Illustrative firm examples
Finland country research brief
Research dated 2026-10-10 · Reviewed 2026-10-09
Version 076045882935
076045882935e16294cce7758a7ef38aab7424cbf39bb462cd5086690f71e0c2Scope: Illustrative firm examples. The selector is not an authorisation or legal-applicability determination. Source-check observations concern retrieval/access only and do not establish legal currentness; the research date is the content date boundary. Source health: review-required, checked 2026-10-12T05:25:56.072Z.
Framework and authorities
Anti-money laundering and supervision
The Finnish Act on Preventing Money Laundering and Terrorist Financing (444/2017) applies to defined obliged entities and activities, not every company. The retained Finlex consolidation is dated 4 September 2026 and incorporates Act 818/2026, effective 1 October, changing remote identification in chapter 3, section 11, point 3. That topic is not mapped here. The National Bureau of Investigation's Financial Intelligence Unit receives and analyses suspicious-transaction reports. Supervisors depend on statutory sector and activity; this is not a complete supervisor map. Guidance and risk assessments are not duties in themselves.
Risk, FATF and sanctions context
Dated national and FATF evidence
The Ministry of Finance's 2026 national risk assessment rates money-laundering risk significant and terrorist-financing risk moderately significant; these are national, not firm/customer, categories. It highlights cross-border criminal proceeds, registered/unregistered hawala-style transfers, underground banking, crypto/digital services, and information-sharing, expertise and resource vulnerabilities. Its sanctions-offence discussion, much Russia-related, is not a proliferation-financing rating; no separate current Finnish proliferation-financing assessment was located in retained sources. Government Proposal HE 105/2026 reports Finland left Financial Action Task Force (FATF) enhanced follow-up in October 2023 after correcting most identified technical deficiencies; fifth-round assessment is scheduled for 2027-2028. This is dated monitoring history, not a new FATF assessment or technical/effectiveness rating.
Sanctions and cross-border nexus
Finnish Acts 659/1967 and 325/2013 address obligations as a European Union (EU) and United Nations member and administrative asset-freezing to combat terrorism. EU measures apply under each regulation's own persons, territory, ownership/control, prohibition, exemption, licence and reporting terms. No live list or designation was checked. United Kingdom and United States measures are conditional: assess each regime's person, territory, transaction or other jurisdictional nexus. A Finnish presence or cross-border customer alone is not asserted to create it.
Selected firm implications
Meaning: An obliged entity identifies/verifies at permanent customer-relationship start. Occasional triggers: transaction(s) at least EUR 10,000 (linked amounts aggregate); Funds Transfer Regulation transfer over EUR 1,000; crypto-asset service transaction over EUR 1,000; or cash goods-sale at least EUR 10,000 (linked cash aggregates). Suspicion or prior-identity doubt triggers at any value. Gambling: at stake, payout or both, a single or linked payment total reaches EUR 2,000. Verify when the specified threshold is reached, before customer control of assets or transaction completion; verify an agent and authority. At a new covered legal-entity/foreign express-trust relationship, check beneficial-owner registration.
Conditions: Obliged entities; only the stated transaction categories.
Exceptions: Chapter 3 section 9 permits identification/verification relief only for low-risk e-money satisfying all product, value, domestic-use, funding and monitoring conditions and cash/remote-payment limits; not a blanket exemption.
Suggested action: Verify identity when the applicable trigger occurs.
Legislation / Binding · Chapter 3, section 2Meaning: Only for transfers to/from unhosted addresses, a crypto-asset service provider must assess money-laundering/terrorist-financing risk, maintain policies/procedures/controls and apply at least one: risk-based identification/verification of originator, beneficiary or beneficial owner (including via third parties); extra origin/destination data; enhanced ongoing monitoring; or other measures mitigating those risks and targeted-sanctions non-implementation/evasion, including proliferation-financing sanctions.
Conditions: Provider's transfers to/from unhosted addresses only.
Suggested action: Apply controls to the covered unhosted-address transfer.
Legislation / Binding · Chapter 3, section 12aNotices and limitations
- Illustrative bank, payments and crypto examples, not an assessed firm profile.
- Product/customer exposure alone is not statutory applicability. This is not a licensing guide.
