro of 
property that has been frozen, seized or 
confiscated. 

Number of freezing, seizing and confiscation 
actions and the amounts or values involved, 
regarding money-laundering, terrorist financing 
and the 21 designated categories of predicate 
offences, collected in such a way as to ensure that 
there is no double-counting with respect to 
statistics relating to the money-laundering offence 
and the underlying predicate offence.  

Breakdown of whether such cases are domestic or 
relate to a foreign request.  

Statistics on the general level of criminality in the 
country. 

Breakdown of the status and/or ultimate outcome 
of such actions (e.g. pending, property released, 
property or value confiscated).   

Breakdown of the amounts ordered in confiscation 
proceedings and recovered. 

3.2.2. Publicly  available  information  on  assets  frozen  and 

confiscated 

In addition to collecting data directly from AROs, we also compiled available statistics from the 
literature – mainly FATF Mutual Evaluation Reports. This data – presented in Table 3.3 below – 
was available for the value of assets seized in money-laundering cases for 18 EU Member States.   

• 

• 

It is not possible to compare overall value over time because each year includes data for 
a different number of Member States.   

For the majority of countries, the value of assets frozen or confiscated fluctuates over 
time, which may reflect changes in valuation methodology or reporting practices, as well 
as practices targeting high or low valued assets.   

• 

The extraction of this data may be useful for future data collection efforts.   

192 

 
EUROPEAN COMMISSION 

Table 3.3: Statistical data on value of assets frozen and confiscated in money-laundering cases (€ million) 

Member State 

2014 

2015 

2016 

2017 

2018 

Sources of information used 

Austria 

Belgium 

Bulgaria 

Croatia 

F 

C 

F 

C 

F 

C 

F 

C 

F 

C 

- 

- 

- 

- 

12.52 

- 

- 

- 

- 

- 

- 

- 

- 

- 

- 

- 

- 

- 

- 

- 

- 

- 

- 

- 

78.02 

3.56  FATF, 2016, 2017b, 2018b 

- 

-  FATF, 2015, 2018c 

149.39 

12.53  MONEYVAL, 2013a, 2018f; 

- 

26.74 

- 

22.28 

- 

25.64 

- 

39.53 

3.00 

1.66  Croatian State Prosecutor's Office for 

OCSC, CEPACA and Supreme Court 
information 

Cyprus 

- 

- 

- 

- 

- 

- 

- 

- 

5.00 

0.10  MONEYVAL, 2011, 2013c, 2015, 2019b 

Czech Republic 

297.25 

343.45 

237.44 

45.19 

379.39 

21.09 

142.40 

8.41 

44.57 

-  MONEYVAL, 2018a; Office for 

the Suppression of Organized Crime and 
Corruption, n.d.; MONEYVAL, 2013b, 
2019c; State Attorney’s Office of the 
Republic of Croatia, n.d. 

Denmark 

Estonia 

Finland 

Greece 

1.78 

1.03 

2.22 

1.16 

0.47 

- 

- 

- 

- 

- 

160.90 

- 

- 

- 

Government Representation in Property 
Affairs (OGRPA), n.d. 
*Note: aggregated data for the period 
2012–mid 2017 

- 

- 

- 

- 

- 

- 

- 

-  FATF, 2017a, 2018a, 2019a; SKAT, n.d. 

9.88 

2.21  MONEYVAL, 2014, 2019c; Republic of 

Estonia, n.d. 

0.90 

5.60 

1.10 

4.90 

42.00 

1.60 

36.45 

19.33  FATF, 2019c; SEO information 

255.40 

- 

301.70 

- 

312.60 

- 

433.70 

-  Customs Authority, n.d.; FATF, 2019b; 
Hellenic Financial Intelligence Unit 
(HFIU); Independent Authority for 
Public Revenue, n.d.  

Hungary 

8.70 

- 

0.03 

- 

Ireland 

Latvia 

Lithuania 

- 

- 

76.12 

0.26 

- 

- 

- 

- 

14.97 

2.07 

- 

- 

- 

- 

- 

- 

- 

- 

- 

- 

- 

- 

12.57 

-  MONEYVAL, 2016, 2017, 2018b, 2019a 

- 

105.41 

- 

- 

HFIU, Police, NTCA, Prosecutor’s Office 
information 

2.18  FATF 2017, FATF 2019d, CAB & DPP 

information 

-  Moneyval 2018c, Moneyval 2019d, SP & 

SRS FPD information 

108.67 

0.43 

17.17 

2.49 

3.42 

-  Moneyval 2018d, STI & Prosecutors’ 

Office & MoJ information 

193 

 
 
Member State 

2014 

2015 

2016 

2017 

2018 

Sources of information used 

EUROPEAN COMMISSION 

F 

C 

F 

C 

F 

C 

F 

C 

F 

C 

0.03 

0.00 

0.05 

0.11 

0.09 

0.03 

0.12 

0.01 

0.59 

0.28  Moneyval 2018e, AGO information 

Malta 

Portugal 

Romania 

18.60 

- 

- 

- 

185.92 

- 

- 

- 

Sweden 

20.40 

6.90 

16.40 

4.00 

Number of Member States 

8 

8 

9 

8 

54.05 

- 

- 

7 

- 

- 

- 

6 

- 

- 

- 

5 

- 

- 

- 

6 

4.99 

-  FATF 2017c, DCIAP & Prosecutors’ 

Office & MoJ information 

468.72 

2.44  Moneyval 2014a, Compliance Enhancing 

Procedures 2018 & 2019, ANABI & MoJ 
information 

42.24 

3.67  FATF 2017d, FATF 2020  

14 

10 

Total 

583.77  409.51  713.33  266.34  845.47  106.13  514.30  157.45  12,92.55  47.97 

Where data was identified in local currencies, a conversion to EUR was made, taking the EUR/currency official rate for January 2020 as reference. 
Notes: F = freezing, C = confiscation, ‘-’ = no statistics available 

194 

 
 
 
 
 
EUROPEAN COMMISSION 

3.3.  Additional information on risk factors for SOC infiltration 

Mihaly  Fazekas  and  Yuliia  Kazmina,  Government  Transparency  Institute  and  Clément  Fays,  RAND 
Europe 

Key findings:  

•  Risk factors for SOC infiltration of companies and public procurement were examined.  

•  Regarding infiltration of companies, the analysis of financial and ownership risk 

indicators does not support the claim of the literature that SOC infiltrated companies 
have a significantly different financial or ownership profile than their non-infiltrated 
peers, when considering individual features. 

• 

• 

The analysis revealed that companies infiltrated by SOC have a distinct profile when 
considering multiple dimensions all at once. 

Extrapolations across the EU identified that corruption, high cash-intensity and weak 
legal frameworks are positively associated with level of SOC infiltration in the economy. 

•  Regarding infiltration of public procurement, single bidding, number of contracts 

awarded by the procuring entity in the year, the share of a supplier in buyer’s annual 
spending, and relative price are all associated with higher probabilities of SOC 
infiltration. 

• 

• 

The extrapolations to the whole EU revealed a rich and diverse picture that only partially 
overlaps with existing perceptions of where SOC infiltration is high.  

The analysis demonstrates that it would be both feasible and fruitful to build large-scale 
SOC risk-assessment tools – based on micro-level databases describing companies and 
public procurement contracts – that would allow frequent monitoring rather than one-off 
reports. 

In this annex, we elaborate on several elements of Section 3.3 of the main report. First, supporting 
materials for the analysis of risk factors for SOC infiltration of companies is described – this includes 
a  full  literature  review  of  risk  factors  identified  in  the  prior  literature,  detailed  methodological 
approach,  results  of  the  analysis,  and  key  findings  and  recommendations.  Second,  supporting 
materials for the analysis of risk factors for SOC infiltration of public procurement is described.  

3.3.1. Supporting  materials  for  analysis  of  risk  factors  for  SOC 

infiltration of companies 

Risk factors identified in the literature 
The existing body of literature on infiltration and investments of SOC groups in the legal economy is 
relatively large, enabling this analysis to start from a range of proposed indicators and empirical tests. 
A considerable scholarly debate has arisen among various authors who take diverse positions on what 
level of measurement – micro-, meso- or macro- – and what indicators – qualitative or quantitative, 
or a combination of both – to employ for the most precise measurement of SOC infiltration in the 
legal economy.  

The reviewed body of literature on indicators and red flags of SOC infiltration presents a 
wide variety of methodological approaches and potential data sources.  

As shown in Table 3.4: Quantitative and qualitative measurement of SOC 
infiltration in the legal economy 

195 

 
 
EUROPEAN COMMISSION 

Source 

Indicator 
used 

Meso/ 
Micro
/ 
Macro 

Country 

Year 

Sector 

Definition, 
description 

Schneider 
(2010) 

Cash intensity  Macro 

20 OECD 
countries 

1995–
2006 

All sectors 

Cobham, 
Janský, and 
Meinzer 
(2015) 

Financial 
secrecy, 
ownership 
links with 
secrecy 
countries 

Macro 

Internationa
l 

Finance 

The latest 
FSI was 
released in 
2018 

Blum, Levi, 
Naylor, and 
Williams 
(1998) 

Complexity of 
business 
ownership 

Macro 

N/A 
(qualitative) 

N/A 

Finance 

On a macro-level, 
cash intensity in this 
study had two 
indicators: i) 
confiscated money 
per capita as 
compared to ii) 
overall cash per capita 
in a country. 
Furthermore, the 
model controls for a 
number of prosecuted 
people in a country. 

When the Financial 
Secrecy Index (FSI) 
was created, many 
researchers turned to 
it as a proxy for tax 
heavens and opacity 
in global financial 
flows. The indicator is 
based on secrecy 
provided to non-
resident investors and 
has four different 
dimensions: 
knowledge of 
beneficial ownership, 
corporate 
transparency, 
efficiency of tax and 
financial regulation, 
and international 
standards and 
cooperation. 

Many attempts have 
been made to identify 
quantitative measures 
for the complexity of 
business ownership, 
however, it remains 
more of a qualitative 
assessment of risks of 
SOC infiltration on a 
macro level. Authors 
point out that the use 
of legal instruments – 
such as numbered 
trusts of various 
secrecy levels and 
International Business 
Corporations – could 
be red flags in this 
context. 

196 

 
EUROPEAN COMMISSION 

Source 

Indicator 
used 

Meso/ 
Micro
/ 
Macro 

Country 

Year 

Sector 

Definition, 
description 

Gurciullo 
(2014) 

High territorial 
specificity 

Meso 

Italy 

2004–
2006 

All sectors 

Italy 

2002 

All sectors 

Meso/ 
Micro 

High sectoral 
and company-
level 
centrality 
measures 

Scherrer & 
Thirion 
(2018) 

Golden Visas: 
investment-
based 
citizenship 
and residency 

Macro 

EU 

All sectors 

Depending 
on the 
availability 
of the data 

Savona & 
Riccardi 
(2018) 

Lower 
financial debt 
/  Higher 
proportion 

Micro 

EU 

2000–
2016 

All sectors 

Some researchers 
considered the 
territorial aspect of 
the issue and 
underlined that SOC 
groups tend to favour 
areas with overall low 
competition, low 
openness to 
international 
investments and 
public-protected 
sectors that enable 
SOC groups to 
monitor pervasively 
the territory in which 
they are active. 

The study is based on 
the network analysis 
approach and 
measures the 
centrality of sectors 
as well as individual 
firms. The degree of 
centrality of a 
company in a market 
network can be 
interpreted as an 
immediate 
risk/chance of a node 
receiving and 
capturing any signal 
or event flowing 
through the network.   
It was concluded that 
SOC tends to infiltrate 
sectors having a high 
degree of centrality 
and a monopolist kind 
of market. On the 
company level, high 
centrality is also 
associated with a 
higher level of 
organised crime. 

The study examined 
risks related to 
‘citizenship for sale’ 
and described a 
positive relationship 
between investment-
based visas in 
jurisdictions of high 
secrecy and a large 
scale of offshore 
financial activities. 

The MORE report 
presents a 
comprehensive list of 
red flags of SOC 

197 

 
EUROPEAN COMMISSION 

Source 

Indicator 
used 

Meso/ 
Micro
/ 
Macro 

Country 

Year 

Sector 

Definition, 
description 

shareholders’ 
loans 

Higher 
proportion of 
trade 
payables / tax 
payables 

Lower ratio of 
liquid assets / 
Total assets 

Higher 
variance of 
total 
assets/yearly 
reported 
revenues 

Administrative 
denials 

Corporate tax 
anomalies 

Quantified 
complexity of 
business 
ownership: 

- business 
ownership 
network 
distance 

- risk score of 
business 
ownership and 
shareholders 

Cash/Total 
Assets ratio 

EBITDA 
margin ratio 

Ferwerda & 
Kleemans 
(2019) 

Micro 

Netherlands  1996–last 

All sectors 

available 
as of 2019 

infiltration and their 
measurement, 
however we list here 
the most innovative 
ones that were not 
used by other studies 
extensively. They are 
all calculated on the 
firm-level with a 
possible aggregation 
on sector, region and 
country levels. These 
metrics are based on 
reported company 
financials, in 
particular balance 
sheets and income 
statements. The study 
presents financial 
ratios to detect 
suspicious activities or 
accounting techniques 
to hide them.  

In this study, 
researchers propose a 
list of innovative 
measures of SOC 
infiltration in the 
economy of the 
Netherlands. They 
introduced the use of 
data on administrative 
denials, which contain 
all records on revoked 
and rejected licenses 
in case of suspicion of 
criminal involvement. 
Furthermore, the 
study employed data 
on anomalies in tax 
declarations detected 
in tax inspections and 
introduced the 
quantified measures 
of complexity of 
business ownership. 
Interestingly, they 
also used a micro-
level cash intensity 
measure and EBITDA 
margin as one of the 
most accurate 
measures of 
profitability compared 
across business 
sectors.  

198 

 
EUROPEAN COMMISSION 

Source 

Indicator 
used 

Meso/ 
Micro
/ 
Macro 

Country 

Year 

Sector 

Definition, 
description 

De Boyrie, 
Pak, and 
Zdanowicz 
(2005) 

High capital 
flight 

Macro 

USA 

1995–
2000 

All export 
and import 
transactions 

Schneider & 
Windischbaue
r (2008) 

‘Errors and 
omissions’ in 
the balance of 
payments 

Macro 

Austria, 
Germany 

1999–
2005 

All sectors 

Soudijn 
(2015) 

Presence and 
betweenness 
scores of 
financial 
facilitators in 
a network 

Micro 

Internationa
l with focus 
on 
Netherlands 

2005–
2011 

Illegal drug 
trafficking 

This approach 
measures the residual 
of a country’s net 
capital official inflow 
of foreign direct 
investments, with the 
deduction of uses of 
funds such as current 
account deficit and 
additions to reserves. 
If this difference is 
negative, it is 
considered as the 
capital flight is 
attributed to 
individual wealth-
maximising 
behaviour, and could 
be an additional signal 
of SOC infiltration. 

‘Errors and omissions’ 
in the balance of 
payments on the 
macro level, as 
highlighted by the 
study, state the 
discrepancy between 
capital inflows and 
outflows and a failure 
to measure all private 
short-term capital 
movements. This 
might be an indicator 
of change in SOC 
activities in a country. 

On the basis of social 
network analysis, the 
authors evaluate 
presence and 
betweenness of 
different participants 
in a network of 31 
cases of SOC with a 
particular focus on 
financial facilitators, 
and highlight that 
professional ‘money-
launderers’ come into 
play only for relatively 
large illegal drugs 
businesses. However, 
the study also points 
out that police tend to 
encounter financial 
facilitators if ‘the 
police were actively 
looking for them’, i.e. 
if money-laundering 
was a priority at the 
earliest planning 

199 

 
EUROPEAN COMMISSION 

Source 

Indicator 
used 

Meso/ 
Micro
/ 
Macro 

Country 

Year 

Sector 

Definition, 
description 

Andrews, 
Brewster & 
Day (2018) 

SOC signals in 
social media 

Micro 

Internet 
based study 
using 
Twitter 

N/A 

Human 
trafficking 

Palan (2010); 
Young (2013) 

Banking 
liabilities and 
total assets 

Macro 

Internationa
l 

Banking 

Latest 
available 
as of 2013 

Savona & 
Berlusconi 
(2015) 

Set of spatial, 
sectoral, 
ownership 
features 

Macro/ 
Micro 

All sectors 

Italy, the 
Netherlands
, Slovenia, 
Sweden, 
and United 
Kingdom 

Depending 
on data 
availability
, mostly 
2012–
2014 

stages of an 
investigation. 

The study aims to 
capture weak early-
stage SOC signals in 
social media. 
Researchers employ 
formal concept 
analysis in 
combination with 
map-based 
visualisation, data 
extraction and NLP 
techniques to extract 
and classify data to 
detect, through social 
media, the presence 
of corroborated 
organised crime 
threats. 

When looking at 
financial ties between 
offshore jurisdictions 
and the West, the 
author draws 
attention to the fact 
that Europe and the 
UK in particular 
heavily invest in 
offshore centres. For 
example, Overseas 
Territories and former 
colonies of the UK 
accounted for 36% of 
international banking 
liabilities in 2008. The 
Cayman Islands 
themselves account 
for 42% of the global 
$4.4 trillion (USD) of 
offshore banking 
liabilities. As of 
September 2011, 
total assets in the 
Caymans were 
reported at $1.6 
trillion (USD). 

Project ARIEL 
presents a 
comprehensive 
approach to assessing 
risk factors 
contributing to the 
emergence and 
development of SOC. 
In addition to already 
discussed indicators, 
this study introduced 
new measures: 

- 

a territorial 
aspect of an 

200 

 
EUROPEAN COMMISSION 

Source 

Indicator 
used 

Meso/ 
Micro
/ 
Macro 

Country 

Year 

Sector 

Definition, 
description 

- 

- 

issue (since 
authors 
argue that 
territories 
with a rich 
history of 
past 
infiltration, 
regions with 
large urban 
areas and 
high levels of 
infrastructura
l equipment 
tend to be 
more 
vulnerable to 
SOC 
infiltration); 

sectoral 
characteristic
s (such as 
low level of 
competition, 
technology, 
and barriers 
to entry); 
and 

some aspects 
of ownership 
structure 
(namely 
firms having 
‘limited 
company’ as 
a preferred 
legal form, 
age, and 
gender of 
shareholders 
and 
directors, 
presence of 
familial 
relationships 
between 
shareholders 
and 
directors). 

N/A 

N/A 

All sectors 

Macro/ 
Meso/ 
Micro 

Vander Beken 
and 
Defruytier 
(2004) 

Combination 
of the 
operating 
principle of 
the spectrum 
of enterprise 
and the 
application of 
a risk-based 
methodologica
l process  

The study revisits the 
methodological issues 
of measurement and 
capturing of SOC and 
develops a 
comprehensive 
methodological 
framework which is 
based on two pillars: 
i) operating principles 
of enterprises drawn 
from monitoring and 
assessment of licit 

201 

 
EUROPEAN COMMISSION 

Source 

Indicator 
used 

Meso/ 
Micro
/ 
Macro 

Country 

Year 

Sector 

Definition, 
description 

Ferrante et 
al. (2019) 

Index of mafia 
presence 

Meso 

Italy 

1991, 
2001, 
2011 

Constructio
n sector 

and illicit markets and 
ii) a risk-based 
methodology, which 
considers 
organisations and 
counter strategies of 
illicit businesses and 
licit and illicit sector 
analysis. 

The research develops 
a new index of mafia 
presence based on 
municipal data and 
finds a robust 
association between 
criminal organisations 
and the degree of 
concentration in the 
construction industry 
in Sicily.  

 below, a large number of studies are based on single, micro-level indicators – such as, for instance, 
a firm’s cash-intensity, profitability, or balance sheet structure as compared to its peers in an industry 
–  while  other  studies  combine  a  set of  financial  metrics  with  more  aggregated  information on the 
sectoral or country-level, providing a more comprehensive picture than each individual red flag.  

A comprehensive study was published by Savona & Riccardi (2018) that presents a wide-ranging list 
of potential red flags of SOC infiltration and their measurement. The researchers focus on firm-level 
financial metrics that could be easily aggregated by sector, region and country. The study presents 
financial ratios to detect suspicious activities or accounting techniques to hide them. For instance, 
ratios focused on liabilities – lower financial debt / higher proportion of shareholders’ loans –
might indicate an infiltrated firm, since it will not require other external funding due to illicit revenue 
streams or shareholder’s support, when compared to peers in the firm’s industries and geography.  

Moreover, the authors highlight that infiltrated businesses tend to have less cash on hand and 
other liquid assets due to a fear of them being confiscated, thus other types of assets prevail 
in  the  balance  sheet  of  such  entities.  An  additional  set  of  indicators  regards  the  variance  of  total 
assets and revenues with high values not supported by objective market conditions as red flags.  

In line with the approach focused on financial ratios, other researchers widely employed 
financial statements-analysis to reveal differences between criminal and legal businesses, 
thus identifying red flags. 

Building  upon  a  combination  of  micro-,  meso-  and  macro-  indicators,  research  on  capturing  and 
measuring SOC infiltration has developed a more complex approach that employs network theory to 
analyse interconnected business ownership networks, networks of financial facilitators and geospatial 
networks. Such studies use financial secrecy of ownership links with secrecy countries as well 
as  the  overall  complexity  of  business  ownership  structure  for  measurement  of  SOC 
infiltration. The complexity of the ownership structure has been discussed in the literature in both 
qualitative and quantitative measures. Qualitative studies point out that the use of legal instruments 
– such as numbered trusts of various secrecy levels and International Business Corporations – could 
be red flags in this context. Nonetheless, this approach was extended by a study in the Netherlands, 
which introduced quantified measures of complexity of business ownership. These include ownership 
network distance and risk score of business ownership.  

Network  science  methods  further  contributed  to  the  research  into  SOC  infiltration  by  introducing 
company-level and sectoral network measures. It was underlined that  SOC groups tend to have 
high  territorial  specificity  as  they  favour  areas  with  overall  low  competition  and  low 

202 

 
EUROPEAN COMMISSION 

openness to international investments, as well as public-protected sectors that enable SOC 
groups to pervasively monitor the territory in which they are active. Furthermore, the network 
analysis approach extends to the measures of the centrality of sectors as well as individual firms. It 
was  concluded  that  SOC  tends  to  infiltrate  sectors  that  have  a  high  degree  of  centrality,  and  a 
monopolist or oligopolistic market. On  the  company  level, high centrality is also associated  with a 
higher level of SOC. 

Developing big data methods also resulted in a new approach to SOC studies that employ social media 
analysis  in  combination  with  formal  concept  analysis  and  neuro-linguistic  programming  (NLP) 
techniques to detect the presence of corroborated SOC threats. The exhaustive list of indicators of 
SOC infiltration in the legal economy discussed in the literature is presented in the table below.  

A closer look at the literature on risk factors of SOC infiltration, however, reveals several 
gaps and shortcomings.  

Despite  a  great  variety  of  indicators,  most  studies  rely  on  merely  theoretical  or  qualitative 
measures with no or very limited potential for implementation on a large scale, due to lack 
of  data.  Only  a  few  studies  in  the  field  demonstrate  a  comprehensive  analysis  of  quantitative 
measures  of  SOC  infiltration.  However  even  these  studies  typically  analyse  indicators  of  SOC 
infiltration indicator-by-indicator, without considering how they combine. Therefore, this report sets 
out  to  build  upon  and  complement  the  existing  body  of  literature,  expand  the  analysis  of  SOC 
infiltration indicators using proven cases and explore combinations of risk factors rather than looking 
at them in isolation.  

203 

 
EUROPEAN COMMISSION 

Table 3.4: Quantitative and qualitative measurement of SOC infiltration in the legal economy 

Source 

Indicator used 

Schneider 
(2010) 

Cash intensity 

Meso/ 
Micro/ 
Macro 

Macro 

20 OECD 
countries 

1995–2006 

All sectors 

Country 

Year 

Sector 

Definition, description 

Cobham, 
Janský, and 
Meinzer (2015) 

Financial secrecy, 
ownership links with 
secrecy countries 

Macro 

International 

The latest FSI 
was released 
in 2018 

Finance 

Blum, Levi, 
Naylor, and 
Williams (1998) 

Complexity of business 
ownership 

Macro 

N/A 
(qualitative) 

N/A 

Finance 

Gurciullo (2014)  High territorial 

Meso 

Italy 

2004–2006 

All sectors 

specificity 

On a macro-level, cash intensity in this study had 
two indicators: i) confiscated money per capita 
as compared to ii) overall cash per capita in a 
country. Furthermore, the model controls for a 
number of prosecuted people in a country. 

When the Financial Secrecy Index (FSI) was 
created, many researchers turned to it as a 
proxy for tax heavens and opacity in global 
financial flows. The indicator is based on secrecy 
provided to non-resident investors and has four 
different dimensions: knowledge of beneficial 
ownership, corporate transparency, efficiency of 
tax and financial regulation, and international 
standards and cooperation. 

Many attempts have been made to identify 
quantitative measures for the complexity of 
business ownership, however, it remains more of 
a qualitative assessment of risks of SOC 
infiltration on a macro level. Authors point out 
that the use of legal instruments – such as 
numbered trusts of various secrecy levels and 
International Business Corporations – could be 
red flags in this context. 

Some researchers considered the territorial 
aspect of the issue and underlined that SOC 
groups tend to favour areas with overall low 
competition, low openness to international 
investments and public-protected sectors that 
enable SOC groups to monitor pervasively the 
territory in which they are active. 

204 

 
Source 

Indicator used 

High sectoral and 
company-level 
centrality measures 

Meso/ 
Micro/ 
Macro 

Meso/ 
Micro 

EUROPEAN COMMISSION 

Country 

Year 

Sector 

Definition, description 

Italy 

2002 

All sectors 

Scherrer & 
Thirion (2018) 

Golden Visas: 
investment-based 
citizenship and 
residency 

Macro 

EU 

All sectors 

Depending on 
the 
availability of 
the data 

Savona & 
Riccardi (2018) 

Lower financial debt /  
Higher proportion 
shareholders’ loans 

Micro 

EU 

2000–2016 

All sectors 

Higher proportion of 
trade payables / tax 
payables 

Lower ratio of liquid 
assets / Total assets 

Higher variance of 
total assets/yearly 
reported revenues 

Ferwerda & 
Kleemans 
(2019) 

Administrative denials  Micro 

Netherlands 

Corporate tax 
anomalies 

Quantified complexity 
of business ownership: 

- business ownership 
network distance 

1996–last 
available as 
of 2019 

All sectors 

The study is based on the network analysis 
approach and measures the centrality of sectors 
as well as individual firms. The degree of 
centrality of a company in a market network can 
be interpreted as an immediate risk/chance of a 
node receiving and capturing any signal or event 
flowing through the network.   It was concluded 
that SOC tends to infiltrate sectors having a high 
degree of centrality and a monopolist kind of 
market. On the company level, high centrality is 
also associated with a higher level of organised 
crime. 

The study examined risks related to ‘citizenship 
for sale’ and described a positive relationship 
between investment-based visas in jurisdictions 
of high secrecy and a large scale of offshore 
financial activities. 

The MORE report presents a comprehensive list 
of red flags of SOC infiltration and their 
measurement, however we list here the most 
innovative ones that were not used by other 
studies extensively. They are all calculated on 
the firm-level with a possible aggregation on 
sector, region and country levels. These metrics 
are based on reported company financials, in 
particular balance sheets and income statements. 
The study presents financial ratios to detect 
suspicious activities or accounting techniques to 
hide them.  

In this study, researchers propose a list of 
innovative measures of SOC infiltration in the 
economy of the Netherlands. They introduced the 
use of data on administrative denials, which 
contain all records on revoked and rejected 
licenses in case of suspicion of criminal 
involvement. Furthermore, the study employed 
data on anomalies in tax declarations detected in 

205 

 
EUROPEAN COMMISSION 

Source 

Indicator used 

Meso/ 
Micro/ 
Macro 

Country 

Year 

Sector 

Definition, description 

- risk score of business 
ownership and 
shareholders 

Cash/Total Assets ratio 

EBITDA margin ratio 

De Boyrie, Pak, 
and Zdanowicz 
(2005) 

High capital flight 

Macro 

USA 

1995–2000 

All export and 
import 
transactions 

Schneider & 
Windischbauer 
(2008) 

‘Errors and omissions’ 
in the balance of 
payments 

Macro 

Austria, 
Germany 

1999–2005 

All sectors 

Soudijn (2015) 

Presence and 
betweenness scores of 
financial facilitators in 
a network 

Micro 

International 
with focus on 
Netherlands 

2005–2011 

Illegal drug 
trafficking 

Andrews, 
Brewster & Day 
(2018) 

SOC signals in social 
media 

Micro 

Internet based 
study using 
Twitter 

N/A 

Human 
trafficking 

tax inspections and introduced the quantified 
measures of complexity of business ownership. 
Interestingly, they also used a micro-level cash 
intensity measure and EBITDA margin as one of 
the most accurate measures of profitability 
compared across business sectors.  

This approach measures the residual of a 
country’s net capital official inflow of foreign 
direct investments, with the deduction of uses of 
funds such as current account deficit and 
additions to reserves. If this difference is 
negative, it is considered as the capital flight is 
attributed to individual wealth-maximising 
behaviour, and could be an additional signal of 
SOC infiltration. 

‘Errors and omissions’ in the balance of payments 
on the macro level, as highlighted by the study, 
state the discrepancy between capital inflows and 
outflows and a failure to measure all private 
short-term capital movements. This might be an 
indicator of change in SOC activities in a country. 

On the basis of social network analysis, the 
authors evaluate presence and betweenness of 
different participants in a network of 31 cases of 
SOC with a particular focus on financial 
facilitators, and highlight that professional 
‘money-launderers’ come into play only for 
relatively large illegal drugs businesses. 
However, the study also points out that police 
tend to encounter financial facilitators if ‘the 
police were actively looking for them’, i.e. if 
money-laundering was a priority at the earliest 
planning stages of an investigation. 

The study aims to capture weak early-stage SOC 
signals in social media. Researchers employ 
formal concept analysis in combination with map-
based visualisation, data extraction and NLP 
techniques to extract and classify data to detect, 

206 

 
EUROPEAN COMMISSION 

Source 

Indicator used 

Meso/ 
Micro/ 
Macro 

Country 

Year 

Sector 

Definition, description 

Palan (2010); 
Young (2013) 

Banking liabilities and 
total assets 

Macro 

International 

Latest 
available as 
of 2013 

Banking 

Savona & 
Berlusconi 
(2015) 

Set of spatial, sectoral, 
ownership features 

Macro/ 
Micro 

Italy, the 
Netherlands, 
Slovenia, 
Sweden, and 
United Kingdom 

Depending on 
data 
availability, 
mostly 2012–
2014 

All sectors 

Vander Beken 
and Defruytier 
(2004) 

Macro/ 
Meso/ 
Micro 

Combination of the 
operating principle of 
the spectrum of 
enterprise and the 
application of a risk-
based methodological 
process  

N/A 

N/A 

All sectors 

through social media, the presence of 
corroborated organised crime threats. 

When looking at financial ties between offshore 
jurisdictions and the West, the author draws 
attention to the fact that Europe and the UK in 
particular heavily invest in offshore centres. For 
example, Overseas Territories and former 
colonies of the UK accounted for 36% of 
international banking liabilities in 2008. The 
Cayman Islands themselves account for 42% of 
the global $4.4 trillion (USD) of offshore banking 
liabilities. As of September 2011, total assets in 
the Caymans were reported at $1.6 trillion 
(USD). 

Project ARIEL presents a comprehensive 
approach to assessing risk factors contributing to 
the emergence and development of SOC. In 
addition to already discussed indicators, this 
study introduced new measures: 

- 

- 

- 

a territorial aspect of an issue (since 
authors argue that territories with a rich 
history of past infiltration, regions with 
large urban areas and high levels of 
infrastructural equipment tend to be 
more vulnerable to SOC infiltration); 

sectoral characteristics (such as low 
level of competition, technology, and 
barriers to entry); and 

some aspects of ownership structure 
(namely firms having ‘limited company’ 
as a preferred legal form, age, and 
gender of shareholders and directors, 
presence of familial relationships 
between shareholders and directors). 

The study revisits the methodological issues of 
measurement and capturing of SOC and develops 
a comprehensive methodological framework 
which is based on two pillars: i) operating 
principles of enterprises drawn from monitoring 
and assessment of licit and illicit markets and ii) 
a risk-based methodology, which considers 

207 

 
EUROPEAN COMMISSION 

Source 

Indicator used 

Meso/ 
Micro/ 
Macro 

Country 

Year 

Sector 

Definition, description 

Ferrante et al. 
(2019) 

Index of mafia 
presence 

Meso 

Italy 

1991, 2001, 
2011 

Construction 
sector 

organisations and counter strategies of illicit 
businesses and licit and illicit sector analysis. 

The research develops a new index of mafia 
presence based on municipal data and finds a 
robust association between criminal organisations 
and the degree of concentration in the 
construction industry in Sicily.  

208 

 
 
EUROPEAN COMMISSION 

Detailed methodological approach 
The aim of this analysis is first, to calculate and review individual micro-level risk indicators of SOC 
infiltration of legal entities. In this task,  we calculate risk indicators for available proven cases of 
SOC  and  compare  the  results  with  the  overall  distributions  of  these  indicators  in  the  respective 
markets.  This  simple  review  of  individual  indicators  is  designed  to  establish  to  what  degree  the 
proven cases are outliers in their own sector and country. This is a necessary step for testing SOC 
indicators, because if the proven case appears to be average or near average in a sector along one 
of the SOC indicator dimensions, it will not be a particularly useful indicator on its own. 

Second,  we  employ  hierarchical  cluster  analysis  and  a  multi-dimensional  similarity  measure  to 
analyse combinations of risk factors and how widespread they are. In this case, we look at similarity 
to proven cases across all known indicators at once. The idea behind considering similarity along 
multiple dimensions all at once is that the reliability of SOC measurement greatly increases if multiple 
indicators are triangulated against each other. Even if each indicator on its own is a noisy measure 
of SOC infiltration, taken together they may well offer a precise measurement, as their combinations 
may be highly unusual. A summary of the steps taken is described in the table below.    

Table 3.5: Summary of analytical steps for analysis of risk factors for 
companies 

Steps of analysis 

Goals of analytical steps 

1(a). Calculate risk indicators for available 
proven cases of SOC 

1(b). Establish the distribution of the risk 
indicators for all firms in the respective markets 

1(c). Compare individual proven cases of SOC to 
a respective market distribution  

2(a). Perform hierarchical cluster analysis  

2(b). Develop a multi-dimensional similarity 
measure of businesses in sectors with identified 
cases of SOC  

3. Extrapolate the multi-dimensional similarity 
measure calculation to the whole EU economy 

4. Examine the relationship between estimated 
level of SOC and external macro-drivers of SOC 

The individual review of a risk indicator is aimed 
at establishing to what degree the proven cases 
are outliers in their own sector and country. This 
is a necessary step for testing SOC indicators 
because if the proven case appears to be 
average or near average in a sector along one of 
the SOC indicator dimensions, it will not be a 
particularly useful indicator on its own. 

Hierarchical cluster analysis is designed to 
compare and group European companies on the 
basis of their (dis)similarity as defined by a 
group of features, not a single indicator. The 
reliability of SOC measurement greatly increases 
if multiple indicators are triangulated against 
each other.  

The idea behind developing a multi-dimensional 
similarity measure is to have a universal, 
reliable measure of how any company of interest 
is similar to proven cases of SOC.  

The extrapolation of a comprehensive similarity 
measure to all European countries based on the 
available sample of cases of proven SOC tests 
the external validity of findings and illustrates 
the distribution of risks of SOC across the EU in 
the four markets with identified cases of SOC. 

We use the infiltration estimates built in previous 
steps to assess the macro risk factors discussed 
by the literature. 

The  sample  includes  81  cases  of  SOC  infiltration  coming  from  14  EU  states, mostly  Bulgaria  and 
Italy,  and  operating  in  construction,  finance,  real  estate  and  car  manufacturing  markets.  The 
company-level  information  is  drawn  from  the  Bureau  van  Dijk  (BvD)  database,  which  contains 
registry, ownership, and financial information on 796 thousand entities. The table below provides an 
overview of the cases of SOC infiltration that were used for this analysis.  

209 

 
 
 
 
EUROPEAN COMMISSION 

Table 3.6: Available cases of SOC infiltration of legal entities for the analysis 

Country 

Industry 

Italy 

Other professional scientific and technical activities 

Bulgaria 

Construction of buildings,  

Civil engineering,  

Specialised construction activities 

Bulgaria 

Advertising and market research 

Romania 

Construction of buildings 

Italy 

Italy 

Italy 

Manufacture of other non-metallic mineral products 

Construction of buildings 

Construction of buildings,  

Civil engineering,  

Specialised construction activities 

Croatia 

Advertising and market research 

Italy 

Italy 

Specialised construction activities 

Construction of buildings,  

Civil engineering,  

Specialised construction activities 

Bulgaria 

Financial service activities (except insurance and 
pension funding)  

Food and beverage service activities,  

Gambling and betting activities 

Bulgaria 

Other professional scientific and technical activities 

Romania 

Human health activities 

Italy 

Wholesale trade (except of motor vehicles and 
motorcycles) 

Retail trade (except of motor vehicles and motorcycles) 

The corresponding table of markets and respective NACE codes is presented below. 

