The curated handbook for Sweden is in review. The obligation register below accounts for the retained units described in its scope statement.
143 retained records are accounted for within this scope. The default view shows only mapped obligations; use the disposition filter to inspect mapped, contextual, outside-scope and unresolved retained records. This register does not establish full-instrument or complete national coverage.
Lag (2017:630) om åtgärder mot penningtvätt och finansiering av terrorism
Swedish Parliament
Riksdag consolidated SFS HTML, amended through SFS 2026:1075
143 provisions accounted for · 125 independently reviewed
Rights and public reuse status not determined; analysis-only/private pending independent rights review.
Lag (2017:630) om åtgärder mot penningtvätt och finansiering av terrorism
Swedish Parliament
Riksdag consolidated SFS HTML, amended through SFS 2026:1075
SourceRights and public reuse status not determined; analysis-only/private pending independent rights review.
Download register PDFDownload register CSV
63 provisions match this filter
Original wording is not reproduced. Read the official source. This view contains RegCanary's reviewed analysis, not a copy of the source text.
The full translation is not reproduced. The plain-English explanation below is analysis, not a translation of the original wording.
Each operator within the Act’s statutory perimeter assesses the risks arising from its own products and services. The statute specifically names product/service type, customers, distribution channels, geography, information from its suspicious-activity reporting, typologies and relevant authority information. This is a business-wide assessment duty, not a prescribed customer score or document template.
Assess how the operator’s products and services could be used for money laundering or terrorist financing and how high that risk is, using the listed factors and relevant authority information.
Assess
Original wording is not reproduced. Read the official source. This view contains RegCanary's reviewed analysis, not a copy of the source text.
The full translation is not reproduced. The plain-English explanation below is analysis, not a translation of the original wording.
The business-wide assessment must be usable for control design and remain a current documented record. Its depth depends on the operator's size, activity and expected risk, rather than a universal template or fixed update interval.
Document and update a proportionate general risk assessment that supports the operator's controls.
Assess Retain records
Original wording is not reproduced. Read the official source. This view contains RegCanary's reviewed analysis, not a copy of the source text.
The full translation is not reproduced. The plain-English explanation below is analysis, not a translation of the original wording.
Customer risk must connect the firm's overall exposure with what it knows about this customer. The low/high-risk factors and other relevant circumstances feed the assessment when needed, and a continuing relationship requires follow-up and revision when warranted.
Determine, follow up and revise the customer risk profile on the statutory risk basis.
Assess
Original wording is not reproduced. Read the official source. This view contains RegCanary's reviewed analysis, not a copy of the source text.
The full translation is not reproduced. The plain-English explanation below is analysis, not a translation of the original wording.
The financial-activity subset numbered 1-13 cannot offer any of the three anonymous products. The prohibition concerns anonymity and the named provider subset, not every safe-deposit service or every non-financial operator.
Do not provide anonymous accounts, passbooks or safe-deposit boxes within the specified financial perimeter.
Prohibited action
Original wording is not reproduced. Read the official source. This view contains RegCanary's reviewed analysis, not a copy of the source text.
The full translation is not reproduced. The plain-English explanation below is analysis, not a translation of the original wording.
Financial operators in points 1-13 must avoid direct shell-bank correspondent links and indirect links through institutions that let shell banks use their accounts. Assess the statutory shell-bank definition as well as access through a correspondent institution.
Prevent direct and specified indirect correspondent relationships involving shell banks.
Prohibited action Verify
Original wording is not reproduced. Read the official source. This view contains RegCanary's reviewed analysis, not a copy of the source text.
The full translation is not reproduced. The plain-English explanation below is analysis, not a translation of the original wording.
Written controls must cover CDD, monitoring, reporting and data processing, and evolve as risk changes. The business-wide assessment drives their scope; keeping an unchanged policy merely because it exists does not meet the adaptation requirement.
Maintain documented, risk-responsive procedures for CDD, monitoring, reporting and data processing.
Retain records
Original wording is not reproduced. Read the official source. This view contains RegCanary's reviewed analysis, not a copy of the source text.
The full translation is not reproduced. The plain-English explanation below is analysis, not a translation of the original wording.
The ultimate parent operator sets group-wide controls. Data-processing and information-sharing procedures are minimum subjects, and sharing is directed to relevant group recipients when needed rather than unrestricted circulation.
Set group procedures covering personal data and necessary sharing of suspicious-activity and related information.
Original wording is not reproduced. Read the official source. This view contains RegCanary's reviewed analysis, not a copy of the source text.
The full translation is not reproduced. The plain-English explanation below is analysis, not a translation of the original wording.
