(Reuters) - Danske Bank DANSKE.CO is embroiled in a money laundering scandal that has triggered criminal investigations, forced out its CEO and chairman and rattled investors in Denmark's largest bank.

An internal investigation, published in September, charted how 200 billion euro (177.70 billion pounds) flowed through Danske Bank’s tiny Estonian branch from clients registered or incorporated in countries including Russia and Britain between 2007 and 2015.

Danske Bank said many of the payments were suspicious.

The following timeline summarises developments, some of which were highlighted in an 87-page report by Danish law firm Bruun & Hjejle, which led Danske Bank’s internal investigation into the allegations.

Nov. 19: Whistleblower Howard Wilkinson testifies at Danish parliament.

Nov. 11: Danske’s chairman Ole Andersen and chairman of audit committee, Jørn Jensen, say they will step down, under pressure from the bank’s biggest shareholder A.P. Moller Holding. A.P Moller calls for the CEO of the Confederation of Danish Industry, Karsten Dybvad, to succeed Andersen. Danske continues its search for a permanent CEO. [L8N1XH5JB]

Oct. 17: Denmark’s regulator, the Financial Supervisory Authority (FSA), rejects Danske’s chosen successor to departed CEO Thomas Borgen as too inexperienced.

Oct. 4: Danske says the U.S. Department of Justice has launched a criminal investigation into its Estonian branch, which could lead to a crippling fine. Many non-resident accounts were held by entities or individuals in Russia, which is the subject of U.S. sanctions.

Sept. 26: Danish newspaper Berlingske names Briton Wilkinson as the whistleblower who helped reveal the scandal. In an email to the paper, Wilkinson confirms his role.

Sept. 19: Danske publishes the Bruun & Hjejle report, revealing that payments totalling 200 billion euros had flowed through its Estonian branch between 2007-2015, many of which it says were suspicious. Borgen, who was in charge of Danske Bank’s international operations, including Estonia, between 2009 and 2012, resigns. The report said he had not breached his legal obligations.

Jesper Nielsen, the head of Danske’s domestic banking business, is appointed interim CEO around two weeks later.

July-August: Estonian and Danish prosecutors launch criminal investigations in the wake of a complaint by Bill Browder, the chief of asset manager Hermitage Capital. Once the biggest foreign money manager in Russia, Browder has led a vocal campaign against the Kremlin.

May 3: Denmark’s FSA criticises Danske’s handling of the Estonian crisis and orders it to reassess its solvency needs, strengthen governance and review management in Estonia. It stops short of action against anyone under its fit and proper rules.

Dec. 2017: Danske fined 12.5 million Danish crowns (1.5 million pounds) by a Danish public prosecutor for violating anti-money laundering rules.

Sept. 21, 2017: Danske says it has “major deficiencies in controls and governance that made it possible to use Danske Bank’s branch in Estonia for criminal activities such as money laundering”. Follows a report prepared by US-based consultancy Promontory Financial Group. The bank expands an investigation into its Estonian branch.

March 2016: Denmark’s financial regulator says it has reported Danske to the police for breaching anti money laundering rules and censures it for not having identified and reduced “significant money laundering risks” in its Estonian branch.

End-2015: Danske shuts the bulk of its non-resident portfolio in Estonia. From 2007-2015, there were around 10,000 customers in total in the portfolio, the Bruun & Hjejle report said.

Feb. 3-6, 2014: The bank conducts an on-site audit in Estonia. In draft conclusions sent by email on Feb 5, 2014, it says: “we cannot identify actual source of funds or beneficial owners”, the law firm’s report said.

The report adds that a branch employee had “confirmed verbally ... that the reason underlying beneficial owners are not identified is that it could cause problems for clients if Russian authorities request information.”

Dec. 27, 2013: A whistleblower, working at Danske’s Estonian branch, emails a first report, entitled “Whistleblower disclosure - knowingly dealing with criminals in Estonia Branch”, the Bruun & Hjejle report says.

It was sent to managers on the bank’s executive board, at group compliance & anti money laundering and in internal audit.

The whistleblower said the accounts of a customer at the Estonian branch were closed in Sept. 2013. “Apparently it was discovered that they included the Putin family and the FSB (Russian Federal Security Service),” the law firm quoted the whistleblower as saying in the email.

The Kremlin had not replied to repeated requests for comment about the allegations from Reuters.

The whistleblower reports more customers with “similar irregularities” to Danske’s group internal audit department between Jan. and April 2014, the law firm’s report says.

2013: A correspondent bank stops clearing dollar transactions out of Danske’s Estonian branch because of money laundering concerns, Bruun & Hjejle report says.

Aug. 2008: Danske abandons a costly plan to migrate its Baltic banking activities onto the group IT platform. As a result, the Estonian branch does not use the anti-money laundering procedures, transaction and risk monitoring developed at group level, the Bruun & Hjejle report said.

June 8, 2007: The Russian Central Bank writes to the Danish financial regulator, voicing concerns that clients of newly-acquired Sampo Bank “permanently participate in financial transactions of doubtful origin” estimated at “billions of rubles monthly”, the Bruun & Hjejle report says.

The letter is forwarded to Danske’s executive board and board of directors. The Estonian regulator also issues a critical inspection report, the law firm says.

Nov. 2006: Danske buys Sampo Bank, Finland’s third-largest bank, which has businesses in countries such as Estonia, Latvia and Lithuania. The acquisition is completed in Feb. 2007.