Table 3.7: Identified markets 

Industry code as 
per 2-digit NACE 

Industry name 

23 

41 

42 

43 

46 

47 

55 

56 

58 

Manufacture of other non-metallic mineral products 

Construction of buildings 

Civil engineering 

Specialised construction activities 

Wholesale trade except of motor vehicles and 
motorcycles 

Retail trade except of motor vehicles and motorcycles 

Accommodation 

Food and beverage service activities 

Publishing activities 

210 

 
 
 
EUROPEAN COMMISSION 

Industry code as 
per 2-digit NACE 

Industry name 

64 

68 

70 

73 

74 

86 

92 

93 

Financial service activities, except insurance and 
pension funding 

Real estate activities 

Activities of head offices; management consultancy 
activities 

Advertising and market research 

Other professional scientific and technical activities 

Human health activities 

Gambling and betting activities 

Sports activities and amusement and recreation 
activities 

Step 1: Calculation and review of individual financial and ownership risk factors  

In this task, we calculate risk indicators for available proven cases of SOC and compare the results 
with  the overall  distributions  of  these  indicators  in  the  respective  markets.  This  simple  review  of 
individual indicators is designed to show to what degree the proven cases are different from other 
companies in their own sector and country. If the proven case appears to be average or near average 
in a sector along one of the SOC indicator dimensions, that measure will not be a particularly useful 
indicator on its own.  

Step 2: Development of a multi-dimensional measure of similarity  

We combine individual micro-level indicators into a single multi-dimensional similarity measure to 
analyse  combinations  of  risk  factors  and  how  widespread  they  are.  In  this  case,  we  look  at  the 
similarity to proven cases across all known indicators at once. The idea behind considering similarity 
along multiple dimensions all at once is that the reliability of SOC measurement greatly increases if 
multiple indicators are triangulated against each other. Even if each indicator on its own is a noisy 
measure of SOC infiltration, taken together they may  well offer a precise  measurement, as their 
combinations may be highly unusual. 

Supporting materials for cluster analysis 
Cluster analysis is a multivariate unsupervised method that aims to classify a sample of observations 
on the basis of a set of measured variables  (here, SOC infiltration risk factors) into  a number of 
different groups, such that similar subjects are placed in the same group. We used a hierarchical 
agglomerative method, in which observations initially started in their own separate cluster. At  the 
next stage, the most similar clusters in terms of Euclidean distance were then combined, and this is 
repeated until all observations end up in one cluster. The variables we considered using for clustering 
were  the  previously  discussed  financial  measures  (network-based  degree  or  degree  centrality 
measures were not used in the final analysis as they failed to sufficiently discriminate among cases) 
(see table below). 

Table 3.8: Descriptive statistics on variables used for clustering 

Metric 

Share of 
current 
assets 

Standard 
deviation of 
assets 

Standard 
deviation of 
revenue 

EBITDA 
margin 

Minimum 

1st quartile 

Median  

Mean 

3rd quartile 

0.007 

0.447 

0.805 

0.678 

0.957 

0.000 

0.000 

-618.064 

19749.779 

16369.318 

69474.283 

57596.401 

216884.297 

140558.732 

201032.518 

185938.765 

0.007 

0.091 

-2.292 

0.289 

211 

 
EUROPEAN COMMISSION 

Metric 

Share of 
current 
assets 

Standard 
deviation of 
assets 

Standard 
deviation of 
revenue 

EBITDA 
margin 

Maximum 

1.000 

7262826.532 

859334.807 

13.997 

After performing multiple attempts of clustering analysis with different parameters as well as a set 
of features, we conclude that using only financial indicators with six clusters yields the most salient 
clustering  result  (i.e.  minimising  intra-cluster  variance  while  maximising  inter-cluster  variance). 
Simply put, the criterion for the optimal clustering is the creation of such groups of observations 
(companies  in  our  case),  that  observations  within  a  group  are  highly  similar,  while  groups 
themselves are far apart in terms of chosen variables (financial indicators). 

The optimal number of clusters is defined with the help of the so-called ‘elbow’ method, which aims 
to define clusters such that the total intra-cluster variation (or total within-cluster sum of square) is 
minimised. The elbow method suggests that the more clusters we define, the lower total within sum 
of square we get (see Figure 3.1).  

Figure 3.1: Optimal number of clusters as per elbow method 

Results of the analysis  

Step 1: Calculation and review of individual financial and ownership risk factors  

While the literature suggests that businesses infiltrated by SOC should have a significantly different 
financial profile with respect to key financial metrics, our analysis reveals a different pattern. That 
is,  the  set  of  proven  cases  does  not  appear to  be  significantly  different  from  other  firms  in  their 
respective markets. Infiltrated companies are also broadly similar to other companies with regard 
to financial metrics, when examined by business sector. 

After reviewing financial measures as indicators of company infiltration, we further proceed with the 
analysis of network structure indicators. We focus on two network-based measures: the degree of 
an entity and its centrality measures. The literature suggests that high centrality of a company in 
an ownership network is associated with a higher level of organised crime, while it also suggests 
that infiltrated companies have a more extensive ownership network (Gurciullo, 2014). In order to 
test this hypothesis, we present ownership networks of the businesses featuring in proven cases of 
infiltration,  and  look  at  the  distribution  of  centrality  measures  of  proven  cases  of  SOC  infiltrated 
businesses and other businesses in the respective markets.  Infiltrated companies in the available 
sample have sparse ownership networks and low degree and centrality measures. The degree and 
centrality of proven cases of SOC are broadly similar to other companies in their respective markets. 

Many attempts have been made to identify or develop quantitative measures for the complexity of 
business ownership and its links with black-listed jurisdictions. The reviewed literature suggests that 
the  use  of  legal  instruments  such  as  numbered  trusts  of  various  secrecy  levels  in  various 
jurisdictions, including tax havens and black-listed jurisdictions, could be red flags in the context of 
SOC  infiltration.  Some  authors  describe  a  positive  relationship  between  ownership  links  and 

212 

 
 
 
EUROPEAN COMMISSION 

investment-based visas in jurisdictions of high secrecy and a large scale of offshore, potentially SOC 
infiltrated, financial activities.  

No ownership links with black-listed jurisdictions were discovered in the sample of proven cases of 
SOC. All shareholders and subsidiaries of convicted businesses in our sample were domestic firms. 
Contrary to the assumption outlined in the literature, the available pool of proven cases of SOC has 
no  links  with  high-secrecy  jurisdictions.  Hence,  the  empirical  material  on  proven  cases  warrants 
further analysis of ownership ties to secrecy jurisdictions on a larger sample of companies – all firms 
in the respective markets.  

Step 2: Development of a multi-dimensional measure of similarity  

We illustrate the results of the optimal clustering in the cluster dendrogram presented in Figure 3.2, 
which visualises how the clustering was performed. The cluster dendrogram should be read from the 
bottom to top representing the order in which observations were grouped in clusters. The bottom of 
the  dendrogram  shows  all  observations  arranged  in  order  of  quantitative  similarity  so  that  most 
similar firms are placed next to each other. At the next step, individual observations are joined in 
one cluster. This procedure of joining individual compounds or existing compounds is repeated until 
the  point  when  all  observations  are  grouped  in  one  cluster.  The  vertical  axis  ‘Height’  refers  to  a 
distance measure between observations or formed clusters. It can be interpreted as the number of 
iterations  needed  to  reach  the  final  stage  of  clustering.  What  we  clearly  see  from  the  presented 
cluster  dendrogram  (Figure  3.2)  is  that  based  on  the  selected  financial  indicators  the  algorithm 
defines three relatively big clusters (pink, blue and brown clusters), with the three other clusters 
grouping a small number of outliers. All companies in the markets with proven cases of SOC can be 
categorised into three large groups of companies based on the selected financial indicators. 

Figure 3.2: Cluster dendrogram 

Notes: Number of clusters = 6, all available records until 2015 year-end.  
Source: BvD, n = 796 thousand entities. 

On the histogram presented below, the distribution of the similarity measure is highly skewed, and 
most of the companies in markets with identified cases of SOC are grouped on the right-hand side, 
i.e. they have profiles similar to cases of SOC infiltration. 

213 

 
 
 
 
 
 
EUROPEAN COMMISSION 

Figure 3.3: Distribution of similarity measure in markets with identified cases 
of SOC infiltration  

Source: BvD, n = 796 thousand entities. 

Step 3: Predictions and extrapolations to all EU countries using the best model 

The  cluster  analysis  approach  and  the  developed  similarity  measure  allows  us  to  extrapolate  the 
assessment of SOC infiltrated businesses to all EU countries, with a focus on four industries in which 
we  have  at  least  three  proven  cases  of  SOC  infiltration  (wholesale  and  retail  of  motor  vehicles, 
construction activities, real estate activities and financial service activities). As an aggregated macro-
indicator of SOC infiltration, we developed a new measure – the share of companies with business 
profiles highly similar to proven cases of SOC. As a threshold for flagging an entity that is highly 
similar to cases of SOC infiltration, we set the similarity between cases in a particular market. The 
results of the macro-aggregation are presented on the maps below (the darker colour corresponds 
to a higher percentage).  

All the four industries have significantly different country rankings, both from each other and from 
perceptions of country rankings based on macro indicators. The visualisations are presented in Figure 
3.4 below.  

214 

 
 
 
EUROPEAN COMMISSION 

Figure 3.4: Distribution of share of companies with high similarity measure as 
compared to identified cases of SOC across Europe 

A)  Wholesale and retail trade of 

B)  Construction 

motor vehicles 

C)  Real estate activities 

D)  Financial service activities 

Step  4:  Examining  the  relationship  between  the  estimated  level  of  SOC 
infiltration across EU countries and macro-indicators  

215 

 
 
 
 
 
 
 
EUROPEAN COMMISSION 

Corruption 
According to the literature, the main sentinel crime would be corruption, as it indicates that OCGs 
have  lobbied  to  infiltrate  public  procurement,  avoid  control  and  facilitate  the  takeover  of  legal 
businesses (Savona & Riccardi, 2018). We are able to look for correlations between infiltration risk 
and  corruption  by  using  the  Control  of  Corruption  Index  (CCI)  in  the  Worldwide  Governance 
Indicators produced by  the World Bank.  This index is meant  to reflect the  extent to which  public 
power is captured by private interests. It is built using many different sources into a consistent and 
comparable annual index ranging from -2.5 (weak control of corruption) to 2.5 (strong control), and 
an unobserved components model is used to aggregate the different sources of information. For the 
purpose  of  our  analysis,  we  rescaled  the  index  from  0  (weak  control)  to  5  (strong  control).  It  is 
important to note that this indicator of corruption is mostly based on individual perceptions, and can 
therefore be different from the actual level of corruption within a country. For instance, it is possible 
that intensified action against corruption could increase the perception of corruption in a country in 
the  short  term.  Other  popular  corruption  indicators,  such  as  the  Corruption  Perception  Index 
measured by Transparency International, suffer from the same limitation. 

In  the  figure  below,  we  observe  a  negative  correlation  between  the  CCI  and  the  percentage  of 
companies flagged as at risk of infiltration in the motor vehicle trade sector. 

Figure 3.5: Correlation between Control of Corruption Index and share of 
companies flagged as likely infiltrated in the motor vehicles trade sector 

Cash-intensity  
According  to  the  literature,  the  most  prominent  vulnerability  facilitating  OC  infiltration  is  cash-
intensity (Savona & Riccardi, 2018). The fact that cash transactions are anonymous and very difficult 
to track make cash attractive to OCGs, who can use it for drugs transactions and other illicit services. 
Hence, businesses in countries where most transactions are done by cash are theoretically more at 
risk of infiltration, as OCGs can use this to hide their involvement. We assessed this hypothesis using 
an EU-wide survey from the European Central Bank (ECB) in 2017 (Esselink & Hernandez, 2017). 
Respondents were surveyed on many aspects of their use of cash, including the share of the value 
of their spending which was made using cash228. We define this share as the ‘cash-intensity’ of a 
country’s economy, and its correlation with our measure of infiltration. 

Once again, we observe an expected correlation between cash intensity and likelihood of infiltration 
in the trade of motor vehicles and construction sectors (no significant relationships were observed 
for the other sectors). The visualisations of correlations between cash-intensity and share of flagged 
companies  in  certain  sectors  are  presented  below.  There  are  some  clear  outliers  among  those 
countries where cash usage is high. For instance, zero percent of Austrian companies in ‘Wholesale 
and retail trade  of  motor vehicles’ are  flagged as being at risk of infiltration, even though nearly 
70% of all transactions are made using cash in the country. In contrast, all countries exhibiting low 
cash usage have a low share of flagged companies.  

228 Some EU countries were included in this survey. Data is missing for Bulgaria, Czech Republic, Denmark, UK, 
Croatia, Hungary, Poland, Romania and Sweden. 

216 

 
 
 
EUROPEAN COMMISSION 

Figure 3.6: Correlation between countries’ cash intensity and share of 
companies flagged as likely to be infiltrated 

A)  Wholesale and retail trade of motor vehicles 

B)  Construction 

Quality of the rule of law 
Previous  research  has  suggested  that  a  major  risk  factor  for  infiltration  is  opacity  of  business 
ownership and the level of financial secrecy (Savona & Riccardi, 2018). Legislation that allows 
opaque or complex ownership systems is ideal for criminals  wishing to invest in legitimate assets 
while  keeping  their  identities  concealed.  A  jurisdiction  with  a  lenient  legal  framework  regarding 
financial and ownership transparency can therefore be considered as being at risk – and observing 
recurrent occurrences of unnecessarily complex business ownership structures in a country should 
raise  suspicion  regarding  OCG  infiltration  (Savona  &  Berlusconi,  2015).  At  the  macro-level,  one 
source of data that we can use as a proxy for the quality of legal frameworks across EU Member 
States is the Rule of Law Index from the Worldwide Governance Indicators produced by the World 
Bank (World Bank, 2019). Rule of law is defined by the ‘perceptions of the extent to which agents 
have  confidence  in  and  abide  by  the  rules  of  society,  and  in  particular  the  quality  of  contract 
enforcement,  property  rights,  the  police,  and  the  courts,  as  well  as  the  likelihood  of  crime  and 
violence’ (World Bank, 2019). It is an index ranging from -2.5 (worst governance) to 2.5 (perfect 
governance).  For  the  purpose  of  our  analysis,  we  rescaled  it  from  0  (worst)  to  5  (perfect).  The 
visualisations of correlations between rule of law and share of flagged companies in the two usual 
sectors are presented below. As expected, higher ability to enforce the rule of law seems to crowd 
out infiltration, as OCGs are less able to conceal their illicit activities in legitimate businesses. 

217 

 
 
 
 
 
EUROPEAN COMMISSION 

Figure 3.7: Correlation between countries’ rule of law index and share of 
companies flagged as likely to be infiltrated 

A)  Wholesale and retail trade of motor vehicles 

B)  Construction 

3.3.2. Supporting materials  for  analysis  of  risk  factors  for  SOC 

infiltration of public procurement 

Risk factors identified in the prior literature 
While there is no dedicated literature discussing SOC infiltration indicators in public procurement, a 
large body of evidence looks at corruption risk indicators in public procurement around the world. 
Drawing on these studies enables us to at least derive a set of potentially relevant indicators, which 
then we can test in the empirical analysis below. 

In the last decade or so, a small but innovative academic and policy literature has emerged 
in public procurement, on the one hand establishing the validity of individual corruption 
proxies; on the other, providing a rich repository of potential corruption indicators based 
on practitioners’ and experts’ views. These studies look into tendering corruption risks, political 
connections and company risk profiles in various contexts, such as elections and high-level politics 
or welfare services and redistributive politics.  

First,  in  terms  of  tendering  risks,  a  widely  cited  example  is  Olken  (2007),  who  uses 
independent  engineers  to  review  road  projects  and  calculates  the  amount  and  value  of 
missing inputs to indicate corruption during contract implementation. Another approach to 
assess the amount of missing procurement outputs in infrastructure is proposed by Golden & Picci 
(2005),  who  examine  the  difference  between  the  stock  of  infrastructure  and  cumulative  public 
spending on it, using two independent data sources. Other authors use indicators characterising the 

218 

 
 
 
 
EUROPEAN COMMISSION 

bidding  process  on  the  micro-level:  the  use  of  exceptional  procedure  types  (Auriol  et  al.,  2016), 
negotiated procedures (Chong et al., 2016), explicit scoring rules (Hyytinen et al., 2018) or single 
bidder auctions (Klašnja, 2016). In addition to such quantitative measurement exercises, a wealth 
of  qualitative  studies  has  documented  the  nature  and  logic  of  diverse  corrupt  practices  in  public 
procurement. These studies cover many countries – both from OECD and non-OECD groups – from 
a more journalistic, government-centred  or legalistic approach  (David-Barrett  et al.,2018;  OECD, 
2007;  Transparency  International,  2006;  World  Bank,  2009).  Detailed  qualitative  accounts  of 
corruption strategies and techniques in public procurement provide a robust basis for identifying the 
most  widespread  corruption  situations  in  large-scale  datasets,  using  analytical  techniques  in  the 
quantitative literature quoted above. 

Second, the empirical literature looks at personal political connections as well as political 
influence established through political-party donations. Academic papers consider short- as 
well  as  long-term  direct  benefits  accruing  to  connected  companies  (1–4  years)  (Goldman  et  al., 
2013; Luechinger & Moser, 2014), while others consider ties either to specific individuals or parties 
as a whole (Straub 2014). Most studies look at individual countries with only partially comparable 
research  questions,  data  and  analytical  tools.  For  example,  in  Brazil,  companies’  campaign 
contributions  translate  into  additional  contracts  won  worth  14  times  more  than  the  contributions 
(Boas et al., 2014); the same figure in the US is only 2.5 times (Bromberg, 2014). Moreover, in the 
US the largest predictor of company procurement volume from before to after the 1994 change in 
the controlling majority of the House and the Senate was party connections/affiliations (Goldman et 
al.,  2013).  Even  in  Denmark,  which  is  viewed  as  one  of  the  least  corrupt  countries  of  the  world 
(Transparency International, 2020), direct family ties between companies and politicians increase 
company  profitability,  especially  in  sectors  dependent  on  public  demand,  i.e.  public  procurement 
(Amore & Bennedsen, 2013). At a different end of the reputational spectrum, one study looks into 
within-country  variation  and  tries  to  link  quality  of  institutions  to  the  association  between 
procurement  income  and  political  connections  in  Russia.  It  uses  a  unique  database  of  all  bank 
transfers leaked from the national bank to identify bogus transfers between companies clustering 
before elections (Mironov & Zhuravskaya, 2016). 

Third,  many  studies  look  at  how  corruption  alters  companies’  financial  performance, 
which  leads  to  signs  of  corrupt  corporate  behaviour  (in  addition  to  the  previously 
discussed  tendering  risks  and  political  connections).  Using  diverse  analytical  techniques, 
company turnover is often found to increase due to corruption (see e.g. Cheung et al., 2006; Cingano 
&  Pinotti,  2012;  Dávid-Barrett  &  Fazekas,  2016).  Overall  turnover  increase  typically  comes  from 
public  procurement  contracts,  which  often  also  translates  into  changes  in  the  share  of  public 
procurement income in  total turnover. Evidence  from  developed economies shows that return on 
assets, profitability and productivity increase significantly through winning public contracts due to 
connections (Amore & Bennedsen, 2013; Cingano & Pinotti, 2012; Williams et al., 2016), although 
other studies focusing on less developed economies find conflicting evidence. While some conclude 
that companies involved in corruption are the less efficient and less profitable ones (Cheung et al., 
2006; Di  Bono et al., 2015; Mironov & Zhuravskaya, 2016), others find the exact opposite or at 
least  a  mixed  picture  (Blagojevic  &  Damijan,  2012).  Further  authors  find  a  strong  relationship 
between government turnover and company success in high corruption economies, but not in clean 
countries (Dávid-Barrett & Fazekas, 2016). Finally, company-registry characteristics – such as tax 
haven registration or very young company age at the time of winning public procurement – contracts 
have been found to be associated with a range of other red flags in quantitative studies as well as 
case studies (Fazekas & Kocsis, 2015; Fazekas & Tóth, 2017). 

Detailed methodological approach 
The goal of this analysis is to predict mafia infiltration  of municipal public procurement contracts 
(coded  as  binary  variable:  1=SOC  infiltration;  0=SOC  non-infiltration)  based  on  procurement-
contract level and regional variables. The set of predictors was restricted in order to allow for EU-
wide extrapolation, using Tenders Electronic Daily (TED) data as compiled by DIGIWHIST (i.e. all 
variables only available in the Italian public procurement dataset, but not in TED were removed from 
the  analysis).  While the micro-level  validity  of  the  analysis  is  very  high,  the  results  were  further 
validated both on Italian and EU-wide data. First, we used Transcrime’s Italian region-level mafia 
index (Calderoni, 2014) to validate our procurement-specific SOC score for the whole of Italy (note, 
not just for the municipalities infiltrated). Second, we correlated the procurement specific SOC score 
on NUTS regions across the whole of the EU with macro-indices of SOC infiltration and corruption 
such as TI CPI. 

219 

 
EUROPEAN COMMISSION 

A  set  of  alternative  predictive  models  were  estimated,  and  the  best  method  selected  based  on 
prediction accuracy. The predictive models included both traditional regression analysis and machine 
learning, and in particular we compared three groups of models: logistic regression, Random Forest, 
and Gradient Boosting Machines. Sets of models were built to predict the binary outcome variable 
on  the  contract  level:  1=SOC  infiltration  of  the  contract/supplier;  0=SOC  non-infiltration  of  the 
contract/supplier. SOC infiltration was assumed if the contract was awarded in a municipality that 
was dissolved up to 3 years after the award of the contract, and SOC non-infiltration was assumed 
if the contract was awarded in a dissolved municipality 3 years  after the dissolution. Models were 
compared based on the percentage of correctly classified contracts on the test dataset, with 70% of 
the sample used for training the models and 30% used for testing accuracy. In addition, we provided 
a  test  for  external  validity  using  the  Transcrime  Mafia  Index  (Calderoni,  2014).  First,  we  report 
logistic regression results then Random Forest and Boosting estimations.  A summary of the steps 
taken are described in the table below.   

Table 3.9: Summary of analytical methods for analysis of risk factors in public 
procurement  

Steps of analysis 

Goals of analytical steps 

1(a). Estimate the probabilities of SOC 
infiltration using Random Forest Classifier.   

1(b). Estimate the probabilities of SOC 
infiltration using Gradient Boosting Machines 
(GBM) Classifier.   

1(c). Estimate the probabilities of SOC 
infiltration using logistic regression.   

Random Forest Classifier, as a more advanced method, 
was applied to improve the model accuracy, using the 
same set of predictors. It also allowed us to explore the 
most important variables for the prediction and inspect 
partial dependence plots for them.  

The GBM Classifier, another tree-based model, was 
developed to compare the results and accuracy among 
different models with the same predictors and select best 
performing approach.  

The first step was to estimate SOC infiltration 
probabilities for the sample of dissolved municipalities, 
using procurement-related indicators together with 
available social and geographical variables.   

2. Select the best model and features predicting 
SOC infiltration. 

Based on the prediction accuracy, we select the best 
model that will be used in further steps.  

3. Test the results against external 
measurements of SOC infiltration.  

4. Extrapolate the SOC infiltration score to the 
full sample of Italian municipalities and to the 
whole of Europe.   

To test the external validity of estimated models, we test 
the results for the infiltration score using Transcrime’s 
Italian region-level mafia index (Calderoni, 2014). This 
was for the whole of Italy and not just for the 
municipalities infiltrated. 

The final step was to use the best performing model to 
predict probabilities of SOC infiltration for the full sample 
of the Italian municipalities, and then to all regions in 
Europe. The extrapolation for Europe was made using 
TED public procurement database. The 
extrapolation allowed us to map the predicted risks of 
SOC infiltration for the European regions.   

The full list of indicators used in the analysis can be found in the table below. 

Table 3.10: Overview of variables used in the analysis 

Variable Name 

Variable Description 

Procurement-related indicators 

Log contract value 

Logarithm of the awarded value.  

Number of bids  

Number of bids submitted, trimmed at 20.  

CPV division 

First two digits of the main CPV code of the tender (XX000000-Y). 

220 

 
EUROPEAN COMMISSION 

Variable Name 

Variable Description 

Selection criterion 

Whether the main criterion for winner selection is the lowest price or 
MEAT.  

Contract delivery is local 

Whether the location of contract implementation is the same as the 
buyer’s location (y=1), or not (y=0).  

Consortium 

Whether tender winner is a member of consortium (y=1) or not (y=0). 

Supply type 

Whether procurement type is services, works or supplies.  

Framework agreement  

Whether a procurement procedure is a framework agreement (y=1) or not 
(y=0).  

Administrative error 

Share of missing key values (information about winner, buyer, contract 
value, number of bids) in the tender.  

Share of supplier in buyer’s 
annual spending 

Share of total contract value of a winner in a year divided by total contract 
value awarded by the procuring entity in a year.  

Number of contracts awarded 
by the procuring entity in the 
year 

Number of contracts awarded by the procuring entity in the year. 

Month of contract award 
publication  

Month of contract award publication. 

Quarter of contract award 
publication  

Quarter of contract award publication. 

Week in a month of contract 
award publication  

Week in a month of contract award publication. 

Day in a week of contract 
award publication  

Day in a week of contract award publication. 

Relative price 

Estimated price of the tender divided by the awarded contract value. 
Coded as a binary variable with y=1 if relative price is more than 1, and 
y=0 for other cases. 

Regional indicators 

Log population 

Logarithm of the population of the NUTS3 region of municipality.  

Area, thousand sq.km. 

Area of the NUTS3 region of municipality in sq.km.  

Coast region (y=1) 

Whether the municipality is located in the coastal region (y=1) or not 
(y=0). 

Mountain region (y=1) 

Whether the municipality is located in the mountain region (y=1) or not 
(y=0). 

The summary statistics for dissolved municipalities are presented in the table below. 

221 

 
 
 
EUROPEAN COMMISSION 

Table 3.11: Summary statistics for dissolved municipalities   

Number of 
contracts 

Mean 

St. Dev.  Min. 

Median  Max. 

Missing 
rate 

Number of contracts 
by procuring entity 

Share of supplier in 
buyer’s annual 
spending 

2,368 

17.84 

17.78 

1 

10 

65 

0% 

2,368 

0.47 

0.36 

0.00 

0.39 

1.00 

11% 

Relative price 

2,368 

0.88 

0.10 

0.38 

0.92 

1.54 

48% 

CPV division 

2,368 

43.3 

13 

1 

39 

70 

0% 

Regional population, 
thousand people 

2,368 

748.6 

708.6 

163.4 

559.8 

3,176.2 

2% 

Log contract value 

2,368 

12.67 

0.87 

0.00 

12.60 

20.98 

46% 

Number of bids 

2,368 

12.58 

26.44 

Procedure type 

2,368 

11.5 

2.7 

0 

1 

3 

11 

292 

45% 

21 

0% 

Tender selection 
method 

2,368 

15.37 

8.15 

25 

9 

26 

51% 

Supply type 

2,368 

23.2 

0.65 

22 

23 

24 

0% 

Consortium 

2,368 

0.04 

0.19 

2,368 

6.16 

3.93 

2,368 

0.04 

0.18 

0 

0 

0 

0 

9 

0 

1 

1 

1 

0% 

0% 

0% 

Local contract 
delivery 

Framework 
agreement 

Administrative error 
(number of key 
missing fields) 

Area, thousand 
sq.km. 

2,368 

0.48 

0.33 

0.00 

0.75 

1 

0% 

2,368 

2.95 

1.28 

1.15 

3.21 

6.83 

2% 

Coast region 

2,368 

0.96 

0.19 

Mountain region 

2,368 

0.72 

0.44 

Weekday of contract 
award publication 

2,368 

4.06 

1.50 

0 

0 

1 

Week in a month of 
contract award 
publication  

2,368 

3.16 

1.36 

1 

1 

1 

4 

3 

1 

1 

7 

6 

0% 

0% 

0% 

0% 

222 

 
 
EUROPEAN COMMISSION 

Number of 
contracts 

Mean 

St. Dev.  Min. 

Median  Max. 

Missing 
rate 

Quarter of contract 
award publication  

2,368 

2.60 

1.10 

1 

3 

4 

0% 

Results of the analysis  

Step 1: Estimate probabilities of SOC infiltration for Italian municipalities using 
different methods 

Supporting materials for Logistic Regression and Random Forest 

As a benchmark, traditional regression analysis is applied. In this step we fit a set of binary logistic 
regression varying the set of predictors included. The final model combines the significant contract- 
and regional-level predictors, as well as red flags from the three sets of variables (see Table 3.12 
below).  

Of the contract-level predictors, higher contract values are associated with lower average probability 
of  SOC  infiltration.  By  contrast,  one  can  observe  positive  coefficients  for  the  most  missing 
information variables – that is the higher the rate of missing information, the higher the likelihood 
of SOC infiltration. To estimate whether missing information in tender announcements is associated 
with higher average probability of mafia presence, we firstly use separate binary coded variables for 
each missing field, and then opt to the composite indicator (administrative error). 

We use four contract-level risk indicators in the model – number of bids (captures single bidding), 
number of contracts awarded by the procuring entity in the year, share of supplier in buyer’s annual 
spending,  and  relative  price.  In  line  with  expectations,  contracts  that  were  awarded  by  large 
procuring entities and received more bids, on average, have lower probabilities of SOC infiltration 
outcome. By contrast, larger values of the share of supplier in buyer’s annual spending increases 
the average probability of SOC infiltration. The effects of the region-level characteristics are large 
and statistically significant. Larger population, and proximity to coast and mountain areas increases 
the  probability  of  SOC  infiltration.  The  most  complete  logistic  regression  model  we  estimated 
achieved an already high degree of accuracy – the model predicted SOC infiltration correctly for 71% 
of observations in the test dataset.  

Table 3.12: Results of Logistic Regression for the SOC infiltration prediction 

Dependent variable: SOC infiltration 

(1) 

(2) 

(3) 

Log contract value 

Number of bids (trimmed at 20) 

-0.349*** 

(0.119) 

-0.038** 

(0.017) 

Single bidding 

Number of bids is missing  

Contract delivery is local 

-0.228 

(0.334) 

-0.341*** 

(0.118) 

0.166 

(0.285) 

0.923* 

(0.551) 

-0.201 

(0.339) 

-0.346*** 

(0.118) 

-0.038** 

(0.017) 

-0.237 

(0.334) 

223 

 
 
 
 
 
 
 
 
 
EUROPEAN COMMISSION 

Dependent variable: SOC infiltration 

(1) 

(2) 

(3) 

Place of contract delivery is missing 

Consortium (y=1) 

Supple type is works  

Supply type is services  

-1.030** 

(0.485) 

-0.620 

(0.511) 

1.477*** 

(0.491) 

0.400 

(0.380) 

Selection criterion is the lowest price 

0.437 

(0.315) 

-0.977** 

(0.482) 

-0.620 

(0.517) 

1.354*** 

(0.488) 

0.373 

(0.379) 

0.302 

(0.310) 

-1.030** 

(0.471) 

-0.580 

(0.506) 

1.473*** 

(0.490) 

0.379 

(0.379) 

0.453 

(0.313) 

Selection criterion is missing 

0.094 

-0.030 

0.157 

(0.497) 

(0.474) 

(0.435) 

Framework agreement (y=1) 

0.367 

(0.610) 

0.353 

(0.605) 

0.343 

(0.606) 

Information about winner is missing 

0.359 

Contract value is missing 

(0.252) 

1.177** 

(0.532) 

Administrative error (missing key 
values)  

1.320* 

(0.706) 

 2.045*** 

(0.680) 

Month of contract award publication  

-0.073 

(0.079) 

Quarter of contract award publication  

0.253 

Week in a month of contract award 
publication  

Day in a week of contract award 
publication  

Share of supplier in buyer’s annual 
spending 

(0.242) 

0.103** 

(0.049) 

0.136*** 

(0.043) 

1.435*** 

(0.202) 

Number of contracts by procuring 
entity 

-0.044*** 

(0.005) 

0.105** 

(0.049) 

0.137*** 

(0.043) 

1.438*** 

(0.201) 

-0.045*** 

(0.005) 

0.106** 

(0.049) 

0.140*** 

(0.043) 

1.388*** 

(0.195) 

-0.044*** 

(0.005) 

224 

 
 
 
 
 
 
 
 
 
 
 
 
 
EUROPEAN COMMISSION 

Dependent variable: SOC infiltration 

(1) 

(2) 

(3) 

Relative price (coded as binary 
variable with y=1 if relative price > 1) 

0.767 

(0.883) 

Log population 

Area, thousand sq.km. 

Coast region (y=1) 

Mountain region (y=1) 

0.926*** 

(0.133) 

0.067 

(0.062) 

2.441*** 

(0.391) 

0.408** 

(0.211) 

0.800 

(0.892) 

0.912*** 

(0.133) 

0.060 

(0.061) 

2.406*** 

(0.390) 

0.405* 

(0.211) 

0.704 

(0.878) 

0.928*** 

(0.133) 

0.069 

(0.062) 

2.430*** 

(0.392) 

0.413** 

(0.211) 

Constant 

-44.097 

-44.382 

-44.140 

(2,938.143) 

(2,937.684) 

(2,937.700) 

CPV division 

Procedure Type 

Yes 

Yes 

Yes 

Yes 

Yes 

Yes 

Observations 

1,657 

1,657 

1,657 

Log Likelihood 

-776.541 

-778.086 

-776.354 

Prediction Accuracy on the Test Set 

70% 

71% 

70% 

*p<0.1; **p<0.05; ***p<0.01 

Note: The model is fitted on the train set to predict the probability of SOC infiltration. The table reports the measure of model performance – 
accuracy of predictions for the test set. Administrative error is calculated as the share of key missing values. For models (2) and (3) the 
administrative error was calculated excluding covariates containing a special level representing missing values (e.g. ‘Selection criterion is 
missing’). 

In order to arrive at a precise estimate of SOC public procurement infiltration we estimated a series 
of tree-based machine learning algorithms (James et al., 2015). The advantage of these methods 
over traditional regression is that they are much more flexible, and are able to incorporate a series 
of interactions and non-linear relationships. Their disadvantage is that it is harder to interpret each 
predictor, nevertheless we provide examples and pointers as to the impact of each variable on SOC 
infiltration risk. 

In order to demonstrate the logic of the Random Forest algorithm we present a sample decision tree 
in Figure 3.8, which represents a section of one of hundreds of trees constituting the Random Forest 
model. For the sake of clarity, it is not shown at the full size, but only the first seven levels. 

225 

 
 
 
 
 
 
 
EUROPEAN COMMISSION 

Figure 3.8: Sample decision tree from the model of SOC infiltration 
classification 

More  advanced,  ensemble-based  methods  are  then  applied,  which  in  essence  combines  the 
predictive  power  of  a  large  number  of  decision  trees:  Gradient  Boosting  Machines  and  Random 
Forests, using the same set of predictors as for the logistic regression.  

Step 2 and Step 3: Selection of the best model and features predicting SOC and 
Validation using Transcrime’s mafia index 

The Logistic regression achieved 71% prediction accuracy, as shown in the table below. Boosting 
achieved 88% prediction accuracy for SOC infiltration in the test set, while the Random Forest model 
achieved 89% of accuracy, so performing slightly better.  

In addition to prediction accuracy of the sample of proven cases, we also look at the correlation of 
predicted SOC infiltration scores with the established proxy, the Transcrime Mafia Index on the level 
of provinces in Italy. The correlation coefficient between the estimated SOC infiltration probability 
based  on  the  prediction  of  the  Random  Forest  model  and  Boosting  model  equals  0.3  and  0.2 
respectively, considering the sample of contracts awarded by municipalities.  

226 

 
 
 
 
 
 
EUROPEAN COMMISSION 

Table 3.13: Models’ accuracy and correlation coefficient of predicted 
probabilities of SOC infiltration and Transcrime Mafia Index 

Logistic 
Regression 

Random Forest  Boosting 

Correlation on prediction for all Italian contracts 

Correlation on prediction for all Italian municipal 
contracts 

Prediction Accuracy on Test Set 

0.26 

0.49 

71% 

0.18 

0.3 

89% 

0.22 

0.24 

88% 

Taken together, we conclude that based on prediction accuracy and correlation with the 
Transcrime Mafia Index, the Random Forest model is the most reliable for identifying OC 
infiltration of municipal procurement contracts.  

Subsequently, we will use this best model for producing further estimates and demonstrating the 
explanatory power of the analysis. 

In order to better visualize the impacts of individual predictors on the probability of SOC infiltration 
of municipal procurement, a few high impact predictors are shown using partial dependence plots. 
In the figure below, the horizontal axis represents values of each variable, while the vertical axis 
depicts average predicted probability of SOC infiltration across all trees, holding all other variables 
constant.  For  instance,  for  values  greater  than  0.60  of  share  of  the  supplier  in  buyer’s  annual 
spending,  the  model  predicts  that  SOC  infiltration  is  highly  likely,  and  close  to  50%  probability. 
Similarly, the SOC infiltration is highly likely when the number of bids is 1. The upward trend is also 
observed for the population variable.  

Figure 3.9: Partial dependence plots for the five most important predictors in 
the selected Random Forest model 

227 

 
 
 
 
EUROPEAN COMMISSION 

Figure  3.10  below  shows  the  predicted  SOC  infiltration  probabilities  for  the  whole  Italian  public 
procurement dataset. Crucially from the perspective of using this indicator for further analysis, most 
contracts have a low estimated SOC infiltration probability, while a substantial minority of contracts 
have a predicted probability above 50%.  

Figure 3.10: Predicted probabilities of SOC infiltration at the contract level 
produced by the selected Random Forest model for the Italian procurement 
data 

Note: Histogram represents the distribution of estimated probabilities of the classification of each contract in the Italian dataset as the case of 
SOC infiltration. Parameter of the number of randomly chosen candidate predictors for each tree node = 14.  