- Local entity / domestic activity selected.
- 2 representative obligations; see the full register for other duties.
- Source observations are unavailable, stale, failed or review-required. This dated brief does not confirm today's legal position.
- AML Act consolidation dated 4 Sep 2026; Act 818 remote-identification change effective 1 Oct.
- FATF 2023 follow-up original blocked; no specific/latest ratings. Separate current proliferation-financing assessment not located.
- National risk evidence: 2026 money-laundering/terrorist-financing assessment, not firm scores.
- Sanctions Acts 659/1967 and 325/2013 editions dated 2025/2017; later amendments and live designations unchecked.
- Selected provisions, not complete authority/perimeter coverage. Profiles are examples. No reuse rights; paraphrase, not advice.
Evidence sources
Original source documents are not reproduced in this brief. Retained originals are private research evidence; use the official-source links.
- Official Legislation Original · Finlex / Ministry of Justice · Finlex Finnish consolidation dated 2026-09-04; live page retrieved 2026-10-09 · Ch. 3 sections 2, 9, 12a; ch. 6 sections 1-2
- Official Legislation Original · Finlex / Ministry of Justice · Promulgated 2026-09-04; published 2026-09-10; effective 2026-10-01 · AML Act chapter 3, section 11, point 3; effective 1 October 2026
- Official Legislation Original · Finlex / Ministry of Justice · Finnish consolidation, ELI date 2025-05-23 · §2: FIU tasks include receiving and analysing suspicious-transaction reports
- Official Government Proposal · Finnish Government / Finlex · Official government proposal 105/2026; full HTML retrieved 2026-10-09 · FATF history: exit Oct 2023; fifth-round assessment 2027-2028
- Official National Risk Assessment · Ministry of Finance; National Bureau of Investigation Financial Intelligence Unit · Finnish original, Ministry of Finance publications 2026:22; published 2026-05-28, 366 pages · Printed pp. 12, 16-17, 324 (PDF pp. 13, 17-18, 325): national ML/TF categories, scale/Table 1 and sanctions offences/Table 20
- Official Legislation Original · Finlex / Ministry of Justice · Finnish consolidation, ELI date 2025-04-25 · Domestic implementation/enforcement framework for UN/EU obligations
- Official Legislation Original · Finlex / Ministry of Justice · Finnish consolidation, ELI date 2017-06-28 · Domestic administrative asset-freeze framework for terrorism
- Official Sanctions Guidance · European Commission · Commission page captured 2026-10-09 · Where EU sanctions apply; scope under each instrument
- Official Sanctions Guidance · HM Treasury, Office of Financial Sanctions Implementation · Guidance updated 2026-05-12; captured 2026-10-09 · Sections 1-2: territorial/person scope; section 4 ownership/control
- Official Sanctions Guidance · U.S. Treasury, Office of Foreign Assets Control · FAQ 11 updated 2024-08-21; page captured 2026-10-09 · FAQ 11: U.S.-person/territorial scope; do not infer automatic Finland nexus
AML Act 444/2017, Finlex 4 Sep 2026
Finlex Finnish consolidation dated 2026-09-04; live page retrieved 2026-10-09 · Ch. 3 sections 2, 9, 12a; ch. 6 sections 1-2
Source record
Retrieved 2026-10-09T23:02:33Z. SHA-256: cee5fc0710699234f75b18ba0b3c35df5289c31a7f9a4d2fbd6644ab628c7bd9
Source retrieval check
observed · Checked 2026-10-12T05:25:46.955Z
A retrieval check is an access observation only; it does not establish legal currentness. Research content date boundary: 2026-10-10.
This brief relies on the identified official source edition. Open it using the official-source control.
Act 818/2026, effective 1 Oct 2026
Promulgated 2026-09-04; published 2026-09-10; effective 2026-10-01 · AML Act chapter 3, section 11, point 3; effective 1 October 2026
Source record
Retrieved 2026-10-09T23:02:37Z. SHA-256: 2a37364cb70fbec670791aa41e9842c9a95ca9c00024bb3263fd53fa20c86f0c
Source retrieval check
observed · Checked 2026-10-12T05:25:48.467Z
A retrieval check is an access observation only; it does not establish legal currentness. Research content date boundary: 2026-10-10.
