## 1. Key AML/CFT Institutions in Denmark

## Source details

**Canonical URL:** [1. Key AML/CFT Institutions in Denmark](https://www.imf.org/-/media/files/publications/cr/2019/1dnkea2019002.pdf)

## Other formats

- [Markdown version](/-/media/files/publications/cr/2019/1dnkea2019002.pdf.md)
- [Structured JSON version](/-/media/files/publications/cr/2019/1dnkea2019002.pdf.json)

---

### Summary and context
- The Danske Bank case involved the possible laundering of approximately €200 billion in transfers through the Estonian branch of Danske Bank and accelerated momentum for AML/CFT reform in the Nordic-Baltic region.
- Denmark has taken important steps to strengthen AML/CFT supervision through: amendments to the AML Act, a significant increase in supervisory resources, and increased on-site inspections.
- Priority recommendations for continuing progress include:
  - adopting a comprehensive institutional risk assessment model or “scoreboard” that includes critical cross-border ML risk factors;
  - intensifying AML/CFT on-site inspections by increasing their length and depth, particularly for higher-risk financial institutions and with respect to the risk-based sampling of customer files;
  - expanding the DFSA’s powers, including authority to issue administrative fine notices for non-compliance with AML/CFT requirements;
  - pursuing MOUs with supervisors in all non-EU/EEA countries where Danish banks have (or intend to open) overseas branches or subsidiaries;
  - holding discussions within the Danish Cabinet, in consultation with relevant authorities, on further integration/consolidation of AML/CFT supervision at the regional or sub-regional levels.

### Key findings on threats and vulnerabilities
- Threats:
  - Staff’s desk-based benchmarking mapped branches, subsidiaries, and correspondent banking relationships (CBRs) of Danish, Finnish, Norwegian, and Swedish banks with countries presenting potentially higher ML risks, focusing on flows originating in the Commonwealth of Independent States (CIS) and intermediaries including the Baltics.
  - As of April 2019, Denmark had the second most extensive banking network in potentially higher-risk countries among the four Nordic economies analyzed.
- Vulnerabilities:
  - The FATF found gaps in Nordic AML/CFT supervisory frameworks. For Denmark, significant gaps related to lack of resources, application of the risk-based approach (RBA), communication with supervised entities, and enforcement of compliance.
  - Denmark was rated “Partially Compliant” on Recommendation 26 (R.26) and “Low” on Immediate Outcome 3 (IO.3) in its August 2017 MER.

### Institutional reforms, legislation, and resources
- Legislative and policy actions:
  - Three political agreements (June 2017, September 2018, March 2019) led to a National AML/CFT Strategy and enactment of AML/CFT legislation (Act No. 651 of 8 June 2017).
  - Laws adopted in June and December 2018 enabled the DFSA to revoke an FI’s license for gross violations of the AML Act and increased fines by requiring courts to index fines to companies’ net turn-over at the time of violation.
  - Per Act No. 552 of 7 May 2019 (The Financial Business Act), fit and proper requirements will apply to AML/CFT compliance officers as of July 2019.
- Resource increases:
  - MLS (Money Laundering Secretariat) hired additional staff in 2018 and, not including the head of the Unit, will have 26 full-time equivalents by July 1, 2019.
  - DFSA established an AML Division and increased AML-dedicated staff from 3.5 to 14.5; developed a new institutional risk scoring and assessment model; and significantly increased on-site inspections.
- DFSA budget and staffing (exact figures):
  - FY2018 DFSA annual budget: DKK 348.8M ($52.7M).
  - Start of FY2019 DFSA budget: DKK 350.8M ($53M); increased by 20 percent in March to DKK 421M ($63.6M).
  - Planned further increases per March 2019 political agreement: DKK 54 million ($8 million) in 2020, and DKK 48 million ($7 million) per year starting in 2021.
  - AML Division staffing: 14.5 dedicated staff with 11.5 dedicated AML/CFT inspectors; hired 11 new staff over two years to reach 14.5.
  - Planned mid-year additions: 5.5 new positions to reach planned complement of 20 staff by end of 2019.
  - Total DFSA AML/CFT staff by end of 2019 (planned): 24.