Step  4:  Extrapolation  of  the  SOC  infiltration  score  to  the  full  sample  of  Italian 
municipalities and to whole Europe 

The Random Forest model, as the best model, was used to estimate the probabilities of the SOC 
infiltration of public procurement across the whole of Italy and for the rest of the EU. Each country 
or region received an aggregate score based on the average predicted probability of SOC infiltration 
for  all  its  municipal  contracts.  Crucially  from  the  perspective  of  using  this  indicator  for  further 
analysis,  most  contracts  have  a  low  estimated  probability  of  SOC  infiltration,  while  a  substantial 
minority  of  contracts  have  a  predicted  probability  above  50%.  The  distribution  of  predicted  SOC 
infiltration probabilities for the whole Italian public procurement dataset is presented below. 

The  geographical  distribution  of  the  predicted  SOC  infiltration  probabilities  for  Italian  regions  is 
shown in the figure below.   

228 

 
 
 
 
EUROPEAN COMMISSION 

Our  analysis  indicates  higher  predictions  for  Southern  regions  and  coastal  regions  of 
Italy.   

Figure 3.11: Mean value of predicted SOC infiltration probabilities for Italian 
regions based on contracts awarded by municipalities 

3.4.  Additional information on the  exploitation of the underground 

economy by OCGs 

Jirka Taylor, RAND  Corporation, Shann Hulme, Clément Fays and Fook Nederveen, RAND  Europe 
and Kamelia Dimitrova and Rositsa Dzhekova, Centre for the Study of Democracy  

Key findings: 

• 

• 

• 

There is no agreed definition of the underground economy. Some definitions include 
both legal and illegal activities, while others strictly exclude illegal activities. This 
creates problems in measuring and comparing estimates of the size and extent of the 
underground economy.   

The relative size of the underground economy is, according to estimates by Medina 
and Schneider (2019), larger in Eastern and Southern Europe than in Western and 
Northern Europe. 

The literature on the exploitation of the underground economy by OCGs remains 
limited. 

•  OCGs are in a particularly good position to exploit underground economic practices in 
sectors that are closely connected to many economic activities, and have a relatively 
centralised position in existing economic networks. 

• 

The underground economy and SOC intersect and thrive on each other in cases of 
THB for labour exploitation. 

229 

 
 
 
 
 
EUROPEAN COMMISSION 

In this annex, we elaborate on several elements of Section 3.4 of the main report. First, we expand 
on efforts to estimate the size of the underground economy. Two main categories of methods are 
discussed: direct and indirect methods, as well as their limitations. Then we discuss in greater detail 
estimates by Medina & Schneider (2019), whose work we used in this study to present the relative 
size of the underground economy in the EU and its member states. This is followed by a detailed 
overview of approaches that have been used for measuring the underground economy and drivers 
and indicators noted in existing literature on the topic. Given the prominence of Friedrich Schneider’s 
work in this field, we also provide an overview of the debate and criticisms surrounding this body of 
work. 

3.4.1. Details  of  efforts  to  estimate  the  size  of  the  underground 

economy 

Direct and indirect methods have been used to measure the underground 
economy in the EU 
The desktop research identified that many  studies have been carried out in the past 20 years  to 
measure the size of the underground economy. Several methods have been used, falling into two 
main categories: 

•  Direct methods relying on primary data collected from participants in the underground 

economy, experts or the general population (e.g. via interviews, surveys, etc.) 

• 

Indirect methods using indicators of the underground economy based on discrepancies 
between observed economic variables or trends (e.g. between reported personal income 
and personal consumption). The most common methods are presented later in this annex.  

At the EU-level, the most prominent example of direct method usage is a survey on undeclared 
work  implemented  by  Eurobarometer.  The  latest  instance  of  the  survey  occurred  in  2019,  when 
27,565 respondents across the 28 Member States were asked about their personal experiences and 
perception  associated  with  undeclared  work  in  their  respective  countries  (Eurobarometer,  2019). 
One main advantage of this survey is that it permits the study of both the supply and demand of 
the underground economy, by asking participants about the different ways they engage with it.  

Recent studies more often use indirect methods, most often the Currency Demand Approach (CDA) 
and Multiple Indicators Multiple Causes (MIMIC) modelling. The former consists of estimating a cash-
demand  equation,  and  interpreting  any  excess  of  demand  as  an  increase  in  the  size  of  the 
underground  economy.  MIMIC  modelling  aims  to  build  a  latent  variable  describing  the  annual 
variations in the size of the underground economy using a variety of drivers and indicators – which 
is then benchmarked using an exogenous measure of the underground economy (MIMIC procedure 
is described in the box below). These two methods have been improved in different studies to try to 
address their respective weaknesses (Ardizzi et al., 2014; Hassan & Schneider, 2016; Herwartz et 
al., 2015; Pickhardt & Sardà, 2015). In particular, CDA is often used for the external benchmarking 
step of the MIMIC model (Dybka et al., 2017). 

230 

 
 
EUROPEAN COMMISSION 

Box 9: MIMIC procedure 

MIMIC modelling is a theory-grounded approach exploiting the expected relationships between a set of observed 
drivers and indicators to build a latent variable. This latent variable is an index of the trend of the size of the 
underground economy describing only the annual size variations. Therefore, this index needs to be calibrated 
(through  benchmarking)  using  an  external  measure  of  the  underground  economy  for  any  year  in  the  past 
(Hassan & Schneider, 2016). This process is described in the schema below. 

Indirect methods rely on the drivers and indicators of the underground economy to estimate its size.  

•  Drivers are factors that favour the emergence and the growth of the underground 

economy, by giving incentives to individuals to conceal their activities.  

• 

Indicators are factors that can be used to indirectly observe the underground economy, 
as they are expected to be highly correlated with it.  

The distinction between driver and indicator can sometimes be thin, therefore some variables can 
often be used either as drivers or as indicators of the underground economy. The list of variables 
provided later in this annex are the most recurrent in the literature. 

These drivers and indicators are extensively used in the models to produce estimates of the size of 
the underground economy in the different countries. They are instrumental in the computation of 
the  latent  variable  used  in  the  MIMIC  models,  which  are  used  to  produce  most  of  the  recent 
estimates. For that reason, exploring empirical correlations between the measures of those drivers 
and  the  estimates  of  the  size  of  the  underground  economy  in  the  different  countries  would  be 
erroneous. Indeed, a correlation between a driver (such as tax burden) and the estimated size of 
the underground economy would be the reflection of the importance of this variable in the estimation 
procedure, rather than the proof of a connection between the driver and the underground economy. 
This was confirmed in an interview with an academic expert229.   

A very influential source of applications of an indirect methodology is Schneider, who has regularly 
published updated estimates of the size of the underground economy worldwide, principally using 
MIMIC modelling  techniques  (Medina & Schneider,  2018;  Schneider  & Buehn, 2018; Schneider  & 
Enste, 2000). In the past 20 years, Schneider has co-authored many studies using MIMIC modelling 
to update the estimated size of the underground economy in a large pool of countries on a very 
regular basis. These estimates have been highly popular and influential in the academic and policy 
literature, as well as in the popular press. 

Both direct and indirect methodologies are susceptible to biases and have important limitations that 
should be considered. These are discussed below.  

Prior  estimates  of  the  underground  economy  have  limitations  that  warrant  cautious 
interpretation. 

229 Interview with academic expert, 13 March 2020 (#19).

231 

 
 
 
 
 
 
EUROPEAN COMMISSION 

Underreporting  is  an  important  limitation  of  direct  methodologies,  such  as  the  Eurobarometer 
survey, as respondents might be reluctant to declare illicit activities. Hence, direct methods findings 
should always be considered as lower bounds. 

The main limitation of the MIMIC method – the indirect methodology employed by Schneider – 
relates to the benchmarking procedure, which consists of using an independent estimate of the size 
of the underground economy in a country for a given year as a base value. The MIMIC procedure 
only produces a latent variable, which allows study of the fluctuations of this size. Therefore, the 
final estimates for the most recent years produced via the MIMIC method are highly dependent on 
external  estimates  used  in  the  benchmarking  procedure,  and  the  reliability  and  validity  of  these 
estimates  are  often  difficult  to  assess  (Feige,  2016).  For  this  reason,  among  others,  Schneider’s 
work has been strongly questioned early on by Breusch (2005), and more recently by Feige (2016). 
Additional criticisms of Schneider’s methodology are discussed later in this annex.  

Existing estimates provide insight into the  relative size of the underground economy in 
the EU 

•  Bearing in mind the limitations discussed above, this section presents current estimates 

from direct and indirect methodology on the size of the underground economy in the EU.  

•  According to the 2019 Eurobarometer survey, 11% of respondents indicated that they had 
consumed undeclared goods or services, and 3% reported having engaged in underground 
activities themselves. These proportions varied significantly across Member States.  

•  On the demand side, the share of the population declaring having consumed undeclared 

goods or services ranges from 5% (Poland) to 30% (Malta).  

•  On the supply side, only 1% of participants from the UK, Cyprus, Malta and Poland 

declared having participated in undeclared paid activities, but 10% in the Netherlands 
(Eurobarometer, 2019).  

The map in the figure below shows the different levels of underground economy in the EU in 2017, 
as described in the latest iteration of Schneider’s work (Medina & Schneider, 2019). 

Figure 3.12: Relative size of the underground economy across EU Member 
States 

Source: Research team’s elaboration of Medina & Schneider (2019) 

232 

 
 
EUROPEAN COMMISSION 

Key observations about the relative size of the underground economy that can be drawn from this 
map include: 

• 

The relative size of the underground economy is, according to these findings, larger in 
Eastern and Southern Europe than it is in Western and Northern Europe.  

•  Member States from Southeast Europe are the most affected, with underground economies 

being nearly as large as a quarter of the size of the formal Gross Domestic Product (GDP) 
in Croatia, Bulgaria, Romania and Greece.  

• 

• 

• 

• 

The Member State with the largest underground economy relative to its legitimate 
economy in 2017 was Cyprus, where it represented 25.2% of the country’s legitimate GDP.  

To a lesser extent, the whole Eastern region of the EU exhibits relatively large 
underground economies. In Hungary, Poland and the Baltics, the underground economy is 
equivalent to approximately 20% of the formal GDP. The same also applies in most 
Mediterranean countries (Italy, Spain and Slovenia). 

In relative terms, Western Europe and Scandinavia seem less subject to the phenomena. 
For most Member States in this region, the size of the underground economy represents 
less than 13% of the formal GDP, the lowest relative size being in Austria (7.1% of the 
GDP). The only notable exception is Belgium, where the underground economy represents 
16.5% of the legitimate GDP. 

Large discrepancies are observed between the findings of the direct method (2019 
Eurobarometer survey) and those of the MIMIC model. For instance, Malta, Cyprus and 
Poland are among the countries reporting the least participation in underground economic 
activity, while the relative sizes of their underground economies are among the largest in 
Europe (according to Schneider). Underreporting probably plays a significant role in this 
difference, as people can understandably be reluctant to declare underground activity, and 
this propensity to underreport might differ across countries. 

Table 3.14: Approaches that have been used for measuring the underground 
economy 

Method name 

Description 

Strengths 

Weaknesses 

References 

DIRECT APPROACHES 

Surveys 

Asking a representative sample 
of the population about their 
behaviours to identify and 
measure shadow economy 
activities. 

Produces clear 
estimates, easy 
to interpret. 

Tax auditing 

Using fiscal auditing 
programmes’ findings in terms 
of undeclared taxable income 
as a proxy to calculate the size 
of the shadow economy 

Theoretically 
attractive. 

INDIRECT APPROACHES 

Schneider & 
Buehn 
(2017)  

Medina & 
Schneider 
(2018)  

Schneider & 
Enste (2000) 

Schneider & 
Buehn 
(2017) 

Schneider 
(2012) 

People are likely to 
underreport 
fraudulent 
activities. 

Costly to 
implement. 

Difficult to design 
an unbiased 
questionnaire. 

Poor comparability 
across different 
countries. 

The sample of 
audited companies 
is biased because it 
is not random.  

The estimates 
depend on the 
ability of the 
authorities to 
detect fraud. 

233 

 
 
 
 
 
EUROPEAN COMMISSION 

Method name 

Description 

Strengths 

Weaknesses 

References 

Discrepancies 
between 
national 
expenditures 
and income 
statistics 

As income and expenditure 
measures of the GNP should 
always be equal – the gap 
between the two could 
theoretically be interpreted as 
resulting from the shadow 
economy. 

Easy to 
calculate. 

Discrepancies are 
likely to be the 
result of national 
accounting errors; 
this method 
therefore lacks 
reliability. 

Discrepancies 
between official 
and actual 
labour 

Transactions 
approach 

Currency 
demand 
approach (CDA) 

The discrepancy between 
official and actual labour force 
could be interpreted as a proxy 
for shadow economy as the 
excess labour force would be 
the one employed in off-the-
book activities. 

As actual labour force cannot 
be observed, past studies 
assumed the labour force 
participation constant, and to 
interpret any decrease in the 
official participation rate as an 
increase in shadow activities. 

Using the assumption of 
constant relationship between 
the volume of transactions and 
the official GDP stated by the 
Fisher quantity equation – and 
assuming the equality of the 
total value of transactions to 
total nominal GNP – one can 
derive the size of ‘underground 
GNP’ by subtracting the official 
nominal GDP to the total value 
of transactions in the same 
year. 

Assuming that shadow 
transactions are always made 
using cash, the idea is to 
develop an equation for 
currency demand over time and 
to interpret any excess of 
demand as an increase in the 
size of shadow economy. 

Simple, easy to 
calculate. 

Grounded in 
economic 
theory. 

Theoretically 
attractive. 

Consistently 
replicable across 
countries. 

Assumption of 
constant labour 
participation rate is 
very strong. 

Variations of 
participation rate 
might be explained 
by other factors 
than underground 
activities. 

Need to arbitrarily 
choose a base year 
and assume that it 
was not affected by 
underground 
economy to derive 
size estimates. 

Difficult to gather 
complete and 
reliable data on 
transactions, in 
particular cash 
transactions. 

All shadow 
transactions might 
not be made in 
cash. 

Studies suggest 
different reasons 
for increases in 
cash demand. 

This method often 
assumes same 
velocity of money 
in both legal and 
shadow economy, 
which cannot be 
tested. 

Again, need to 
arbitrarily choose a 
base year and 
assume that it was 
not affected by 
underground 
economy to derive 
size estimates. 

Schneider & 
Buehn 
(2017) 

Medina & 
Schneider 
(2018) 

Schneider 
(2012) 

Schneider & 
Buehn 
(2017) 

Medina & 
Schneider 
(2018) 

Schneider 
(2012) 

Schneider & 
Buehn 
(2017) 

Schneider 
(2012) 

Schneider & 
Buehn 
(2017) 

Pickhardt & 
Sarda 
(2015) 

Ardizzi et al. 
(2014) 

Medina & 
Schneider 
(2018) 

Schneider 
(2012) 

234 

 
 
 
 
 
 
 
 
 
 
EUROPEAN COMMISSION 

Method name 

Description 

Strengths 

Weaknesses 

References 

The electricity 
consumption 
method 

Taking electric power 
consumption as an observable 
indicator of economic activity, 
the idea is to interpret 
differentials between electricity 
consumption growth and GDP 
growth as increases of the size 
of the shadow economy. 

Simple and 
appealing 
method. 

Accessible data. 

The direct link 
between electricity 
consumption and 
economic activity is 
questionable. 

This link is likely to 
be different across 
countries and over 
time. 

Schneider & 
Buehn 
(2017) 

Schneider & 
Enste (2000) 

Schneider 
(2012) 

The model 
approach 
(Multiple 
indicators, 
multiple causes 
estimation, or 
MIMIC) 

The idea is to build a latent 
‘shadow economy’ variable by 
using a structural equation 
model including known drivers 
of the shadow economy. Then, 
the latent variable is used to 
predict a set of shadow 
economy indicators in a 
measurement model. If the 
latent variable proves to be an 
efficient predictor of the 
shadow economy indicators, it 
can then be used to predict 
evolution in the size of the 
shadow economy. 

Wider approach 
than competing 
methods since it 
can use several 
causal factors 
and indicators. 

Flexible in its 
application, can 
be adjusted to 
available data. 

More confirmatory 
than explanatory 
model. 

Schneider & 
Buehn 
(2017) 

Only produces 
relative estimates 
(latent variable), 
therefore need to 
use a benchmark 
observation 
produced by 
another method. 

Hassan & 
Schneider 
(2016) 

Medina & 
Schneider 
(2018) 

Schneider 
(2012) 

235 

 
 
 
 
 
EUROPEAN COMMISSION 

Variable 

Theory 

Data 

References 

Table 3.15: Drivers and indicators of the underground economy 

DRIVERS 

The economic burden 
of tax and social 
security contributions 

The higher the cost induced by tax and social security contributions, the more 
likely individuals are to seek escaping them by going underground, and hence 
maximize their incomes. In addition, low tax morale is also understood as a driver 
of the shadow economy. Indeed, previous studies have argued that taxpayers are 
more likely to evade their duty if they perceive that their tax money is unfairly 
used and distributed. 

Countries’ national data on 
tax and social contribution 
levels 

Hassan & 
Schneider 
(2016) 

Regulations 

Higher levels of regulation in the legitimate economy are likely to increase the 
likelihood of some activities to go off-the-books. For instance, labour market 
regulations in terms of minimum wages, maximum working hours or workers’ 
safety standards can be perceived as too pressuring on the labour costs, and 
hence provide further economic incentives to hide activities. 

Economic and business 
freedom indexes 

Institutional quality 

The ability for an administration to apply the tax codes and regulations in an 
effective and transparent way can be a more decisive decisional factor to operate 
in the underground economy than the actual burden of taxes and regulations.   

Furthermore, presence of corruption in an administration will reduce the ability to 
enforce the different regulations, and hence facilitate the concealment of activities 
and reduce the benefits of being formal. 

Rule of Law index 

Regulatory Quality index 

Government Effectiveness 
index 

Control of Corruption index 

As formal businesses often benefit from good-quality public services, the inability 
to efficiently deliver good public services also increases the attractiveness of the 
underground economy. This is a vicious circle, as the increase in the size of the 
shadow economy automatically reduces the tax revenues of the public sector, 
which hinders its ability to efficiently deliver public goods, which in turn favours 
the development of the shadow economy. 

If public-sector weaknesses can therefore increase the development of the 
informal economy, it sounds reasonable that a good deterrence strategy can 
inversely slow it down. However, data to prove such an assertion is difficult to 
collect, and there is weak evidence that effective deterrence is helping to reduce 
the size of the shadow economy. 

Herwartz, 
Schneider & 
Tafenau (2010) 

Feld & Schneider 
(2010) 

OECD (2017) 

Enste (2015) 

Medina & 
Schneider 
(2018) 

Schneider & 
Buehn (2018) 

Williams & 
Schneider 
(2016) 

Herwartz, 
Schneider & 
Tafenau (2015) 

Hassan & 
Schneider 
(2016) 

Feld & Schneider 
(2010) 

OECD (2017) 

236 

 
 
 
EUROPEAN COMMISSION 

Variable 

Theory 

State of legitimate 
economy 

High unemployment and self-employment rates might incentivize individuals to 
move to the shadow economy to generate incomes.  

Some sectors are also more likely to have a part of their activity hidden from the 
authorities. This is for example the case of the agricultural sector, for which 
relative size can be considered as both a driver or an indicator of the size of the 
shadow economy. 

Data 

References 

Countries’ national data on 
unemployment/self-
employment 

Williams & 
Schneider 
(2016) 

INDICATORS 

Size of the formal 
economy 

Cash in circulation 

There is a proven negative correlation between the size of the shadow economy 
and the size of the formal economy, all else being equal. The reason behind this is 
quite straightforward – the shadow economy growth is detrimental to legitimate 
economy growth.  

Countries’ national data on 
GDP 

Individuals involved in shadow activities are more likely to make their transactions 
in cash than with other payment methods that are more easily traceable, and thus 
more likely to attract the attention of the authorities. Therefore, an excessive 
demand for cash (compared to legitimate reasons for people to hold cash) in a 
country might suggest that it is used in the underground economy. 

Ratio of cash in circulation 
(M1/M2) 

Labour participation 
rate 

The underground economy is crowding out workforce from the legitimate 
economy. Hence, the larger the underground economy is, the lower the official 
labour participation rate should be (all else being equal). 

Countries’ national data on 
labour participation rate 

Feld & Schneider 
(2010) 

Hassan & 
Schneider 
(2016) 

Hassan & 
Schneider 
(2016) 

Hassan & 
Schneider 
(2016) 

Medina & 
Schneider 
(2018) 

Hassan & 
Schneider 
(2016) 

Medina & 
Schneider 
(2018) 

237 

 
 
EUROPEAN COMMISSION 

Controversy surrounding Schneider’s work  
Problem of definition and scope 
As defined in Schneider’s work, the underground economy (or ‘shadow economy’) is a component 
of the unobserved economy, alongside the illicit economy and the informal economy. However, 
Feige  (2016)  noticed  that  Schneider’s  estimates  of  the  size  of  the  underground  economy  are 
significantly larger than estimates of the size of the unobserved economy for the same countries 
and  years  for  which  he  collected  data  from  national  statistical  agencies.  This  is  of  course 
counterintuitive, as by definition the underground economy cannot be larger than the unobserved 
economy. Schneider’s estimates are therefore unexpectedly high. In 2002 a publication on the 
measurement of the non-observed economy by the Organisation for Economic Co-operation and 
Development  (OECD)  had  already  noted  that  macro  models,  such  as  the  MIMIC  employed  by 
Schneider,  have  the  tendency  to  ‘produce  spectacularly  high  measures,  which  attract  much 
attention from politicians and newspapers’ (OCED, 2002).  

High sensitivity of the model 
MIMIC models require researchers to assign a unit coefficient to one of the indicator variables, for 
normalisation. It means that one of the indicator variables is arbitrarily set to have a one to one, 
or one to negative one, correlation with the latent variable, which will in turn be used to calculate 
the size of the underground economy. Common choices of variable for the normalising indicator 
are currency holdings, GDP per capita or real GDP. The problem is that the choice of the sign of 
the coefficient assigned to the normalising indicator is made arbitrarily and has a direct impact 
on  the  conclusions  of  the  model.  For  instance,  Breusch  (2005)  indicated  that  in  a  study  from 
Dell’Anno & Schneider (2003), the arbitrary choice of assigning a negative coefficient to real GDP 
was  the  only  reason  for  the  study’s  conclusions  that  tax  burden,  government  size  and  self-
employment  positively  affect  the  size  of  the  underground  economy.  Had  the  coefficient  of  the 
normalising indicator been set to one, the results would have been different. Feige (2016) pointed 
out that all Schneider’s MIMIC models find consistent correlations between indicator variables and 
the underground economy, which are not always in line with the theory. According to him, this 
suggests that the results are biased to fit into the authors’ prior beliefs.  

Lack of documentation on the benchmarking procedure 
The MIMIC models employed in Schneider’s papers ‘only’ produce a latent variable, which is an 
index meant to describe the evolution of the underground economy year on year. The actual size 
of the underground economy is calculated during the benchmarking procedure, which is done by 
taking the estimate from a prior exogenous study and adjusting it to another year using the values 
of the latent variable in both years. A major point of criticism from Feige (2016) on Schneider’s 
studies is their lack of documentation regarding the sources used for the benchmarking procedure. 
If it is indicated that these studies use currency demand models, too few details would be shared 
regarding their data sources or specifications, making it impossible for other researchers to assess 
the quality of these estimates or to replicate them. 

Professor  Schneider  answered  to  these  critics  in  a  response  paper  (Schneider,  2016).  On  the 
question  of  scope,  he  in  turn  questioned  the  source  of  the  unobserved  economy  estimates 
presented by Feige, which were obtained through private conversations with national statistical 
agencies, and hence non-verifiable. He also denied the assertion that the choice of the coefficients 
signs  for  the  normalising  indicators  is  arbitrary,  arguing  that  it  is  based  on  economic  theory. 
Finally, he strongly rejected the accusation regarding the lack of documentation of his studies. He 
affirmed that all necessary information, data and code had been provided to all researchers willing 
to undertake the replication of his results, including to Feige himself. 

In  conclusion,  the  reliability  of  the  estimates  presented  above  is  subject  to  debate  among 
academic  experts.  Yet,  they  are  the  only  existing  estimates  coming  from  a  unique  consistent 
source. They are also widely used in economics, public policy and crime literature. Hence, it is 
reasonable to use them as indicators of the different sizes of undergrounds economies across EU 
Member States. However, we need to remain cautious and critical when it comes to interpreting 
these results,  as they are  not  unanimously accepted  among the experts in the field. Professor 
Schneider himself recognizes that the estimates have a margin of error of 15% (Schneider, 2016). 

238 

 
 
 
EUROPEAN COMMISSION 

3.4.2. Illustrating the use of the underground economy by SOC 

in the labour sector 

Kamelia Dimitrova and Rositsa Dzhekova, Centre for the Study of Democracy 

In order to better understand the links between SOC and underground economy structures and 
the modus operandi of OCG exploitation of such structures, we undertook a case study analysis 
focusing on the use of undeclared work by OCGs involved in THB for labour exploitation in Bulgaria 
and  Romania.  We  focused  on  THB  because  there  is  known  to  be  heavy  organised  crime 
involvement and a known intersection with the labour sector, and we focused on Bulgaria and 
Romania because they are among the top five EU countries for  registered victims of trafficking 
(European Commission, 2018c).  

As previously noted, there is a relative paucity of evidence on the interaction between OCGs and 
the underground economy,  and the two phenomena  are  often dealt with  separately. This case 
study  thus  aims  to  address  this  gap  in  knowledge  by  illustrating  how  OCGs  exploit  the 
underground economy in the case of THB for labour exploitation.  

The case study will review how OCGs  adopt different undeclared work practices and fraudulent 
schemes  throughout  the  different  phases  of  labour  trafficking,  in  order  to  avoid  government 
detection and achieve cost reduction and profit increase at the expense of the human rights of 
victims.  

The  analysis  is  based  on  literature  review  as  well  as  analysis  of  11  different  proven  cases  of 
trafficking for labour exploitation conducted by OCGs from Bulgaria and Romania, identified via 
searches in judicial databases, media reports and through stakeholder interviews. Furthermore, 
the  case  study  draws  on  14  interviews  with  national  stakeholders  from  Bulgaria,  Romania, 
Germany,  Austria,  Spain,  Sweden  and  Belgium  (including  law  enforcement  officers,  labour 
inspectors,  social  security  inspectors,  trades  union  and  Non-Governmental  Organisation 
representatives). Bulgaria and Romania were selected as they are both primary countries of origin 
of  trafficking  victims  in  the  EU.  In  addition,  while  trafficking  for  labour  exploitation  remains 
underreported, both countries have experienced a significant increase in the prosecuted cases of 
THB for labour exploitation in the past 5 years. Bulgaria and Romania have some of the highest 
shares of undeclared economy in the EU (European Commission, 2017b). 

The extent of THB in Bulgaria and Romania 
Bulgaria – along with Romania, Hungary, the Netherlands and Poland – is one of the top five EU 
countries of citizenship of registered victims of trafficking (European Commission, 2018c). Each 
year,  between  400  and  500  victims  are  registered  in  criminal  statistics  by  the  Bulgarian 
Prosecutor’s Office (НКБТХ, 2017, 2018, 2019). This number is cumulative and refers to all victims 
identified in criminal proceedings in the respective year.  

In Bulgaria, about 13% of the registered victims in the last two years (2017–2018) were trafficked 
for labour exploitation, while trafficking for sexual exploitation remains the prevalent form with 
65%–70% of registered victims. Other forms of exploitation include trafficking for the purpose of 
sale of unborn babies and trafficking for begging. Data from the Bulgarian National Commission 
for Combatting Trafficking in Human Beings (NCCTHB) show a slight increase in registered THB 
for labour exploitation cases from 2014 onwards. This is due to the increased attention to this 
type of crime both on EU-level and Member State-level (Europol, 2016; НКБТХ, 2019)230.  

Romania is also a key source country for victims trafficked within the EU.  The THB market in 
Romania appears to have been shrinking in the last 10 years, according to statistics published by 
the Romanian National Agency against Trafficking in Persons (ANITP). The number of victims of 
labour exploitation come at second place after the victims of sexual exploitation  – at 17% and 
20%  in  2017  and  2018  respectively.  The  total  number  of  victims  of  all  forms  of  exploitation 
(including  sexual  exploitation,  labour  exploitation  begging  and  other  forms)  has  also  been  in 

230 Interview national stakeholder, 16 March 2020.

239 

 
 
 
 
 
EUROPEAN COMMISSION 

decline, to 497 victims in 2018 (see the figure below)231. Regarding the countries of exploitation, 
official statistics of ANITP show that internal trafficking most prevalent, with most of the Romanian 
victims being trafficked in their own country (Romania Insider, 2019). 

Figure 3.13: Victims of trafficking in Bulgaria by type of exploitation 

700

600

500

400

300

250

200

100

216

24

s

m

i
t
c
i
v
f
o
r
e
b
m
u
N

580

579

541

480

455

369

540

491

428

409

346

296

508

447

443

409

314

329

323

309

32

94

143

124

0
2008 2009 2010 2011 2012 2013 2014 2015 2016 2017 

44

16

26

31

67

59

2018 
Г.

Year

Total

sexual

labour

Г.

Source: Bulgarian National Commission for Combatting Trafficking in Human Beings annual reports. 

Figure 3.14: Victims of trafficking in Romania by type of exploitation 

231 Government's Reply to GRETA's 3rd Questionnaire, published 10 January 2020.

240 

 
 
 
 
 
 
 
 
 
 
EUROPEAN COMMISSION 

896

450

375

757

499

188

880

756

498

530

180

132

662

454

79

497

335

100

2500

2000

1048

1041

1500

1000

500

557

506

408

410

s

m

i
t
c
i
v
f
o
r
e
b
m
u
N

0
2011

2012

2013

2014

2015

2016

2017

2018

Year

Labour exploitation

Sexual exploitation

Total

Sources: ANITP annual reports. 

Characteristics of victims of THB for labour exploitation in Bulgaria and 
Romania 
Most of the victims of trafficking for labour exploitation in  Bulgaria are adult males – around 
two-thirds of all registered victims. Victims typically originate from economically disadvantaged 
regions,  such  as  northwestern  Bulgaria,  and  have  low  socio-economic  status.  The  victims  are 
typically  in  an  economically  active  age  and  have  low  educational  qualification  levels.  Country 
reports, case studies and additional interviews reveal that men from marginalised communities 
are frequently targeted for labour exploitation in the agricultural and construction sectors (GRETA, 
2019).  

The profile of the victims for labour exploitation in Romania is similar to the profile of victims from 
Bulgaria. Most of the victims for labour exploitation in the period 2015–2018 were male (83%), 
adult (90%), from rural areas (63%) and with poor education (60% up to secondary school)232. 

Most  common  destination  countries  and  sectors  for  victims  of  THB for 
labour exploitation in Bulgaria and Romania. 
The  most  common  destination  countries  of  Bulgarian  victims  of  trafficking  for  labour 
exploitation are  Germany, France, Italy, Belgium,  the  Netherlands,  the  UK  and Greece, though 
national statistics do not allow for more precise disaggregation by country (НКБТХ, 2017, 2018). 
The  most  common  economic  sectors  where  exploitation  takes  place  include  agriculture, 
hospitality, construction, and domestic and social care (НКБТХ, 2017, 2019). In addition, schemes 
of  sham  employment  in  au-pair  services  were  identified  as  potential  trafficking  for  labour 
exploitation  (European Commission, n.d.). More recently,  experts point  to  industries  – such as 
recycling,  meat-processing,  beauty  salons  and  the  transport  sector  – that  are  susceptible  to 
trafficking and labour exploitation of Bulgarian nationals233. 

For Romania, victims for labour exploitation are mostly exploited in Romania (27%), the United 
Kingdom (18%), Germany and Italy (12% each). All the victims in the ANITP 2015–2018 database 

232 Years 2015–2018 were considered because for these years the data are in open format.
233 Interview national stakeholder BG, 16 March 2020 (#52);  

241 

 
 
 
 
 
 
 
 
EUROPEAN COMMISSION 

for labour exploitation  were  Romanian.  As regards  the sectors of labour exploitation,  the main 
areas are agriculture, construction, hospitality and day-care for children and elderly.  

The exploitation of underground markets and the grey areas between 
the licit and illicit economy in the context of THB for labour exploitation 
Drawing on analysis of 11 proven cases of THB for labour exploitation of Bulgarian and Romanian 
nationals  in  other  EU  countries  of  destination,  the  research  team  identified  the  main  actors 
involved  and  modus  operandi  of  OCGs  and  the  use  of  undeclared  work  practices  –  i.e. 
exploitation of the underground economy. 

The analysis of cases identified shows a high level of  infiltration of OCGs in the legal economy 
using legal companies both for the purpose of recruitment and exploitation of victims. The labour 
exploitation is intertwined with various forms of tax and social contributions evasion or fraud, and 
traffickers make use of schemes for bogus self-employment or posting of workers abroad, or other 
grey economic practices and violations of labour and other administrative regulations. 

Recruitment  

THB cases from Bulgaria and Romania reveal that recruitment of victims typically takes place 
through false promises about employment, good working conditions and high remuneration. This 
is  done  both  through  official  job  ads  and  recruitment  agencies,  but  also  through  informal 
networks.  

Online advertising is used by traffickers through job advertisements on job-search and free ad-
posting websites, as well as through social networks, with the aim to attract and recruit potential 
victims.  Word  of  mouth  is  another  (complementary)  recruitment  strategy  as  recruiters  often 
come  from  the  same  community  as  victims.  The  advantage  is  the  trust  between  community 
members, who may in some cases be relatives to the victims of the crime. In many cases, male 
workers are recruited in groups and are encouraged to convince friends and relatives to join the 
group (Europol, 2016).  

Previous research has shown that in the field of migrant labour, the intermediaries facilitating the 
link  between  supply  and  demand  of  migrant  labour  can  be  both  OCGs  as  well  as  disguised 
legitimate businesses with close ties to the formal and informal economy in destination countries 
(Andrees, 2008). Recruitment mechanisms in cross-border labour exchanges include legal, semi-
legal/informal, or illegal means.  

The analysis of proven cases from Bulgaria and Romania reveals a clear trend that traffickers use 
legitimate companies in the process of recruitment and to conceal the profits of exploitation. 
The reviewed  cases,  as well  as stakeholder  interviews,  indicate that  intermediaries  acting  as 
recruitment agencies play an important role in trafficking for labour exploitation. While in Bulgaria 
there is a licensing regime for legitimate recruiters, the labour inspectorates lack the capacity to 
proactively check all emerging intermediaries, but rather undertake inspections based on reported 
irregularities  (FRANET,  2014).  The  Bulgarian  General  Labour  Inspectorate  reports  on  the 
substantially increased inspections of firms that recruit and post workers abroad234. In Romania, 
legislative changes took place in 2018 forbidding recruitment agencies to charge fees from job 
seekers. 

Analysed  proven  cases  revealed  that  pre-screening  of  victims  through  skype  calls  and  on-site 
interviews  is  a  technique  used  to  lower  the  risk  of  the  traffickers,  by  making  sure  that  those 
seeking  work  are  potential  migrants.  Traffickers  may  rent  additional  facilities  in  hotels  or 
administrative buildings to be used as fronts of their business in order to gain the trust of potential 
victims and to deceive authorities.  

Contracts, pay and benefits 

234 Interview national stakeholder BG, 16 March 2020 (#52).  

242 

 
 
 
 
EUROPEAN COMMISSION 

A  trend  illustrated  by  both  Bulgarian  and  Romanian  cases  is  that  traffickers  tend  to  offer  a 
contract  to  the  exploited  workers,  although  work  without  any  formal  contract  still  occurs 
where payments are done in cash, if at all (НКБТХ, 2019). However, labour contracts are offered 
in a language that the workers cannot understand and may be completely bogus. Another practice 
is to include clauses that could be difficult to grasp by workers with low levels of experience and 
education. In a case analysed from Romania, the initial contract was subsequently replaced by 
irregular work practices.  

Prevalent  undeclared  work  practices  that  go  hand  in  hand  with  labour  exploitation  include 
payments below the national minimum wage, imposing longer working hours and substandard or 
even  dangerous  working  conditions  (while  severely  underreporting  the  hours  worked),  bogus 
contracts (where the true nature and conditions of the work arrangement is not disclosed), and 
withholding all or a large part of the promised due to various fees, charges and deductions. In 
some destination countries, traffickers take advantage of the regulatory environment and the low 
risk of detection, for example where labour contracts are not subject to mandatory reporting and 
registration to the authorities235. 

