Approaching a Small Economy in European Union With a Geopolitical Risk

Estonia as one of the smallest post-Soviet countries has been economically well off and is regarded as a true success story. It has enjoyed 35 years as the biggest GDP per capita among post-soviet countries. Early decisions in 1990s to concentrate its economy on IT and become a truly digital society and economy have paid off with international fame for being innovative and a hub for startups and tech-savvy entrepreneurs. Economic links with Russia were intentionally cut off and Scandinavia became the largest trade partners. The success story came with heavy price: Scandinavian banks used Estonia as hub for money from Russia during 2000s and AML scandals become well known stories. Also, size does matter — with a population of 1.3 million, one can be as expat friendly as possible, but both the geopolitical risk not only from the famous aggressive neighbor from the East but also risk of abuse of the openness to foreign high-risk businesses relocation to Estonia needs to be kept in mind.

What Is Driving the Change

Estonia intentionally decided to cut itself economically off from Russia and concentrate on Scandinavia. The decision was also made that, due to its small size, both heavy industry and other ‘traditional’ economy would not have been a realistic choice. The decision was made to become as digitalized as possible and provide a good platform for IT and digital innovation.

Small size enabled quick post-Soviet time reforms and liberalization of the economy. Monetary decisions were straightforward and lenient. This enabled fast growth and innovation.

Cultural and historical links with Scandinavia enabled quick assimilation towards Western traditions and understanding of business. The financial system was quickly acquired by Scandinavian banks. This caused a high concentration of Scandinavian financial influence and also a concentration within the banking market.

What the Experience of Estonia Reveals

Scandinavian influence on the financial sector resulted in financial institutions also using Estonia as a hub to attract Russian and CIS wealth. Similar situations arose in neighboring Latvia, where most of the financial sector was only concentrating on servicing wealthy clients from the east. After AML scandals, both Latvia and Estonia had to close the whole business down during last decade. Apparently, the rapid import of Western business culture did not create a strong compliance culture. Both Swedbank and Danske AML scandals are still under investigation by the DOJ. Tech-savvy Estonia is still attractive for larger IT corporates, but the financial sector will need decades to recover from the international scandals.

The IT success story has generated some big names with international pedigree (Skype, Bolt), and one of the biggest number of unicorns per capita in Europe. During the last decade the IT sector clearly overheated: there was a systemic deficiency of qualified staff and reputational issues (inflow of early-stage crypto-related businesses). Although the justice system is well operating and the country has done well in bribery indexes, the business ethics are still developing, especially after the bitter lessons from past AML scandals.

The small size of the economy provides a heavy uphill struggle to generate a comprehensive and lenient justice system that can deal with the complexities of the breaches that occurred with the overheating digital economy. Authorities were slow to understand outrageous risks taken by the banks regarding inflow of capital from the East. Once the breaches became public, the investigative authorities proved to be understaffed and underqualified; too much dependency was put on Scandinavian regulators and U.S. agencies to perform the actual investigations.

Implications for Multinational Companies

The Economy and the justice system have been friendly towards foreign investment. Attracting MNCs is a governmental priority, and flexibility is provided, also for commercial considerations and tailor-made legal requirements (if needed). The country’s small population provides agility and openness. Scandinavian investments during last 35 years have generated a healthy and open business culture. However, the country’s small size also means that the legal system may struggle with coping with complex compliance issues and cross-border disputes.

A strong compliance culture and structure should be implemented from the “mother” company level and include centralized controls and legal assistance. Geopolitical risk assessment is of relevance as the EU sanction regime is technical — and even minor breaches are investigated. Breach of sanctions in one EU jurisdiction may have implications in all jurisdictions (e.g., concentrated banking sector, good cooperation between EU enforcement authorities).

The rapid structural change from the early-stage post-Soviet economy took place more than 20 years ago, and stability was reached during the last decade; thus it is assumed that the legislative and regulatory environment shall remain relatively stable. That said, MNCs should not apply a risk assessment assuming stability and rapid growth.

What Comes Next

Geopolitical risk from Russia shall remain for an unknown period. And while the exact contents and timeline are unclear, the geopolitical risk has been there for around 1000 years. The defense sector is already booming — both the strong IT ecosystem and close cooperation with the Ukraine defense sector provides good opportunities to invest into high-tech startups.

Since 2022, barely any economic link exists with Russia. This enables the financial sector to realign and deal with reputational issues. The IT sector is strong and active in expanding to other jurisdictions, but this will cause FCPA and similar risks for local international companies setting up their businesses in Middle East and Africa.

Bottom Line

For multinational companies, the central lesson is that a foreign investment friendly and strategically planned economy is good for business but it can caused deficiencies in the organic development of compliance culture.