### Key AML/CFT institutions and roles
- Danish Financial Supervisory Authority (DFSA): Supervision – Monitor and enforce FIs’ compliance with AML/CFT-related obligations, exchange information with foreign counterparts, chair the Money Laundering Forum, head Denmark’s delegation to the FATF.
- Money Laundering Forum (MLF): Coordination – Coordinate risk assessments and other ML/TF measures among relevant supervisory and law enforcement authorities.
- Money Laundering Secretariat (MLS): Financial Intelligence – Receive, analyze, and disseminate suspicious transaction reports (STRs); exchange information with foreign counterparts.
- Police Districts: Law Enforcement – Investigate and, as appropriate, prosecute ML/TF.
- State Prosecutor for Serious Economic and International Crime (SPSEIC): Law Enforcement – Investigate and, as appropriate, prosecute ML and the violation of related obligations under Danish law.

### International and domestic cooperation: findings and options
- International cooperation findings:
  - Danish law permits the DFSA to exchange information with EU/EEA counterparts and within supervisory colleges; enabled since Act No. 1556 of 21 December 2010.
  - Outside the EU/EEA and supervisory colleges, the DFSA may only exchange information on the basis of a bilateral MOU or international cooperation agreement; to date the DFSA has concluded only one AML/CFT-specific MOU, with Dubai.
  - The DFSA’s international supervisory cooperation arrangements are too narrow given Denmark’s banking groups; gaps noted in Australia, Brazil, Hong Kong SAR (China), India, Russia, Singapore, and Switzerland.
  - Over the past three years, the DFSA has not exchanged AML/CFT-related information with non-EU/non-EEA counterparts nor made or received AML/CFT-related spontaneous disclosures to/from such counterparts.
  - The first joint AML/CFT on-site inspection of a Danish FI took place at Danske Bank in March 2019 with Finland, Norway, and Sweden; as of April 2019, DFSA had not taken part in a joint AML/CFT on-site inspection outside of Denmark.
  - On May 8, 2019, financial supervisory authorities of all the Nordic-Baltic states formed a permanent working group to maintain regular contact and exchange experiences and information.
- Domestic cooperation findings:
  - The MLF role was enshrined in law in 2017 via Section 74 of the AML Act; MLF required to “coordinate the authorities’ risk assessments and general measures against money laundering and financing of terrorism.”
  - The MLF has an MOU dating from 2013; the MOU is being updated.
  - DFSA and MLS have a collaborative working relationship; Danish law effectively requires cooperation between DFSA and MLS, including on sharing information originally obtained from the private sector.
  - The National AML/CFT Strategy calls for an analytical center as the “operational arm” of the MLF; mentioned in the March 2019 political agreement.

### Public-private cooperation and the CDD utility (MLF+)
- MLF+ established to foster public-private cooperation and explore a common customer due diligence (CDD) utility.
- Potential common CDD utility functions (vision refined based on March 2019 political agreement):
  - verify customers’ identities;
  - track familial connections;
  - capture names of individuals and entities that present higher ML/TF risks according to agreed criteria.
- Potential advantages: efficiency, accuracy, facilitation of AML/CFT supervision—dependent on DFSA access to utility data to identify networks of high-risk customers and assess FIs’ monitoring.
- Potential drawbacks: privacy, data protection, and due process of law.
- Recommendation for private sector: prioritize completion of the visioning process in consultation with authorities, balancing advantages and drawbacks.

### ML National Risk Assessment (NRA), DFSA guidance, and sectoral risk work
- MLS finalized a new ML NRA in April 2019 and published a sanitized version on its website; a confidential version circulated within government and industry associations.
- FATF assessors’ concerns with Denmark’s 2015 ML NRA included: insufficient coordination, failure to adopt whole-of-government approach, methodological deficiencies, and lack of statistics on effectiveness and efficiency of AML systems.
- Public version of 2019 NRA available only in Danish; English translation to be complete by the end of June 2019.
- DFSA issued comprehensive new guidance on the AML Act in October 2018 (Finanstilsynet’s Guide on the Act on Preventive Measures against Money Laundering and Financing of Terrorism); the working group preparing the guidance is now permanent with the first annual update to be released in late 2019.
- DFSA sectoral risk assessments (SRA):
  - DFSA updates SRA twice a year; most recent update includes substantial ML component.
  - Most recent SRA available (dated November 21, 2018) considers ML a macro-financial risk and notes ML risks have diminished owing to “increased attention” generated by the Danske Bank case, but underlying information supporting this conclusion is not specified.
  - An updated SRA to be made public in August 2019 with an extended chapter on AML/CFT.