In  the  case  of  Bulgarian  nationals  exploited  abroad,  two  prevalent  schemes  of  undeclared 
work and related administrative abuses were illustrated by the cases analysed and verified 
by  interviews  and  desktop  research.  One  of  the  main  schemes  includes  the  abuse  of  posted 
work  regulations,  where  workers  are  sent  abroad  without  signing  the  necessary  formal 
documents  (a  so-called  ‘A1  form’)  that  would  ensure  the  employer  pays  insurance  costs.  This 
occurs alongside other administrative offences that are made to cut costs, including lack of any 
form of insurance, evasion of taxes and social contribution  in the sending state, and non-
compliance  with  minimum  wage  or  other  labour  regulations  in  the  receiving  state  (Rusev  & 
Kojouharov,  2019)236.  In  the  usual  scheme  the  posted  worker  is  stated  to  be  insured  at  the 
minimum wage in the receiving country, while in reality he/she receives lower actual remuneration 
as different 'fees' – such as transportation to the receiving country, accommodation, etc.  – are 
subtracted illegally from the posted worker’s pay. Subsequently the full amount of taxes due is 
not  paid  in  the  sending  state.  The  undeclared  work  practices  often  associated  with  labour 
exploitation  through  posted  work  may  also  include  fictitious  posting  (workers  are  not  actually 
posted, but hired locally), exceeding the allowed posting period, underdeclaring wages or hours 
worked, and payment below the minimum wage, among others (Mineva & Stefanov, 2018). Such 
schemes often involve registering numerous shell companies without any assets, which quickly 
disappear to avoid liability and detection by authorities. In some cases, traffickers have several 
legally  employed  workers,  around  which  more  people  are  trafficked  and  work  illegally  (being 
forced to sign bogus contracts or working completely undeclared) (Ollus & Jokinen, 2019)237. They 
may also work as temporary agency workers.  

Alternatively, perpetrators use the method of bogus self-employment to cut costs and reverse 
the  burden  of  social  contributions  onto  the  workers.  Bogus  self-employment  schemes  include 
deceiving, manipulating or forcing victims to register as self-employed persons in the destination 
country, while they work under the subordination of an employer. This type of scheme is used in 
low-qualified positions. The employer in practice reverses the burden for payment of taxes 
and social contributions to the workers and thus cuts labour costs. Another scheme employed 
is to coerce victims to register as shareholders of a limited liability company (Federal Public 
Service Social Security, 2011).  In some cases, victims become bogus company shareholders  – 
i.e. victims are made to sign papers that to acquire 5% of a company, but are not aware what 
they have signed238. There are many variations of bogus remuneration schemes that traffickers 
may use to evade taxes and social security contributions.  

Transport and logistics 

In many cases, transport is organised by the recruiters in the country of origin through a logistical 
partner. The recruiters point to a departure place and time, which takes the workers across the 

235 Interview national stakeholder DE, 10 March 2020 (#47).
236 Interview national stakeholder AT, 10 March 2020 (#46).
237 Interview national stakeholder BG, 10 March 2020 (#45).
238 Interview national stakeholder BE, 16 February 2020 (#37).

243 

 
 
 
 
 
 
 
 
EUROPEAN COMMISSION 

border  to  the  destination  country239.  The  transport  is  commonly  provided  by  unlicensed 
operators, who are often part of the trafficking ring. While the provision of transport is usually a 
part  of  the  overall  logistical  ‘package’  offered  by  the  traffickers,  Bulgarian  anti-trafficking 
practitioners  observe  that  in  some  cases,  the  workers  organise  transport  themselves240.  The 
identified Romanian cases reveal that workers can also travel via regular bus companies, although 
the  traffickers  make  reservations  for  their  travel.  In  such  scenarios,  the  workers  are  met  by 
traffickers upon arrival in the countries of destination. The advantage of self-arranged travel is 
that it is more difficult to detect a trafficking link by authorities. 

A notable aspect of the modus operandi of the cases analysed is the participation of actors from 
the countries of destination, who oversee the logistics at the place of exploitation. This includes 
accommodation, food and management of relations with the subcontracting companies from the 
countries of destination.  

The role of intermediaries, supply chains and legal entities in the exploitation 
of victims 

Previous research shows that the use of intermediaries and long labour supply chains, including 
cascade  subcontracting,  are  some  of  the  main  features  in  cases  of  labour  exploitation  where 
traffickers also exploit the informal sector (Davies & Ollus, 2019). The role of supply chains (both 
of products and of labour) is argued to be key to identifying the intersections between the formal 
and informal economy within forced labour and labour trafficking (Allain et al., 2013).  

All cases analysed reveal the use of intermediary companies or ‘subcontractors’ between the 
end employer and the exploited victim. At a minimum, two companies are registered by traffickers 
–  one  in  the  country  of  origin  to  recruit  and  post  victims  abroad,  and  one  in  the  country  of 
destination to arrange logistics and to enter a contractual relationship with the ultimate employer, 
who may or may not be oblivious of the subsequent exploitation of workers. These are registered 
either as job intermediary / recruitment agencies, or as trade companies in other business sectors 
whose activity is later used to conceal the illicit cash flows (Allain et al., 2013).  

Bulgarian  cases  reveal  that  sub-contracting  was  present  across  different  sectors,  including 
agriculture, cleaning services and maintenance. Seasonality of labour needs usually calls for the 
use of several intermediaries in longer supply chains (Allain et al., 2013).  

In  the  case  of  farming/agriculture,  the  susceptibility  to  exploitation  in  the  supply  chain is  also 
driven by the time-sensitive nature of the industry, and the drive to lower costs by various actors 
in the product supply chain (Allain et al., 2013). As in one of the identified cases within this study, 
pressure  to  employ  labour  for  seasonal  work  and  to  cut  costs  of  production  can  lead  to 
employment of more informal intermediaries in the supply chain, usually on a temporary basis. 
This is especially so during harvesting season, so harvesting operations are known as high risk to 
forced labour (Allain et al., 2013). The interviews revealed the employment of low qualified, in 
many cases illiterate Bulgarian workers, in  the  harvesting of oranges (Spain), olives (Greece), 
berries (Sweden), strawberries (Italy), radishes (Austria) and grapes (France)241. While in most 
of  these  cases,  labour  trafficking  charges  were  not  pressed  due  to  lack  of  clear  evidence  of 
coercion  or  other  elements  of  THB,  all  of  them  illustrated  clear  violations  of  labour  laws  and 
involvement in the undeclared economy. 

Analysis  of  cases  reveals  that  supply  chain  intermediaries  are  registered  in  the  country  of 
destination and control the working hours and conditions of victims.  

Cascade sub-contracting in supply chains is a common instrument for covering various labour-
law  violations  and  evasion  of  due  taxes and  social contributions.  In  order  to  lower  risks  of 
inspections  or  criminal  investigations,  often  these  sub-contractors  are  letterbox  companies  or 

239 Interview national stakeholder AT, 10 March 2020 (#46).
240 Interview national stakeholder BG, 10 March 2020 (#45).
241 Interview national stakeholder BG, 25 February 2020 (#34); Interview national stakeholder BG, 10 March 
2020 (#46).

244 

 
 
 
 
 
 
 
EUROPEAN COMMISSION 

companies  without  any  employees  or  assets242.  Even  if detected,  these shell entities are  easily 
dumped and disposed of (Federal Public Service Social Security, 2011). 

In all cascade sub-contracting observed, the control is exerted by a subcontracted/intermediary 
company. Victims do not come in contact with the large company and employer at the beginning 
of the supply chain. In most cases there are formal and legitimate contracts between the ultimate 
employer and the first intermediary company. The exploitation, thus, happens at the second or 
third level of subcontracting243. This is also where the undeclared work practices or administrative 
violations – such as tax and social security evasion – take place. The ‘intermediary’ can be either 
an actual intermediary agency responsible for staff recruitment directly, or can use one or more 
subcontractors to create a longer supply chain, where the last company in the chain pays out low 
salaries while the other companies in the chain receive a larger share of the profit, without being 
liable for misuses (Ollus & Jokinen, 2019).   

Revenues, financial flows and money-laundering 

The  cases  analysed  and  stakeholder  interviews  confirm  that  the  general  avenues  for  profit 
generation from trafficking for labour exploitation include: 

•  Revenues generated from arrangement of the recruitment and transport of the victims, 

which could be paid by the latter in the form of advance fees. 

•  Generation of profits from labour exploitation from cutting costs by using cheap labour, 
below the minimum wages in the country (including through undeclared work and non-
payment of health insurance and social securities). 

•  Withholding cash from victims through imposing various fines.  

Previous  research  covering  both  Romania  and  Bulgaria  reveals  that  as  with  other  forms  of 
trafficking,  financial  flows  related  to labour trafficking  operations  are  predominantly  in  cash. 
Cross-sectoral differences exist, as some sectors are more cash-intensive (e.g. agriculture, car-
washing) and in others bank transfers are the norm – such as food-processing and construction 
(CSD, 2015).  

While cases from Bulgaria and Romania illustrate very low amounts of money paid to victims of 
labour  exploitation,  it  is  not  always  clear  whether  payments  were  made  in  cash  or  via  bank 
transfers. However, a pattern is discerned in the cases of cascade subcontracting.  

Cases from Bulgaria illustrate that, in most instances, the contracting authority at the start of the 
supply  chain  pays  via  bank  transfer  to  the  intermediary  for  the  services  provided.  The 
intermediary  subsequently  opens  bank  accounts  for  the  workers  involved.  Payments to  the 
victimised workers may also be carried out via bank transfers. In these cases, traffickers usually 
control the bank-cards of the victims, and immediately withdraw money in cash so that the victims 
receive a fraction of their earnings. 

Other  mechanisms  used  by  Bulgarian  and  Romanian  perpetrators  to  transfer  the  profits  of 
exploitation to the country of destination include the purchase of luxury goods, such as watches 
or cars. In some cases, money is physically transported via mules who carry below €10,000 and 
thus  do  not  need  to  report  the  amounts  upon  entry  in  the  country  of  origin.  The  use  of  wire 
transfers is also noted by Bulgarian anti-trafficking practitioners, where the amount wired is below 
the minimum threshold244. 

Some of the  money-laundering  mechanisms illustrated  by  the cases include the purchase  of 
properties in both countries of origin and destination, donations made between members of the 
organised  criminal  group,  or  (though  this  is  not  laundering  in  the  sense  of  legitimisation  of 
proceeds  of  crime)  the  reinvestment  of  proceeds  in  other  criminal  activities,  such  as  drug 

242 Interview national stakeholder BE, 16 February 2020 (#37).
243 Interview national stakeholder BE, 16 February 2020 (#37).
244 Interview national stakeholder BG, 10 March 2020 (#46).

245 

 
 
 
 
 
 
 
EUROPEAN COMMISSION 

trafficking  or  trafficking  for  sexual  exploitation.  In  Bulgaria,  legal  companies  registered  in  the 
countries of destination are used to conceal the profits of the crime245.  

Trafficking cases are often connected to additional crimes, for instance: victims are forced to sign 
documents  through  which  loans  are  drawn,  and  document  fraud,  tax  fraud  or  other  economic 
crimes are also often present246. 

Many  stakeholders  interviewed  stressed  that  it  is  very  difficult  to  prove  THB  and  labour 
exploitation simultaneously, both in the countries of origin and in some destination countries. This 
often leads to charges being brought for fraud, tax evasion or labour law violations, but not for 
THB, as elements of coercion are hard to prove, such as seizure of identity documents, restriction 
to freedom of movement (people are forbidden to leave the place where they work/live), threats 
of  violence,  etc247.  Measures  to  control  victims  such  as  imposition  of  debts  or  economic 
dependency are difficult to withstand (e.g. in Bulgarian court). Even when victims are forced to 
sign  employment  contracts,  mediation  contracts  or  rental  contracts  with  highly  unfavourable 
terms,  such  actions  are  often  treated  as  fraud  but  do  not  qualify  as  trafficking  under  national 
legislation.  

This  case  study  has  shown  an  example  of  the  exploitation  of  the  underground  economy  by 
organised criminal groups, with the purpose of lowering costs of production in different sectors. 
OCGs use various forms of tax and social contributions evasion or fraud, bogus self-employment 
schemes and other grey economic practices in order to lower costs of production at the expense 
of  exploitation  of  victims  of  trafficking  for  labour  exploitation.  Yet,  OCGs  increasingly  use 
legitimate companies in the course of recruitment, transport and exploitation of victims, thereby 
blurring the line between the formal and informal economy and posing further challenges to the 
detection and investigation of the crime. 

3.5.  Additional information on the exploitation of NPMs by OCGs  

Key findings: 

• 

The use of new and non-banking payment methods (NPMs) for money-laundering 
purposes is observed in practically all Member States, and there are indications that it 
is growing, although with different intensity across countries and criminal markets. 

•  Cryptocurrencies are regularly used in both cyber-enabled and cyber-dependent 

crimes, in illicit trade via dark-net markets, and in money-laundering linked to these 
types of crime.  

• 

Prepaid cards are rarely used by OCGs compared to cash and other methods.  

•  Digital or mobile wallets are moderately used in certain cybercrimes, such as phishing 

and child sexual exploitation material, however they are rarely used in IPR 
infringements and money-laundering compared to traditional payment methods.  

•  Other innovative and mobile payment services are rarely used, compared to cash and 

bank transfers.  

•  Money transfer services are regularly used – particularly for THB, smuggling of 

migrants, cybercrime and money-laundering – but less often than cash.  

•  Hawala and similar informal transfer systems are regularly used for migrant 

smuggling, and rarely for other types of crimes except where OCGs are of particular 
nationalities (i.e. Nigerian, Chinese, Afghani).   

•  Overall, OCGs still rely more on cash than on new and non-bank payment methods.  

245 Interview national stakeholder BG, 16 March 2020 (#52).
246 Interview national stakeholder BG, 10 March 2020 (#46).
247 Interview national stakeholders BG (#40, #45, #46, #52) and DE (#47).

246 

 
 
 
 
 
 
 
 
EUROPEAN COMMISSION 

This annex presents the full case studies conducted as part of the analysis of the exploitation of 
new and non-banking payment  methods (NPMs) by  OCGs, as presented in  Section 3.5  of  the 
main report.  

The  first  case  study  examined  the  use  of  NPMs  in  the  context  of  cybercrime,  and  the  second 
focused on NPMs in the context of THB.  

3.5.1. Case study 1: NPMs in the context of cybercrime 

Maria Karayotova, Centre for the Study of Democracy  

According to law enforcement reports,  NPMs  and cryptocurrencies facilitate various cybercrime 
activities (Europol, 2018c). They facilitate the obtainment of money from victims, the settlement 
of payments within the cybercriminal network and  the laundering of the proceeds. In order  to 
explore how NPMs are used in the context of cybercrime, the case study focuses on two types of 
cyber-dependent crime – ransomware and data-compromise via phishing. The case study details 
in what way and how often NPMs are used for each of those two cybercrimes, as well as what the 
underlying factors are that determine the choice and use of NPMs by perpetrators. 

Over  the  last  year  the  impact  and  intensity  of  ransomware  attacks  has  increased  (Amy-Vogt, 
2019; Europol, 2018c; Verizon, 2019). Similarly, the prevalence of data-compromise via phishing 
has been  high –  one report suggests that  64%  of businesses  experienced  a phishing attack in 
2018 (Check Point Research, 2019). Our focus on ransomware will also provide an opportunity to 
examine the way cryptocurrencies facilitate cybercrime, since ransoms are usually requested in 
virtual  currencies  (Paquet-Clouston  et  al.,  2019).  Phishing,  on  the  other  hand,  might  involve 
different methods for the settlement of payments and the laundering of revenues, including digital 
payment systems. The case study focuses on ransomware and phishing regardless of the level of 
OCG involvement. 

Prevalence of the use of cryptocurrencies in ransomware attacks 
A study noted that the use of cryptocurrencies and onion routing have contributed to an increase 
in  efficiency  of  ransomware,  since  the  first  occurrences  of  the  encryption  attack  technique 
(Paquet-Clouston  et  al.,  2019).  Ransomware  attackers  use  cryptocurrencies  as  a  preferred 
payment  method,  since  the  blockchain  system  and  decentralised  nature  of  cryptocurrencies 
provide a level of anonymity, and are typically not subject to banking regulation or oversight. The 
use of cryptocurrencies for the settlement of unmediated payments – in combination with strong 
cryptographic techniques and communication tools that confer a high degree of anonymity – has 
provided ransomware attackers with a high level of impunity. 

A typical ransomware infection would involve four events:  (1) infection via an infection vector, 
such as an email with a malicious attachment; (2) encryption; (3) extortion; and (4) decryption. 
The  extortion  event  consists  of  a  ransom  note  displaying  on  the  device’s  screen  (Conti  et  al., 
2018).  The  note  includes  a  threat  message,  a  ransom  amount  given  in  fiat  currency  and/or 
cryptocurrency, a timer that indicates the time left before the deadline and a payment address, 
which is either a virtual currency address or a website address (Conti et al., 2018).  

In  the  case  of  ransomware,  cybercriminals  profit  from  the  value  the  victims  assign  to  their 
encrypted data, and their willingness to regain access to them (Everett, 2016; Hampton & Baig, 
2015). Studies note that this business model provides more favourable monetising opportunities 
than forms of cybercrime that profit from the misuse of stolen data (Paquet-Clouston et al., 2019). 
The main reasons for this are the lack of intermediaries in the perpetration of the crime, and its 
scalability (Paquet-Clouston et al., 2019). Over recent years, a ransomware-as-a-service business 
model  has  also  emerged,  with  cybercriminals  offering  their  operation  via  web  platforms  in 
exchange  for  a  share  of  the  ransom  gains,  or  a  fixed  fee  (Lord,  2018).  Up  to  2018,  most 
ransomware  attacks  demanded payments  in  bitcoins,  despite  the emergence  of  other  types of 
cryptocurrencies248. Europol noted that although the market share of bitcoin had dropped to 35% 
by the beginning of 2017, this was not reflected in cybercrime investigations within the EU – and 

248 Interview with international organisation representative, 22 April 2020 (#73).

247 

 
 
 
 
 
EUROPEAN COMMISSION 

bitcoin  has  remained  the  most  encountered  cryptocurrency  (Europol,  2018c).  Therefore,  the 
ransom  note  usually  includes  instructions  on  how  and  where  to  buy  bitcoins.  However,  some 
ransomware demands provide alternative cryptocurrency payment options, such as MoneyPak (in 
the case of Crypto Locker) and Litecoin (in the case of Crypto Wall) (Litecoin, n.d.; MoneyPak, 
n.d.).  There is a risk of a  shift towards  cryptocurrencies with built-in privacy settings,  such  as 
Monero and Zcash (Europol, 2018c)249.  A common strategy of cybercriminals would be to request 
the ransom  in  bitcoins and then convert  the amount  to a privacy-oriented currency to  conceal 
their trails (see WannaCry case, Box 10 below). The main reason why cybercriminals might 
prefer  to  request  ransoms  in  bitcoins  is  that  this  type  of  cryptocurrency  still  has  the 
biggest liquidity, and it is easier to hide high volumes of funds inside the network250. In 
addition, bitcoin is still the most publicly known cryptocurrency, and it might be easier for victims 
to obtain it in order to pay the ransom.  

Box 10: The case of WannaCry 

WannaCry  is  a  ransomware  computer-worm  that  targets  the  family  of  Microsoft  Windows  operating 
systems. It started to spread in May 2017 and infected more than 200,000 computers in over 150 countries 
(Bistarelli et al., 2018). Infected institutions included hospitals in the UK and European telecommunication 
companies. The ransom note demanded between $300 (USD) and $600 (USD) from victims, depending on 
how early the payment was made (Bistarelli et al., 2018). Estimates of the WannaCry impact suggested 
that only 0.06% of the victims paid the requested amount and less than $120,000 (USD) was paid to three 
bitcoin wallets (Kshetri & Voas, 2017). At the time of the attack, a cybersecurity company suggested that 
a fault in the WannaCry encryption software might make it impossible to decrypt the victim’s files after the 
ransom was paid (Economist, 2017). Three months after the spread of the ransomware, the perpetrators 
managed  to  conceal  the  financial  trail  and  cash-out  the  received  amounts.  Experts  tracking  the  bitcoin 
funds discovered they were  converted to Monero via a cryptocurrency exchanger (Franceschi-Bicchierai, 
2017). Once the bitcoins had been exchanged to Monero, the experts were not able to check the balance 
of the addresses or to see when they were used to move the funds. The applied method was the same as 
in an earlier version of the ransomware and the experts believed that the malware authors were the same 
(Franceschi-Bicchierai, 2017). 

Share of victims paying the ransom 
Cybersecurity companies’ reports suggest that a significant number of businesses are  willing to 
pay the ransom. However, results of studies tracing bitcoin transactions related to ransomware 
suggest that the share of victims paying the ransom and the overall profits might not be as high 
as suggested by security industry reports (see WannaCry case, Box 8 above) (Conti et al., 2018; 
Paquet-Clouston et al., 2019). A study suggested that a low pay-out ratio might be caused by the 
complexity  of  complying  with  the  cybercriminals’  demands  (Kshetri  &  Voas,  2017). 
Cryptocurrencies are new to many of the victims and it takes some effort and time to make and 
verify an account on cryptocurrency exchangers. Furthermore, there are no guarantees that the 
decryption key will be provided and data restored (see WannaCry case, Box 8 above). To minimise 
the  effects  of  these  two  factors,  cybercriminals  might  operate  a  call  centre  offering  technical 
support  to  the  victims,  navigating  them  through  the  pay-out  and  data-restoration  processes 
(Economist, 2017). 

Over the last two years there has been a decrease in the overall number of ransomware infections 
on endpoints, but an increase in the number and scale of enterprise infections (Europol, 2020a; 
Symantec, 2019). Fewer attacks on individuals have occurred, but more targeted attacks towards 
private- and public-sectors entities (Europol, 2020a)251. In such cases the ransom demands could 
be  substantial.  According  to  an  interviewee  from  Europol,  there  is  a  possibility  that  major 
ransomware  attacks  with  substantial  ransom  demands  have  not  been  reported  to  law-
enforcement  authorities  due  to  enterprises’  reputational  concerns252.  Their  cyber-insurance 
companies take the necessary actions to buy the cryptocurrency and recover the private keys and 

249 Interview with international organisation representative, 22 April 2020 (#73).
250 Interview with law enforcement representatives, 12 March 2020 (#48).
251 Interview with Europol representatives, 12 March 2020 (#48).
252 Interview with Europol representatives, 12 March 2020 (#48). 

248 

 
 
 
 
 
 
 
 
EUROPEAN COMMISSION 

decrypting tools. A cyber-security survey253 suggested that 33% of UK companies have bought 
bitcoins in order to be prepared to pay the ransom (Mizrahi, 2016). 

Use of cryptocurrencies for laundering ransomware proceeds 
As  ransomware  payments  are  predominantly  made  in  bitcoins,  the  perpetrators  use  money-
laundering tools in the bitcoin ecosystem or a combination of these tools to launder the proceeds 
and  ‘cash-out’254.  The  cybercriminals  often  use  bitcoin  mixing  or  swapping  services  or  non-
compliant cryptocurrency exchangers to convert the bitcoins into another type of virtual currency 
(see WannaCry case, Box 8 above) (Liao et al., 2016)255. A substantial number of bitcoin mixing 
and exchange services, or an overall cryptocurrency money-laundering service, are also offered 
on dark net websites (Van Wegberg et al., 2018). The opportunities to convert bitcoins into more 
privacy-focused cryptocurrencies could make the use of bitcoin mixers less frequent (Europol, 
2018c). Despite the opportunities provided by money-laundering tools in the bitcoin ecosystem, 
there have been some cases in which money mule networks have also been used.   

Empirical studies examining bitcoin transactions linked to ransomware have also established links 
with dark net  marketplaces.  For example, bitcoin  addresses  associated with the Crypto Locker 
ransomware were linked to The Sheep Marketplace, a dark net marketplace and successor of the 
Silk Road that specialised in the trade of narcotics256. In this case, after the Crypto Locker bitcoin 
addresses  made  some  exchanges  via  BTC-e,  the  bitcoins  were  transferred  to  two  money-
laundering addresses used in the Sheep Marketplace scam (Liao et al., 2016). While the exact 
association between the two criminal activities is not clear, the transactions’ connections suggest 
that part of the ransomware proceeds were linked to other criminal activities. 

An interview with law enforcement officers suggested that the use of a combination of  money-
laundering tools in the cryptocurrency ecosystem could also be more cost efficient than traditional 
cash-out schemes257. While costs for the money mules and their coordinator could reach 40% of 
the  revenues,  the  layering  and  cash-out  through  several  cryptocurrency  tools  could  cost  only 
6%258. Furthermore, the overall cash-out process takes less time, as cryptocurrency mixing and 
exchange could be carried out in just a couple of hours and without any logistical constraints259. 

Prevalence of the use of NPMs in phishing attacks 
Digital  payment  systems  and  forms  of  electronic  cash  are  used  as  a  target  in  the 
perpetration of phishing attacks and to launder the proceeds from the commission of 
cybercrimes  (McGuire,  2018).  Digital  payment  providers  are  a  preferred  target  of  phishing 
attacks as these companies usually communicate with their customers via emails and telephone 
messages, which creates an opportunity to effectively deceive their general users (Downs et al., 
2007). While most phishing attacks aim to access credentials to the digital payment service, some 
are devised to also access other personal information, such as mailing address information or e-
mail credentials (Thakkar, 2019). In cases where more personal information is acquired, more 
complex fraud schemes could be devised with the stolen data. Phishing is also often used as a 
vector to access parts of a network and steal confidential data, run administrative commands or 
deploy malware. 

Once the credentials are stolen, the cybercriminal could either use the digital payment accounts 
themselves to withdraw available balances and/or buy goods and services or sell the credentials 

253 An online survey with 250 IT and security specialists in UK companies with 250+ employees, which took 
place between 19 May and 24 May 2016.
254 Interview with Europol representatives, 12 March 2020 (#48); Interview with international organisation 
representative, 25 February 2020 (#73).
255 Interview with Europol representatives, 12 March 2020 (#48); Interview with international organisation 
representative, 25 February 2020 (#73).
256 The owners of the Sheep Marketplace shut down the site following claims of the administrators that one of 
the  dealers  hacked  the  market  and  stole  5,400  bitcoins.  However,  the  users  of  the  platform  accused  the 
owners of an exit scam, blocking bitcoin withdrawals from the site and holding 96,000 bitcoins (over $100 
million (USD)) belonging to its users.
257 Interview with Europol representatives, 12 March 2020 (#48).
258 Interview with Europol representatives, 12 March 2020 (#48).
259 Interview with Europol representatives, 12 March 2020 (#48). 

249 

 
 
 
 
 
 
 
 
 
 
EUROPEAN COMMISSION 

on  the  online  underground  markets  (Trend  Micro,  2011).  PayPal  accounts  obtained  through 
phishing are one of the common commodities on the dark net (McGuire, 2018). Such packages 
of accounts obtained on the dark net could be used in PayPal micro-laundering schemes. The low 
prices of such stolen credentials have also led authors to suggest that making use of the stolen 
data is either very difficult or fails frequently (Florêncio & Herley, 2010; Franklin, 2007). 

Factors determining the choice of NPMs in a phishing attack 
The selection of a payment service as a target of a phishing campaign depends to a great extent 
on the payment culture in the victims’ country of origin260. If a particular payment service 
is  popular  and  profitable  among  the  general  population  in  a  Member  State,  there  is  a  higher 
probability of a phishing campaign being organised261. This might be one of the reasons why some 
digital payment and financial technology (FinTech) services, which are more popular outside the 
European Union, have not yet become a target of a phishing campaigns in any Member State. 
Instead,  over  the  last  years  some  Member  States  have  reported  cases  of  spear  phishing262 
impersonating tax authorities263. The specific target of the phishing campaign might also depend 
on the origin, growth and technical expertise of the criminal network. In the Netherlands, 
there  have  been  several  cases  of  home-grown  phishing  criminal  groups  that  emerged  and 
developed along offline social ties  (Leukfeldt et al., 2017). These groups would often prefer to 
target clients of local traditional  banking  institutions. In  some cases, they used  low-level bank 
employees to acquire personal details about victims, make changes to the victims’ accounts and 
increase withdrawal and credit limits (Leukfeldt, 2014). 

The origin and growth of a criminal group, their experience of different payment services and the 
type  of  phishing  attack  could  also  determine  their  preference  towards  a  particular  method  for 
settling payments among the members of the phishing group prior to or after the attack264. There 
are OCGs using cryptocurrencies to pay each other265, however most cybercriminal networks still 
preferred  to  settle  payments  with  their  collaborators  and  within  the  group  using  cash266.  Even 
though  some  phishing  groups  tried  buying  cryptocurrencies,  they  eventually  returned  to 
traditional money-mule cash-out schemes267. One of the reasons why cryptocurrencies might not 
be  a  preferred  method  for  settling  payments  within  phishing  groups  is  the  increased  level  of 
regulation of the cryptocurrency exchangers, who have introduced identity verification procedures 
and reporting  of  suspicious transactions268. When payments within  the group  are  made across 
jurisdictions  they  might  use  a  money  remittance  service,  such  as  MoneyGram,  or  alternative 
person-to-person money transfer services269. For example, a Romanian cybercrime network made 
use of the possibility provided by some gas companies to send money from one gas station to 
another270.  While  there  are  additional  costs  associated  with  the  use  of  these  services, 
cybercriminals find them attractive as they allow immediate withdrawal of the money271. 

Use of NPMs for laundering of phishing proceeds 
The literature review and the interviews with experts suggested that NPMs are hardly used for 
laundering of the profits generated by phishing attacks. Instead, money mules are the 
preferred means for draining compromised financial accounts (Florêncio & Herley, 2010). 
The traditional money-laundering networks in the country of origin of the perpetrators are often 
exploited by phishing  networks272. For example,  a Germany-based cybercriminal network used 

260 Interview with an academia representative, 25 February 2020 (#35). 
261 Interview with Europol representatives, 12 March 2020 (#48). 
262 Spear phishing is typically used in targeted attack campaigns to gain access to an individual’s account or 
impersonate a specific individual, such as a high-ranking official or person involved in confidential operations 
within the company (see Swinhoe, 2019). 
263 Interview with an academia representative, 25 February 2020, (#35); Europol (2019). 
264 Interview with academia representative, 25 February 2020 (#35). 
265 Interview with academia representative, 25 February 2020 (#35). 
266  Interview with  international  organisation  representative, 22  April 2020  (#73);  Interview  with  academia 
representative, 25 February 2020 (#35). 
267 Interview with academia representative, 25 February 2020 (#35). 
268 Interview with academia representative, 25 February 2020 (#35); Europol (2019) Op. cit. 
269 Interview with international organisation representative, 22 April 2020 (#73). 
270 Interview with international organisation representative, 22 April 2020 (#73). 
271 Interview with international organisation representative, 22 April 2020 (#73). 
272 Interview with academia representative, 25 February 2020 (#35).

250 

 
 
 
 
 
 
EUROPEAN COMMISSION 

the services of members of an outlawed motorcycle club to manage money mules (Leukfeldt et 
al.,  2017).  In  another  case,  a  Latvian  phishing  network  applied  a  very  traditional  money-
laundering  scheme  by  bringing  money  mules  to  the  Netherlands,  making  them  open  bank 
accounts and cash-out the money,  before  returning  them  to  their  country of  origin273.  As with 
other types of crime, the risks of tracing the money mules to the perpetrators is minimised by 
the  use  of  facilitators  who  recruit  and  coordinate  the  money-mule  network274.  In  addition, 
cybercriminals  often  used  additional  layers  of  security  (e.g.  installing  a  proxy  server,  VPN  or 
encryption of the traffic network) in their communication with facilitators275.  

However, in some cases the phishing attack aims to obtain account credentials for use in micro-
laundering  schemes.  Micro-laundering  involves  moving  a  large  amount  of  money  in  small 
amounts  through  thousands  of  electronic  transactions,  hence  evading  anti-money-
laundering  transaction  limits  (Richet,  2013).  McGuire  (2018)  evidenced  that  in  20%  of  the 
cybercrime cases sampled, the main money-laundering tool was PayPal and other digital payment 
systems.  Cybercrime  profits  are  diverted  through  multiple  PayPal  accounts  to  distribute  the 
profits,  very  often  in  combination  with  fraudulently  opened  bank  accounts  and  Western  Union 
transfers (Richet, 2013). 

Information on how revenues from phishing activities are spent is limited. However, the review 
of cases of phishing networks operating in the Netherlands suggested that most of the profits are 
spent on lifestyle items, such as cars, jewellery and holidays276. Despite some major cases 
where the authorities seized 30 cars, it appears that some members of phishing networks do not 
manage to significantly increase their living standard277. 

3.5.2. Case study 2: NPMs and THB   

Kamelia Dimitrova, Centre for the Study of Democracy  

This case study explores the intersection between the market of THB for sexual exploitation and 
non-banking payment methods in two OCGs present in Europe: Nigerian and Southeast European 
(Bulgarian  and  Romanian)  traffickers.  According  to  Aronowitz,  criminal  enterprises  involved  in 
THB are not a uniform business, but operate in diverse cultural and political contexts and differ in 
their  modus  operandi,  including  recruitment,  transport  and  control  of  victims,  as  well  as  in 
investment of profits generated from THB (Aronowitz, 2009). 

The two OCGs were selected based on their large-scale presence on the EU criminal market of 
THB for sexual exploitation, and also due to the diversity of the money-transfer methods used by 
traffickers. The case study will detail the extent of use of non-banking payment methods – such 
as money remittance services and hawala – in the context of THB for sexual exploitation, as well 
as the underlying factors that drive their use. 

Southeast  European  and  Nigerian  OCGs  are  important  actors  in  the  THB  for  sexual 
exploitation market in the EU. According to Europol, a great majority of OCGs involved in THB 
in the EU are comprised of nationals from Southeast Europe (Bulgaria and Romania) and Nigeria 
(Europol,  2016).  To  understand  the  management  of  financial  flows  and  use  of  NPMs  of  OCGs 
originating from Nigeria and Southeast Europe, a consideration of the organisation of the criminal 
groups is needed. 

Previous research by CSD (2019) reveals that, at the time of accession to the EU, Bulgaria was 
experiencing  decentralisation  and  increased  flexibility  of  the  OCGs  controlling  THB  for  sexual 
exploitation. THB networks tend to be loose networks that are organised along family, kinship or 
ethnicity (CSD, 2015). Domestic THB in Bulgaria could be organised by single traffickers, while 
OCGs typically consist of between three and six members. Groups organised on a family or clan 

273 Interview with academia representative, 25 February 2020 (#35).
274 Interview  with  international  organisation  representative,  22  April  2020  (#73);  Interview  with  academia 
representative, 25 February 2020 (#35).
275 Interview with international organisation representative, 22 April 2020 (#73).
276 Interview with an academia representative, 25 February 2020 (#35).
277 Interview with an academia representative, 25 February 2020 (#35).

251 

 
 
 
 
 
 
 
 
 
EUROPEAN COMMISSION 

principle could consist of 20–30 members. OCGs are very dynamic and easily restructured upon 
detection  from  law  enforcement  (CSD,  2019).  According  to  Europol,  Romanian  and  Bulgarian 
OCGs share many characteristics in common: they have hierarchical structures and they operate 
with small, mobile groups of victims controlled by a few members (Europol, 2016). 

According  to  Europol,  Nigerian  OCGs  are  known  to  be  highly  organised,  large-scale  networks 
(Europol, 2016)278. They are often family- or kinship-based, with members coming from the same 
community and cultural background. Europol also reports that Nigerian groups handle all phases 
of the THB process independently and are best able to hide their activities via legal businesses 
(Europol, 2016). Nigerian confraternities operate all over the world, funding the brotherhood279 
in Nigeria through both licit and illicit activities, in some cases through organised crime and, in 
particular, THB (Europol, 2019c).  

The Nigerian OCGs rely on social capital and social connections  – victims are often recruited in 
their own home, sometimes by a relative or family friend (UNODC, 2010). The victims’ family is 
asked to pay money for their transportation and living costs. Previous studies assess that the fee 
demanded  by  traffickers  can  range  between  $35,000  (USD)  and  $70,000  (USD)  (Campana, 
2016).  An  interviewed  law  enforcement  expert  from  Sweden  referred  to  an  amount  reaching 
€70,000 
to  be  a  highly  profitable 
destination280.  These fees subsequently need to be returned to the country of origin of the victim. 

for  transfer  to  Sweden,  a  country  considered 

THB for sexual exploitation is an overwhelmingly cash-based criminal market. Reports 
by Europol, Association of Law Enforcement Forensic Accountants (ALEFA) and Financial Action 
Task  Force  (FATF)  –  alongside  recent  country  studies  in  Bulgaria,  Italy,  Romania  and  Spain 
conducted by CSD – did not establish any evidence of the extensive use of NPMs by traffickers 
in the process of settlement of payments during the operations connected with the exploitation 
of victims (ALEFA, 2019; Europol, 2015; FATF-APG, 2018; Shentov et al., 2019). Interviews with 
national investigative authorities, as well as EU-level stakeholders, also did not lead to findings of 
extensive use of NPMs in sex-trafficking operations. Thus, OCGs predominantly rely on traditional 
payment methods in their operations of the criminal market of THB for sexual exploitation. 

The settlements of payments – between clients and victims, between victims and traffickers or 
between perpetrators within the THB network – are almost entirely cash based. An in-depth study 
of the financial aspects of THB in nine EU Member States, including Bulgaria and Romania, shows 
that this is especially valid in the case of THB for sexual exploitation (Shentov et al., 2019). This 
mechanism holds true both for Southeast European and Nigerian criminal networks. The analysis 
below provides an insight into the operations of OCGs in an attempt to explain the prevalence of 
cash operations and the possibility of using NPMs in the settlement of payments. 

Cash is typically paid upfront by the end-client to the victim, who promptly gives the money to 
an  intermediary  or  delivers  an  accumulated  sum  to her  exploiters  on  a  periodic  basis.  Money-
flows from the victim to the traffickers typically occur directly between procurers and victims, or 
between trusted associates and victims (Shentov et al., 2019). 

