This explanation is a bit too far fetched. The effort to move the bank to their own banking system is on itself a tremendous effort. We're talking calendar yea

This explanation is a bit too far fetched. The effort to move the bank to their own banking system is on itself a tremendous effort. We're talking calendar years of implementation time, huge risks and a stall of most other development. The leadership knows that their banking systems are a pile of bleeding horse dung that they wish to avoid touching at any cost. They are not kindergartners, but they are not omnipotent either. Knowing that the Estonian bank had improper processes would by itself require a lot of work to discover, and figuring out if this has been abused would likely be quite a massive task. Doing the move to the new business logic would reveal the issue, but not before it was done. Never attribute to malice what can be sufficiently explained by incompetence. What we see here can be explained with just a little bit of incompetence, or an extreme amount of malice. The former is far more likely.