### DFSA institutional risk model, on-site inspection planning, and procedures
- Institution-level risk assessment model overhauled in 2018; updates institution-level assessments on an ongoing basis.
- New model calculates FI’s inherent risk as a function of:
  - (i) overall risk assigned to credit institutions by the ML NRA;
  - (ii) overall risk assigned to credit institutions by the most recent SRA;
  - (iii) two bank-specific factors (one objective and one based primarily on tips or other information obtained by the DFSA).
- Residual risk assigned subjectively by DFSA rating based on tips or information including from prudential inspections.
- Institution-level “scoreboard” (spreadsheet of inherent and residual risk ratings) updated each time DFSA receives new information.
- Model development recommendation: further develop over 2019–2020 to aggregate and account for specific, cross-border ML risk factors such as:
  - the number, locations, and size of overseas branches or subsidiaries;
  - the gain or loss of CBRs;
  - the number of non-resident customers;
  - the volume of international financial flows, both at group and branch-level, particularly as compared to associated bank assets or customer deposits.
- To gather such information, staff recommends issuance of (electronic) questionnaires or establishment of automatic reporting requirements; DFSA is studying this and will propose amendments to relevant law(s).

- On-site inspection planning and intensity:
  - Each April, DFSA draws up annual inspection plan based on snapshot of the scoreboard.
  - DFSA balances more frequent inspections for higher-risk institutions with periodic inspections of lower-risk institutions.
  - Inspection types: “ordinary”/full scope or “thematic”/targeted inspections.
  - Typical on-site component duration: one to two days (as little as one day for lowest risk, as many as two days for highest risk).
  - Overall process spans three-to-four-months with a rough average of 300 (or more) hours of work before and after the inspection.
  - Comparative observation: DFSA on-site durations appear far shorter and less intense than foreign counterparts based on wide-ranging anecdotal evidence.
  - Inspection counts and planning:
    - 2017: 10 AML/CFT on-site inspections within Denmark.
    - 2018: 45 AML/CFT on-site inspections within Denmark.
    - 2019 planned: 35 AML/CFT on-site inspections within Denmark (a planned 22 percent reduction in number versus 2018).
  - 2019 plan reserves certain dates without specifying FI names or staff to allow flexibility for snap inspections or to extend inspections.

- DFSA procedural gaps and near-term objectives:
  - DFSA lacks an AML/CFT-specific inspection manual and tailored guidance for on-site visits to large, complex FIs.
  - Near-term objective: (re)develop AML/CFT-specific business procedures “from scratch” covering inspection techniques, interview subjects, AML/CFT-specific sampling methodology, systems and processes to verify, and special procedures for large international banking groups.
  - Procedures to verify compliance with the new requirement that banking groups establish and implement group-wide AML/CFT policies (Act No. 651 (8 June 2017)) have yet to be developed.

### DFSA enforcement powers, planned updates, and limitations
- DFSA enforcement approach:
  - Historically relied on an “educational approach,” using “social trust” and “reputational risk” to promote adherence.
  - Updating an enforcement policy paper to specify circumstances and timeframes for using new and likely future sanctioning powers to maximize consistency and predictability and ensure violations do not linger.
- New and expanded sanctioning powers (laws and political agreement):
  - Law No. 706 of 8 June 2018: DFSA can revoke license of a bank or other FI in response to gross violations of the AML Act.
  - Law No. 552 of 7 May 2019 (The Financial Business Act): extended fit and proper requirements to AML/CFT compliance officers; expanded fit and proper assessment of directors and management committee members to include sufficient understanding of the AML Act; empowered DFSA to decide board members and AML/CFT compliance officers are unsuitable or must resign based on involvement in past breaches. Effective July 2019 for fit and proper determinations related to AML/CFT.
  - March 2019 political agreement (planned expansions): Parliament intends to empower DFSA to place short-term observers or “monitors” in banks; temporarily bar onboarding of new customers or certain types of new customers (e.g., non-residents); and issue administrative fine notices in response to non-compliance with key provisions of the AML Act.
- Current gap and FATF concern:
  - As of the report, DFSA remained unable to issue administrative fine notices in response to non-compliance with the AML Act; FATF cited this gap as a key deficiency in Denmark’s 2017 MER.
  - Consequences: reduces DFSA’s leverage, delays imposition of consequences for chronic, low-level non-compliance, and requires referrals to SPSEIC for potential criminal investigation.
  - Note: Finland, Norway, and Sweden already have the power to levy administrative sanctions for AML/CFT non-compliance.