Differences can be observed regarding the more sophisticated and expensive ends of the sexual 
exploitation  market.  A  study  on  financial  flows  from  THB  in  Belgium  reveals  that  clients  from 
Western Europe may wire money (debit or credit) as if to pay for a legitimate service, i.e. massage 
(CSD,  2015;  Raets  &  Janssens,  2019).  In  these  cases,  the  victim  is  often  located  in  another 
Member State in Southeast Europe (including Bulgaria and Romania), and the wired money is in 
effect a pre-payment for transportation and sex services to be rendered by the victim upon arrival 
(CSD, 2015; Raets & Janssens, 2019).    

278 Interview with national stakeholder SE, 10 March 2020 (#43).
279 Nigerian brotherhoods were initially formed in Nigeria’s principal universities around the mission of fighting 
against European colonial powers. Their purpose, however, was subsequently diverted towards organisation 
of criminal activities (Shentov et al., 2019).
280 Interview with national stakeholder SE, 10 March 2020 (#43).

252 

 
 
 
 
 
 
 
EUROPEAN COMMISSION 

Although the internet has gained importance in terms of advertising of victims from Southeast 
Europe, according to an investigative expert from Sweden, cash is still the prevalent payment for 
services, even in when victims are advertised on the internet281. 

Underlying factors for lack of extensive use of NPMs by OCGs 
The  lack  of  use  of  NPMs  by  Southeast  European  OCGs  in  their  operations  of  THB  for  sexual 
exploitation is to some extent explained by a country report on Romanian financial flows, which 
suggests that the convicted traffickers typically lack the necessary knowledge and sophistication, 
and thus resort to traditional cash flow operations  (Shentov et al., 2019). Brenig et al. (2015) 
also  argue  that  despite  the  advantages  of  crypto-currencies  and  cyber-mediated  laundering, 
human traffickers are inclined to use more traditional methods, such as cash. A report by CSD 
covering financing of THB OCGs attributes the lack of popularity of virtual currencies in human 
trafficking circles to unfamiliarity or a general lack of expertise. Financial management is a high-
expertise ‘high-stakes phase’ of the trafficking cycle, and this could be the reason why traffickers 
prefer to use more familiar methods (Shentov et al., 2019). 

According to Europol the free movement of goods and people within the Schengen area is a 
facilitating factor for undeclared transports of large amounts of cash within the EU, from 
countries of exploitation to countries of origin. As cash flow operations are difficult to trace, they 
remain a preferred method of traffickers for transferring money (Europol, 2015).  

A study on financial flows from THB in Italy reveals that as Nigerian victims are predominantly 
exploited in street prostitution, cash is used in transactions between victims and customers, and 
between victims and the money collectors. In this case, the money collector is the  ‘madam’, a 
former victim herself, who oversees revenues and expenditures. The madam is responsible for 
delivering  the  proceeds  to  her  partner  and  for  paying  other  individuals  who  support  the 
prostitution activity (Shentov et al., 2019). 

Use of NPMs for return of proceeds and money-laundering 
ALEFA reports that proceeds from transnational THB operations are typically sent back to 
the perpetrators’ country of origin (which is often also the victims’ country of origin), either 
as cash or high-value goods (ALEFA, 2019). For the OCGs originating from Southeast Europe and 
Nigeria, literature review and stakeholder interviews delineate three main methods for the return 
of funds from THB to the countries of origin: smuggling of cash or value goods, wire transfers 
through money remittance services, or via the hawala system.  

According  to  FAFT,  money  remittance  services  are  conveniently  used  by  traffickers 
because of the predominance of cash handling/transactions in the process of settlement 
of payments (FATF, 2011). According to ALEFA and stakeholder interviews, the most commonly 
used money remittance services by OCGs involved in THB are Western Union, MoneyGram and 
RIA (ALEFA, 2019)282. Western Union and MoneyGram are the money remittance services typically 
used by Southeast European OCGs involved in THB for sexual exploitation.  

As  previously  described,  the  proceeds  from  THB  for  sexual  exploitation  are  typically 
gathered in cash. Southeast European OCGs stockpile the amounts and break them down into 
small  sums,  to  be  transferred  to  the  countries  of  origin.  When  money  remittance  services  are 
used,  traffickers  use  ‘smurfing  techniques’  to  wire  the  money283.  This  practice  refers  to  the 
breaking up significant amounts of cash into smaller amounts that are typically transmitted by 
several  persons.  The  money  transferred  is  thus  below  the  threshold  requiring  an  in-depth 
identification of the customer. Using multiple senders and/or receivers, large sums of cash can be 
transferred to the countries of origin of perpetrators without raising suspicion (Europol, 2015). 

In the case of Bulgarian OCGs, Petrunov (2011) reports that members of the OCG rarely use 
wire  transfers.  Rather,  the  victims  send  the  money  to  their  relatives,  or  to  relatives  of  the 

281 Interview with national stakeholder SE, 10 March 2020 (#43).
282 Interview with national stakeholder SE, 10 March 2020 (#43); Interview with EU stakeholder, 10 March 
2020 (#44).
283 Interview with EU stakeholder, 10 March 2020 (#44).

253 

 
 
 
 
 
 
 
EUROPEAN COMMISSION 

traffickers. Often  the receivers use  false  IDs, and  the transfers are  below  €2,500  (the amount 
that would require a transaction report) (Petrunov, 2011). In addition, the CSD study reveals that 
Western  Union  is  used  by  victims  who  may  transfer  small  amounts  of  money  to  their  families 
(Shentov et al., 2019). This is presumably because it is the largest and most globally distributed 
firm, rather than because of any special weakness in controls, since there is seldom anything in 
such transfers to enable the firm to deduce that the transferee is a THB victim. 

Bulgarian law enforcement  has also detected  the  sale  of  personal  identities for  the  use  of 
wire and bank transfers by traffickers. Typically, the persons selling their personal identities 
are  from  impoverished  groups  and  have  low  levels  of  literacy,  and  are  not  aware  of  the  THB 
operation284. Money remittance services located in the EU are required to identify their customers, 
but  any  form  of  photographic  identification  is  sufficient  to  transfer  amounts  below  a  specified 
threshold, so traffickers use this method to avoid detection by law enforcement.  

Romanian  OCGs  also  typically  use  Western  Union  or  MoneyGram  systems  for  wire 
transfer.  Victims  are  also  known  to  use  these  systems  to  wire  money  to  their  exploiter,  who 
might have employed ‘lover boy’ grooming methods285 to recruit them into trafficking. In one case 
of THB for sexual exploitation, four women victims of THB from Romania were able to send back 
€86,000 using wire transfers (Shentov et al., 2019). 

The money transfers made by Southeast European OCGs fall below the red flag indicators outlined 
by FATF as money-laundering techniques in THB and migrant smuggling, namely: 

• 

• 

• 

small amounts sent with high frequency to unconnected persons;  

small amounts sent to different recipients;  

frequent money transfer to ‘risky’ countries; and 

•  multiple customers making international funds transfers to the same overseas 

beneficiary (FATF, 2011). 

Due  to  heightened  attention  by  law  enforcement  on  money  transfer  operations,  and  the 
cooperation of key money-transfer service providers, previous research and interviews conducted 
for  this  study  reveals  that  Bulgarian  and  Romanian  traffickers  are  making  less  use  of 
money-transfer services for the return of proceeds, in lieu of the more intensive use of 
cash smuggling (Raets & Janssens, 2019; Shentov et al., 2019)286. 

Another method used by traffickers to return the proceeds of criminal activities to the countries 
of origin is through informal value transfer systems, also known as hawala287. According to 
Europol, Nigerian OCGs use hawala systems to return the proceeds of THB to the country of origin 
(Europol,  2019c).  A  large  part  of  the  money  transferred  via  the  hawala  systems  is  for  the 
repayment of debts incurred by the families of the THB victim. According to a recent case study 
on THB for sexual exploitation of Nigerian women in Oslo, the hawala customers were required to 
pay a transaction fee of 10% (FATF, 2011). 

The informal transfer system utilised by the Nigerian networks in Italy, also known as ‘euro-to-
euro’, involves parallel money transfer through grocery stores and other retailers. The system is 
based  on  services  and  guarantees  ‘ad  persona’  –  that  is,  it  is  linked  to  the  credibility  of  the 
intermediary within a widespread network of intermediaries located mainly in Nigeria, and with 
money collected in Italy. According to a CSD study, the fee for transferring money through this 
informal system is 1–2% of the amount (Shentov et al., 2019). 

While recent reports warn of the regular use of the hawala system by Nigerian OCGs involved in 
THB for sexual exploitation in particularly, there is no actual assessment on the share of use of 

284 Interview national stakeholder BG, 13 March 2020 (#51).
285  The  ‘lover  boy’  method  of  recruitment  usually  revolves  around  victims  being  manipulated  to  become 
emotionally attached to their exploiters. See Trafficking in human beings brief for additional details.
286 Interview with national stakeholder BG, 13 March 2020 (#51).
287 For detailed definition, please refer to Glossary (see main report). 

254 

 
 
 
 
 
 
 
EUROPEAN COMMISSION 

the system as opposed to alternative channels of return of proceeds, such as the use of money 
transfers or cash smuggling.  

While Southeast European and Nigerian OCGs use money remittances as well as hawala systems 
to transfer the proceeds of THB for sexual exploitation to the origin countries, our research did 
not  find  evidence  of  the  attempted  use  of  bitcoins  or  cryptocurrencies  in  the  THB 
operations. This seems to be  the  general  rule  with regards  to THB networks. ALEFA  concludes 
that ‘there is limited evidence of modern digital financial payments (e.g. bitcoin) being used (in 
THB  cases),  but  the  consensus  is  that,  like  for  most  other  criminality,  this  will  become  more 
prevalent in the future’ (ALEFA, 2019). The need for development of law enforcement capacity in 
this area was underscored during interviews with national experts288. 

Europol also warns of an increased use of pre-paid credit cards for money-laundering purposes in 
cases  of  THB  (Europol,  2015),  although  the  interviews  conducted  for  this  study  with  law 
enforcement  experts  in  Bulgaria  revealed  that  there  have  been  no  registered  instances  of  the 
abuse of pre-paid cards289. However, this does not preclude the use of pre-paid cards by other 
OCGs. 

Smuggling of cash remains prevalent compared to NPMs 
The desk research and the conducted interviews clearly showed that even though different NPMs 
are  commonly  used  by  both  Southeast  European  and  Nigerian  OCGs,  smuggling  of  cash  or 
luxury goods remains the prevalent method to return proceeds to the country of origin 
(Shentov et al., 2019)290. This assessment is confirmed by all interviewed stakeholders, as well 
as  by  previous  research.  It  constitutes  a  non-banking  remittance  method,  and  as  such  poses 
challenges for detection by law enforcement. 

According to previous research and current interviews with law enforcement, common techniques 
used  by  Bulgarian  traffickers  are  to  use  victims  as  couriers  by  organising  regular  trips  of  the 
exploited women back to  Bulgaria,  or  by  rotating victims  (Petrunov, 2011). Similar tactics are 
used by Romanian OCGs (Shentov et al., 2019). The victims usually carry sums that amount to 
up to €10,000, so they do not have to report the source of the money. Similarly, bus/van drivers 
conducting regular trips to countries of exploitation are used as  cash couriers. For a small fee, 
they often agree to bring cash to Bulgaria291. In addition, previous research has identified another 
technique used by traffickers: the hiring of persons whose jobs require international travel to act 
as  cash  couriers.  The  couriers  could  be  drivers,  line  stewards  or  flight  attendants  (Petrunov, 
2011).  

Nigerian networks use cash couriers to smuggle cash through airports. Terenghi & Nicola (2018) 
point out that the price paid for such service is 6% of the smuggled amount. Alternatively, victims 
– or sometimes even traffickers – might carry cash with them on planes and buses, or the cash 
can be shipped in containers (Shentov et al., 2019). Nigerian OCGs in Italy also use ‘trolley men’ 
who transfer cash in suitcases back to Nigeria (Shentov et al., 2019). 

288 Interview with national stakeholder BG, 13 March 2020 (#51).
289 Interview with national stakeholder BG, 13 March 2020 (#51).
290 Interview with national stakeholder BE, 26 February 2020 (#37); Interview with EU stakeholder, 10 March 
2020 (#44); Interview with national stakeholder BG, 13 March 2020 (#51).
291 Interview with national stakeholder BG, 13 March 2020 (#51).

255 

 
 
 
 
 
 
 
 
 
 
 
EUROPEAN COMMISSION 

  References 

Ablon, L., Libicki, M. C., & Golay, A.  A. (2014).  'Markets for cybercrime tools and stolen data: 

Hackers' bazaar'. Santa Monica, CA: RAND Corporation. 

Aebi, M. F. (2014). European Sourcebook of Crime and Criminal Justice Statistics 2014. Helsinki: 

European Institute for Crime Prevention and Control. 

Agnew,  K.  (2020).  'How  new  Irish  motorways  led  to  more  rural  crime'.  RTE.  Retrieved  from: 

https://www.rte.ie/brainstorm/2020/0303/1119982-motorways-rural-crime/ 

ALEFA. (2019). Trafficking in human beings (THB). Financial investigations handbook. Retrieved 
from:  http://www.alefa.eu/ckeditor_uploads/files/165804-ALEFA-E-Publication-updated-
14%2003%2019%20v%20edit%20with%20NO%20contacts.pdf 

Allain, J., Crane, A., LeBaron, G., & Behbahani, L. (2013). 'Forced labour’s business models and 

supply chains'. Retrieved from:  
https://www.jrf.org.uk/sites/default/files/jrf/migrated/files/forced-labour-business-
full.pdf 

Allen, E. (2012). 'The illicit trade in tobacco products and how to tackle it'. World Customs Journal, 

6(2), 121–130.  

Amilhat, E., Basic, T., Beaulaton, L., Belpaire, C., Bernotas, P., Briand, C., . . . Dekker, W. (2019). 

'Joint EIFAAC/ICES/GFCM Working Group on Eels (WGEEL)'.  

Amore, M. D., & Bennedsen, M. (2013). Corporate Governance and the Environment: Evidence 

from Green Innovations. 

Amy-Vogt,  B.  (2019).  'Despite  Warnings,  Ransomware  Attacks  Rise  in  Frequency,  Impact  and 

Intensity'. Retrieved from: 
cybersecurity-ransomware-attacks-increase-frequency-impact-intensity-acronissummit/ 
Anderson, R., Barton, C., Bölme, R., Clayton, R., Van Eeten, M. J. G., Levi, M., . .  . Savage, S. 
(2013).  'Measuring  the  cost  of  cybercrime'.  In  Böhme,  R.  (Ed.),  The  economics  of 
information security and privacy (265–300): Springer. 

 https://siliconangle.com/2019/10/15/sad-state-

Anderson, R., Barton, C., Bölme, R., Clayton, R., Ganán, C., Grasso, T., . . . Vasek, M. (2019). 
from: 

cybercrime'. 

Retrieved 

changing 

cost 

of 

'Measuring 
http://orca.cf.ac.uk/122684/ 

the 

Andrees,  B.  (2008).  'Forced  labour  and  trafficking  in  Europe:  how  people  are  trapped  in,  live 

through and come out'. Geneva: ILO. 

Andrews,  S.,  Brewster,  B.,  &  Day,  T.  (2018).  Organised  crime  and  social  media:  a  system  for 
detecting, corroborating and visualising weak signals of organised crime online. Security 
Informatics, 7(1), 3. 

Angelini, M., Camerini, D., Giommoni, L., Soriani, C., & Standridge, P. (2015). 'Organised crime 
portfolio: Illicit revenues and criminal investments in Europe'. European Law Enforcement 
Research Bulletin(12), 4–12.  

Aniello, S., & Caneppele, S. (2017). 'Selling stolen goods on the online markets: an explorative 

study'. Global Crime, 1–21.  

Anti-slavery. (2014). 'Trafficking for forced criminal activities and begging in Europe: Exploratory 

study and good practice examples'. Retrieved from: 
 http://www.antislavery.org/wp-
content/uploads/2017/01/trafficking_for_forced_criminal_activities_and_begging_in_eur
ope.pdf 

Antonopoulos, G. A., & Hall, S. (2014). 'The death of the legitimate merchant? Small to medium-
size enterprises and shady decisions in Greece during the financial crisis'. In van Duyne, 
P. C., Harvey, J., Antonopoulos, G. A., von Lampe, K., Maljević, A. & Markovska, A. (Eds.), 
Corruption, greed and crime-money. Sleaze and shady economy in Europe and beyond, 
Nijmegen: Wolf Legal Publishers. 

Antonopoulos, G. A., & Hall, A. (2016). 'The financial management of the illicit tobacco trade in 

the United Kingdom'. British Journal of Criminology, 56(4), 709–728.  

Ardizzi, G., Petraglia, C., Piacenza, M., & Turati, G. (2014). 'Measuring the Underground Economy 
with  the  Currency  Demand  Approach:  A  Reinterpretation  of  the  Methodology,  With  an 
Application to Italy'. Review of Income and Wealth, 60(4), 747–772.  

Armbrüster, C., Beauvais, P., Chedouki, J., Cornu, M., Fortis, É., Frigo, M., . . . Renold, M. (2011). 
'Study on preventing and fighting illicit trafficking in cultural goods in the European Union'.  
Armor. (2019). 'The  Armor 2019  Black  Market Report: A look inside the  Dark Web'.  Retrieved 
https://cdn.armor.com/app/uploads/2018/10/2019-Q3-Report-BlackMarket-

from: 
SinglePages-1.pdf 

256 

 
 
 
 
EUROPEAN COMMISSION 

Aronowitz, A. (2009).  'Human Trafficking,  Human Misery: The  Global  Trade in Human Beings'. 

Retrieved from:  
https://is.cuni.cz/studium/predmety/index.php?do=download&did=33454&kod=JPM346  

ASH Scotland. (2016). 'Illicit tobacco'. Retrieved from:  

https://www.ashscotland.org.uk/media/591209/illicit-tobacco.pdf 

ATM Industry Association. (2014). 'Best Practices for Preventing ATM Gas and Explosive Attacks'. 

Retrieved from:  
atm-gas-and-explosive-attacks-2457294  

https://www.readkong.com/page/best-practices-for-preventing-

Auliya,  M.,  Altherr,  S.,  Ariano-Sanchez,  D.,  Baard,  E.  H.,  Brown,  C.,  Brown,  R.  M.,  .  .  . 
Henningheim, E. (2016). 'Trade in live reptiles, its impact on wild populations, and the 
role of the European market'. Biological Conservation, 204, 103–119.  

Auriol,  E.,  Straub,  S.,  &  Flochel,  T.  (2016).  Public  procurement  and  rent-seeking:  the  case  of 

Paraguay. World Development, 77, 395-407. 

Baird, J., Curry, R., & Cruz, P. (2014). 'An overview of waste crime, its characteristics, and the 

vulnerability of the EU waste sector'. Waste Management & Research, 32(2), 97–105.  

Bales, K., Hesketh, O., & Silverman, B. (2015). 'Modern slavery in the UK: How many victims?'. 

Significance, 12(3), 16–21.  

Barber-Meyer,  S.  (2009).  Dealing  with  the  cladenstine  nature  of  wildlife-trade  market  surveys 

Conversation Biology 24(4), 918-923. 

Barbone,  L.,  Belkindas,  M.  V.,  Bettendorff,  L.,  Bird,  R.,  Bonch-Osmolovskiy,  M.,  &  Smart,  M. 
(2013). 'Study to quantify and analyse the VAT Gap in the EU-27 Member States: Final 
Report'. CASE and CPB Netherlands Bureau for Economic Policy Analysis. Retrieved from:

 https://ec.europa.eu/taxation_customs/sites/taxation/files/docs/body/vat-

gap.pdf 

BBC.  (2019).  'Illegal  eel  exporters  exposed  by  Countryfile'.  BBC  News.  Retrieved  from: 

https://www.bbc.com/news/uk-england-gloucestershire-48647168 

Bekhouche, I. E. (2018). 'Copyright and trademark offences which might infringe the consumer’s 

rights'. ATHENS LJ, 4(243). 

Berry, M. (2018). 'Technology and organised crime in the smart city: an ethnographic study of 

the illicit drug trade'. City, Territory and Architecture, 5(1), 1–11.  

Bezlov, T., Gounev, P., & Gerganov, A. (2011). 'Crime Trends in Bulgaria 2000–2010'. Retrieved 

from: https://www.files.ethz.ch/isn/132589/NIP.pdf  

Bijan, S. (2019, 23 July ). Plex makes piracy just another streaming service. The Verge. Retrieved 
https://www.theverge.com/2019/7/23/20697751/piracy-plex-netflix-hulu-

from 
streaming-wars 

Bisschop, L. (2012). 'Is it all going to waste? Illegal transports of e-waste in a European trade 

hub'. Crime, Law and Social Change, 58(3), 221–249.  

Bisschop,  L.  (2017).  'Transnational  environmental  crime:  exploring  (un)  charted  territory'.  In 
White, R. (Ed.), Transnational Environmental Crime (3–32). London: Routledge. 
Bistarelli,  S.,  Parroccini,  M.,  &  Santini,  F.  (2018).  'Visualizing  bitcoin  flows  of  ransomware: 

WannaCry one week later'.  

Blagojevic,  S.,  &  Damijan,  J.  P.  (2012).  Impact  of  private  incidence  of  corruption  and  firm 
ownership on performance of firms in Central and Eastern Europe. Katholieke Universiteit 
Leuven, LICOS Discussion Paper(310). 

Blakeborough,  L.,  &  Correia,  S.  G.  (2019).  'The  scale  and  nature  of  fraud:  A  review  of  the 

evidence'. Retrieved from: 
https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachme
nt_data/file/720772/scale-and-nature-of-fraud-review-of-evidence.pdf 

Blecher, E., Liber, A., Ross, H., & Birckmayer, J. (2015). 'Euromonitor data on the illicit trade in 

cigarettes'. Tobacco control, 24(1), 100–101.  

Blum, J. A., Levi, M., Naylor, R. T., & Williams, P. (1998). Financial havens, banking secrecy and 

money-laundering: UN. 

Boas, T. C., Hidalgo, F. D., & Richardson, N. P. (2014). The spoils of victory: campaign donations 

and government contracts in Brazil. The Journal of Politics, 76(2), 415-429. 

Boerman,  F.,  Grapendaal,  M.,  Nieuwenhuis,  F.,  &  Stoffers,  E.  (2017).  '2017  National  Threat 
from: 

Assessment'. 
https://www.politie.nl/binaries/content/assets/politie/algemeen/nationaal-
dreigingsbeeld-2017/2017-national-threat-assessment-organised-crime.pdf  

Retrieved 

Borkowski,  F.,  &  Twomey,  C.  (2019).  'European  Union:  Confronting  Illicit  Tobacco  Trade:  An 

Update on EU Policies'. World Bank. 

257 

 
 
 
 
 
EUROPEAN COMMISSION 

Borselli,  F.  (2011).  'Organised  VAT  fraud:  features,  magnitude,  policy  perspectives'.  Retrieved 

from: https://papers.ssrn.com/sol3/papers.cfm?abstract_id=2023080 

Borselli,  F.,  Fedeli,  S.,  &  Giuriato,  L.  (2015).  'Digital  VAT  carousel  fraud:  a  new  boundary  for 

criminality?'. Tax Notes International, 77(8). Retrieved from: 
https://www.researchgate.net/publication/273131335_Digital_VAT_Carousel_Fraud_A_
New_Boundary_for_Criminality 

Bos, M. (2015). 'Trafficking in human organs'. Policy Department, Directorate General for External 

Policies, European Union, 20(21), 22–23.  

Bourne, M. (2013). 'Small arms and light weapons spread and conflict'. In Greene, O., & Marsh, 

N. (Eds),  Small Arms, Crime and Conflict (45–58). London: Routledge. 

Brenig, C., Accorsi, R., & Müller, G. (2015). 'Economic Analysis of Cryptocurrency Backed Money 
Laundering'. Paper presented at the Twenty-Third European Conference on Information 
Systems (ECIS), Münster, Germany. 

Breusch, T. (2005). 'Estimating the Underground Economy using MIMIC Models'. Retrieved from: 

http://jota.website/index.php/JoTA/article/view/70/0  

Brochet, A. L., Van Den Bossche, W., Jones, V. R., Arnardottir, H., Damoc, D., Demko, M., . . . 
Ghasabyan,  M.  (2019).  'Illegal  killing  and  taking  of  birds  in  Europe  outside  the 
Mediterranean:  assessing  the  scope  and  scale  of  a  complex  issue'.  Bird  Conservation 
International, 29(1), 10–40.  

Bromberg,  D.  (2014).  Can  vendors  buy  influence?  The  relationship  between  campaign 
contributions and government  contracts.  International  Journal  of Public Administration, 
37(9), 556-567. 

Brown,  J.,  Welding,  K.,  Cohen,  J.  E.,  Cherukupalli,  R.,  Washington,  C.,  Ferguson,  J.,  &  Clegg 
Smith, K. (2017). An analysis of purchase price of legal and illicit cigarettes in urban retail 
environments in 14 low‐and middle‐income countries. Addiction, 112(10), 1854-1860. 

Burges, D. (2012). Cargo theft, loss prevention, and supply chain security. Oxford: Butterworth-

Heinemann. 

Bush, E. R., Baker, S. E., & Macdonald, D. W. (2014). 'Global trade in exotic pets 2006–2012'. 

Conservation Biology, 28(3), 663–676.  

Butticè, V., Caviggioli, F., Franzoni, C., Scellato, G., & Thumm, N. (2018). Impact of counterfeiting 

on the performance of digital technology companies. Retrieved from: 

Calderoni, F. (2014). 'A new method for estimating the illicit cigarette market at the subnational 

level and its application to Italy'. Global Crime, 15(1–2), 51–76.  

Calderoni,  F.,  Favarin,  S.,  Garofalo,  L.,  &  Sarno,  F.  (2014).  'Counterfeiting,  illegal  firearms, 
gambling and waste management: an exploratory estimation of four criminal markets'. 
Global Crime, 15(1–2), 108–137. doi:10.1080/17440572.2014.883499 

Camerini, D., Favarin, S., & Dugato, M. (2015). 'Estimating the counterfeit markets in Europe'. 

Transcrime.  

Campana,  P.  (2016).  'The  Structure  of  Human  Trafficking:  Lifting  the  Bonnet  on  a  Nigerian 

Transnational Network'. The British Journal of Criminology, 56(1), 68–86.  

Campana,  P.  (2017).  'Macro  trends  in  the  smuggling  of  migrants  into  Europe:  An  analytical 

exploration'. European Law Enforcement Research Bulletin(16), 57–64.  

Campbell,  P.  B.  (2013).  'The  Illicit  Antiquities  Trade  as  a  Transnational  Criminal  Network: 
Characterizing and Anticipating Trafficking of Cultural Heritage'. International Journal of 
Cultural Property(20), 113–153.  

Caneppele,  S.,  Savona,  E.,  &  Aziani,  A.  (2013).  'Crime  proofing  of  the  new  tobacco  products 
directive: Proofing the EU Commission proposal for a revised Tobacco Products Directive 
against 
from: 
https://www.researchgate.net/publication/276952284_Crime_Proofing_of_the_New_To
bacco_Products_Directive  

criminal  opportunities'.  Retrieved 

risks  of  unintended 

the 

Cardador, L., Tella, J. L., Anadon, J. D., Abellan, P., & Carrete, M. (2018). The European trade 

ban on wild birds reduced invasion risks Conservation Letters 

Caulkins, J. P., Disley, E., Tzvetkova, M., Pardal, M., Shah, H., & Zhang, X. (2016). 'Modeling the 
structure and operation of drug supply chains: The case of cocaine and heroin in Italy and 
Slovenia'. International Journal of Drug Policy, 31, 64–73.  

Caulkins, J. P., & Kilmer, B. (2013). 'Estimating the size of the EU cannabis market'. In Trautmann, 
T., Kilmer, B., & Turnbull, P. (Eds), Further Insights into Aspects of the Illicit EU Drugs 
Market (27–29). Luxembourg: Publications Office of the European Union. 

Caulkins,  J.  P.,  Kilmer,  B.,  &  Graf,  M.  (2013).  4.  Estimating  the  size  of  the  EU  cannabis 

market. Further insights into aspects of the EU illicit drugs market, 27. 

258 

 
 
 
 
EUROPEAN COMMISSION 

Chabinsky,  S.  (2010).  'The  Cyber  Threat:  Who's  Doing  What  to  Whom?'.  Retrieved  from: 

https://archives.fbi.gov/archives/news/speeches/the-cyber-threat-whos-doing-what-to-
whom 

Chaudhry,  P.  E.,  &  Zimmerman,  A.  (2012).  Protecting  your  intellectual  property  rights: 
Understanding the role of management, governments, consumers and pirates. Springer 
Science & Business Media. 

Chechi, A. (2019). 'Fighting and preventing offences relating to cultural property: existing rules 

and proposals for functioning regulatory systems'. Retrieved from: 
https://rm.coe.int/fighting-and-preventing-offences-relating-to-cultural-property-
existin/1680980d4e  
(2019). 

Retrieved 

Security 

Solution 

Brief'. 

Point. 

'ATM 

from: 

https://www.checkpoint.com/downloads/products/check-point-atm-security-solution-
brief.pdf 
Point 

Research. 

Retrieved 

Security 

Report'. 

(2019). 

'2018 

from: 

Check 

Check 

https://research.checkpoint.com/2018/check-points-2018-security-report/ 

Cheung,  Y.-L.,  Rau,  P.  R.,  &  Stouraitis,  A.  (2006).  Tunneling,  propping,  and  expropriation: 
evidence from connected party transactions in Hong Kong. Journal of Financial economics, 
82(2), 343-386. 

Chionis,  D.,  &  Chalkia,  A.  (2016).  'Illicit  tobacco  trade  in  Greece:  the  rising  share  of  illicit 

consumption during crisis'. Trends in Organized Crime, 19(3–4), 236–253.  

Chon, S., & Broadhurst, R. (2014). 'Routine Activity Theory and Cybercrime: What about Offender 

Resources?'. Retrieved from: https://ssrn.com/abstract=2379201 

Chonaill,  S.  N.,  Reding,  A.,  &  Valeri,  L.  (2011).  Assessing the  illegal  trade  in  cultural  property 

from a public policy perspective. Retrieved from Cambridge:  

Chong,  E.,  Klien,  M.,  &  Saussier,  S.  (2016).  The  use  and  abuse  of  discretionary  procurement 

procedures: Evidence from the European Union. Working Pap. Chaire EPPP. 

Choo, K. K. R., & Smith, R. G. (2008). 'Criminal exploitation of online systems by organised crime 

groups'. Asian journal of criminology, 3(1), 37–59.  

Chouvy, P. A. (Ed.) (2013). An Atlas of Trafficking in Southeast Asia: The Illegal Trade in Arms, 
Drugs, People, Counterfeit Goods and Natural Resources in Mainland Southeast Asia (Vol. 
17). London: IB Tauris. 

Cingano, F., & Pinotti, P. (2012). Trust, firm organization and the structure of production. Paolo 

Baffi Centre Research Paper(2012-133). 

Cobham, A., Janský, P., & Meinzer, M. (2015). The financial secrecy index: Shedding new light 

on the geography of secrecy. Economic geography, 91(3), 281-303. 

Codex Alimentarius Commission. (2017). Codex committee on food import and export inspection 
and  certification  systems  –  discussion  paper  on  food  integrity  and  food  authenticity. 
from: 
Retrieved 
https://ec.europa.eu/food/safety/international_affairs/standard_setting_bodies/codex/c
cfics_en 

Coles,  I.,  &  Nasralla,  S.  (2015).  'The  migrant  truck  tragedy:  ‘I  feel  really  bad  about  what 

happened’'. Reuters Investigates. Retrieved from: 
https://www.reuters.com/investigates/special-report/europe-migrants-truck/ 

Columb, S. (2017). 'Excavating the organ trade: An empirical study of organ trading networks in 

Cairo, Egypt'. British Journal of Criminology, 57(6), 1301–1321.  

Commission,  E.  (2017).  'First  Report  under  the  Visa  Suspension  Mechanism'.  Retrieved  from:
https://ec.europa.eu/home-affairs/sites/homeaffairs/files/what-is-
new/news/20171220_first_report_under_suspension_mechanism_en.pdf 

Comolli, V. (2019). 'Niger: Curtailing migration has unintended consequences'. IISS. Retrieved 

from: 
https://www.iiss.org/blogs/analysis/2019/11/csdp-curtailing-migration-niger 

Conti, M., Gangwal, A., & Ruj, S. (2018). 'On the economic significance of ransomware campaigns: 

A Bitcoin transactions perspective'. Computers & Security, 79, 162–189.  

Cook, T. (2013). 'Revision of the European Union regime on customs enforcement of intellectual 

property rights'. Journal of Intellectual Property Rights, 18, 485–490. 

Cornelius, C. V. M., Lynch, C. J., & Gore, R. (2017). 'Aging out of crime: exploring the relationship 
between age and crime with agent based modelling'. Paper presented at the SpringSim-
ADS 2017, Virginia Beach.  

CREATe & PwC. (2014). 'Economic Impact of Trade Secret Theft: A framework for companies to 
from: 

secrets  and  mitigate  potential 

threats'.  Retrieved 

safeguard 

trade 

259 

 
 
 
 
 
 
  
EUROPEAN COMMISSION 

https://www.innovation-asset.com/hubfs/blog-files/CREATe.org-PwC-Trade-Secret-
Theft-FINAL-Feb-2014_01.pdf 

Crime&Tech.  (2017).  'Retail  Security  in  Europe.  Going  beyond  shrinkage'.  Retrieved  from: 

https://www.crimetech.it/landing/retail-security-in-europe/Retail-Security-in-Europe-
Executive-Summary-EN.pdf  

Croatian State Prosecutor's Office for the Suppression of Organized Crime and Corruption. (N.d.). 

Homepage. Retrieved from: http://www.dorh.hr/m 

CSD. (2015). 'Financing of Organised Crime'. Retrieved from:   

http://old.csd.bg/artShow.php?id=17317 

CSD.  (2019).  'Оценка  на  заплахите  от  организираната  престъпност  в  България'  ('Bulgarian 

Organised Crime Threat Assessment'). Retrieved from:  
https://csd.bg/fileadmin/user_upload/publications_library/files/2019_12/BOCTA_BG.pdf  
Customs Authority. (N.d.). 'Customs Service – General Directorate of Customs and Excise Duty'. 

Retrieved from:  https://portal.gsis.gr/portal/page/portal/ICISnet/authority 

Czabański, J. (2009). 'The feasibility of cost of crime estimations in Eastern Europe – the case of 

Poland'. European Journal on Criminal Policy and Research, 15(4), 327.  

Dávid-Barrett, E., & Fazekas, M. (2016). Corrupt contracting: Controlling Partisan Favouritism in 

Public Procurement.  

David-Barrett,  E.,  Fazekas,  M.,  Hellmann,  O.,  Mark,  L.,  &  McCorley,  C.  (2018).  Controlling 

Corruption in Development Aid: New Evidence from Contract-Level Data. 

Davies,  J.,  &  Ollus,  N.  (2019).  'Labour  exploitation  as  corporate  crime  and  harm:  outsourcing 
responsibility  in  food  production  and  cleaning  services  supply  chains'.  Crime,  Law  and 
Social Change, 72(1), 87–106.  

Day,  G.  (2014).  'Explaining  the  Art  Market’s  Thefts,  Frauds,  and  Forgeries  (And  Why  the  Art 
Market Does Not Seem to Care)'. Vanderbilt Journal of Entertainment & Technology Law, 
16(3), 457–495.  

De  Boyrie,  M.  E.,  Pak,  S.  J.,  &  Zdanowicz,  J.  S.  (2005).  The  impact  of  Switzerland's  money 
laundering law on capital flows through abnormal pricing in international trade.  Applied 
financial economics, 15(4), 217-230. 

Décary-Hétu, D., & Giommoni, L. (2017). Do police crackdowns disrupt drug cryptomarkets? A 
longitudinal analysis of the effects of Operation Onymous. Crime, Law and Social Change. 
67(1), 55-75.  

de Cock, M., & Woode, M. (2014). 'Profits and poverty: The economics of forced labour'. Retrieved 

from:  https://research.monash.edu/en/publications/profits-and-poverty-the-
economics-of-forced-labour  

Dégardin, K., Roggo, Y., & Margot, P. (2014). Understanding and fighting the medicine counterfeit 

market. Journal of pharmaceutical and biomedical analysis, 87, 167-175. 

Di    Bono,  L.,  Cincimino,  S.,  Riccardi,  M.,  &  Berlusconi,  G.  (2015).  Management    strategies    of  
infiltrated businesses. In E. Savona & G. Berlusconi (Eds.), Organized crime infiltration of 
legitimate businesses  in Europe: A   pilot project  in  five  European   countries  (pp. 102–
112). Trento: Transcrime – Università degli Studi di Trento. 

de la Feria, R. (2018). 'Tax Fraud and the Rule of Law'. Retrieved from: 

https://wayback.archive-it.org/org-
467/20200808042212/http://eureka.sbs.ox.ac.uk/7281/1/WP1802.pdf 

De Stercke, J., Liagre, F., & Stove, A. (2014). 'An integral methodology to develop an information-

led and community-orientated policy to tackle domestic burglary'.  

Dell’ Anno, R. & Schneider, F. (2003). 'The Shadow Economy of Italy and other OECD countries: 
What do we know?'. Journal of Public Finance and Public Choice, 21(2–3) 97–120.  
Demant,  J.,  Munksgaard,  R.,  Décary-Hétu,  D.,  &  Aldridge,  J.  (2018).  'Going  local  on  a  global 
platform: A critical analysis of the transformative potential of cryptomarkets for organized 
illicit drug crime'. International Criminal Justice Review, 28(3), 255–274.  