Impressive numbers on paper. Estonia is frequently invoked as the paradigmatic success narrative of post-Soviet European transition — a digitally sophisticated, investment-oriented economy of 1.3 million inhabitants that deliberately severed its economic dependence on Russia and anchored itself firmly within the Scandinavian and European Union institutional frameworks. For the multinational enterprise surveying the landscape, Estonia presents an ostensibly straightforward proposition: a member state of the European Union, a NATO ally, a jurisdiction that performs well on corruption perception indices, and a regulatory environment consciously engineered to attract foreign capital. That characterization, while accurate in its particulars, is materially incomplete. The Estonian experience furnishes a compelling case study in the tensions that arise when a small, open economy pursues rapid institutional modernization in the persistent shadow of geopolitical vulnerability — and the compliance lacunae that may emerge in the interstices.

The Honest Business Reality. Estonia’s economic architecture was purposefully constructed around technology and digital services. The foundational decision in the 1990s to forgo traditional industrial development in favor of a digital-first economic model yielded demonstrable results: the emergence of enterprises such as Skype and Bolt, and one of Europe’s highest per capita concentrations of technology unicorns (so-called “Estonian start-up Mafia”). Foreign direct investment is actively solicited, commercial regulation is streamlined, and the government has exhibited a willingness to fashion bespoke legal frameworks for strategically significant investors. The information technology ecosystem remains vibrant and internationally competitive.

However, the very openness and institutional agility that rendered Estonia attractive simultaneously exposed the jurisdiction to substantial risk. During the 2000s, Scandinavian financial institutions — which exercise dominant market share in Estonia’s highly concentrated banking sector — utilized their Baltic operations as conduits for Russian and Commonwealth of Independent States capital. The resultant anti-money laundering failures at Swedbank and Danske Bank constituted some of the most consequential compliance scandals in European financial history, and both matters remain subject to ongoing investigation by the United States Department of Justice. Neighboring Latvia, whose financial sector exhibited even greater dependence on Eastern capital flows, suffered analogous and even more grave consequences. The lesson admits of a straightforward formulation: the rapid adoption of Western institutional architectures does not, in itself, engender a mature compliance culture. The regulatory infrastructure materialized before the institutional habits and supervisory capacity required to sustain it.

The Mistakes Companies Make. The most prevalent error committed by foreign enterprises operating in Estonia is the treatment of the jurisdiction as a frictionless extension of the Nordic market. While the legal system functions effectively and the judiciary maintains its independence, the country’s modest scale imposes genuine structural limitations. Investigative and regulatory authorities have historically been under-resourced and insufficiently equipped to address complex cross-border compliance matters with the requisite rigor. When the anti-money laundering scandals came to light, Estonian regulators were substantially dependent upon their Scandinavian counterparts and United States enforcement agencies to conduct the substantive investigative work. For the multinational enterprise, the practical implication is that the domestic enforcement environment may fail to identify irregularities at an early stage — yet, once such issues surface in international fora, the consequences propagate rapidly and comprehensively.

The second characteristic error is an underestimation of the geopolitical dimension. Estonia occupies a position directly on NATO’s eastern flank. The European Union sanctions regime is technically exacting and aggressively enforced; even minor sanctions infractions in one EU member state are liable to trigger regulatory scrutiny across the bloc. A compliance failure originating in Tallinn may generate material consequences in Frankfurt, Stockholm, and — as examples have shown — also in Washington, D.C.

Where the Opportunity Lies. Estonia’s defense technology sector is experiencing significant and accelerating growth. The convergence of a robust domestic information technology ecosystem and close operational cooperation with Ukraine’s defense sector since 2022 has generated substantial opportunities for investment in high-technology defense ventures. For enterprises possessing appropriate compliance architectures and a calibrated risk appetite, this sector presents genuine near-term potential that a considerable number of foreign investors have yet to fully apprehend.

What Compliance Can and Cannot Solve. Rigorous compliance practice can effectively manage sanctions exposure — Estonia’s regulatory environment is well-charted, and the applicable rules, while technically demanding, are ascertainable and navigable with competent counsel. What compliance frameworks cannot remediate is the structural immaturity of domestic enforcement capacity. An enterprise operating in Estonia should construct its compliance architecture at the parent-company level. Centralized controls, centralized legal oversight, and compliance standards imported from the home jurisdiction — rather than calibrated to local regulatory minima — are essential. Reliance upon local regulatory pressure to maintain institutional discipline is inadvisable, as the supervisory authority may lack the capacity to exert such pressure until a point at which remediation becomes significantly more costly.

The One Step Before Entry. Prior to authorizing operations in Estonia or any comparably situated small EU economy with material geopolitical exposure, a multinational enterprise should conduct a comprehensive sanctions and anti-money laundering stress test predicated on the assumption that the domestic enforcement infrastructure will not identify irregularities proactively. The compliance program should be designed to satisfy the standards of the most exacting EU jurisdiction that might assert supervisory interest — not calibrated to the local regulatory floor. Estonia rewards enterprises that bring institutional discipline with them. It does not yet reliably impose that discipline through its own supervisory mechanisms.