### Selected recommendations (priorities and time frames as in source)
- International and Domestic Cooperation (near-term and medium-term actions):
  - Pursue MOUs with DFSA counterparts in all non-EU/EEA countries where Danish banks maintain or intend to open overseas branches or subsidiaries. — Lead: DFSA — Time Frame: Near-Term
  - Ensure MLS proactively shares with DFSA analysis of STRs that may indicate shifts in banks’ institutional risk profiles. — Lead: MLS — Time Frame: Near-Term
  - Complete and adopt planned update to the MLF MOU. — Lead: All Authorities — Time Frame: Near-Term
  - Participate, as feasible, in periodic and event-driven joint inspections of Danish banks’ higher-risk overseas branches and subsidiaries. — Lead: DFSA — Time Frame: Near-Term
  - Reinforce MOUs with foreign counterparts to fill procedural gaps and establish automaticity for cooperation (e.g., information exchange, joint inspections). — Lead: DFSA — Time Frame: Medium-Term
  - Hold Cabinet discussions, with relevant authorities, on integration/consolidation of AML/CFT supervision at regional/sub-regional levels and arrive at a formal governmental position. — Lead: Cabinet — Time Frame: Medium-Term
  - Issue findings on feasibility and benefits of a private sector-led CDD utility and its potential support for AML/CFT supervision. — Lead: MLF+ — Time Frame: Medium-Term
- Implementing the Risk-Based Approach:
  - Adopt a comprehensive institutional risk assessment model or “scoreboard” that includes specific cross-border ML risk factors. — Lead: DFSA — Time Frame: Near-Term
  - Issue annual electronic questionnaires to banks and other critical financial sector segments or establish automatic reporting to gather institution-level data required for the DFSA “scoreboard.” — Lead: DFSA — Time Frame: Near-Term
  - Conduct an internal review after the 2019–2020 inspection cycle to determine whether the on-site inspection plan was sufficiently flexible to address fast-moving developments and follow-up. — Lead: DFSA — Time Frame: Medium-Term
- DFSA resources, procedures, and powers:
  - Fully and expeditiously implement, in law, the March 2019 political agreement to expand DFSA powers, including authority to issue administrative fine notices for AML/CFT non-compliance. — Lead: Cabinet, Parliament — Time Frame: Near-Term
  - Develop a comprehensive AML/CFT on-site inspection manual. — Lead: DFSA — Time Frame: Near-Term
  - Intensify AML/CFT on-site inspections by increasing their length and depth, particularly for higher-risk FIs and risk-based sampling of customer files. — Lead: DFSA — Time Frame: Near-Term
  - Complete hiring and training to bring DFSA’s AML Division to full strength and develop a formal staff retention plan. — Lead: DFSA — Time Frame: Near-Term
  - Update DFSA’s standard follow-up procedures to incorporate the full range of current and future sanctioning powers. — Lead: DFSA — Time Frame: Medium-Term
  - Maintain comprehensive statistics on DFSA actions in line with current and future enforcement powers to ensure consistent treatment of FIs and enable evaluation of effectiveness. — Lead: DFSA — Time Frame: Medium-Term
- Note: Priority recommendations are noted in italics in the source. Near-Term is one year; Medium-Term is two–three years.

### Conclusion and key priorities
- Political will is strong to strengthen Denmark’s AML/CFT regime, driven by Denmark’s 2017 FATF MER findings and scrutiny from the Danske Bank case.
- Progress already achieved includes increased resourcing of DFSA; hiring and training of new inspectors; new legal requirements on AML/CFT policies and group information-sharing; stiffer penalties; and a political agreement to expand DFSA’s sanctioning powers.
- Ongoing ML risk profile:
  - Denmark is exposed to higher-threat regions via an extensive network of bank branches, subsidiaries, and CBRs.
  - Overall vulnerability appears to have diminished owing to recent reforms, though it remains high.
  - Criminals may shift activity from larger to smaller banks or use complex corporate vehicles as controls at larger banks strengthen.
- Key priorities:
  - Maintain and build on momentum: develop skills of newly hired inspectors; implement comprehensive institutional risk assessment model and AML/CFT supervisory manual; strengthen working relationships with foreign counterparts; and preserve continued political and operational momentum to complete reforms.