This brief relies on the identified official source edition. Open it using the official-source control.
FIU Act 445/2017, 23 May 2025
Finnish consolidation, ELI date 2025-05-23 · §2: FIU tasks include receiving and analysing suspicious-transaction reports
Source record
Retrieved 2026-09-10T20:37:08.004Z. SHA-256: dd367e8b2263fbadb4f9bdf24f81b04fd30544767dd3382b5682ab8c52e8257f
Source retrieval check
review-required · Checked 2026-10-12T05:25:49.160Z
A retrieval check is an access observation only; it does not establish legal currentness. Research content date boundary: 2026-10-10.
This brief relies on the identified official source edition. Open it using the official-source control.
HE 105/2026, FATF monitoring context
Official government proposal 105/2026; full HTML retrieved 2026-10-09 · FATF history: exit Oct 2023; fifth-round assessment 2027-2028
Source record
Retrieved 2026-10-09T23:02:43Z. SHA-256: eade792d119e577de6042553422cacfbd32f3d11567b9d47b11559edd23055eb
Source retrieval check
observed · Checked 2026-10-12T05:25:49.949Z
A retrieval check is an access observation only; it does not establish legal currentness. Research content date boundary: 2026-10-10.
This brief relies on the identified official source edition. Open it using the official-source control.
NRA 2026, Ministry of Finance 2026:22
Finnish original, Ministry of Finance publications 2026:22; published 2026-05-28, 366 pages · Printed pp. 12, 16-17, 324 (PDF pp. 13, 17-18, 325): national ML/TF categories, scale/Table 1 and sanctions offences/Table 20
Source record
Retrieved 2026-10-09T23:02:27Z. SHA-256: 13a8c00abb190b3407458d1c00eaeca2ea064e9cd6fc997f849d25f9e6a775db
Source retrieval check
observed · Checked 2026-10-12T05:25:51.519Z
A retrieval check is an access observation only; it does not establish legal currentness. Research content date boundary: 2026-10-10.
This brief relies on the identified official source edition. Open it using the official-source control.
Act 659/1967, 25 Apr 2025
Finnish consolidation, ELI date 2025-04-25 · Domestic implementation/enforcement framework for UN/EU obligations
Source record
Retrieved 2026-09-10T20:40:27.565Z. SHA-256: 983fc0cd71245b2eb00447608cca0639c67c21e2af96c2b3cd019cdbac18dd57
Source retrieval check
review-required · Checked 2026-10-12T05:25:52.650Z
A retrieval check is an access observation only; it does not establish legal currentness. Research content date boundary: 2026-10-10.
This brief relies on the identified official source edition. Open it using the official-source control.
Act 325/2013, 28 Jun 2017
Finnish consolidation, ELI date 2017-06-28 · Domestic administrative asset-freeze framework for terrorism
Source record
Retrieved 2026-09-10T20:40:27.706Z. SHA-256: 85dbcc17b70e5adb635931242759f9016b50dfaa642173e1a08d6da14c1820aa
Source retrieval check
review-required · Checked 2026-10-12T05:25:53.423Z
A retrieval check is an access observation only; it does not establish legal currentness. Research content date boundary: 2026-10-10.
This brief relies on the identified official source edition. Open it using the official-source control.
EU sanctions overview, 9 Oct 2026
Commission page captured 2026-10-09 · Where EU sanctions apply; scope under each instrument
Source record
Retrieved 2026-10-09T19:54:30Z. SHA-256: 84d90e3b6d3d7ca27c33d98783660ea6e86c7f837a8006418763b4e96dab98c4
Source retrieval check
observed · Checked 2026-10-12T05:25:54.182Z
A retrieval check is an access observation only; it does not establish legal currentness. Research content date boundary: 2026-10-10.
This brief relies on the identified official source edition. Open it using the official-source control.
UK OFSI scope, 12 May 2026
Guidance updated 2026-05-12; captured 2026-10-09 · Sections 1-2: territorial/person scope; section 4 ownership/control
Source record
Retrieved 2026-10-09T20:24:30.136Z. SHA-256: 254c2891db0f511d40d8bf862d92954c08469ae8c7f720dbd9b613b551e9c230
Source retrieval check
review-required · Checked 2026-10-12T05:25:55.065Z
A retrieval check is an access observation only; it does not establish legal currentness. Research content date boundary: 2026-10-10.
