Europe’s regulatory strength is only as strong as its weakest link

When we consider Europe’s strength, we tend to often look at its collective economic power, the European single market, and the shared values across the content. But what if one small link in that chain were to quietly undermine the rest?

While the EU since always placed fiscal and regulatory development as a key priority since its founding, some of its own member states have simultaneously become soft spots, not necessarily by design, but through decades of permissive financial structures that have enabled tax avoidance, shell companies and even circumvention of sanctions.

Earlier this year, the European Parliament warned that unstandardised tax rules and uneven enforcement among member states have allowed for aggressive tax planning and evasion to thrive, distorted competition and negatively impacted public revenues as a result.

And the problem extends beyond taxes. Inconsistencies in sanctions enforcement, beneficial ownership transparency, and anti–money laundering frameworks create cracks that hostile regimes and illicit actors can exploit. These weaknesses do not remain confined within national borders. When one jurisdiction falls behind, the entire EU’s integrity is weakened.

Cyprus as a case in point

Among EU member states, Cyprus stands out as a particularly exposed node in this web of financial interdependence. A small country with an outsized professional services sector, Cyprus has repeatedly been cited in investigations and enforcement actions for its role as a gateway for offshore wealth and opaque financial structures.

The Cyprus Confidential leak, a massive data trove of 3.6 million documents released in 2023, revealed how six major Cypriot financial service providers and a corporate registry firm helped thousands of clients, among them dozens of sanctioned Russian oligarchs, structure assets through shell companies and trusts. Investigators found that at least 67 of the 105 Russian billionaires on the Forbes list at the time had used Cyprus-connected firms to manage their wealth.

The details were often striking. Leaked files showed for example that PwC Cyprus assisted Russian oligarch Alexey Mordashov in moving a US$1.4 billion investment out of his name just as EU sanctions were being imposed in February 2022.

Another Cyprus-based provider, Abacus Ltd, executed a $5 million transfer for Russian banker Petr Aven on the same day sanctions were announced, moving funds that should have been frozen.

Meanwhile, companies tied to Roman Abramovich used Cyprus structures to claim superyachts were commercially leased and therefore exempt from VAT. After years of litigation, Cyprus’s Supreme Court upheld a ruling that the arrangement constituted tax evasion, leaving the firms liable for tens of millions in unpaid taxes.

The lawyers behind the curtain

What is often overlooked is how deeply law firms themselves sit at the center of these networks. While accountants and corporate service providers execute transactions, it is lawyers who design, justify, and legitimise many of the structures that make financial opacity possible. In Cyprus, a number of law firms occupy this gray zone between professional service and facilitation.

One recent example is Tokentrust Holdings, sanctioned recently by both the United States Treasury and Ukraine for allegedly helping Russian nationals evade sanctions through digital-asset transactions.

Tokentrust’s registered headquarters in Limassol incidentally shares the same address as Costas Tsirides & Co LLC, a prominent Cypriot law firm. This firm is no stranger to controversy: years earlier, it filed the complaint that led to an arrest warrant for Maria Efimova, the whistleblower who exposed suspected money-laundering operations and was also the source for murdered Maltese investigative journalist Daphne Caruana Galizia.

One of the directors from the same firm, a Russian-Cypriot lawyer, has also been linked to an offshore company in the Paradise Papers, and even served as director of Linetrust PTC Ltd, an “entity of interest” believed to be associated with sanctioned individuals by Western authorities. Despite these unusual overlaps and circumstances, it is noteworthy that the firm itself has never been the subject of any formal investigation, a fact that may reflect the leniency often afforded to law firms.

Such intersections between sanctioned entities, local firms, and networks of corporate service providers can illustrate how enforcement efforts may at times fall short. In some cases, the issue is not necessarily hidden offshore but can exist in plain sight, even within the same professional structures designed to uphold the law.

And Cyprus is not unique in this pattern. Similar cases have surfaced across the EU: Mossack Fonseca’s European intermediaries in Luxembourg and Malta, Appleby’s operations in the Channel Islands, and the Baltic legal boutiques involved in the Danske Bank money-laundering scandal all reveal the same structural flaw. The EU’s rules focus on banks and beneficial ownership, yet they often overlook the legal gatekeepers who enable the system to function.

A systemic weakness

This vulnerability matters for more than moral reasons. When companies and wealthy individuals can use favourable tax and corporate regimes to shift profits or assets through jurisdictions like Cyprus, they deprive other EU states of tax revenue and undermine fair competition. The result is a race to the bottom within the very union that was designed to harmonise economic governance.

The problem deepens when these same networks are used to circumvent sanctions. The EU’s restrictive measures against Russia, for instance, depend on consistent enforcement across all member states. But when one state delays or dilutes enforcement—Cyprus for example repeatedly missed EU deadlines to establish a fully empowered sanctions unit, reportedly under pressure from its legal and financial sectors—the effectiveness of the entire regime falters.

Furthermore, in a tightly integrated union, one country’s leniency becomes everyone’s risk. Tax base erosion in one state affects public services and budgets across the continent. Inconsistent enforcement of sanctions essentially enables adversaries to exploit divisions, thereby reducing the EU’s credibility abroad. And every scandal involving European intermediaries, whether it is in Cyprus, Luxembourg, or Malta, chips away at public trust in the EU’s claim to uphold fairness, transparency, and the rule of law.

Europe’s geopolitical weight depends not just on its armies or its diplomacy, but also on the integrity of its markets. When it’s possible to hide wealth in certain parts of the EU, it sends a signal that European rules can be gamed. This perception diminishes the credibility of the union and its ability to lead by example, and it also undermines its capacity to expect partners and rivals alike to uphold transparency, pursue tax justice, and comply with international norms.

How to close the gaps

Reinforcing the EU’s financial integrity will require building a coherent, collective architecture that leaves no room for arbitrage or abuse. The EU needs harmonised enforcement across all 27 member states: fully functional sanctions units, transparent beneficial ownership registers, and coordinated anti–money laundering mechanisms.

It must also extend scrutiny to the legal profession, often shielded by claims of client confidentiality, by requiring more rigorous due diligence and reporting of suspicious structures. And smaller or more exposed economies like Cyprus should receive not just pressure, but support, to build the institutional resilience necessary to resist capture by vested interests.

In the end, the challenge is as political as it is technical. Financial secrecy is able to exist because it serves distorted economic interests, those who profit from complexity and ambiguity. And the EU undermines its own credibility by looking turning a blind eye. The strength of any system depends on its most fragile part.

Cyprus embodies that weakness today. But the story is not uniquely Cypriot. It is European. In order for Europe to continue leading on transparency, and the rule of law, it needs to repair its own weak links, starting with the ones that have been existed for far too long.