Detica  &  Cabinet  Office. 

(2011).  The 

cost  of 

cyber 

crime.  Retrieved 

from: 

https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachme
nt_data/file/60943/the-cost-of-cyber-crime-full-report.pdf 

Di Nicola, A., & Terenghi, F. (2016). 'Managing finances in the illicit tobacco trade in Italy'. Trends 

in Organized Crime, 19(3-4), 254–272.  

Downs,  J.  S.,  Holbrook,  M.,  &  Cranor,  L.  F.  (2007).  'Behavioral  response  to  phishing  risk'.  In 
eCrime  '07:  Proceedings  of  the  anti-phishing  working  groups  2nd  annual  eCrime 
researchers summit, 37–44. Retrieved from: 
https://dl.acm.org/doi/pdf/10.1145/1299015.1299019 

260 

 
 
 
 
 
EUROPEAN COMMISSION 

Dugato,  M.,  Favarin,  S.,  &  Giommoni,  L.  (2015).  'The  risks  and  rewards  of  organized  crime 

investments in real estate'. British Journal of Criminology, 55(5), 944–965.  

Duquet,  N.  (2016).  'Armed  to  kill:  An  exploratory  analysis  of  the  guns  used  in  public  mass 

shootings in Europe'. Flemish Peace Institute. 

Duquet,  N.  (2018).  'Triggering  terror:  Illicit  gun  markets  and  firearms  acquisition  of  terrorist 

networks in Europe'. Retrieved from: 
https://www.academia.edu/36450059/_2018_Triggering_Terror_Illicit_Gun_Markets_an
d_Firearms_Acquisition_of_Terrorist_Networks_in_Europe 

Duquet, N., & Goris, K. (2018). 'Firearms acquisition by terrorists in Europe: Research findings 
and policy recommendations of Project SAFTE'. Brussels: Flemish Peace Institute.  
Dybka, P., Kowalczuk, M., Olesinski, B., Rozkrut, M., & Torój, A. (2017). 'Currency demand and 
MIMIC  models:  towards  a  structured  hybrid  model-based  estimation  of  the  shadow 
economy  size'.  SGH  KAE  Working  paper  Series(2017/030).  Retrieved 
from: 
http://kolegia.sgh.waw.pl/pl/KAE/Documents/WorkingPapersKAE/WPKAE_2017_030.pdf 
EAST.  (2020).  ‘European  Payment  Terminal  Crime  report  2019.  Period:  January  -  December’'. 

Non-public EAST report (disclosed to research team upon request to use for the study). 

ECB. (2018). 'Fifth report on card fraud'. Retrieved from: 

https://www.ecb.europa.eu/pub/cardfraud/html/ecb.cardfraudreport201809.en.html 

Eisend,  M.  (2019).  Explaining  Digital  Piracy:  A  Meta-Analysis.  Information  Systems  Research, 

30(2), 636-664. 

Ekwall, D., & Lantz, B. (2012). 'Value and incident categories for cargo theft in Europe: Analysing 

TAPA EMEA statistics'. Retrieved from:   http://www.diva-
portal.org/smash/get/diva2:887489/FULLTEXT01.pdf 

Ellis,  C.  (2017).  'On  Tap  Europe:  Organised  Crime  and  Illicit  Trade  in  Tobacco,  Alcohol  and 

Pharmaceuticals'. Retrieved from: 
https://rusi.org/sites/default/files/201703_rusi_whr_2-
17_on_tap_europe_updated_low-res.pdf 

EMCDDA.  (2018).  'Recent  changes  in  Europe’s  cocaine  market:  results  from  an  EMCDDA 

trendspotter study'. Retrieved from: 
https://www.emcdda.europa.eu/system/files/publications/10225/2018-cocaine-
trendspotter-rapid-communication.pdf  

EMCDDA.  (2019a).  Drug  precursor  developments  in  the  European  Union.  Retrieved  from: 

https://www.emcdda.europa.eu/publications/emcdda-papers/drug-precursor-
developments-eu_en  

EMCDDA.  (2019b).  'European  Drug  Report:  Trends  and  developments'.  Retrieved  from: 

http://www.emcdda.europa.eu/system/files/publications/11364/20191724_TDAT19001
ENN_PDF.pdf 

EMCDDA.  (2020).  'European  Drug  Report  2020:  Trends  and  Developments'.  Retrieved  from: 
https://www.emcdda.europa.eu/system/files/publications/13236/TDAT20001ENN_web.p
df   

EMCDDA & Europol. (2016). 'EU drug markets report: In-depth analysis'. Office of the European 

Union. 

EMCDDA & Europol. (2017). 'Drugs and the darknet: perspectives for enforcement, research and 

policy'. Retrieved from:  
http://www.emcdda.europa.eu/system/files/publications/6585/TD0417834ENN.pdf 

EMCDDA & Europol. (2019). 'EU drug markets report: In-depth analysis'. Office of the European 

Union. 

EMCDDA & Pompidou Group. (1997). 'Estimating the prevalence of problem drug use in Europe'. 
Retrieved from:  https://www.emcdda.europa.eu/html.cfm/index34027EN.html_en 

EnviCrimeNet. (2016). 'Report on Environmental Crime in Europe'. Retrieved from: 

http://www.envicrimenet.eu/images/docs/envicrimenet%20report%20on%20environme
ntal%20crime.pdf   

Environmental  Investigation  Agency  (EIA).  (2020).  Illegal  trade  seizures:  large-scale  elephant 
from  https://eia-international.org/wildlife/wildlife-trade-

ivory  seizures.  Retrieved 
maps/large-scale-elephant-ivory-seizures/ 

Esselink, H., & Hernandez, L. (2017). The use of cash by households in the euro area.  
EUCPN. (2017). 'Thematic Paper - Pickpocketing committed by mobile organised crime groups'. 

Retrieved from:  
https://eucpn.org/sites/default/files/document/files/Theoretical%20Paper%20Pickpocke
ting.pdf 

261 

 
 
 
 
 
 
 
 
EUROPEAN COMMISSION 

EUIPO.  (2015).  'The  economic  cost  of  IPR  infringement  in  the  toys  and  games  (4th  sectorial 
from: 

study)'. 
https://euipo.europa.eu/ohimportal/en/web/observatory/ipr_infringement_toys_and_ga
mes?utm_source=hootsuite 

Retrieved 

EUIPO. (2016). 'Report on Infringement of Protected Geographical Indications for Wine, Spirits, 
Agricultural  Products  and  Foodstuffs  in  the  European  Union'.  Retrieved  from:

https://euipo.europa.eu/tunnel-

web/secure/webdav/guest/document_library/observatory/documents/Geographical_indi
cations_report/geographical_indications_report_en.pdf 

EUIPO. (2016a). 'The economic cost of IPR infringement in handbags and luggage (6th sectorial 

study)'. Retrieved from: 
https://euipo.europa.eu/ohimportal/en/web/observatory/ipr_infringement_handbags_an
d_luggage 

EUIPO. (2016b). 'The economic cost of IPR infringement in jewellery and watches (5th Sectorial 
from:  

study)'. 
https://euipo.europa.eu/ohimportal/en/web/observatory/ipr_infringement_jewellery_an
d_watches 

Retrieved 

EUIPO.  (2016c).  'The  economic  cost  of  IPR  infringement  in  the  pharmaceutical  industry: 
in  Manufacture  of  pharmaceutical  preparations 

Quantification  of 
infringement 
(NACE21.20)'. Retrieved from:    
https://euipo.europa.eu/tunnelweb/secure/webdav/guest/document_library/observatory
/resources/research-andstudies/ip_infringement/study9/pharmaceutical_sector_en.pdf 

EUIPO. (2017a). 'The economic cost of IPR infringement in the pesticides sector (10th sectorial 
study)'.  Retrieved  from:  https://euipo.europa.eu/ohimportal/en/web/observatory/ipr-
infringement-pesticides-sector 

EUIPO.  (2017b).  'The  economic  cost  of  IPR  infringement  in  the  recorded  music  industry  (7th 
from: 

sectorial 
https://euipo.europa.eu/ohimportal/en/web/observatory/ipr_infringement_music 
EUIPO. (2017c). 'The economic cost of IPR infringement in the smartphones sector (11th sectorial 
study)'.  Retrieved  from:  https://euipo.europa.eu/ohimportal/en/web/observatory/ipr-
infringement-smartphone-sector 

Retrieved 

study)'. 

EUIPO.  (2017d).  'European  citizens  and  intellectual  property:  Perception,  awareness  and 

behaviour'. Retrieved from: 
https://euipo.europa.eu/tunnelweb/secure/webdav/guest/document_library/observatory
/documents/IPContributionStudy/2017/european_public_opinion_study_web.pdf  
EUIPO. (2017e). 'Infringement of protected geographical indications for wine, spirits, agricultural 
products  and  foodstuffs  in  the  European  Union'.  Alicante,  Spain:  European  Union 
Intellectual Property Office. 

EUIPO. (2018). 'The economic cost of IPR infringement in the tyres and batteries sectors (12th 
https://euipo.europa.eu/tunnel-

sectorial 
web/secure/webdav/guest/document_library/observatory/resources/research-and-
studies/ip_infringement/study12/tyres_batteries_sector_sector_en.pdf 

Retrieved 

study)'. 

from: 

EUIPO.  (2019a). 

'2019 

intellectual  property  and  youth  scoreboard'.  Retrieved 

from: 
https://euipo.europa.eu/tunnelweb/secure/webdav/guest/document_library/observatory
/documents/IP_youth_scoreboard_study_2019/IP_youth_scoreboard_study_2019_en.p
df  

EUIPO.  (2019b).  'Illegal  IPTV  in  the  European  Union:  Research  on  online  business  models 
infringing 
from: 
https://euipo.europa.eu/tunnelweb/secure/webdav/guest/document_library/observatory
/documents/reports/2019_Illegal_IPTV_in_the_European_Union/2019_Illegal_IPTV_in_t
he_European_Union_Full_en.pdf  

intellectual 

Retrieved 

property 

phase 

rights 

4'. 

- 

and 

EUIPO.  (2019c).  'Report  on  the  EU  enforcement  of  intellectual  property  rights:  Results  at  EU 
borders 
from: 
States 
https://euipo.europa.eu/tunnelweb/secure/webdav/guest/document_library/observatory
/documents/reports/2019_Report_on_Enforcement_of_IPR_at_EU_borders_and_in_MS_
2013_2017/2019_Report_on_enforcement_of_IPR_at_EU_borders_and_in_MS_2013_2
017_Full_en.pdf  

2013–2017'. 

Retrieved 

Member 

in 

EUIPO.  (2020a).  '2020  status  report  on  IPR  infringement:  Why  IP  rights  are  important,  IPR 
infringement,  and  the  fight  against  counterfeiting  and  piracy'.  Retrieved  from: 
https://euipo.europa.eu/tunnelweb/secure/webdav/guest/document_library/observatory

262 

 
 
 
 
 
 
EUROPEAN COMMISSION 

/documents/reports/2020_Status_Report_on_IPR_infringement/2020_Status_Report_o
n_IPR_infringement_en.pdf 

EUIPO.  (2020b).  'IP  crime  and  its  link  to  other  serious  crimes:  Focus  on  Poly-Criminality'. 

Retrieved from:  
https://euipo.europa.eu/tunnelweb/secure/webdav/guest/document_library/observatory
/documents/reports/2020_IP_crime_and_its_link_to_other_serious_crimes/2020_IP_cri
me_and_its_link_to_other_serious_crimes_Full.pdf 

EUIPO & Europol. (2019). 'Intellectual Property Crime Threat Assessment 2019'. Retrieved from:

https://euipo.europa.eu/tunnel-

web/secure/webdav/guest/document_library/observatory/documents/reports/2019_IP_
Crime_Threat_Assessment_Report/2019_IP_Crime_Threat_Assessment_Report.pdf 

Eurobarometer. 

(2009). 

'Survey  on  Tobacco:  Analytical 

report'.  Retrieved 

from: 

https://ec.europa.eu/commfrontoffice/publicopinion/flash/fl_253_en.pdf 

Eurobarometer.  (2019). 

'Undeclared  Work 

in 

the  European  Union'.  Retrieved 

from: 

https://ec.europa.eu/commfrontoffice/publicopinion/index.cfm/ResultDoc/download/Doc
umentKy/89505 

European Anti-Fraud Office. (2019). 'Report fraud'. Retrieved from: 

https://ec.europa.eu/anti-fraud/olaf-and-you/report-fraud 

European Commission. (2011). 'Action plan to fight against smuggling of cigarettes and alcohol 

along the EU Eastern border'. Retrieved from:   
http://aei.pitt.edu/45825/1/SEC_(2011)_791.pdf 

European Commission. (2012). 'Report for the Study on Typology and Policy Responses to Child 

Begging in the EU'. Retrieved from: 
trafficking/sites/antitrafficking/files/report_for_the_study_on_typology_and_policy_resp
onses_to_child_begging_in_the_eu_0.pdf 

https://ec.europa.eu/anti-

European  Commission.  (2013).  'Communication  from  the  Commission  to  the  Council  and  the 
European Parliament: Stepping up the fight against cigarette smuggling and other forms 
of  illicit  trade  in  tobacco  products  -  A  comprehensive  EU  Strategy'.  Retrieved  from:

https://ec.europa.eu/anti-

fraud/sites/antifraud/files/docs/body/communication_en.pdf 

European  Commission.  (2014a).  'Economic  impact  of  eel  trade  ban  –  general  trends.  Study  in 

support to the STECF'. Retrieved from:  https://ec.europa.eu/jrc/en/publication/eur-
scientific-and-technical-research-reports/economic-impact-eel-trade-ban-general-
trends-study-support-stecf 

European  Commission.  (2014b).  'Study  to  Support  an  Impact  Assessment  on  Options  for 
Combatting  Illicit  Firearms  Trafficking  in  the  European  Union,  Final  Report'.  Retrieved 
from: 
https://ec.europa.eu/home-affairs/sites/homeaffairs/files/e-
library/documents/policies/organized-crime-and-human-
trafficking/general/docs/dg_home_-_illicit_fireams_trafficking_final_en.pdf 

European Commission. (2015). 'A study on smuggling of migrants: Characteristics, responses and 

cooperation with third countries - Final Report'. Retrieved from: 
https://ec.europa.eu/home-affairs/sites/homeaffairs/files/what-we-
do/networks/european_migration_network/reports/docs/emn-
studies/study_on_smuggling_of_migrants_final_report_master_091115_final_pdf.pdf 

European Commission. (2016a). 'Commission Staff Working Document: Technical assessment of 
the  experience  made  with  the  Anti-Contraband  and  Anti-Counterfeit  Agreement  and 
General Release of 9 July 2004 among Philip Morris International and affiliates, the Union 
and its Member States'. Retrieved from: 
fraud/sites/antifraud/files/technical_assessment_pmi_24022016_en.pdf 

 https://ec.europa.eu/anti-

European  Commission.  (2016b).  'Communication  from  the  Commission  to  the  European 
Parliament, the Council, the European Economic and Social Committee and the Committee 
of the Regions: Analysis and Evidence in support of the EU Action Plan against Wildlife 
Trafficking'. Retrieved from: 
https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A52016SC0038 

European  Commission.  (2016c).  'Communication  from  the  Commission  to  the  European 
Parliament, the Council, the European Economic and Social Committee and the Committee 
of the Regions: Analysis and Evidence in support of the EU Action Plan against Wildlife 
Trafficking'. Retrieved from:  
https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:52016SC0038 

263 

 
 
 
 
 
 
 
  
 
EUROPEAN COMMISSION 

European  Commission.  (2016d).  'EU  Action  Plan  against  Wildlife  Trafficking'.  Retrieved  from: 

https://ec.europa.eu/environment/cites/trafficking_en.htm  

European Commission. (2017a). 'Commission introduces new measures to fight poaching and to 

end trade in raw ivory'. Retrieved from: 
https://ec.europa.eu/commission/presscorner/detail/en/IP_17_1308 

European  Commission.  (2017b).  'European  Semester  Thematic  Factsheet:  Undeclared  Work'. 
Retrieved from:  https://ec.europa.eu/info/sites/info/files/file_import/european-
semester_thematic-factsheet_undeclared-work_en.pdf 

European Commission. (2017c). 'Report from the Commission to the Council and the European 
Parliament:  Progress  report  on  the  implementation  of  the  Commission  Communication 
‘Stepping  up  the  fight  against  cigarette  smuggling  and  other  forms  of  illicit  trade  in 
tobacco products  - a comprehensive EU strategy (Com (2013) 324 final of 6.6.2013)’'. 
Retrieved from: https://ec.europa.eu/anti-
fraud/sites/antifraud/files/tobacco_implementation_report_12052017_en.pdf 

European  Commission.  (2018a).  'Commission  Staff  Working  Document:  Annual  overview  with 
information  on  the  results  of  the  Hercule  III  Programme  in  2017  accompanying  the 
document: Report from the Commission to the European Parlement and the Council: 29th 
Annual Report on the Protection of the European Union's financial interests - Fight against 
Fraud 
https://ec.europa.eu/anti-
fraud/sites/antifraud/files/herculeiii_results_overview_2017_en.pdf 

Retrieved 

2017'. 

from: 

- 

European  Commission.  (2018b).  'The  concept  of  Tax  Gaps  –  Report  III:  MTIC  Fraud  Gap 

estimation methodologies'. Retrieved from: 
https://ec.europa.eu/taxation_customs/sites/taxation/files/tax_gaps_report_mtic_fraud
_gap_estimation_methodologies.pdf 

European Commission. (2018c). 'Data collection on trafficking in human beings in the EU – Final 

report'. Retrieved from: 
https://eprints.lancs.ac.uk/id/eprint/138015/1/20181204_data_collection_study.pdf 

European  Commission.  (2018d).  ‘Progress  report  on  the  implementation  of  the  EU  Action  Plan 
from: 

trafficking’. 
against 
https://ec.europa.eu/environment/cites/pdf/progress_report_EU_action_plan_wildlife_tr
afficking_en.pdf 

Retrieved 

wildlife 

European  Commission.  (2018e).  'Second  report  on  the  progress  made  in  the  fight  against 
trafficking in human beings (2018) as required under Article 20 of Directive 2011/36/EU 
on  preventing  and  combating  trafficking  in  human  beings  and  protecting  its  victims'. 
Retrieved from:  https://ec.europa.eu/home-affairs/sites/homeaffairs/files/what-we-
do/policies/european-agenda-security/20181204_com-2018-777-report_en.pdf  
European  Commission.  (2019).  Commission  implementing  regulation  (EU)  2019/1715  of  30 
September  2019  laying  fown  rules  for  the  functioning  of  the  information  management 
system  for  official  controls  and  its  system  components  (‘the  IMSOC  Regulation’). 
Retrieved from: https://eur-lex.europa.eu/eli/reg_impl/2019/1715/oj 

European  Commission.  (2019a).  'Cybercrime'.  Retrieved  from:  https://ec.europa.eu/home-

affairs/what-we-do/policies/organized-crime-and-human-trafficking/cybercrime_en 

European  Commission.  (2019b).  'Excise  Duty  Tables:  Tax  Receipts  –  Manufactured  Tobacco'. 
Retrieved  from:  https://ec.europa.eu/taxation_customs/business/excise-duties-alcohol-
tobacco-energy/excise-duties-tobacco_en  

European  Commission.  (2019c).  'VAT  Fraud:  New  tool  to  help  EU  countries  crack  down  on 

criminals and recoup billions'. Retrieved from:   
https://ec.europa.eu/commission/presscorner/detail/en/IP_19_2468 

European Commission. (2019d). 'VAT Gap Report - September 2019'. Retrieved from:   

https://ec.europa.eu/taxation_customs/sites/taxation/files/vat-gap-factsheet-
2019_en.pdf 

European Commission. (2020a). 'Combating environmental crime'. Retrieved from: 

https://ec.europa.eu/environment/legal/crime/ 

European Commission. (2020b). 'Data collection on trafficking in human beings in the EU'.  
European  Commission.  (N.d.).  'Bulgaria:  General  situation  of  trafficking  in  human  beings'. 
Retrieved from https://ec.europa.eu/anti-trafficking/member-states/bulgaria_en 
European Court of Auditors. (2015). 'Tackling intra-Community VAT fraud: More action needed'. 

Retrieved from:  
https://www.eca.europa.eu/Lists/ECADocuments/SR15_24/SR_VAT_FRAUD_EN.pdf 

264 

 
 
 
 
 
 
 
EUROPEAN COMMISSION 

European  Parliament.  (2008).  ‘Directive  2008/98/EC  of  the  European  Parliament  and  of  the 
Council of 19 November 2008 on waste and repealing certain directives’. Retrieved from: 
https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32008L0098 

European  Parliament.  (2011).  'Directive  2011/36/EU  of  the  European  Parliament  and  of  the 
Council  of  5  April  2011  on  preventing  and  combating  trafficking  in  human  beings  and 
protecting its victims, and replacing Council Framework Decision 2002/629/JHA'.  
European  Parliament.  (2014).  'Directive  2014/40/EU  of  the  European  Parliament  and  of  the 
Council of 3 April 2014 on the approximation of the laws, regulations and administrative 
provisions of the Member States concerning  the manufacture, presentation and sale of 
tobacco and related products and repealing Directive 2001/37/EC'. 

European Parliament. (2017). 'Directive  (EU)  2017/853  of the European Parliament and of the 
Council  of  17  May  2017  amending  Council  Directive  91/477/EEC  on  control  of  the 
acquisition and possession of weapons'. 

European Parliament. (2017a). Organised property crime in the EU. Study request by the LIBE 
from: 

Committee. 
https://www.europarl.europa.eu/RegData/etudes/STUD/2020/656042/IPOL_STU(2020)
656042_EN.pdf 

Retrieved 

European  Union.  (2017).  'Special  Eurobarometer  458:  Attitudes  of  Europeans  towards  tobacco 

and electronic cigarettes'. Retrieved from: 
https://ec.europa.eu/commfrontoffice/publicopinion/index.cfm/ResultDoc/download/Doc
umentKy/79003 

European Union. (2019). 'Report on the EU customs enforcement of intellectual property rights: 
Results  at  the  EU  border,  2018'.  Luxembourg:  Publications  Office  of  the  European 
Union.Europol. (2009). 'Cargo theft  report: Applying  the  brakes to road  cargo crime in 
Europe'. Retrieved from: 
http://www.transportschaden.biz/html/documents/Cargo_Theft_Report.pdf 
Crime 

EU  Organised 

Assessment. 

Retrieved 

Europol. 

(2011). 

Threat 

from: 

https://www.europol.europa.eu/newsroom/news/europol-organised-crime-threat-
assessment-2011 

Europol. (2013a). 'Serious and Organised Crime Threat Assessment (SOCTA)'. Retrieved from: 
https://www.europol.europa.eu/activities-services/main-reports/eu-serious-and-
organised-crime-threat-assessment-socta-2013 

Europol.  (2013b).  'Threat  Assessment  2013:  Environmental  Crime  in  the  EU'.  Retrieved  from: 
https://www.europol.europa.eu/publications-documents/threat-assessment-2013-
environmental-crime-in-eu 

Europol. (2014). 'Intelligence notification: Child trafficking for forced criminal activities and forced 

begging'.  

Europol. (2015). 'The THB financial business model. Assessing the current state of knowledge'.  
Europol. (2015a). '2015 Situation Report on Counterfeiting in the European Union'. Europol and 

the Office for Harmonization in the Internal Market. 

Europol. (2015b). 'Exploring tomorrow’s organised crime'. Retrieved from: 

https://www.europol.europa.eu/publications-
documents/exploringtomorrow%E2%80%99s-organised-crime 

Europol. (2015c). 'The THB financial business model. Assessing the current state of knowledge'. 
Europol. (2015d). 'Why is cash still a king? A strategic report on the use of cash by criminal groups 
from: 

as 
https://www.europol.europa.eu/publications-documents/why-cash-still-king-
strategicreport-use-of-cash-criminal-groups-facilitator-for-money-laundering 

laundering'. 

Retrieved 

facilitator 

money 

for 

a 

Europol.  (2016).  'Situation  report:  trafficking  in  human  beings  in  the  EU'.  Retrieved  from: 

http://www.respect.international/situation-report-trafficking-in-human-beings-in-the-
eu/ 

Europol. (2017). 'European Union Serious and Organised Crime Threat Assessment: Crime in the 
age  of 
from:  https://www.europol.europa.eu/activities-
services/main-reports/european-union-serious-and-organised-crime-threat-assessment-
2017 

technology'.  Retrieved 

Europol. (2017a). '2017 Situation Report on Counterfeiting in the European Union'. Europol and 

the Office for Harmonization in the Internal Market. 

Europol.  (2018a).  'European  Migrant  Smuggling  Centre:  3rd  Annual  Activity  Report  –  2018'. 
Retrieved from: https://www.europol.europa.eu/publications-documents/emsc-3rd-
annual-activity-report-%E2%80%93-2018 

265 

 
 
 
 
 
 
EUROPEAN COMMISSION 

Europol. (2018b). 'Glass eels traffickers earned more than EUR 37 million from illegal exports to 

Asia'. Retrieved from:   https://www.europol.europa.eu/newsroom/news/glass-eel-
traffickers-earned-more-eur-37-million-illegal-exports-to-asia 

Europol. (2018c). 'Internet Organised Crime Threat Assessment (IOCTA) 2018'. Retrieved from:

https://www.europol.europa.eu/activities-services/main-reports/internet-

organised-crime-threat-assessment-iocta-2018 

Europol. (2019a). 'Operation OPSON VII - Analysis report'. Retrieved from: 

https://www.europol.europa.eu/publications-documents/operation-opson-vii-analysis-
report 

Europol. (2019b). 'Over 5 tonnes of smuggled glass eels seized in Europe this year'. Retrieved 
https://www.europol.europa.eu/newsroom/news/over-5-tonnes-of-smuggled-

from: 
glass-eels-seized-in-europe-year 

Europol.  (2019c).  'Trafficked  By  Voodoo  Threats:  One  Of  The  Largest  Operations  In  Europe 

Rescues 39 Nigerian Women [Press release]'. Retrieved from:   
https://www.europol.europa.eu/newsroom/news/trafficked-voodoo-threats-one-of-
largest-operations-in-europe-rescues-39-nigerian-women 

Europol. (2020a). 'Beyond the pandemic – how COVID-19 will shape the serious and organised 

crime landscape in the EU'. Retrieved from: 
https://www.europol.europa.eu/publications-documents/beyond-pandemic-how-covid-
19-will-shape-serious-and-organised-crime-landscape-in-eu 

Europol. (2020b). 'Environmental crime'. Retrieved from: 

https://www.europol.europa.eu/crime-areas-and-trends/crime-areas/environmental-
crime 

Europol.  (2020c).  'European  Migrant  Smuggling  Centre  4th  Annual  Report'.  Retrieved  from: 
https://www.europol.europa.eu/publications-documents/emsc-4th-annual-activity-
report-%E2%80%93-2019 

Europol.  (2020d).  'Excise  Fraud'.  Retrieved  from:  https://www.europol.europa.eu/crime-areas-

and-trends/crime-areas/economic-crime/excise-fraud 

Europol.  (2020e). 

'MTIC  (Missing  Trader  Intra  Community)  Fraud'.  Retrieved 

from: 

https://www.europol.europa.eu/crime-areas-and-trends/crime-areas/economic-
crime/mtic-missing-trader-intra-community-fraud 

Europol. (2020f). 'Organised property crime'. Retrieved from:   

https://www.europol.europa.eu/crime-areas-and-trends/crime-areas/organised-
property-crime 

Europol & EUCPN. (2019). 'Preventing Physical ATM Attacks'. Retrieved from:   

https://www.europol.europa.eu/publications-documents/preventing-physical-atm-
attacks  

Europol-Interpol.  (2016).  'Migrant  Smuggling  Networks:  Joint  Europol-INTERPOL  Report  - 
Executive  Summary'.  Retrieved  from:  https://www.europol.europa.eu/publications-
documents/europol-interpol-report-migrant-smuggling-networks 

Europol-Interpol. (2017). 'Operation OPSON VI: targeting counterfeit and substandard foodstuff 

and beverage'. Retrieved from:  
https://ec.europa.eu/food/sites/food/files/safety/docs/official-controls-food-
fraud_opson-vi-report.pdf 

Europol, & Interpol. (2018). Operation OPSON VI: Targeting counterfeit and substandard foodstuff 

and beverage. Retrieved from 

Eurostat.  (2020a).  'Generation  of  waste  by  waste  category,  hazardousness  and  NACE  Rev.  2 

activity'. Retrieved from: 
https://appsso.eurostat.ec.europa.eu/nui/show.do?dataset=env_wasgen&lang=en 
Eurostat.  (2020b).  'HICP  (2015  =  100)  -  annual  data  (average  index  and  rate  of  change)'. 

Retrieved from:  
https://appsso.eurostat.ec.europa.eu/nui/show.do?dataset=prc_hicp_aind&lang=en 

Eurostat.  (2020c).  'Transboundary  shipments  of  notified  waste  by  partner,  hazardousness  and 

waste management operations'. Retrieved from: 
https://appsso.eurostat.ec.europa.eu/nui/show.do?dataset=env_wasship&lang=en 

Eurostat.  (2020d).  'Treatment  of  waste  by  waste  category,  hazardousness  and  waste 

management operations'. Retrieved from: 
https://appsso.eurostat.ec.europa.eu/nui/show.do?dataset=env_wastrt&lang=en 
Everett, C. (2016). 'Ransomware: to pay or not to pay?'. Computer Fraud & Security, 2016(4), 

8–12.  

266 

 
 
 
 
 
 
 
 
 
 
EUROPEAN COMMISSION 

EY. (2015). 'Implementing the destination principle to intra-EU B2B supplies of goods: Feasibility 

and economic evaluation study'. Retrieved from: 
https://ec.europa.eu/taxation_customs/sites/taxation/files/docs/body/ey_study_destina
tion_principle.pdf  

FATF. (2011). 'Money Laundering Risks Arising from Trafficking in Human Beings and Smuggling 
 http://www.fatf-

of Migrants'. Retrieved from: 
gafi.org/media/fatf/documents/reports/Trafficking%20in%20Human%20Beings%20and
%20Smuggling%20of%20Migrants.pdf 

FATF. (2012). 'Illicit Tobacco Trade'. Retrieved from:  http://www.fatf-

gafi.org/media/fatf/documents/reports/Illicit%20Tobacco%20Trade.pdf 

FATF.  (2015).  'Anti-money  laundering  and  counter-terrorist  financing  measures:  Belgium'. 

Retrieved from: www.fatf-gafi.org/topics/mutualevaluations/documents/mer-belgium-
2015.html 

FATF.  (2016).  'Anti-money  laundering  and  counter-terrorist  financing  measures:  Austria'. 
Retrieved from: www.fatf-gafi.org/publications/mutualevaluations/documents/mer-
austria-2016.html 

FATF.  (2017).  ‘Anti-money  laundering  and  counter-terrorist  financing  measures:  Ireland’. 
from:  https://www.fatf-gafi.org/media/fatf/documents/reports/mer4/MER-

Retrieved 
Ireland-2017.pdf  

FATF.  (2017a).  'Anti-money  laundering  and  counter-terrorist  financing  measures:  Denmark'. 
Retrieved from: www.fatf-gafi.org/publications/mutualevaluations/documents/mer-
denmark-2017.html 

FATF.  (2017b).  'Anti-money  laundering  and  counter-terrorist  financing  measures:  Austria'. 
Retrieved from: www.fatf-gafi.org/publications/mutualevaluations/documents/fur-
austria-2017.html 

FATF.  (2017c).  'Anti-money  laundering  and  counter-terrorist  financing  measures:  Portugal'. 
from:  https://www.fatf-gafi.org/media/fatf/documents/reports/mer4/MER-

Retrieved 
Portugal-2017.pdf 

FATF.  (2017d).  'Anti-money  laundering  and  counter-terrorist  financing  measures:  Sweden. 
from:  https://www.fatf-gafi.org/media/fatf/documents/reports/mer4/MER-

Retrieved 
Sweden-2017.pdf 

FATF.  (2018a).  'Anti-money  laundering  and  counter-terrorist  financing  measures:  Denmark'. 

Retrieved from: http://www.fatf-gafi.org/publications/mutualevaluations/documents/fur-
denmark-2018.html 

FATF.  (2018b).  Anti-money  laundering  and  counter-terrorist  financing  measures:  Austria'. 

Retrieved from: http://www.fatf-gafi.org/publications/mutualevaluations/documents/fur-
austria-2018.html 

FATF.  (2018c).  'Anti-money  laundering  and  counter-terrorist  financing  measures:  Belgium'. 

Retrieved from: http://www.fatf-gafi.org/publications/mutualevaluations/documents/fur-
belgium-2018.html 

FATF.  (2019a).  'Anti-money  laundering  and  counter-terrorist  financing  measures:  Denmark'. 

Retrieved from: http://www.fatf-gafi.org/publications/mutualevaluations/documents/fur-
denmark-2019.html 

FATF.  (2019b).  'Anti-money  laundering  and  counter-terrorist  financing  measures:  Greece'. 

Retrieved from: http://www.fatf-
gafi.org/publications/mutualevaluations/documents/mer-greece-2019.html 

FATF.  (2019c).  'Anti-money  laundering  and  counter-terrorist  financing  measures:  Finland'. 

Retrieved from: http://www.fatf-
gafi.org/publications/mutualevaluations/documents/mer-finland-2019.html 

FATF. (2019d). 'Anti-money laundering and counter-terrorist financing measures: Ireland. Follow-
up  report  and  technical  compliance  re-rating.’  Retrieved  from:  https://www.fatf-
gafi.org/media/fatf/documents/reports/mer4/Follow-Up-Report-Ireland-2019.pdf 
FATF.  (2020).  'Anti-money  laundering  and  counter-terrorist  financing  measures:  Sweden.  1st 
from: 

regular 
http://www.fatf-gafi.org/media/fatf/documents/reports/fur/Follow-Up-Report-Sweden-
2020.pdf 

technical  compliance  re-rating.  Retrieved 

follow-up  report  and 

FATF-APG. (2018). 'Financial Flows from Human Trafficking'. Retrieved from: 

https://www.fatf-gafi.org/media/fatf/content/images/Human-Trafficking-2018.pdf 

267 

 
 
 
 
 
EUROPEAN COMMISSION 

Fazekas,  M.,  &  Kocsis,  G.  (2015).  Uncovering  high-level  corruption:  cross-national  corruption 
proxies using government contracting data. European Research Centre for Anti-Corruption 
and State-Building Working Paper(46). 

Fazekas, M., & Tóth, I. J. (2017). Corruption in EU Funds? Europe-wide evidence of the corruption 

effect of EU-funded public contracting. 

Fearing, A., Hopes, J., Jaras, T., Adeniji-Adele, A., Brooks, I., Kandemir, I., . . . Patel, K. (2015). 
'Implementing  the  ‘destination  principle’  to  intra-EU  B2B  supplies  of  goods'.  Retrieved 
from: 
https://ec.europa.eu/taxation_customs/sites/taxation/files/docs/body/ey_study_destina
tion_principle.pdf  

Fedeli, S., & Forte, F. (2011). 'EU VAT frauds'.  European Journal of Law and Economics, 31(2), 

143–166.  

Federal Public Service Social Security. (2011). 'Legal environment for fighting undeclared work 

and social fraud: The situation de lege lata'. Retrieved from: 
http://yves-jorens.be/projects/ICENUW_DeLegeLata_20110128.pdf 

Feige,  E.  L.  (2016).  'Reflections  on  the  Meaning  and  Measurement  of  Unobserved  Economies: 
What Do We  Really Know About the ‘Shadow  Economy’'.  Journal of  Tax Administration 
(2016) Vol, 2.  

Feld, L. P., & Schneider, F. (2010). Survey on the shadow economy and undeclared earnings in 

OECD countries. German economic review, 11(2), 109-149. 

Fell, E., James, O., Dienes, H., Shah, N., & Grimshaw, J. (2019). 'Understanding organised crime 
2015/2016:  Estimating  the  scale  and  the  social  and  economic  costs  -  Second  edition'. 
Retrieved from:  
https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachme
nt_data/file/782656/understanding-organised-crime-mar16-horr103-2nd.pdf 

Ferrante, L., Fontana, S., & Reito, F. (2019). Mafia and bricks: unfair competition in local markets 

and policy interventions. Small Business Economics, 1-24. 

Ferwerda, J., &  Kleemans,  E.  R. (2019).  'Estimating money laundering risks: An application to 
business sectors in the Netherlands'. European Journal on Criminal Policy and Research, 
25(1), 45–62.  

Fijnaut, C., & Paoli, L. (2004). Organised Crime in Europe. Dordrecht: Springer. 
Florêncio, D., & Herley, C. (2010). 'Phishing and money mules'. Paper presented at the 2010 IEEE 

International Workshop on Information Forensics and Security. 

Florencio,  D.,  &  Herley,  C.  (2011).  'Sex,  Lies  and  Cyber-crime  Surveys'.  Retrieved  from: 

https://www.microsoft.com/en-us/research/wp-
content/uploads/2011/06/SexLiesandCybercrimeSurveys.pdf  

Florquin, N., & Desmarais, A.  (2018). 'Lethal legacies: Illicit  firearms and  terrorism in  France'. 