This brief relies on the identified official source edition. Open it using the official-source control.
OFAC FAQ 11, 21 Aug 2024
FAQ 11 updated 2024-08-21; page captured 2026-10-09 · FAQ 11: U.S.-person/territorial scope; do not infer automatic Finland nexus
Source record
Retrieved 2026-10-09T19:54:40Z. SHA-256: 92cfe8932dd817a5c2371d265ae1ecbaf62970f798c0d5c6ab77fd96897e0e99
Source retrieval check
review-required · Checked 2026-10-12T05:25:56.072Z
A retrieval check is an access observation only; it does not establish legal currentness. Research content date boundary: 2026-10-10.
This brief relies on the identified official source edition. Open it using the official-source control.
Retail bank
Meaning
An obliged entity identifies/verifies at permanent customer-relationship start. Occasional triggers: transaction(s) at least EUR 10,000 (linked amounts aggregate); Funds Transfer Regulation transfer over EUR 1,000; crypto-asset service transaction over EUR 1,000; or cash goods-sale at least EUR 10,000 (linked cash aggregates). Suspicion or prior-identity doubt triggers at any value. Gambling: at stake, payout or both, a single or linked payment total reaches EUR 2,000. Verify when the specified threshold is reached, before customer control of assets or transaction completion; verify an agent and authority. At a new covered legal-entity/foreign express-trust relationship, check beneficial-owner registration.
Full public provision explanation
An obliged entity may not hold anonymous or fictitious-name accounts or customer relationships (except the narrow exceptions this section itself provides), and must identify the customer and verify identity when establishing a permanent customer relationship, and also for occasional customers where the transaction (or linked transactions) totals at least EUR 10,000, or is a transfer of funds under the Funds Transfer Regulation exceeding EUR 1,000, or a crypto-asset service transaction exceeding EUR 1,000; in the sale of goods where an occasional customer's transaction (or linked transactions) in cash totals at least EUR 10,000; for suspicious transactions; and where the entity doubts previously-verified identity data. For gambling, identification/verification is required at stake or payout (or both) once EUR 2,000 is reached in linked stakes/winnings. Where someone acts on the customer's behalf (an agent), that person's identity and authority must also be verified. Identification/verification must occur at relationship formation or, at the latest, before the customer gains control of the transaction's assets or the transaction is completed; for new relationships with entities/foreign express trusts covered by chapter 6, the entity must confirm the beneficial owner is entered in the relevant register.
Suggested action
Verify identity when the applicable trigger occurs.
Conditions
Obliged entities; only the stated transaction categories.
- Mandatory on establishing a permanent relationship; threshold-triggered for occasional customers.
Exceptions
Chapter 3 section 9 permits identification/verification relief only for low-risk e-money satisfying all product, value, domestic-use, funding and monitoring conditions and cash/remote-payment limits; not a blanket exemption.
Crypto and digital assets
Meaning
Only for transfers to/from unhosted addresses, a crypto-asset service provider must assess money-laundering/terrorist-financing risk, maintain policies/procedures/controls and apply at least one: risk-based identification/verification of originator, beneficiary or beneficial owner (including via third parties); extra origin/destination data; enhanced ongoing monitoring; or other measures mitigating those risks and targeted-sanctions non-implementation/evasion, including proliferation-financing sanctions.
Full public provision explanation
Crypto-asset service providers must identify and assess the money-laundering/terrorist-financing risk of transfers to or from unhosted addresses, maintain internal policies/procedures/controls for this, and apply at least one of four enhanced measures: risk-based identification/verification of the originator/beneficiary or their beneficial owner (including via third parties), requiring extra data on the origin/destination of the crypto-assets, enhanced ongoing monitoring of the transactions, or other measures that mitigate money-laundering/terrorist-financing risk and the risk of circumventing targeted financial sanctions (including proliferation-financing sanctions).
Suggested action
Apply controls to the covered unhosted-address transfer.
Conditions
Provider's transfers to/from unhosted addresses only.
- Transfers to or from an unhosted (self-custodied) crypto-asset address.