By the end of 2025, the EPPO was handling 518 active cases related to the NextGenerationEU, out of which 512 stemmed from the Recovery and Resilience Facility (RRF), corresponding to approximately 21% of all active expenditure fraud investigations. In these 518 active cases, 1419 offences were under investigation involving altogether 1993 suspects.
The estimated damage to the EU’s financial interests amounts to €5.08 billion, out of which €2.63 billion relate to active cases in the field of procurement fraud. The total damage corresponds to 14% of the overall estimated damage for expenditure fraud.
Considering the level of maturity achieved in the investigations handled by the EPPO, the number of cases in the court phase has significantly increased. A total of 95 cases, involving 403 suspects, are in the court proceedings phase. Nine cases have reached a final court decision concerning 18 defendants, and, in three cases, the simplified prosecution procedure was applied regarding six defendants. In 2025, the EPPO opened 293 new investigations. All but one of the new cases related to the RRF. This represents a sharp increase compared to 2024 (145 investigations were opened).
National law enforcement authorities remain the main source of reporting, with 86% of the new investigations opened based on their information. New investigations opened based on reports from private parties have increased from 6% to 12%, while 1% of the reports are from EU institutions, bodies, offices and agencies (IBOAs). Only three reports from IBOAs led to the opening of an investigation in 2025. The EPPO also opened four investigations ex officio.
The EPPO’s investigations into fraud affecting the RRF continue to highlight the disparities across Member States, reflecting variations in the allocation of funds, crime detection capabilities, and the prevalence of fraud schemes.
For the first time, investigations in the field of the NextGenerationEU were opened in Belgium, Cyprus and Latvia. Fraudulent activities were concentrated in projects regarding green transition and digital transformation. These areas represent the largest share of NextGenerationEU allocations during the reporting period, with substantial investments directed towards renewable energy, sustainable mobility, energy efficiency, healthcare and the deployment of advanced digital structures. Other affected areas continue to be company competitiveness, public infrastructure and public transport, innovation, training and formation, education and research, health and medical equipment, and public administration.
The most common form of fraud in the RRF involves the provision of false, incomplete, or misleading information to obtain funds unlawfully. Frequently, this includes the falsification of invoices and contracts, often combined with the submission of fraudulent statements or documents to hide disqualifying criteria.
Out of 518 active cases in the field of NextGenerationEU, 97 involved the investigation of a procurement procedure, and 421 dealt with non-procurement types of fraud. The damage in procurement investigations continued to be higher than that in non-procurement cases.
In some non-procurement fraud investigations in 2025, financial incentives were granted to start-ups or spin-offs to develop artificial intelligence (AI), blockchain, or robotic process-automation solutions. During the project execution, false invoices were submitted for IT consultancy services, and documents regarding rental agreements and wages for staff allegedly working on AI products were falsified.
In the healthcare sector, RRF funds were misused through unlawful prescribing and reimbursement practices for medical devices and consumables, including the provision of equipment without valid prescriptions.
Subsidy applications for the installation of photovoltaic panels on building roofs and building insulation works, as part of the green transition, were often targeted. In one specific investigation, satellite images and onsite verification revealed that the panels had already been installed prior to the submission of the RRF application. Tax-credit abuse was also identified, where companies claimed fictitious tax credits for ‘employees training costs’, but the training sessions were never conducted.
Large-scale green infrastructure projects revealed a pattern of circumvention of environmental administrative safeguards and the absence of mandatory environmental authorisations and permits, illustrated by specific cases. Procurement fraud continued to have a significant impact on the NextGenerationEU. The observed patterns included rigged tenders in renewable energy infrastructure, such as restrictive specifications for photovoltaic installation and renewable energy production, demonstrating a particular model effectively excluding other suppliers and undermining the competition. A conflict of interest arising from family or corporate linkages was identified in some cases. One investigation showed that the contracting authority, a public body, was under the control of one brother, while the awarded company was owned and managed by another brother through a chain of corporate entities. Such structures raised serious concerns regarding undue influence and a lack of impartiality in the contractor selection process. Public procurement fraud was also identified in sustainable transport projects, where, in one case, a contracting authority purchased electric minibuses at grossly inflated prices by imposing restrictive technical specifications that limited competition, causing damage to the EU budget.
The damage caused by corruption and misappropriation in active NextGenerationEU cases is estimated at €2.05 billion. Public officials have allegedly demanded and received payments from contractors in exchange for manipulating procurement procedures and favouring certain companies. One investigation revealed that a major enterprise, with close links to the awarding authority, was allegedly unduly favoured during the procurement process in exchange of bribes.
