On 26 June 2026, Europol published its second in-depth assessment of the EU’s most threatening criminal networks (MTCNs), entitled “Decoding the EU’s most threatening criminal networks: Issue 2 – The blueprint of criminal opportunism”.

The report provides a Europe-wide law enforcement perspective on how MTCNs are organised, the criminal activities they pursue, and how and where they operate. It also examines the characteristics that make them particularly threatening to the EU’s internal security, updating the findings of the first edition published in 2024 (→ eucrim 1/2024, pp. 31–32). The first assessment identified four recurring characteristics: MTCNs are agile, borderless, controlling, and destructive (ABCD).

The current assessment confirms the continued relevance of this framework while highlighting significant changes in the criminal landscape:

• While 821 MTCNs were identified in the 2024 assessment, 76% of these networks are no longer reflected in the current list, potentially due to law enforcement disruption, dissolution, restructuring, transformation, or changes in assessed threat level;
• 198 MTCNs identified in 2024 are still among today’s networks, demonstrating their resilience and ability to adapt and reorganise;
• 533 new MTCNs have been identified;
• 731 MTCNs across the EU now constitute the current total.

The 731 MTCNs continue to display a consistent threat profile. They are primarily profit-driven, with cohesion supported by trust, regional connections, and opportunism, and they operate across the full spectrum of serious and organised crime: drug trafficking, cybercrime, migrant smuggling, trafficking in human beings, fraud, property crime, and money laundering. Some have links to terrorism. Crime-as-a-service, particularly in financial services, further strengthens this model by allowing specialised actors to provide services to a broad criminal clientele and lowering barriers to entry. The scale and reach of the MTCNs are reflected in the following figures:

• 85% of the criminal networks use legal business structures;
• Over 400,000 members, representing 118 nationalities, are involved in the networks;
• More than one-third are involved in drug trafficking;
• Less than one-quarter are poly-criminal.

A key new insight of the assessment is that MTCNs should not be understood as isolated entities, but as part of a fluid and interconnected criminal ecosystem. When law enforcement disrupts a network, other actors may emerge, activities may be relocated or transformed, and networks may restructure or cooperate with others. Shared criminal services, international contacts, specialised providers, and countermeasures enable the wider ecosystem to adapt and sustain criminal activity. This challenges traditional concepts of criminal networks based on fixed structures, permanence, and defined roles, as the ecosystem facilitates ad hoc alliances, needs-based cooperation, and the rapid exploitation of opportunities.

Against this background, Europol has identified several factors that enable criminal networks to resist disruption and re-emerge. These factors are part of what the report describes as a “blueprint of criminal opportunism”:

• Persistent and fluid nature of MTCNs;
• Flexible cooperation – if needed;
• Specialised service providers;
• Operational cells in multiple countries;
• Instrumental use of violence, intimidation, and corruption;
• Use of digital and technological opportunities;
• Exploiting of financial opportunities and systemic vulnerabilities;
• Blurred boundaries between legal and illegal activities.

Driven by profit, MTCNs systematically identify and exploit vulnerabilities in modern systems. Digitalisation, technological innovation, global trade, geopolitical instability, and the overlap between legal and illegal economies create new opportunities for criminal exploitation. MTCNs make use of online platforms, encrypted communication, and AI; open new markets and routes; exploit regulatory loopholes; and strategically use professions and businesses. Crime-as-a-service and the exploitation of vulnerable individuals further lower barriers to entry.

The combination of a fluid criminal ecosystem and this blueprint of criminal opportunism helps explain how organised crime can adapt to disruption, regenerate, and persist. MTCNs are increasingly interconnected and embedded in the legitimate economy and wider society, allowing them to exploit structural weaknesses while sustaining their activities despite continued law enforcement pressure.

The report concludes that targeting high-value actors and other forms of disruption remains essential, but is not sufficient. An effective response must combine targeted disruption with systemic action and address vulnerabilities in logistics, financial systems, digital infrastructure, and global trade. Europol therefore calls for complementary, collaborative, and by-design approaches involving law enforcement, other public authorities, and the private sector as follows:

• An administrative approach to prevent the exploitation of legal businesses and provisions;
• A preventive approach, including awareness campaigns and prevention initiatives;
• Greater use of innovation and technology in combating serious and organised crime;
• A data-oriented and intelligence-led approach, including lawful access to data and improved data-retention practices where appropriate;
• A financial approach, including strengthened asset tracing;
• A legal approach to close jurisdictional gaps and develop robust legislation where necessary;
• A collaborative approach bringing together law enforcement, public authorities, and the private sector, and including international cooperation.