It was 2013 and officers at the Estonian branch of Danske Bank were beginning to realise they had taken on some very unpleasant customers. After a tipoff, a member of staff had travelled to Moscow and started asking questions. The team was trying to trace the identity of people hiding behind anonymous corporate vehicles, which had opened accounts and were now using them to transfer huge sums of money. That was when its staff began to receive anonymous threats. “This bank will sink,” one caller warned.

Today, Danske is still very much in business, but its chief executive, Thomas Borgen, has resigned. He fell on his sword after a report produced by lawyers for his board, published on Wednesday, revealed the full extent of problems at the Estonian branch. It had thousands of suspicious customers, responsible for €200bn (£180bn) of transactions over a nine-year period. The realisation is dawning that what has been uncovered is probably the largest ever money-laundering scandal in history.

“Europe has a major money-laundering problem,” said anti-corruption expert Nienke Palstra, at campaign group Global Witness. “Until we see senior executives held fully accountable for criminal wrongdoing and serious fines for the banks involved, this kind of scandal will continue for decades to come.”

Regulators and law enforcement agencies are slowly beginning to respond. Britain’s National Crime Agency (NCA) has confirmed it is investigating an anonymous corporate vehicle linked to the scandal. For the moment, this is a civil, not a criminal case, which means no individuals will be prosecuted.

The US is taking an interest. The justice department, the treasury department and the Securities and Exchange Commission, which regulates US stock markets, are reportedly involved.

Denmark’s regulator, the Financial Supervisory Authority, has reopened an investigation that it had closed in May. Its first inquiry resulted in a reprimand, but no fine. Now the authority will look at whether management should face legal action. Its head, Jesper Berg, told the Financial Times: “It’s easy to understand that there’s a lot of public uproar. It’s a continuation of the financial crisis. There’s this sense of unmet consequences for the financial sector.”

Before being rewarded with the top job, Borgen had been responsible for Estonia as Danske’s head of international operations from 2009-12. The chief executive, in his resignation statement, said the report concluded he had “lived up” to his legal obligations. There are concerns, however, that the person at the helm during a catastrophic failure of the bank’s internal controls is not leaving immediately. Borgen is being retained until a replacement is found and, as part of his contract, he is entitled to collect a year’s pay.

Many questions remain unanswered. Even as the number of law enforcement agencies trying to tackle the Danske problem grows, doubts are mounting about their ability to bring prosecutions. Money laundering is a transnational crime. The Danske scandal involves 32 currencies, companies from Cyprus, the British Virgin Islands and the Seychelles. Customers of the Estonian branch have been traced to Russia, Azerbaijan and Ukraine.

One scheme run through the branch reportedly involved Azerbaijan’s ruling elite, and a $2.9bn (£2.2bn) fund used to pay European politicians and lobbyists.

“Money laundering is a globalised industry and if you operate on a domestic basis you might as well not bother,” said Tom Keatinge, the director of the centre for financial crime and security studies at the Royal United Services Institute. A former investment banker, Keatinge worked at JP Morgan for 20 years before turning his attention to combating fraud. “The borders are immaterial to you when you are structuring these transactions, whereas the borders are not immaterial for the cops who are trying to chase you.”

Last week, the European commission put forward proposals to create the EU’s first genuine cross-border anti-money laundering force. The European Banking Authority will see its relevant investigations team increased from two people to 10, and the agency is to be handed the power to intervene where it believes national regulators are failing. But its mandate is limited to taking action against banks – it cannot prosecute their criminal customers.

Neither this week’s 87-page report, produced for Danske by an independent law firm, Bruun and Hjejle, nor a 19-page memorandum by the Danish FSA outlining Danske’s failings in May, have confirmed the names of any of the bank’s suspicious clients. Five years after staff in Estonia began raising the alarm, the only revelations in this area have come from investigative reporters.

The Bruun and Hjejle report makes a glancing reference to the most eye-catching name: the Putin family. It confirms that in December 2013, a whistleblower’s account was sent to a member of Danske’s executive board. The whistleblower named a UK registered company with an account at Danske whose beneficial owners were suspected to include “the Putin family and the FSB”.

Bruun and Hjejle referenced reporting by the Danish newspaper Berlingske, which last year named Igor Putin, a businessman and cousin of the Russian president, and a number of his associates, as the individuals suspected by Danske staff of having transacted money through its Estonian accounts. Putin did not respond to a request for comment from Berlingske.

The transactions centred on a UK-registered company called Lantana Trade LLP. England’s limited liability partnerships are notoriously popular for money laundering, because the information they are obliged to disclose is minimal. Companies House lists 50,000 active LLPs.

Lantana had filed accounts claiming to be dormant, according to the Danish FSA report from May. But Danske staff noticed in the summer of 2012 that it had an extensive history of transactions and a credit balance of nearly $1m. The alarm was raised with managers, but instead of closing the account, they allowed Lantana to remain a client until September 2013.

The NCA will not name the company it is investigating. The only detail given is that it is an LLP. In a statement, the agency did acknowledge the role often played by English companies in illegal schemes. “The threat posed by the use of UK company structures as a route for money laundering is widely recognised and the NCA is working with partners across government to restrict the ability of criminals to use them in this way.”

The government says it is considering how to bolster the ability of the Companies House team to check the information provided by entities on its register. But for Keatinge, information gathering is not enough. “We know that supervision doesn’t get the bad guys,” he said. “It’s investigation that gets the bad guys.”