As the NextGenerationEU programs approach their conclusion, by December 2026, Member States must complete all milestones and targets in their plans and submit all final payment requests. However, until the end of 2025, roughly 50% of the funds have been disbursed. Due to the high volume of disbursements expected, the broad scope of projects, and the concentration of activities toward the end of the programming period, the risk environment remains attractive for fraud and corruption.
The perception of threats posed by organised crime groups to our society is changing. The traditional view of organised crime groups as essentially ‘profit-driven’, and a danger to public safety only when violence is involved, is giving way to the perception of the danger they represent for our democratic governance, as well as of their ability to destabilise our society.
Through its investigations and prosecutions, the EPPO enables an accurate and comprehensive understanding of the current complexities and dynamics of organised crime groups in Europe.
The core business of the organised crime groups under investigation by the EPPO is related to sophisticated and large-scale fraudulent schemes affecting EU revenue. Investigations into the offence of participation in a criminal organisation account for 22.23% of the total estimated damage in all ongoing EPPO cases. Within this share, revenue fraud is by far the main area of activity, representing approximately 86.66% of the estimated damage in organised crime cases.
EPPO’s investigations demonstrate that criminal enterprises operating in the field of VAT and customs fraud achieve very high profits while facing relatively low risks. This explains why conventional criminal activities focusing on illegal goods (counterfeited goods, currency counterfeiting, drugs, substandard goods, weapons, etc.), or on criminal exploitation of vulnerable people (exploitation of labour, prostitution, human trafficking) are increasingly combined with, or even replaced by, criminal activities related to the trading of legal goods, carried out using criminal modalities that cause massive damage to the financial interests of both the EU and its Member States. These activities remain difficult to detect from a purely national perspective.
Moreover, they have a detrimental impact on the legal economy in certain sectors, in which the influence of organised crime groups has outgrown mere infiltration. Honest economic operators are suffocated by unfair competition from actors connected to the criminal networks.
While numerous criminal organisations in Europe continue to be active on intra-EU VAT fraud, with schemes based on carousel circuits and missing-trader companies, the EPPO has recently observed an alarmingly high level of fraud orchestrated by large-scale organised crime groups, related to the import and sale of goods originating outside the EU.
The inherently cross-border nature of these types of fraud, including the extra-EU dimension, and the high level of specialisation required to manage these activities force organised crime groups to continuously develop and adapt new ways of collaborating with one another.
When it comes to goods entering the EU from China, in particular, criminal networks composed of individuals of Chinese origin have taken control of almost the entire fraudulent chain. They exploit the supply chain from China, use underground banking systems to steer financial flows, and maintain elaborate operational structures within the EU to manage all the phases of their criminal activity. These criminal networks are heavily present in major commercial ports and terminals in Europe, where they seek to control custom clearance procedures. They are connected to extensive networks of sham or buffer companies across the Member States, which they use to conceal the real destination of goods and to evade VAT payments. They also exploit the large Chinese diaspora in the EU, especially when working in the so-called Chinese commercial districts, significant hubs for trade and logistics. These organised crime groups control market distribution either through traditional cash-generating shops and malls or via the relocation of goods to e-commerce platforms.
Corruption and violence are frequently used, as demonstrated by recent EPPO investigations and reported by several Member States.
This criminal environment also creates conditions for highly effective and convenient money laundering schemes. EPPO’s investigations have confirmed that proceeds from certain crimes are laundered into these criminal undertakings and then reinvested into additional criminal activities.
The EPPO has also identified schemes where underground banking systems are run by professionals and used by criminal networks to launder and reinvest proceeds from any kind of criminal activities, linking different criminal organisations in unexpected ways. In this context, the role of Chinese criminal networks and underground banking in supporting other organised crime groups is well established, both in facilitating financial flows for criminal activities, and for laundering purposes.
In short: customs and VAT fraud, with its central role in money laundering schemes and the heavy influence of Chinese criminal networks in this respect, are reshaping the criminal ecosystem in the EU.
Organised crime groups are also involved in criminal activities affecting EU expenditure. The EPPO has investigated several cases in which criminal organisations carried out large-scale frauds to obtain public funding, including funds related to the NextGenerationEU. These criminal organisations demonstrated the ability not only to manage and control numerous economic subjects, figureheads, and professionals, but also to infiltrate and corrupt public administrations.
Even when fraud is limited to a single country, criminal networks have created structures in other countries to conceal their criminal patterns and launder proceeds. In some cases, they have reproduced the same fraudulent schemes across multiple Member States, underlining this way the ever-present international dimension of organised crime.