The ultimate parent must make the common controls operate across the group. Establishing a group policy under the preceding rule is only part of this responsibility; actual group application is required here.
Ensure the group actually applies its common procedures and guidelines.
Original wording is not reproduced. Read the official source. This view contains RegCanary's reviewed analysis, not a copy of the source text.
The full translation is not reproduced. The plain-English explanation below is analysis, not a translation of the original wording.
A non-EEA subsidiary of the ultimate parent, or an operator's non-EEA branch, must apply the Swedish requirements where the local prevention rules are weaker. The comparison and home-state legal restrictions matter; the next section governs inability to comply.
Ensure the specified non-EEA subsidiaries and branches apply Swedish AML requirements when local rules are weaker.
Original wording is not reproduced. Read the official source. This view contains RegCanary's reviewed analysis, not a copy of the source text.
The full translation is not reproduced. The plain-English explanation below is analysis, not a translation of the original wording.
A conflict with non-EEA local law does not simply remove the group obligation. The affected parent or branch operator must manage the extra risk and notify its supervisor of the inability to meet the requirements.
Mitigate additional non-EEA group risk and notify the supervisor when local law prevents compliance.
Report
Original wording is not reproduced. Read the official source. This view contains RegCanary's reviewed analysis, not a copy of the source text.
The full translation is not reproduced. The plain-English explanation below is analysis, not a translation of the original wording.
Suitability procedures must cover the people performing AML-significant work, including contractors and comparable participants. The rule does not prescribe a universal employee document package or expressly cover roles without that significance.
Use suitability procedures for staff and other participants doing AML-significant work.
Verify
Original wording is not reproduced. Read the official source. This view contains RegCanary's reviewed analysis, not a copy of the source text.
The full translation is not reproduced. The plain-English explanation below is analysis, not a translation of the original wording.
People doing AML-significant tasks need continuing, relevant training linked to both the legal rules and the firm's own risks and controls. Detection information is a minimum training subject; the Act does not state one fixed timetable for all roles.
Provide continuing AML training and information covering rules, firm risks, procedures and suspicious-activity detection.
Train staff
Original wording is not reproduced. Read the official source. This view contains RegCanary's reviewed analysis, not a copy of the source text.
The full translation is not reproduced. The plain-English explanation below is analysis, not a translation of the original wording.
Protect people who perform the firm's AML duties against hostile consequences and avoid retaliation for internal or police reporting of suspected ML/TF. This combines protective procedures and necessary measures with a specific prohibition on the operator's own reprisals.
Protect AML personnel from hostile acts and prohibit reprisals for the specified reports.
Prohibited action
Original wording is not reproduced. Read the official source. This view contains RegCanary's reviewed analysis, not a copy of the source text.
The full translation is not reproduced. The plain-English explanation below is analysis, not a translation of the original wording.
Insufficient CDD blocks onboarding, continuation and occasional transactions where the operator cannot manage risk or conduct the statutory monitoring/assessment. The professional-services exception is confined to the stated actors and legal-proceeding or legal-position work; it is not a banking waiver.
Withhold or end the specified relationship/transaction activity when CDD is insufficient, subject to the narrow professional exception.
Prohibited action
Original wording is not reproduced. Read the official source. This view contains RegCanary's reviewed analysis, not a copy of the source text.
The full translation is not reproduced. The plain-English explanation below is analysis, not a translation of the original wording.
Suspicion of intended misuse prevents opening a relationship. This onboarding prohibition is separate from the reasonable-grounds transaction rule and the reporting assessment in other sections.
Do not establish a relationship where the specified suspicion of intended misuse exists.
Prohibited action
Original wording is not reproduced. Read the official source. This view contains RegCanary's reviewed analysis, not a copy of the source text.
The full translation is not reproduced. The plain-English explanation below is analysis, not a translation of the original wording.
The normal response to a transaction suspected on reasonable grounds is to refrain. The operator must consider police handling information after a report; the statute allows execution when refraining is impossible or would probably hinder further investigation, rather than granting general discretion to proceed.
Refrain from qualifying suspicious transactions, considering police information and the two express execution exceptions.
Prohibited action Assess
Original wording is not reproduced. Read the official source. This view contains RegCanary's reviewed analysis, not a copy of the source text.
The full translation is not reproduced. The plain-English explanation below is analysis, not a translation of the original wording.