Retrieved from:  https://vlaamsvredesinstituut.eu/safte/files/project_safte_france.pdf 

Florquin, N., & King, B. (2018). 'From legal to lethal: converted firearms in Europe'. Retrieved 
from:  http://www.smallarmssurvey.org/fileadmin/docs/U-Reports/SAS-Report-Europe-
Conversion.pdf 

Food  Fraud  Advisors.  (2017).  'Trends  and  developments  in  food  fraud  2017'.  Retrieved  from: 

https://www.foodfraudadvisors.com/trends-and-developments-in-food-fraud-2017/ 

Franceschi-Bicchierai,  L.  (2017).  'Hackers  Behind  WannaCry  Cashed  Out  Bitcoin  While  No  One 

Was Watching'. Retrieved from: 
https://www.vice.com/en_us/article/qvky75/hackers-behind-wannacry-cashed-out-
bitcoin-while-no-one-was-watching 

FranceTVinfo. (2016). Interview with Alban Mikoczy, in 'Attentats terroristes en France: quelles 
from:  https://www.francetvinfo.fr/faits-

armes  ont  été  utilisées?'.  Retrieved 
divers/terrorisme/attaques-du-13-novembre-a-paris/enquete-sur-les-attentats-de-
paris/attentats-terroristes-en-france-quelles-armes-ont-ete-utilisees_1374239.html  

FRANET. (2014). 'Supporting victims of severe forms of labour exploitation in having access to 

justice in EU Member States'.  

Franklin, J. (2007). 'An Inquiry into the Nature and Causes of the Wealth of Internet Miscreants'. 

Paper presented at the ACM Conference on Computer and Communications Security. 

FRONTEX. (2018). 'Risk Analysis for 2018'. Retrieved from: 

https://frontex.europa.eu/publications/risk-analysis-for-2018-aJ5nJu 

FRONTEX. (2019). 'Risk analysis for 2019'. Retrieved from: 

https://frontex.europa.eu/publications/risk-analysis-for-2019-RPPmXE 

268 

 
 
 
 
 
 
 
 
EUROPEAN COMMISSION 

FRONTEX. (2020). 'Risk analysis for 2020'. Retrieved from: 

https://frontex.europa.eu/assets/Publications/Risk_Analysis/Risk_Analysis/Annual_Risk_
Analysis_2020.pdf 

Frunza, M.-C. (2016). 'Cost of the MTIC VAT Fraud for European Union Members'. Retrieved from: 

http://dx.doi.org/10.2139/ssrn.2758566 

Frunza, M.-C. (2019). Value Added Tax Fraud: Routledge Research in Finance and Banking Law. 

Abingdon: Routledge. 

FWI SCIC. (2016). 'Putting a Price Tag on Underreported Cargo Theft in Europe'. Retrieved from: 

http://www.sensitech.com/en/media/UnderreportedCargoTheftweb_tcm35-10477.pdf 

Gallagher,  A.  T.  (2017).  'What's  wrong  with  the  Global  Slavery  Index?'.  Anti-Trafficking 

Review(8).  

Gallus, S., Lugo, A., La Vecchia, C., Boffetta, P., Chaloupka, F. J., Colombo, P., . . . Gilmore, A. 
(2014).  'Pricing  Policies  And  Control  of  Tobacco  in  Europe  (PPACTE)  project:  cross-
national comparison of smoking prevalence in 18 European countries'. European journal 
of cancer prevention, 23(3), 177–185.  

Garrett, D. (2019). 'Protecting Works of Art from Theft'. In S. Hufnagel & D. Chappell (Eds.), The 

Palgrave Handbook on Art Crime (187–212). London: Palgrave Macmillan. 

Gebrewold, B., Kostenzer, J., & Müller, A. T. (Eds.). (2017). Human trafficking and exploitation: 

Lessons from Europe. Abingdon: Taylor & Francis. 

Gee,  J.,  &  Button,  M.  (2019).  'The  Financial  Cost  of  Fraud  2019'.  Retrieved  from 

https://www.crowe.com/uk/croweuk/-/media/Crowe/Firms/Europe/uk/CroweUK/PDF-
publications/The-Financial-Cost-of-Fraud-2019.pdf  

Geeraerts, K., Illes, A., & Schweizer, J. (2015). 'Illegal shipment of e-waste from the EU: A case 
study  on  illegal  e-waste  export  from  the  EU  to  China'.  London:  Institute  for  European 
Environmental Policy. Retrieved from:   
https://www.researchgate.net/publication/311233314_Illegal_shipment_of_e-
waste_from_the_EU_A_case_study_on_illegal_e-waste_export_from_the_EU_to_China 

Gill, D. W.  J. (2019). 'The  Return of  Looted  Objects to  Their Countries of Origin: The Case  for 
Change'.  In  S.  Hufnagel  &  D.  Chappell  (Eds.),  The  Palgrave  Handbook  on  Art  Crime. 
London: Palgrave Macmillan. 

Global initiative against transnational organised crime. (2020). 'Smuggling in the time of COVID-
19: The impact of the pandemic on human-smuggling dynamics and migrant-protected 
risks'. Retrieved from: https://globalinitiative.net/smuggling-covid-19/ 

Godart, B. (2010). 'IP crime: The new face of organized crime: From IP theft to IP crime'. Journal 

of Intellectual Property Law & Practice, 5(5), 378–385. 

Golden, M. A., & Picci, L. (2005). Proposal for a new measure of corruption, illustrated with Italian 

data. Economics & Politics, 17(1), 37-75. 

Goldman,  E.,  Rocholl,  J.,  &  So,  J.  (2013).  Politically  connected  boards  of  directors  and  the 

allocation of procurement contracts. Review of Finance, 17(5), 1617-1648. 

Gounev, P., & Bezlov, T. (2010). Examining the links between organised crime and corruption. 

Retrieved from: https://ec.europa.eu/home-
affairs/sites/homeaffairs/files/doc_centre/crime/docs/study_on_links_between_organise
d_crime_and_corruption_en.pdf 

Grabosky,  P.  (2007).  'The  internet,  technology,  and  organized  crime'.  Asian  journal  of 

criminology, 2(2), 145–161.  

Gray,  I.  (2019).  Pricing  Analysis  of  Goods  in  Cybercrime  Communities.  Retrieved  from: 

https://go.flashpoint-intel.com/docs/pricing-analysis-of-goods-in-cybercrime-
communities 

GRETA. (2019) 'Reply from Bulgaria to the questionnaire for the evaluation of the implementation 
of the Council of Europe Convention on Action against Trafficking in Human Beings by the 
Parties'. Third Evaluation Round. 

Gruber, S. (2019). 'Cultural Heritage Offences: A View from Asia'. In S. Hufnagel & D. Chappell 

(Eds.), The Palgrave Handbook on Art Crime. London: Palgrave Macmillan. 

Gurciullo, S. (2014). Organised crime infiltration in the legitimate private economy-An empirical 

network analysis approach. arXiv preprint arXiv:1403.5071. 

Haken,  J.  (2011). 

from: 
https://www.gfintegrity.org/wp-content/uploads/2014/05/gfi_transnational_crime_high-
res.pdf 

'Transnational  Crime  In  The  Developing  World'.  Retrieved 

269 

 
 
 
 
EUROPEAN COMMISSION 

Hall, A., Koenraadt, R., & Antonopoulos, G. A. (2017). 'Illicit pharmaceutical networks in Europe: 
organising the illicit medicine market in the United Kingdom and the Netherlands'. Trends 
in Organized Crime, 20(3–4), 296–315. 

Hampton, N.,  &  Baig,  Z.  A. (2015).  'Ransomware:  Emergence  of the  cyber-extortion menace'. 

Retrieved from: https://doi.org/10.4225/75/57b69aa9d938b  

Harris,  L.,  &  Shiraishi,  H.  (2018).  'Understanding  the  global  caviar  market:  results  of  a  rapid 

assessment on trade in sturgeon caviar'. Retrieved from: 
https://www.traffic.org/site/assets/files/9805/global_caviar_market-1.pdf 

Hassan,  M.,  &  Schneider,  F.  (2016).  'Size  and  development  of  the  shadow  economies  of  157 
countries  worldwide:  Updated  and  new  measures  from  1999  to  2013'.  IZA  Discussion 
Paper Series(10281). Retrieved from: http://ftp.iza.org/dp10281.pdf  

Heeks, M., Reed, S., Tafsiri, M., &  Prince, S. (2018). 'The economic and social costs of crime'. 

Retrieved from:  
https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachme
nt_data/file/732110/the-economic-and-social-costs-of-crime-horr99.pdf 

Hellenic Financial Intelligence Unit (HFIU). Retrieved from http://www.hellenic-fiu.gr/ 
Herwartz, H., Tafenau, E., & Schneider, F. (2015). 'One share fits all? Regional variations in the 
extent of the shadow economy in Europe'. Regional Studies, 49(9), 1575–1587.  

HM Government. (2018). 'Serious Violence Strategy'. Retrieved from:   

https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachme
nt_data/file/698009/serious-violence-strategy.pdf  

HM Revenue & Customs. (2012). 'Measuring tax gaps 2012 edition: Tax gap estimates for 2010-

11'. Retrieved from: 
https://webarchive.nationalarchives.gov.uk/20150612044958/https://www.gov.uk/gove
rnment/statistics/measuring-tax-gaps 

HM Revenue & Customs. (2013). 'Measuring tax gaps 2013 edition: Tax gap estimates for 2011-

12'. Retrieved from: 
https://webarchive.nationalarchives.gov.uk/20150612044958/https://www.gov.uk/gove
rnment/statistics/measuring-tax-gaps 

HM Revenue & Customs. (2014). 'Measuring tax gaps 2014 edition: Tax gap estimates for 2012-

13'. Retrieved from: 
https://webarchive.nationalarchives.gov.uk/20150612044958/https://www.gov.uk/gove
rnment/statistics/measuring-tax-gaps 

HM Revenue & Customs. (2015). 'Measuring tax gaps 2015 edition: Tax gap estimates for 2013-

14'. Retrieved from: 
https://webarchive.nationalarchives.gov.uk/20160615051045/https://www.gov.uk/gove
rnment/statistics/measuring-tax-gaps 

HM Revenue & Customs. (2016). 'Measuring tax gaps 2016 edition: Tax gap estimates for 2014-
15'. 
from: 
Retrieved 
https://webarchive.nationalarchives.gov.uk/20170621230141/https://www.gov.uk/gove
rnment/statistics/measuring-tax-gaps 

HM Revenue & Customs. (2018). 'Measuring tax gaps 2018 edition: Tax gap estimates for 2016-

17'. Retrieved from: 
https://webarchive.nationalarchives.gov.uk/20190509073425/https://www.gov.uk/gove
rnment/statistics/measuring-tax-gaps 

HM Revenue & Customs. (2019). 'Measuring tax gaps 2019 edition: Tax gap estimates for 2017-

18'. Retrieved from: 
https://webarchive.nationalarchives.gov.uk/20200701215139/https://www.gov.uk/gove
rnment/statistics/measuring-tax-gaps 

Holden, C. (2017). Graduated sovereignty and global governance gaps: Special economic zones 

and the illicit trade in tobacco products. Political geography, 59, 72-81.  
Home Office. (2018). 'Serious and Organised Crime Strategy'. Retrieved from:  

https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachme 
Hoorens, S., Hunt, P., Malchiodi, A., Pacula, R. L., Kadiyala, S., Rabinovich, L., & Irving, B. (2012). 
'Measuring IPR infringements in the internal market: Development of a new approach to 
estimating the impact of infringements on sales'. Santa Monica, CA: RAND Europe. 

HOSAC. (2018). 'Understanding the costs of cyber crime: A report of key findings from the Costs 

of Cyber Crime Working Group'. Retrieved from: 
https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachme
nt_data/file/674046/understanding-costs-of-cyber-crime-horr96.pdf 

270 

 
 
 
 
 
 
 
 
 
 
 
EUROPEAN COMMISSION 

Huang,  K.,  Siegel,  M.,  &  Madnick,  S.  (2018).  'Systematically  understanding  the  cyber  attack 

business: A survey'. ACM Computing Surveys (CSUR), 51(4), 1–36.  

Hurby,  D.  (2019).  'The  world’s  biggest  reptile  fair  is  also  a  hub  for  traffickers'.  Mongabay. 
Retrieved  from  https://news.mongabay.com/2019/05/the-worlds-biggest-reptile-fair-is-
also-a-hub-for-traffickers/ 

Hutchings, A. (2014). 'Crime from the keyboard: organised cybercrime, co-offending, initiation 

and knowledge transmission'. Crime, Law and Social Change, 62(1), 1–20.  

Hyytinen,  A.,  Lundberg,  S.,  &  Toivanen,  O.  (2018).  Design  of  public  procurement  auctions: 

Evidence from cleaning contracts. The RAND Journal of Economics, 49(2), 398-426. 

IARC.  (2012).  'Effectiveness  of  tax  and  price  policies  for  tobacco  control'.  IARC  Handbooks  of 

Cancer Prevention in Tobacco Control (Vol. 14). World Health Organization. 

ICMPD. (2020). 'ICMPD Migration Outlook 2020: 10 thing to look out for in 2020  - Origins, key 

events and priorities for Europe'. Retrieved from: 
https://www.euneighbours.eu/sites/default/files/publications/2020-
02/ICMPD%20publication.pdf 

IFAW. (2018). 'Disrupt: Wildlife Cybercrime - Uncovering the scale of the online wildlife trade'. 

Retrieved from:  
https://d1jyxxz9imt9yb.cloudfront.net/resource/210/attachment/original/IFAW_-
_Disrupt_Wildlife_Cybercrime_-_FINAL_English_-_new_logo.pdf   

IHME. (2018). 'Global mortality from firearms, 1990–2016'. Retrieved from: 

http://www.healthdata.org/research-article/global-mortality-firearms-
1990%E2%88%922016 

ILO. (2012). 'ILO 2012 global estimate of forced labour'. Retrieved from: 
https://www.ilo.org/wcmsp5/groups/public/---ed_norm/---
declaration/documents/publication/wcms_181953.pdf 

ILO. (2017). 'Global estimates of modern slavery: Forced labour and forced marriage'. Retrieved 

from:  https://www.ilo.org/wcmsp5/groups/public/---dgreports/---
dcomm/documents/publication/wcms_575479.pdf 

Independent Authority for Public Revenue. (N.d.). Homepage. Retrieved from: www.aade.gr 
Interpol.  (2017).  'Research  identified  illegal  wildlife  trade  on  the  Darknet  [Press  release]'. 

Retrieved from:  
https://www.interpol.int/fr/Actualites-et-evenements/Actualites/2017/Research-
identifies-illegal-wildlife-trade-on-the-Darknet 

Interpol.  (2018).  'Global  Wildlife  Enforcement:  Strengthening  Law  Enforcement  Cooperation 

Against Wildlife Crime'. Retrieved from: 
https://www.interpol.int/en/content/download/5179/file/WEB_Wildlife%20ProspectusMa
rch2019.pdf 

Interpol.  (2020).  INTERPOL  Strategic  Analysis  Report:  Emerging  criminal  trends  in  the  global 
from 

plastic 
https://www.interpol.int/en/News-and-Events/News/2020/INTERPOL-report-alerts-to-
sharp-rise-in-plastic-waste-crime 

Retrieved 

January 

market 

waste 

2018 

since 

Interpol Office of Legal Affairs. (2014). 'COUNTERING ILLICIT TRADE IN TOBACCO PRODUCTS: A 

guide for policy-makers'. Retrieved from: 
www.scoop.it/doc/download/7I4OaIFV7TA7Jx_2bnpwWfA 

Jahrl, J. (2013). 'Illegal caviar trade in Bulgaria and Romania: Results of a market survey on trade 

in caviar from sturgeons (acipenseridae)'. Retrieved from: 
http://awsassets.panda.org/downloads/illegal_caviar_trade_in_bulgaria_and_romania.p
df 

James, G., Witten, D., Hastie, T., & Tibshirani, R. (2015). An Introduction to Statistical Learning: 

With Applications in R (Vol. 6th edition). London: Springer. 

Janssen, J., &  Leupen, B.T.C. (2019).  The role of the  Netherlands in the reptile trade.  Monitor 
https://mcrsociety.org/wp-

from: 

Conservation  Research  Society.  Retrieved 
content/uploads/2020/04/Reptile-Trade-Resized.pdf 

Johnston, N., Kegö, W., & Wenngren, C. (2016). 'Cigarette smuggling: Poland to Sweden'.  
Joossens,  L.,  Lugo,  A.,  La  Vecchia,  C.,  Gilmore,  A.  B.,  Clancy,  L.,  &  Gallus,  S.  (2014).  Illicit 
cigarettes and hand-rolled tobacco in 18 European countries: a cross-sectional survey'. 
Tobacco control, 23(e1), e17–e23.  

Juárez, B., & Shigematsu, L. M. (2019) El con-sumo de cigarros ilícitos en México. Una estimación 
robusta  y  transparente  para  apoyar  la  toma  de  decisiones.  Atlanta:  American  Cancer 
Society 

271 

 
 
 
 
 
 
 
 
EUROPEAN COMMISSION 

Karp, A. (2018). 'Estimating global civilian-held firearms numbers'. Retrieved from: 

http://www.smallarmssurvey.org/fileadmin/docs/T-Briefing-Papers/SAS-BP-Civilian-
Firearms-Numbers.pdf 

Kilmer,  B.,  Caulkins,  J.  P.,  Pacula,  R.  L.,  &  Reuter,  P.  (2011).  'Bringing  perspective  to  illicit 
markets: estimating the size of the US marijuana market'. Drug and alcohol dependence, 
119(1–2), 153–160.  

Kilmer, B. & Pacula,  R. (2009).  ‘Estimating the size of the global drug market: A demand-side 

approach’. Santa Monica, Calif.: RAND Corporation. Retrieved from: 
https://www.rand.org/pubs/technical_reports/TR711.html 

Kilmer, B., Taylor, J., Hunt, P., & McGee, P. (2013). 'Sizing national  heroin markets in the EU: 
insights  from  self-reported  expenditures  in  the  Czech  Republic  and  England'.  In  F. 
Trautmann, B. Kilmer, & P. Turnbull (Eds.), Further Insights into Aspects of the Illicit EU 
Drugs Market (257–269). Luxembourg: Publications Office of the European Union. 
King, M. (2019). 'Trucks The ‘Weakest Link’ As Cargo Thefts Soar'. American Shipper. Retrieved 
https://www.freightwaves.com/news/trucks-the-weakest-link-as-cargo-thefts-

from: 
soar 

Klašnja, M. (2016). Increasing rents and incumbency disadvantage. Journal of Theoretical Politics, 

28(2), 225-265. 

KPMG. (2003). ‘La Contraffazione in Italia’. Geneva: American Chamber of Commerce in Italy. 
KPMG.  (2016).  'Brexit:  Potential  Fraud  Risks  in  a  Time  of  Change'.  Retrieved  from: 
https://assets.kpmg/content/dam/kpmg/uk/pdf/2016/10/brexit-potential-fraud-
risks.pdf 

KPMG. (2017). 'Project Sun: A study of the illicit cigarette market in the European Union, Norway 

and Switzerland - 2016 Results'. Retrieved from: 
https://assets.kpmg/content/dam/kpmg/uk/pdf/2017/07/project-sun-2017-report.pdf 

KPMG. (2019). 'Project Stella: A study of the illicit cigarette market in the European Union, Norway 

and Switzerland'. Retrieved from: 
source/external-docs/kpmg-project-stella/project-stella-
methodology.pdf?sfvrsn=aea077d7_2 

 https://www.stopillegal.com/docs/default-

Kruisbergen,  E.  W.,  Kleemans,  E.  R.,  &  Kouwenberg,  R.  F.  (2015).  'Profitability,  power,  or 
proximity? Organized crime offenders investing their money in legal economy'. European 
Journal on Criminal Policy and Research, 21(2), 237–256.  

Kruithof, K., Aldridge, J., Décary-Hétu, D., Sim, M., Dujso, E., & Hoorens, S. (2016). 'Internet-
facilitated drugs trade: An analysis of the size, scope and the role of the Netherlands'. 
Santa Monica, Calif.: RAND Corporation. Retrieved from: 
https://www.rand.org/pubs/research_reports/RR1607.html 

Kruize,  P.,  &  Sorensen,  D.  W.  M.  (2018).  'Danish  Burglary  in  a  European  Perspective'. 

Samfundsøkonomen, 4, 16-22.  

Kshetri, N., & Voas, J. (2017). 'Do crypto-currencies fuel ransomware?'. IT professional, 19(5), 

11–15.  

Lakhdar, C. B. (2008). 'Quantitative and qualitative estimates of cross-border tobacco shopping 

and tobacco smuggling in France'. Tobacco control, 17(1), 12–16.  

Lamensch,  M.,  &  Ceci,  E.  (2018).  VAT  fraud:  Economic  impact,  challenges  and  policy  issues. 

Retrieved from: http://hdl.handle.net/2078.1/222731 

Lau, W., Crooks, C. V., Musing, L., Guan, J., & Xu, L. (2016). 'A rapid survey of UK ivory markets'. 

TRAFFIC Cambridge, United Kingdom. 

Lavorgna, A. (2014). 'The online trade in counterfeit pharmaceuticals: New criminal opportunities, 

trends and challenges'. European Journal of Criminology, 12(2), 226–241. 

Lavorgna, A., & Sergi, A. (2016). 'Serious, therefore organised? A critique of the emerging ‘cyber-
organised  crime’  rhetoric  in  the  United  Kingdom'.  International  Journal  of  Cyber 
Criminology, 10(2), 170–187.  

Le, V. (2012). 'Organised Crime Typologies: Structure, Activities and Conditions'.  International 

Journal of Criminology and Sociology, 1, 121–131.  

Leinez, N. (2019). 'The debts of undocumented Vietnamese migrants in Europe'. OpenDemocracy. 

Retrieved from:  
slavery/debts-undocumented-vietnamese-migrants-europe/ 

https://www.opendemocracy.net/en/beyond-trafficking-and-

Leukfeldt, E. R. (2014). 'Cybercrime and social tie's. Trends in Organized Crime, 17(4), 231–249.  
Leukfeldt, E. R., Kleemans, E. R., & Stol, W. P. (2017). 'Cybercriminal networks, social ties and 
online forums: Social ties versus digital ties within phishing and malware networks. The 
British Journal of Criminology, 57(3), 704–722.  

272 

 
 
 
 
 
 
 
EUROPEAN COMMISSION 

Leukfeldt, E. R., Lavorgna, A., & Kleemans, E. R. (2017). 'Organised cybercrime or cybercrime 
that  is  organised?  An  assessment  of  the  conceptualisation  of  financial  cybercrime  as 
organised crime. European Journal on Criminal Policy and Research, 23(3), 287–300.  

Levi, M. (2009). 'E-gaming and money laundering risks: a European overview'. Paper presented 

at the ERA Forum. 

Levi, M. (2014). 'Thinking about organised crime: Structure and threat'. The RUSI Journal, 159(1), 

6–14.  

Levi, M., Innes, M., Reuter, P., & Gundur, R. V. (2013). The Economic, Financial & Social Impacts 

of Organised Crime in the European Union. Brussels: Publications Office. 

Levi, M., Doig, A., Gundur, R. V., Wall, D., & Williams, M. (2015). 'The Implications of Economic 
from: 

Cybercrime 
https://www.researchgate.net/publication/282605084_The_Implications_of_Economic_
Cybercrime_for_Policing 

doi:10.13140/RG.2.1.3357.2566. 

Retrieved 

Policing'. 

for 

Lewis,  J.  (2018).  'Economic  Impact  of  Cybercrime  —  No  Slowing  Down'.  Retrieved  from: 

https://www.csis.org/analysis/economic-impact-cybercrime 

L'Hoiry, X. D. (2012). ''Tobacco smuggling: A review of the literature. Eur. J. Crime Crim. L. & 

Crim. Just., 20, 415.  

Liao,  K.,  Zhao,  Z.,  Doupé,  A.,  &  Ahn,  G.-J.  (2016).  'Behind  closed  doors:  measurement  and 
analysis of CryptoLocker ransoms in Bitcoin'. 2016 APWG Symposium on Electronic Crime 
Research (eCrime), 1–13. Retrieved from: 
https://ieeexplore.ieee.org/document/7487938 

Litecoin. (N.d). 'The cryptocurrency for payments'. Retrieved from: https://litecoin.org/ 
López-Fraga, M., Van Assche, K., Domínguez-Gil, B., Delmonico, F. L., & Capron, A. M. (2017). 
'Human  trafficking  for  the  purpose  of  organ  removal'.  In  Piotrowicz,  R.  et  al.  (Eds.), 
Routledge handbook of human traficking (120–134). 

Lord,  N.  (2018).  'What  is  Ransomware  as  a  Service? Learn  About  the  New  Business  Model  in 

Cybercrime'. Digital Guardian, 9 December. Retrieved from: 
https://digitalguardian.com/blog/what-ransomware-service-learn-about-new-business-
model-cybercrime 

Lord, N., Flores Elizondo, C. J., & Spencer, J. (2017). 'The dynamics of food fraud: The interactions 
between  criminal  opportunity  and  market  (dys)  functionality  in  legitimate  business'. 
Criminology & Criminal Justice, 17(5), 605–623.  

Luechinger, S., & Moser, C. (2014). The value of the revolving door: Political appointees and the 

stock market. Journal of Public Economics, 119, 93-107. 

Mackenzie,  S.  (2019).  'White-Collar  Crime,  Organised  Crime  and  the  Challenges  of  Doing 
Research on Art Crime'. In S. Hufnagel & D. Chappell (Eds.), The Palgrave Handbook on 
Art Crime (839–853). London: Palgrave Macmillan. 

Maftei, L. (2012). 'An Overview of the Tobacco Black Market in Europe'. CES Working Papers, Vol. 

4(Iss. 3a), 541–553.  

Marvin, H. J., Bouzembrak, Y., Janssen, E. M., Van der Fels-Klerx, H., van Asselt, E. D., & Kleter, 
G. A. (2016). 'A holistic approach to food safety risks: Food fraud as an example'. Food 
research international, 89, 463–470.  

Masini, S. (2018). 'Mafia makes billions from the Italian food industry'. Interviewer: Eurobsit. 
Massari, M., & Monzini, P. (2004). 'Dirty businesses in Italy: a case-study of illegal trafficking in 

hazardous waste'. Global Crime, 6(3–4), 285–304.  

McAfee. (2018). 'EXECUTIVE SUMMARY: The Economic Impact of Cybercrime—No Slowing Down'.  
McGuire,  M.  (2018).  'Into  the  web  of  profit:  An  in-depth  study  of  cybercrime,  criminals  and 

money'. Retrieved from: 
https://www.bromium.com/wp-
content/uploads/2018/05/Into-the-Web-of-Profit_Bromium.pdf 

Medina, L., & Schneider, F. (2018). 'Shadow economies around the world: what did we learn over 
from: 

the 
https://www.imf.org/en/Publications/WP/Issues/2018/01/25/Shadow-Economies-
Around-the-World-What-Did-We-Learn-Over-the-Last-20-Years-45583 

Retrieved 

Working 

years?'. 

papers. 

IMF 

last 

20 

Medina, L., & Schneider, F. (2019). 'Shedding Light on the Shadow Economy: A Global Database 
from: 

Interaction 

Retrieved 

Official 

One'. 

and 
https://www.ifo.de/DocDL/cesifo1_wp7981.pdf  

with 

the 

the 

Melzer,  S.,  &  Martin,  C.  (2016).  'A  brief  overview  of  illicit  trade  in  tobacco  products'.  In  Illicit 

Trade: CONVERGING CRIMINAL NETWORKS, Paris: OECD Publishing. 

Meneghini, C., Favarin, S., Andreatta, D., & Savona, E. (2017). 'An exploratory estimate of the 

extent of illicit waste trafficking in the EU'. Retrieved from: http://www.blockwaste.eu/  

273 

 
 
 
 
 
EUROPEAN COMMISSION 

Michalopoulos, S. (2017). 'EU anti-fraud official: Tobacco smuggling is ‘major source’ of organised 

crime'. Euractiv, 7 February. Retrieved from: 
https://www.euractiv.com/section/trade-society/interview/olaf-official-tobacco-
smuggling-major-source-for-organised-crime/ 

Mills, H., Skodbo, S., & Blyth, P. (2013). 'Understanding organised crime: estimating the scale 

and the social and economic costs'. Retrieved from: 
https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachme
nt_data/file/246390/horr73.pdf 

Mineva, D., & Stefanov, R. (2018). 'Evasion of Taxes and Social Security Contributions'. Retrieved 

from: https://ec.europa.eu/social/BlobServlet?docId=20207&langId=en. 

Mironov,  M.,  &  Zhuravskaya,  E.  (2016).  Corruption  in  procurement  and  the  political  cycle  in 
tunneling:  Evidence  from  financial  transactions  data.  American  Economic  Journal: 
Economic Policy, 8(2), 287-321. 

Mizrahi,  A.  (2016).  '33%  of  UK  Firms  Are  Buying  Bitcoin  in  Anticipation  of  Cyber  Attacks'. 
from:  https://www.financemagnates.com/cryptocurrency/news/33-of-uk-

Retrieved 
firms-are-buying-bitcoin-in-anticipation-for-cyber-attacks/ 

MoneyPak.  (N.d.).  'Send  cash  quickly  and  conveniently  to  almost  anyone'.  Retrieved  from: 

https://www.moneypak.com/ 

MONEYVAL. (2011). 'Anti-money laundering and combating the financing of terrorism: Cyprus'. 
Retrieved from: https://rm.coe.int/report-on-fourth-assessment-visit-anti-money-
laundering-and-combating-/1680715f1f 

MONEYVAL.  (2012).  'Criminal  money  flows  on  the  Internet:  methods,  trends  and  multi-

stakeholder counteraction'. Retrieved from:  
criminal-money-flows-on-the-internet-methods-trends-an/168071509a 

https://rm.coe.int/research-report-

MONEYVAL. (2013a). 'Anti-money laundering and combating the financing of terrorism: Bulgaria'. 
https://rm.coe.int/report-on-fourth-assessment-visit-anti-money-

from: 

Retrieved 
laundering-and-combating-/1680715c0b 

MONEYVAL. (2013b). 'Anti-money laundering and combating the financing of terrorism: Croatia'. 
Retrieved from: https://rm.coe.int/report-on-fourth-assessment-visit-executive-
summary-anti-money-launder/1680715c76 

MONEYVAL. (2013c). '4th round evaluation of Cyprus: Biennial update (including information on 
from: 

the 
https://www.coe.int/en/web/moneyval/jurisdictions/cyprus 

Assessment 

Retrieved 

Report)'. 

Special 

MONEYVAL. (2014). 'Anti-money laundering and combating the financing of terrorism: Estonia'. 
https://rm.coe.int/report-on-fourth-assessment-visit-anti-money-

from: 

Retrieved 
laundering-and-combating-/168071601f 

MONEYVAL. (2014a). Report on fourth assessment visit: Anti-money laundering and combating 
the  financing  of  terrorism:  Romania'.  Retrieved  from:  https://rm.coe.int/report-on-
fourth-assessment-visit-anti-money-laundering-and-combating-/1680716481 

MONEYVAL.  (2015).  '4th  round  evaluation  of  Cyprus:  Biennial  update'.  Retrieved  from: 

https://www.coe.int/en/web/moneyval/jurisdictions/cyprus 

MONEYVAL. (2016). 'Anti-money laundering and counter-terrorist financing measures: Hungary'. 
https://rm.coe.int/anti-money-laundering-and-counter-terrorist-

from: 

Retrieved 
financing-measures-hungary/16807161b4 

MONEYVAL. (2017). 'Anti-money laundering and counter-terrorist financing measures: Hungary'. 

Retrieved from:  
follow-up-report-technical-compl/1680792c61 

https://rm.coe.int/moneyval-2017-21-hungary-1st-enhanced-

MONEYVAL. (2018a). 'Anti-money laundering and counter-terrorist financing measures – Czech 

Republic'. Retrieved from: 
https://rm.coe.int/czech-republic-5th-round-mer/168094b621 

MONEYVAL.  (2018b).  'Anti-money  laundering  and  counter-terrorist  financing  measures: 
Hungary'.  Retrieved  from:  https://rm.coe.int/committee-of-experts-on-the-evaluation-
of-anti-money-laundering-measur/1680932f59 

MONEYVAL. (2018c). ‘Anti-money laundering and counter-terrorist financial measures – Latvia’. 
Retrieved from: https://rm.coe.int/moneyval-2018-8-5th-round-mer-latvia/16808ce61b 
MONEYVAL.  (2018d).  ‘Anti-money  laundering  and  counter-terrorist  financial  measures  – 
Lithuania’.  Retrieved  from:  https://rm.coe.int/committee-of-experts-on-the-evaluation-
of-anti-money-laundering-measur/16809247ed 

274 

 
 
 
 
 
 
EUROPEAN COMMISSION 

MONEYVAL. (2018e). ‘Anti-money laundering and counter-terrorist financial measures – Malta’. 
https://rm.coe.int/moneyval-2019-5-5th-round-mer-

from: 

Retrieved 
malta2/168097396c 

MONEYVAL. (2018f). 'Bulgaria: First compliance report - Exit compliance enhancing procedures 

report'. Retrieved from: 
https://rm.coe.int/bulgaria-1st-compliance-report-4th-round-evaluation/1680935d9c 

MONEYVAL.  (2019a).  'Anti-money  laundering  and  counter-terrorist  financing  measures  - 
from:  https://rm.coe.int/anti-money-laundering-and-counter-

Hungary'.  Retrieved 
terrorist-financing-measures-hungary/1680998aaa 

MONEYVAL. (2019b). 'Anti-money laundering and counter-terrorist financing measures – Cyprus'. 
https://rm.coe.int/anti-money-laundering-and-counter-terrorist-

from: 

Retrieved 
financing-measures-cyprus-/16809c3c47 

MONEYVAL.  (2019c).  'Exit  follow  up  report  submitted  to  MONEYVAL'.  Retrieved  from: 

https://rm.coe.int/moneyval-2019-13-ee-4thfollowuprep/16809805e3 

MONEYVAL. (2019d). 'Anti-money laundering and counter-terrorist financing measures – Latvia. 
https://www.fatf-

enhanced 

follow-up 

from: 

1st 
gafi.org/media/fatf/documents/reports/fur/MONEYVAL%20Follow-
Up%20Report%20Latvia.pdf 

Retrieved 

report. 

Moore,  T.,  Clayton,  R.,  &  Anderson,  R.  (2009).  'The  economics  of  online  crime'.  Journal  of 

Economic Perspectives, 23(3), 3–20.  

Mountz,  A.  (2010).  'Seeking  asylum:  Human  smuggling  and  bureaucracy  at  the  border'. 

Minneapolis: University of Minnesota Press. 

Mundy-Taylor, V. (2013). 'Illegal Wildlife Trade and the European Union: An analysis of EU-TWIX 

seizure data for the period 2007-2011'. Retrieved from: 
https://www.traffic.org/site/assets/files/5952/eu-twix-analysis-2007-2011.pdf 

Mundy,  V.  (2014).  'The  re-export  of  pre-convention/antique  ivory  from  the  European  Union'. 

Retrieved from:  
https://ec.europa.eu/environment/cites/pdf/Ivory%20report_Nov%202014.pdf 
Nagy, H. Z. A., & Mezei, K. (2016). 'The Organised Criminal Phenomenon on the Internet'. Journal 

of Eastern-European Criminal Law, 137.  

National Research Council. (2015). 'Understanding the U.S. illicit tobacco market: characteristics, 
from: 

international  experiences'.  Retrieved 

policy  context,  and 
from 
https://www.nap.edu/catalog/19016/understanding-the-us-illicit-tobacco-
marketcharacteristics-policy-context-and  

lessons 

Nets.  (2019).  'European  Fraud  Report  2019  –  Payments Industry  Challenges'.  Retrieved  from: 

https://www.paymentscardsandmobile.com/research/european-fraud-report-payments-
industry-challenges/ 

NFCU.  (2016).  'Food  Crime:  Annual  Strategic  Assessment  -  A  2016  Baseline'.  Retrieved  from: 

https://www.food.gov.uk/sites/default/files/media/document/fsa-food-crime-
assessment-2016.pdf 

Noel,  L.  (2018).  'Independent  review  into  serious  and  organised  crime  in  the  waste  sector'. 

Retrieved from:  
https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachme
nt_data/file/756526/waste-crime-review-2018-final-report.pdf 

Norwegian Initiative on Small Arms Transfers. (N.d.). Homepage. Retrieved from: 

http://nisat.prio.org/ 

OECD. (2002). Measuring the Non-Observed Economy: A Handbook. OECD Publications Service: 

Paris, France. 1–249.  

OECD. (2008). The Economic Impact of Counterfeiting and Piracy. Paris: OECD Publishing. 
OECD. (2007). Preventing Corruption in Public Procurement. Paris: OECD Publishing.  
OECD.  (2016).  'Consumption  Tax  Trends  2016:  VAT/GST  and  excise  rates,  trends  and  policy 
https://www.oecd-ilibrary.org/docserver/ctt-2016-
issues'. 
en.pdf?expires=1584612632&id=id&accname=ocid56013842&checksum=0F6EC7407F0
0076DE06FD1B7255D2F52 

Retrieved 

from: 

OECD. (2017). Shining Light on the Shadow Economy: Opportunities and Threats. Retrieved from 

http://www.oecd.org/tax/crime/shining-light-on-the-shadow-economy-opportunities-
and-threats.pdf 

OECD/EUIPO. (2016).  Trade in Counterfeit  and  Pirated  Goods: Mapping The  Economic Impact. 

Paris: OECD Publishing. 

OECD/EUIPO. (2017). Mapping the Real Routes of Trade in Fake Goods. Paris: OECD Publishing. 

275 

 
 
 
 
 
 
EUROPEAN COMMISSION 

OECD/EUIPO.  (2018).  Governance  Frameworks  to  Counter  Illicit  Trade:  Executive  Summary. 

Paris: OECD Publishing. 

OECD/EUIPO. (2019). 'Trends in Trade in Counterfeit and Pirated Goods'. Paris: OECD Publishing.  
OECD-EUIPO.  (2020).  'Trade  in  Counterfeit  Pharmaceutical  Products'.  Retrieved  from: 
http://www.oecd.org/gov/trade-in-counterfeit-pharmaceutical-products-a7c7e054-
en.htm  

Office for Government Representation in Property Affairs (OGRPA). (N.d.). Homepage. Retrieved 

from: https://www.uzsvm.cz/ 

OLAF. (2019). 'Operation HYGIEA: OLAF, Asian & EU customs lead large-scale operation against 

counterfeit goods'. Retrieved from: 
https://ec.europa.eu/anti-fraud/media-corner/news/09-10-2019/operation-hygiea-olaf-
asian-eu-customs-lead-large-scale-operation_en 

Olken, B. A. (2007). Monitoring corruption: evidence from a field experiment in Indonesia. Journal 

of political Economy, 115(2), 200-249. 

Ollus, N., & Jokinen, A. (Eds.). (2019). Shady Business. Uncovering the business model of labour 

exploitation. Helsinki: HEUNI. 

Oosterman, N. (2019). 'Regional Overviews of the Policing of Art Crime in the European Union'. 
In S.  Hufnagel & D. Chappell  (Eds.),  The  Palgrave  Handbook on  Art Crime  (213–236). 
London: Palgrave Macmillan. 

Optimity  Advisors.  (2015).  'A  study  on  smuggling  of  migrants:  Characteristics,  responses  and 
from:  https://ec.europa.eu/home-

cooperation  with 
affairs/sites/homeaffairs/files/what-
wedo/networks/european_migration_network/reports/docs/emnstudies/study_on_smug
gling_of_migrants_final_report_master_091115_final_pdf.pdf  

third  countries'.  Retrieved 

Palan, R. (2010). International financial centers: the British-Empire, city-states and commercially 

oriented politics. Theoretical Inquiries in Law, 11(1), 149-176. 

PANDA  SECURITY. (2010). 'THE CYBER-CRIME  BLACK  MARKET: UNCOVERED'.  Retrieved from: 

 https://www.pandasecurity.com/mediacenter/src/uploads/2014/07/The-Cyber-

Crime-Black-Market.pdf 

Paoli, L., Adriaenssen, A., Greenfield, V. A., & Conickx, M. (2017). 'Exploring definitions of serious 
crime in EU policy documents and academic publications: A content analysis and policy 
implications'. European Journal on Criminal Policy and Research, 23(3), 269–285.  
Papadouka, M. E., & Haenlein, C. (2017). Organised Crime and Illicit Trade in Europe. Retrieved 

from: 

Paquet-Clouston, M., Haslhofer, B., & Dupont, B. (2019). 'Ransomware payments in the bitcoin 

ecosystem'. Journal of Cybersecurity, 5(1), tyz003.  

Persi Paoli, G., Aldridge, J., Ryan, N., & Warnes, R. (2017). 'Behind the curtain: The illicit trade 
of  firearms,  explosives  and  ammunition  on  the  dark  web'.  Santa  Monica,  Calif.:  RAND 
Corporation. Retrieved from: 
https://www.rand.org/pubs/research_reports/RR2091.html 

Petrunov,  G.  (2011).  'Managing  money  acquired  from  human  trafficking:  case  study  of  sex 
trafficking from Bulgaria to Western Europe'. Trends in Organized Crime, 14(2–3), 165–
183.  

Phelps,  J.,  Biggs,  D.,  &  Webb,  E.  L.  (2016).  'Tools  and  terms  for  understanding  illegal  wildlife 
trade'. Frontiers in Ecology and the Environment, 14(9), 479–489. doi:10.1002/fee.1325 
Pickhardt,  M.,  &  Sardà,  J.  (2015).  'Size  and  causes  of  the  underground  economy  in  Spain:  A 
correction of the record and new evidence from the MCDR approach'.  European Journal 
of Law and Economics, 39(2), 403–429.  

Polner, M. (2019). 'Preventing Illicit Trafficking of Cultural Objects: A Supply Chain Perspective'. 
In  S.  Hufnagel  &  D.  Chappell  (Eds.),  The  Palgrave  Handbook  of  Art  Crime.  London: 
Palgrave Macmillan. 

Poniatowski, G., Bonch-Osmolovskiy, M., María, J., Durán-Cabré, Esteller-Moré, A., & Śmietanka, 
A. (2019). 'Study and Reports on the VAT Gap in the EU-28 Member States: 2019 Final 
Report'. Retrieved from: 
https://ec.europa.eu/taxation_customs/sites/taxation/files/vat-gap-full-report-
2019_en.pdf 

Positive Technologies. (2018). 'The criminal cyberservices market'. Retrieved from: 

https://www.ptsecurity.com/ww-en/analytics/darkweb-2018/ 

276 

 
 
 
  
 
 
 
 
EUROPEAN COMMISSION 

Prieger, J., & Kulick, J. (2018). 'Cigarette Taxes and Illicit Trade in Europe'.  Economic Inquiry, 

56(3), 1706–1723. Retrieved from: 
https://onlinelibrary.wiley.com/doi/pdf/10.1111/ecin.12564 

Pro  Wildlife,  et  al.  (2017).  'EU  IVORY  TRADE:  THE  NEED  FOR  STRICTER  MEASURES:  Paper 
submitted to the European Commission'. Retrieved from: https://www.prowildlife.de/wp-
content/uploads/2017/08/EU_IvoryTradeBrief.pdf 

Profiling,  M.  S.  (2015).  'Enhancing  Physical  Security:  The  Impact of  Internet and  Social  Media 

Exposure'. Concierge Security Report, 1(3).  

PwC.  (2016).  'Food  fraud  vulnerability  assessment  and  mitigation:  Are  you  doing  enough  to 

prevent food fraud?'. Retrieved from: 
https://www.pwccn.com/en/migration/pdf/fsis-food-fraud-nov2016.pdf 

Raets,  S.,  &  Janssens,  J.  (2019).  'Financing  of  Trafficking  in  Human  Beings  in  Belgium'.  In 
Financing  of  Organised  Crime:  Human  Trafficking  In  Focus  (129–160).  Center  for  the 
Study of Democracy. 

Rana, J. (2018). 'Illegal elver fishing and how we tackle it'. Retrieved from: 

https://environmentagency.blog.gov.uk/2018/05/03/illegal-elver-fishing-and-how-we-
tackle-it/ 

RAND Corporation (2020). Dark web observatory. Retrieved at: https://dwo.rand.cloud/ 
Renold, M.-A. (2018). 'The legal and illegal trade in cultural property to and throughout europe: 
Facts, findings and legal analysis'. Paper presented at the Study for the capacity-building 
conference, Geneva.  

Republic of Estonia. (N.d.). 'Ministry of Justice'. Retrieved from: https://www.just.ee/en 
Ribeiro, J., Reino, L., Schindler, S., Strubbe, D., Vall-llosera, M., Araújo, M. B., . . . Monteiro, M. 
(2019). Trends in legal and illegal trade of wild birds: a global assessment based on expert 
knowledge. Biodiversity and Conservation, 28(12), 3343-3369. 

Riccardi, M. (2014). 'When criminals invest in businesses: Are we looking in the right direction? 
An exploratory analysis of companies controlled by mafias'. In Caneppele, S. & Calderoni, 
F. (Eds), Organized crime, corruption and crime prevention (197–206). Springer. 
Richet, J.-L. (2013). 'Laundering Money Online: a review of cybercriminals methods'.  Retrieved 

from: https://arxiv.org/ftp/arxiv/papers/1310/1310.2368.pdf 

Roberts, D. L., & Hernandez-Castro, J. (2017). 'Bycatch and illegal wildlife trade on the dark web'. 

Oryx, 51(3), 393–394.  

Romania  Insider.  (2019).  'Romania  tops  EU’s  internal  migration  ranking'.  Retrieved  from: 

https://www.romania-insider.com/romania-eu-internal-migration 

Ronchi, A. (2018). 'Fighting against petty crimes'. Retrieved from: 

https://re.public.polimi.it/retrieve/handle/11311/1063859/311107/Petty%20Crimes.pdf 
Rosta'mi, A., Mondani, H., Liljeros, F., & Edling, C. (2018). Criminal organizing applying the theory 
of partial organization to four cases of organized crime'. Trends in Organized Crime, 315–
342.  

Rucevska, I., Nelleman, C., Isarin, N., Yang, W., Liu, N., Yu, K., . . . Devia, L. (2015). 'Waste 
crime  –  waste  risks:  gaps  in  meeting  the  global  waste  challenge'.  UN  Environment 
Programme.  

Rusev,  A.,  &  Kojouharov, A.  (2019).  'Trafficking  for  Labour  Exploitation  in  Bulgaria'.  Retrieved 

from:  https://csd.bg/publications/publication/trafficking-for-labour-exploitation-in-
bulgaria/ 

Saggers, T. (2019). 'An assessment of the extent of Albanian speaking organised crime groups 
involved  in  drug  supply  in  the  European  Union:  Characteristics,  role  and  the  level  of 
influence'. Lisbon: European Monitoring Centre for Drugs and Drug Addiction. Retrieved 
from: 
https://www.emcdda.europa.eu/system/files/attachments/12102/EDMR2019_Backgrou
ndReport_AlbanianSpeakingOCGs.pdf 

Sanchez,  G.  (2018).  'Five  misconceptions  about  migrant  smuggling  (9290846070)'.  Retrieved 
https://globalinitiative.net/wp-content/uploads/2018/05/Five-Misconceptions-

from: 
About-Migrant-Smuggling-European-University-Institute-2018.pdf 

Savona, E., & Riccardi, M. (2015). 'From illegal markets to legitimate businesses: The portfolio of 

organised crime in Europe'.  

Savona,  E.,  &  Riccardi,  M.  (Eds.).  (2018).  'Mapping  the  Risk  of  Serious  and  Organised  Crime 

Infiltration in Europe – Final Report of the MORE Project'. Milan, Italy. 

277 

 
 
 
 
 
 
 
 
EUROPEAN COMMISSION 

Scherrer, A., & Thirion, E. (2018). Citizenship by Investment (CBI) and Residency by Investment 
(RBI)  Schemes  in  the  EU:  State  of  Play,  Issues  and  Impacts.  Study  of  the  European 
Parliamentary Research Service, PE, 627, 128. 

Schneider, F. (2016). ‘Comment on Feige's Paper "Reflections on the Meaning and Measurement 
of  Unobserved  Economies:  What  do  we  really  know  about  the  'Shadow  Economy'?"’. 
CESifo Working Paper Series 5818, Munich: CESifo Group.  

Schneider,  F.  (2010).  Turnover  of  organized  crime  and  money  laundering:  some  preliminary 

empirical findings. Public choice, 144(3-4), 473-486. 

Schneider, F., & Buehn, A. (2018). 'Shadow economy: Estimation methods, problems, results and 

open questions'. Open Economics, 1(1), 1–29.  

Schneider,  F.,  &  Enste,  D.  H.  (2000).  'Shadow  economies:  size,  causes,  and  consequences'. 

Journal of economic literature, 38(1), 77–114.  

Schneider, F., & Windischbauer, U. (2008). Money laundering: some facts.  European Journal of 

Law and Economics, 26(3), 387-404. 

Schneider, M., & Maillefer, C. (2015). How Europe deals with private imports of counterfeit and 

pirated goods. Journal of Intellectual Property Law & Practice, 10(4), 262-268. 

Select  Committee  on  Culture,  Media  and  Sport.  (2000).  'Seventh  Report  -  Cultural  Property: 

Return and Illicit Trade'. Retrieved from: 
https://publications.parliament.uk/pa/cm199900/cmselect/cmcumeds/371/37103.htm 

Shea, A. (2018). 'Shooting Fish in A Bliss Bucket: Targeting Money Launderers in the Art Market'. 

Columbia Journal Of Law & The Arts, 41, 665–687.  

Shentov, O.,  Rusev, A., &  Antonopoulos, G.  A. (2019). 'Financing of  Organised Crime:  Human 

Trafficking in Focus'. Retrieved from: 
https://research.tees.ac.uk/en/publications/financing-of-organised-crime-human-
trafficking-in-focus 

Shimazono, Y. (2007). 'The state of the international organ trade: a provisional picture based on 
integration of available information'. Bulletin of the World Health Organization, 85, 955–
962.  

Siegel, D. (2014). 'Lithuanian itinerant gangs in the Netherlands'. Kriminologijos Studijos(2), 5–

40.  

Siegel, D. (2019). 'Human smuggling reconsidered: the case of Lesbos'. Paper presented at The 

19th cross-border Crime Colloquium.  

Sina, S., Gerstetter, C., Porsch, L., Roberts, E., Smith, L., Klaas, K., & de Castillo, T. F. (2016). 
'Wildlife crime'. Policy Department A: Economic and Scientific Policy. Directorate General 
for Internal Policies.  

SKAT. (N.d.). 'Danish Tax Agency'. Retrieved from: https://www.skat.dk/ 
Skinnari, J., & Korsell, L.  K. (2016). 'The illicit tobacco market in Sweden  - from smuggling to 

warehousing'. Trends in Organized Crime 19(3–4), 273–299.  

Spapens,  T.  (2011).  Interaction  between  criminal  groups  and  law  enforcement:  the  case  of 

ecstasy in the Netherlands. Global Crime. 12(1), 19-40.  

Sosnowski, M.  C., Knowles, T. G., Takahashi, T., & Rooney, N. J. (2019). 'Global ivory market 
the  1989  CITES  ban'.  Biological  Conservation,  237,  392–399. 

prices  since 
doi:10.1016/j.biocon.2019.07.020 

Soudjin, M. (2015). Hawala and money laundering: potential use of Red flags for persons offering 

hawala services. European Journal on Criminal Policy and Research, 21(2), 257-274. 

Spink, J., & Moyer, D. C. (2011). 'Defining the public health threat of food fraud'. Journal of food 

science, 76(9), R157–R163.  

Spink, J., Moyer, D. C., Park, H., & Heinonen, J. A. (2013). 'Defining the types of counterfeiters, 

counterfeiting, and offender organizations'. Crime Science, 2(1), 1. 

Srinivasan, S., Krishnamoorthy, P., & Koteeswaran, R. (2019). 'Safeguarding of ATM'. In Khosrow-
Pour.,  M.  (Ed.),  Advanced  Methodologies  and  Technologies in  Business  Operations  and 
Management (94–105). IGI Global. 

State  Attorney’s  Office  of  the  Republic  of  Croatia.  (N.d.).  Homepage.  Retrieved  from: 

http://www.dorh.hr/m 

Stein, F. M., Wong, J. C., Sheng, V., Law, C. S., Schröder, B., & Baker, D. M. (2016). 'First genetic 
evidence of illegal trade in endangered European eel (Anguilla anguilla) from Europe to 
Asia'. Conservation Genetics Resources, 8(4), 533–537.  

Stoklosa, M., & Ross, H. (2014). 'Contrasting academic and tobacco industry estimates of illicit 

cigarette trade: evidence from Warsaw, Poland'. Tobacco control, 23(e1), e30–e34.  

Straub, S. (2014). Political firms, public procurement, and the democratization process. 

278 

 
 
 
 
 
EUROPEAN COMMISSION 

Sudy, I., Kummer, S., & Lehner, E. (2013). 'Risk Response Measures for the Management of Theft 

Risk in Road Freight Transport Chains'. Supply Chain Safety Management, 153–166.  

Sullivan, B. A., Chan, F., Fenoff, R., & Wilson, J. M. (2017). 'Assessing the developing knowledge-
base of product counterfeiting: a content analysis of four decades of research'. Trends in 
Organized Crime, 20(3–4), 338–369. 

Sustainable Eel Group. (2018a). 'Again, Germany has been used as transit country for glass eel 

trafficking! [Press release]'. Retrieved from: 
https://www.sustainableeelgroup.org/germany-is-transit-country-for-one-of-planets-
greatest-wildlife-crime-2/ 

Sustainable  Eel  Group.  (2018b).  'Quantifying  the  illegal  trade  in  European  glass  eels  (Anguilla 

anguilla): Evidences and Indicators'. Retrieved from: 
https://www.sustainableeelgroup.org/wp-content/uploads/2018/02/SEG-Report-2018-
1-V1-1.pdf 

Suvantola,  L.,  Favarin,  S.,  Mehlbaum,  S.,  Sahramäki,  I.,  Savona,  E.,  Spapens,  T.,  & 
Kankaanranta, T. (2017). 'Blocking the loopholes for illicit waste trafficking (blockwaste) 
- Final Consolidated Report'. Retrieved from: 
https://drive.google.com/file/d/1ItSzdolm0Gt4D7iw9XdlohxqvRa81h5I/view 

Symantec. (2019). 'Internet Security Threat Report'.  
Swinhoe, D. (2019). 'What is spear phishing? Why targeted email attacks are so difficult to stop'. 
from:  https://www.csoonline.com/article/3334617/what-is-spear-phishing-

Retrieved 
why-targeted-email-attacks-are-so-difficult-to-stop.html  
July 

Retrieved 

'Vigilant, 

(2018). 

2018'. 

TAPA. 

from: 

https://www.tapa-

global.org/information/newsletter-vigilant.html 

TAPA.  (2019).  'Vigilant:  The  Monthly  Cargo  Crime  Update  for  TAPA's  Global Family'.  Retrieved 

from:   https://www.tapa-
global.org/fileadmin/public/downloads/vigilant/2019/December_2019/TAPA_Vigilant_e-
Magazine_-_December_2019_issue.pdf 

TAPA. (2020a). 'Annual Report 2019'.  
TAPA. (2020b). 'IIS Data Resource'. Retrieved from: 

https://www.tapa-global.org/intelligence/iis-data-resource.html 

TAPA EMEA. (2019). 'Annual Report 2018'.  
Terenghi,  &  Nicola,  D.  (2018).  'Human  Trafficking  Finances:  Evidence  from  Three  European 

Countries'.  

Thakkar,  J.  (2019).  'The  Latest  PayPal  Phishing  Email  Goes  Beyond  Your  Login  Credentials'. 
from:  https://www.thesslstore.com/blog/the-latest-paypal-phishing-email-

Retrieved 
goes-beyond-your-login-credentials/ 

The Economist. (2017). 'WannaCry Should Make People Treat Cyber-Crime Seriously'. Retrieved 

from:  https://www.economist.com/science-and-technology/2017/05/20/wannacry-
should-make-people-treat-cyber-crime-seriously 

Tiniti,  P.,  &  Reitano,  T.  (2016).  Migrant,  Refugee,  Smuggler,  Saviour.  London:  Hurst  &  Co 

Publishers. 

Tops,  P.,  van  Valkenhoef,  J.,  van  der  Torre,  E.,  &  van  Spijk,  L.  (2018).  'The  Netherlands  and 

synthetic drugs: an inconvenient truth'. The Hague: Eleven International Publishing. 

Tracit.  (2019).  'Mapping  the  Impact  of  Illicit  Trade  on  the  Sustainable  Development  Goals'. 

Retrieved from:  
https://www.tracit.org/uploads/1/0/2/2/102238034/standalone_traffickingpersons.pdf 

TRAFFIC. (2008). 'The Illegal Trade in Wild Birds for Food through South-East and Central Europe'. 

Retrieved from:  
https://www.traffic.org/site/assets/files/3754/illegal_trade_wild_birds_for_food_europe.
pdf 

TRAFFIC.  (2019).  'Understanding  ETIS:  An  introduction  and  overview  of  the  Elephant  Trade 

Information System Analysis'. Retrieved from:   
https://www.traffic.org/site/assets/files/3817/understanding-etis-vfinal-web.pdf 
TRAFFIC. (2020). 'An overview of seizures of CITES-listed wildlife in the European Union: January 

to December 2018'. Retrieved from: 
https://www.traffic.org/site/assets/files/12745/eu-seizures-report-2020-final-web.pdf 

Transcrime.  (2015a).  'An  European  outlook  on  the  illicit  trade  in  tobacco  products'.  Trends  in 

Organized Crime, 19(3/4), 300–328. doi:10.1007/s12117-015-9260-1 

279 

 
 
 
 
 
 
 
 
EUROPEAN COMMISSION 

Transcrime. (2015b). 'European outlook on the illicit trade in tobacco products: Methodological 

Annex'. Retrieved from: 
http://www.transcrime.it/wp-content/uploads/2015/01/Methodological-Annex.pdf 
Transcrime. (2015c). 'From Illegal Markets to Legitimate Businesses: The Portfolio of Organised 

Crime in Europe'. Retrieved from: 
portfolio-of-organised-crime-in-europe/ 

 http://www.transcrime.it/pubblicazioni/the-

Transcrime.  (2019).  'ITTP  NEXUS  in  Europe  and  Beyond  (A.  a.  M.  D.  Aziani  Ed.)'.  Milano: 

Transcrime – Università Cattolica del Sacro Cuore. 

Transparency International. (2006). Curbing Corruption in Public Procurement.  
Transparency International. (2020). Corruption Perceptions Index 2019. 
Treadwell, J. (2012). 'From the car boot to booting it up? eBay, online counterfeit crime and the 
transformation of the criminal marketplace'. Criminology & Criminal Justice, 12(2), 175–
sa191. 

Trend Micro. (2011). 'Cybercriminals Selling PayPal Accounts for Personal Gain'. Retrieved from: 

https://blog.trendmicro.com/cybercriminals-selling-paypal-accounts-for-personal-gain/ 

‘t Sas-Rolfes, M., Challender, D. W. S., Hinsley, A., Veríssimo, D., & Milner-Gulland, E. J. (2019). 
'Illegal wildlife trade: Scale, processes, and governance'. Annual Review of Environment 
and Resources, 44(1), 201–228. doi:10.1146/annurev-environ-101718-033253 
Ugur,  A.  (2019).  'Advertise  publicly,  trade  privately?  Analysing  the  cybercrime-as-a-service 
from: 

forums'. 
(CaaS) 
https://www.cambridgecybercrime.uk/slides-2019-akyazi.pdf 

underground 

Retrieved 

offerings 

in 

UK Finance. (2019). 'FRAUD THE FACTS 2019: The definitive overview of payment industry fraud'. 

Retrieved from:  
https://www.ukfinance.org.uk/system/files/Fraud%20The%20Facts%202019%20-
%20FINAL%20ONLINE.pdf 

UK  Parliament.  (2018).  'VAT  fraud:  cooperation  between  tax  administrations'.  Retrieved  from: 

https://publications.parliament.uk/pa/cm201719/cmselect/cmeuleg/301-
xxviii/30116.htm  

Underwood, F. M., Burn, R. W., & Milliken, T. (2013). 'Dissecting the illegal ivory trade: an analysis 

of ivory seizures data'. PloS one, 8(10).  

UNEP. (2019). Basel Convention on the control of transboundary movements of hazardous wastes 
and  their  disposal.  Protocol  on  liability  and  compensation  for  damage  resulting  from 
transboundary  movements  of  hazardous  wastes  and  their  disposal.  Retrieved  from: 
http://www.basel.int/TheConvention/Overview/TextoftheConvention/tabid/1275/Default
.aspx 

UNEP, CITES, IUCN & TRAFFIC.  (2013). 'Elephants in the dust : the African elephant crisis  - a 
from: 

rapid 
https://portals.iucn.org/library/sites/library/files/documents/2013-002.pdf 

assessment'. 

Retrieved 

response 

UNESCO.  (2018).  'Fighting  the  Illicit  Trafficking  of  Cultural  Property  -  A  Toolkit  for  European 

Judiciary and Law Enforcement'. Retrieved from: 
http://www.unesco.org/new/fileadmin/MULTIMEDIA/HQ/CLT/movable/pdf/Toolkit_01.pd
f 

UNODC.  (2010).  'The  Globalization  of  Crime:  A  Transnational  Organized  Crime  Threat 
https://www.unodc.org/documents/data-and-

Retrieved 

Assessment'. 
analysis/tocta/TOCTA_Report_2010_low_res.pdf 

from: 

UNODC.  (2011).  'Estimating  illicit  financial  flows  resulting  from  drug  trafficking  and  other 
transnational  organized  crimes  -  Research  Report  (final  draft)'.  Retrieved  from: 
https://www.unodc.org/documents/data-and-analysis/Studies/Illicit-financial-
flows_31Aug11.pdf 

UNODC. (2014). 'Global report on trafficking in persons'. Retrieved from: 

https://www.unodc.org/res/cld/bibliography/global-report-on-trafficking-in-
persons_html/GLOTIP_2014_full_report.pdf 

UNODC. (2015a). 'Drug Money: The Illicit Proceeds of Opiates Trafficked on the Balkan Route'. 

Retrieved from: https://www.unodc.org/documents/data-and-
analysis/Studies/IFF_report_2015_final_web.pdf 

UNODC. (2015b). 'Migrant Smuggling in Asia: Current Trends and Related Challenges'. Retrieved 

from: 
https://www.unodc.org/documents/southeastasiaandpacific/Publications/2015/som/Curr
ent_Trends_and_Related_Challenges_web.pdf 

280 

 
 
 
  
 
 
 
EUROPEAN COMMISSION 

UNODC. (2015c). 'A study on the transnational nature of and routes and modus operandi used in 

trafficking in firearms'. Retrieved from:  https://www.unodc.org/documents/firearms-
protocol/UNODC_Study_on_Firearms_WEB.pdf 

UNODC.  (2016).  'World  wildlife  crime  report:  Trafficking  in  protected  species'.  United  Nations 

UNODC. 

Office on Drugs and Crime (UNODC). 
'Global 

(2018a). 

study  on  Smuggling  of  Migrants'.  Retrieved 

from: 

https://www.unodc.org/documents/data-and-
analysis/glosom/GLOSOM_2018_web_small.pdf 

UNODC. (2018b). 'Monitoring Target 16.2 of the United Nations sustainable development goals: 
a multiple systems estimation of the numbers of presumed human trafficking victims in 
the Netherlands in 2010-2015 by year, age, gender, form of exploitation and nationality'. 
Retrieved from:  https://www.unodc.org/documents/research/UNODC-
DNR_research_brief.pdf 

UNODC. (2018c). 'Monitoring Target 16.2 of the United Nations Sustainable Development Goals: 
multiple systems estimation of the numbers of presumed victims of trafficking in persons 
- 
https://www.unodc.org/documents/data-and-
Retrieved 
analysis/glotip/MSE_Research_Brief_Ireland.pdf 

Ireland'. 

from: 

UNODC. (2018d). 'Monitoring Target 16.2 of the United Nations Sustainable Development Goals: 
multiple systems estimation of the numbers of presumed victims of trafficking in persons 
https://www.unodc.org/documents/data-and-
Retrieved 
- 
analysis/glotip/MSE_Research_Brief_Romania.pdf 
UNODC. (2018e). 'Trafficking in cultural property'. Retrieved from: 

Romania'. 

from: 

https://www.unodc.org/e4j/en/organized-crime/module-3/key-issues/cultural-property-
trafficking.html 

UNODC. 

(2020). 

'World 
https://www.unodc.org/documents/data-and-
analysis/wildlife/2020/World_Wildlife_Report_2020_9July.pdf  

Wildlife 

Crime 

Report'. 

Retrieved 

from: 

US District Court. (2000). 'European Community complaint against Philip Morris, RJ Reynolds and 
Japan  Tobacco'.  New  York:  United  States  District  Court,  Eastern  District  of  New  York. 
Retrieved from:  http://uniset.ca/other/cs6/150FSupp2d456.html 

US National Cancer Institute, & WHO, N. C. I. T. C. (2016). 'The economics of tobacco and tobacco 

control'. Retrieved from: 
https://cancercontrol.cancer.gov/brp/tcrb/monographs/21/docs/m21_complete.pdf 

Van Daele, S., & Vander Beken, T. (2010). 'Exploring itinerant crime groups'. European Journal 

on Criminal Policy and Research, 16, 1–13.  

Van den Engel, A., & Prummel, E. (2007). 'Organised theft of commercial vehicles and their loads 
in  the  European  Union'.  Brussels:  European  Parliament,  Directorate  General  Internal 
Policies of the Union, Policy Department Structural and Cohesion Policies, Transport and 
Tourism.  

van  der  Giessen,  M.,  van  Ooyen-Houben,  M.  M.,  &  Moolenaar,  D.  E.  (2016).  'Estimating  the 
production, consumption and export of cannabis: The Dutch case'. International Journal 
of Drug Policy, 31, 104–112.  

van Dijk, J., Van der Knaap, L. M., Aebi, M. F., & Campistol, C. (2014). 'Counting what counts: 

tools for the validation and utilization of EU statistics on human trafficking'.  

Van  Duyne,  P.  C.,  Scheinost,  M.,  Antonopoulos,  G.  A.,  Harvey,  J.,  &  Lampe,  K.  v.  (2016). 
'Narratives  on  Organised  Crime  in  Europe:  Criminals,  Corrupters  &  Policy'.  The 
Netherlands: Wolf Legal Publishers. 

Van  Laar,  M.,  Frijns,  T.,  Trautmann,  F.  and  Lombi,  L.  (2013),  ‘Cannabis  market:  user  types, 
availability and consumption estimates report’, in Trautmann, F., Kilmer, B. and Turnbull, 
P. (eds), Further insights into aspects of the EU illicit drugs market, Publications Office of 
the  European  Union,  Luxembourg.  Retrieved  from:  http://ec.europa.eu/justice/anti-
drugs/files/eu_market_full.pdf 

van Uhm, D., & Siegel, D. (2016). 'The illegal trade in black caviar'. Trends in Organized Crime, 

19(1), 67–87. Retrieved from:   
https://link.springer.com/content/pdf/10.1007%2Fs12117-016-9264-5.pdf 

Van Wegberg, R., Tajalizadehkhoob, S., Soska, K., Akyazi, U., Ganan, C. H., Klievink, B., . . . Van 
Eeten, M. (2018). 'Plug and prey? measuring the commoditization of cybercrime via online 
anonymous markets'. Proceedings of the 27th USENIX Security Symposium, 1009–1026. 
Retrieved from:  

281 

 
 
 
 
 
EUROPEAN COMMISSION 

https://www.usenix.org/system/files/conference/usenixsecurity18/sec18-
van_wegberg.pdf 

Vander  Beken,  T.,  &  Defruytier,  M.  (2004).  Measure  for  measure:  Methodological  tools  for 
assessing  the  risk  of  organized  crime  Threats  and  phantoms  of  organised  crime, 
corruption  and  terrorism:  critical  European  perspectives  (pp.  51-84):  Wolf  Legal 
Publishers. 

Vander  Beken,  T.,  Van  Daele,  S.,  &  Dorn,  N.  (2007).  'Reducing  vulnerabilities  to  crime  of  the 
European waste management industry: the research base and the prospects for policy'. 
European Journal of Crime, Criminal Law and Criminal Justice, 15(1), 23–36.  

Verizon. 

(2019). 

'2018  Data  Breach 

Investigations  Report'.  Retrieved 

from: 

https://enterprise.verizon.com/resources/reports/DBIR_2018_Report.pdf 

Vujović,  S.  (2015).  'Cigarette  smuggling  at  the  local  level  through  smugglers’  eyes:  How  and 
why'? In A. M. Petrus C.  van Duyne, Georgios A. Antonopoulos, Jackie Harvey & Klaus 
von Lampe (Eds.), The Relativity of Wrongdoing: Corruption, Organised Crime, Fraud and 
Money Laundering in Perspective. Nijmegen: Wolf Legal Publishers. 
Free 
https://www.globalslaveryindex.org/2018/findings/highlights/ 

'The  Global  Slavery 

Index'.  Retrieved 

Foundation. 

(2018a). 

from: 

Walk 

Walk Free Foundation. (2018b). ‘The Global Slavery Index: Methodology, Prevalence’. Retrieved 

from: https://www.globalslaveryindex.org/2018/methodology/prevalence  

Wall,  D.  S.  (2015).  'Dis-organised  crime:  Towards  a  distributed  model  of  the  organization  of 

WCO.  (2015). 

cybercrime'. The European Review of Organised Crime, 2(2).  
'Illicit  Trade  Report  2015'.  Retrieved 

from:  http://www.wcoomd.org/-

/media/wco/public/global/pdf/topics/enforcement-and-compliance/activities-and-
programmes/illicit-trade-report/itr_2015_en.pdf?db=web 

Whitehead, J., Jackson, J., Balch, A., & Francis, B. (2019). 'On the Unreliability of Multiple Systems 
Estimation for Estimating the Number of Potential Victims of Modern Slavery in the UK'. 
Journal of Human Trafficking, 1–13.  

WHO.  (2015).  'Illegal  trade  of  tobacco  products:  What  you  should  know  to  stop  it'.  Retrieved 

from:  
https://apps.who.int/iris/bitstream/handle/10665/170994/WHO_NMH_PND_15.3_eng.p
df;jsessionid=23A27DFD93CC37063C9B372C08E92E6E?sequence=1 

WHO FCTC. (2014). 'Combating the illicit trade in tobacco products from a European perspective'. 
from: 

Regional 
https://www.who.int/fctc/publications/Regional_studies_paper_3_illicit_trade.pdf 
Williams,  C.  C.,  Martinez-Perez,  A.,  &  Kedir,  A.  M.  (2016).  Informal  Entrepreneurship  in 
Developing Economies: The Impacts of  Starting Up Unregistered on Firm Performance. 
Entrepreneurship Theory and Practice, 41(5), 773-799. 

Retrieved 

Studies 

Series, 

Paper 

R/3. 

Williams, C.C. & Schneider, F. (2016). Measuring the global shadow economy: The prevalence of 

informal work and labour. Edward Elgar Publishing 

Williams, P. (2001). 'Organized crime and cybercrime: Synergies, trends, and responses'. Global 

Issues, 6(2), 22–26.  

Wollinger,  G.  R.,  Querbach,  M.,  Röhrig,  A.,  König,  A.,  &  Isenhardt,  A.  (2018).  'Offender 
organization  and  criminal  investigations  with  regard  to  organised  residential  burglary'. 
Retrieved from:  
https://kfn.de/wpcontent/uploads/Forschungsberichte/FB_147%20en.pdf 

World Animal Protection. (2020). 'Live snakes stuffed into tiny takeaway boxes sold at UK reptile 

market'. Retrieved from: 
snakes-stuffed-tiny-takeaway-boxes-sold-uk-reptile-market 

 https://www.worldanimalprotection.org.uk/news/live-

World Bank. (2019). Worldwide governance indicators. 
WWF.  (2019).  'Two  years  after  China  bans  elephant  ivory  trade,  demand  for  elephant  ivory  is 
from:  https://www.worldwildlife.org/stories/two-years-after-china-

down'.  Retrieved 
bans-elephant-ivory-trade-demand-for-elephant-ivory-is-down 

WWF. (N.d.). 'Coalition to End Wildlife Trafficking Online'. Retrieved from: 

https://www.worldwildlife.org/pages/coalition-to-end-wildlife-trafficking-online 

Yonkova, N., Gillan, S., Keegan, E., Charlton, D., O'Connor, M., & Zobnina, A. (2017). 'Protecting 
Victims:  An  analysis  of  the  antitrafficking  directive  from  the  perspective  of  a  victim  of 
gender-based 
from: 
https://www.immigrantcouncil.ie/sites/default/files/2018-
10/2018%20AT%20Protecting%20Victims.%20Analysis%20of%20the%20Anti-
trafficking%20Directive%20from%20GBV%20perspective.pdf 

Retrieved 

violence'. 

282 

 
 
 
 
EUROPEAN COMMISSION 

Young,  M.  A.  (2013).  Banking  secrecy  and  offshore  financial  centers:  money  laundering  and 

offshore banking: Routledge. 

НКБТХ. (2017). 'Годишен отчет за изпълнение на Национална програма за борба с трафика 

на хора и закрила на жертвите за 2016'.  

НКБТХ. (2018). 'Годишен отчет за изпълнение на Национална програма за борба с трафика 

на хора и закрила на жертвите за 2017'.  

НКБТХ. (2019). 'Годишен отчет за изпълнение на Национална програма за борба с трафика 

на хора и закрила на жертвите за 2018'. 

283 

 
 
 
GETTING IN TOUCH WITH THE EU  

In person  

All over the European Union there are hundreds of Europe Direct information centres. You can 
find the address of the centre nearest you at: https://europa.eu/european-union/contact_en  

On the phone or by email  

Europe  Direct  is  a  service  that  answers  your  questions  about  the  European  Union.  You  can 
contact this service:  

–by freephone: 00 800 6 7 8 9 10 11 (certain operators may charge for these calls), 

–at the following standard number: +32 22999696, or 

–by email via: https://europa.eu/european-union/contact_en 

FINDING INFORMATION ABOUT THE EU  

Online  

Information about the European Union in all the official languages of the EU is available on the 
Europa website at: https://europa.eu/european-union/index_en  

EU publications  

can 

download 

from: 
You 
https://op.europa.eu/en/publications.  Multiple  copies  of  free  publications  may  be  obtained  by 
contacting  Europe  Direct  or  your  local  information  centre  (see  https://europa.eu/european-
union/contact_en).  

publications 

priced 

order 

free 

and 

EU 

or 

EU law and related documents  

For access to legal information from  the  EU, including  all EU  law since  1952 in all the official 
language versions, go to EUR-Lex at: http://eur-lex.europa.eu  

Open data from the EU  

The  EU  Open  Data  Portal  (http://data.europa.eu/euodp/en)  provides  access  to  datasets  from 
the EU. Data can be downloaded and reused for free, for both commercial and non-commercial 
purposes.