Establishing a business relationship triggers CDD without an amount threshold here. Without a relationship, CDD applies to a single transaction of EUR 15,000 equivalent or more, or knowingly/ought-to-be-known connected transactions reaching that amount. The transfer limb is strictly over EUR 1,000 equivalent. The Swedish text says funds or crypto-assets but cites EU 2023/1113 Article 3(9), which defines funds transfers; Article 3(10) defines crypto-asset transfers. This crypto-reference dependency remains unresolved: do not silently replace the native citation or infer a universal threshold or complete EU transfer workflow.
Apply CDD at relationship establishment; absent a relationship, at EUR 15,000-equivalent single/linked transaction triggers or the specified transfer trigger strictly over EUR 1,000 equivalent, preserving the unresolved crypto-reference dependency.
Verify Collect information
Original wording is not reproduced. Read the official source. This view contains RegCanary's reviewed analysis, not a copy of the source text.
The full translation is not reproduced. The plain-English explanation below is analysis, not a translation of the original wording.
For an in-scope operator, customer identity verification must use one of the source categories stated in the section. The text permits specified electronic and remote methods; it does not prescribe a single document set. A representative’s identity and authority are separate checks when the customer acts through another person.
Identify and verify the customer using an independent, reliable source, and verify a representative’s identity and authority when relevant.
Verify Collect information
Original wording is not reproduced. Read the official source. This view contains RegCanary's reviewed analysis, not a copy of the source text.
The full translation is not reproduced. The plain-English explanation below is analysis, not a translation of the original wording.
Beneficial-owner work requires at least a register search, understanding entity/trust ownership and control, and identity verification where an owner exists. A qualifying listed company or subsidiary is exempt from the first paragraph. The senior-officer fallback applies for a legal person with no owner after investigation, or where the identified person is reasonably doubted; it does not substitute for doing the investigation.
Investigate and verify beneficial ownership with the register, structural checks, listed-company exception and conditional fallback.
Collect information Verify
Original wording is not reproduced. Read the official source. This view contains RegCanary's reviewed analysis, not a copy of the source text.
The full translation is not reproduced. The plain-English explanation below is analysis, not a translation of the original wording.
Identity checks must finish before a relationship or occasional transaction begins. The low-risk, normal-business-course qualification permits a later verification point only within the explicit latest limit of relationship establishment; it cannot be read here as general permission to verify after onboarding.
Complete customer and beneficial-owner identity checks within the stated pre-activity timing limits.
Verify
Original wording is not reproduced. Read the official source. This view contains RegCanary's reviewed analysis, not a copy of the source text.
The full translation is not reproduced. The plain-English explanation below is analysis, not a translation of the original wording.
PEP screening must address the customer and beneficial owner, including the defined family and associate categories. Identification feeds the enhanced measures elsewhere; the section does not itself mandate rejecting a PEP.
Assess PEP and related-person status for the customer and beneficial owner.
Assess
Original wording is not reproduced. Read the official source. This view contains RegCanary's reviewed analysis, not a copy of the source text.
The full translation is not reproduced. The plain-English explanation below is analysis, not a translation of the original wording.
Check the customer's establishment against the Commission's high-risk third-country identification for non-EEA countries. This is a specific regulatory-list test, distinct from general geographic indicators or a current FATF-status claim.
Check whether the customer is established in a Commission-identified high-risk third country.
Verify
Original wording is not reproduced. Read the official source. This view contains RegCanary's reviewed analysis, not a copy of the source text.
The full translation is not reproduced. The plain-English explanation below is analysis, not a translation of the original wording.
Collect relationship-purpose and nature information that supports an expected-activity baseline and the customer risk profile. The duty specifies the information needed for these assessments rather than one required form or document.
Obtain relationship purpose/nature information and use it to assess expected activity and customer risk.
Collect information Assess
Original wording is not reproduced. Read the official source. This view contains RegCanary's reviewed analysis, not a copy of the source text.
The full translation is not reproduced. The plain-English explanation below is analysis, not a translation of the original wording.
Continuing CDD keeps identity, beneficial ownership, PEP, country and relationship information adequate for the assessed risk. A reporting financial institution must also perform this follow-up when tax-account review obligations require customer contact; no universal calendar interval is stated.
Refresh continuing CDD and perform the additional follow-up when reportable-account review requires contact.
Verify Assess
Original wording is not reproduced. Read the official source. This view contains RegCanary's reviewed analysis, not a copy of the source text.
The full translation is not reproduced. The plain-English explanation below is analysis, not a translation of the original wording.
The intensity of the named CDD tasks must fit the customer's risk profile and circumstances. This calibrates the work required; it does not allow abandoning required checks simply because a customer appears low risk.
Scale the specified CDD checks to the customer's risk and circumstances.
Assess