*Prepared by IMF staff; source content from the IMF chapter titled "1. Key AML/CFT Institutions in Denmark."*

### 1. Key AML/CFT Institutions in Denmark ________________________________________________ 5

### 1. Key AML/CFT Institutions in Denmark

### Summary and context
- The Danske Bank case involved the possible laundering of approximately €200 billion in transfers through the Estonian branch of Danske Bank and accelerated momentum for AML/CFT reform in the Nordic-Baltic region.
- The paper finds Denmark has taken important steps to strengthen AML/CFT supervision through: amendments to the AML Act, a significant increase in supervisory resources, and increased on-site inspections.
- Priority recommendations for continuing progress include:
  - adopting a comprehensive institutional risk assessment model or “scoreboard” that includes critical cross-border ML risk factors;
  - intensifying AML/CFT on-site inspections by increasing their length and depth, particularly for higher-risk financial institutions and with respect to the risk-based sampling of customer files;
  - expanding the DFSA’s powers, including authority to issue administrative fine notices for non-compliance with AML/CFT requirements;
  - pursuing MOUs with supervisors in all non-EU/EEA countries where Danish banks have (or intend to open) overseas branches or subsidiaries;
  - holding discussions within the Danish Cabinet, in consultation with relevant authorities, on further integration/consolidation of AML/CFT supervision at the regional or sub-regional levels.

### Key findings on threats and vulnerabilities
- Threats:
  - Staff’s desk-based benchmarking mapped branches, subsidiaries, and correspondent banking relationships (CBRs) of Danish, Finnish, Norwegian, and Swedish banks with countries presenting potentially higher ML risks, focusing on flows originating in the Commonwealth of Independent States (CIS) and intermediaries including the Baltics.
  - As of April 2019, Denmark had the second most extensive banking network in potentially higher-risk countries among the four Nordic economies analyzed.
- Vulnerabilities:
  - The FATF found gaps in Nordic AML/CFT supervisory frameworks. For Denmark, significant gaps related to lack of resources, application of the risk-based approach (RBA), communication with supervised entities, and enforcement of compliance.
  - Denmark was rated “Partially Compliant” on Recommendation 26 (R.26) and “Low” on Immediate Outcome 3 (IO.3) in its August 2017 MER, reflecting supervisory vulnerabilities relative to peers.

### Institutional reforms and resources
- Legislative and policy actions:
  - Three political agreements (June 2017, September 2018, March 2019) led to a National AML/CFT Strategy and enactment of AML/CFT legislation (Act No. 651 of 8 June 2017).
  - Laws adopted in June and December 2018 enabled the DFSA to revoke an FI’s license for gross violations of the AML Act and increased fines by requiring courts to index fines to companies’ net turn-over at the time of violation.
  - Per Act No. 552 of 7 May 2019 (The Financial Business Act), fit and proper requirements will apply to AML/CFT compliance officers as of July 2019.
- Resource increases:
  - MLS (Money Laundering Secretariat, Denmark’s FIU) hired additional staff in 2018 and, not including the head of the Unit, will have 26 full-time equivalents by July 1, 2019.
  - DFSA established an AML Division and increased AML-dedicated staff from 3.5 to 14.5; developed a new institutional risk scoring and assessment model; and significantly increased on-site inspections.

### Key AML/CFT institutions and roles (as presented)
- Danish Financial Supervisory Authority (DFSA): Supervision – Monitor and enforce FIs’ compliance with AML/CFT-related obligations, exchange information with foreign counterparts, chair the Money Laundering Forum, head Denmark’s delegation to the FATF.
- Money Laundering Forum (MLF): Coordination – Coordinate risk assessments and other ML/TF measures among relevant supervisory and law enforcement authorities.
- Money Laundering Secretariat (MLS): Financial Intelligence – Receive, analyze, and disseminate suspicious transaction reports (STRs); exchange information with foreign counterparts.
- Police Districts: Law Enforcement – Investigate and, as appropriate, prosecute ML/TF.
- State Prosecutor for Serious Economic and International Crime (SPSEIC): Law Enforcement – Investigate and, as appropriate, prosecute ML and the violation of related obligations under Danish law.

### Selected recommendations (from Table 2)
- International and Domestic Cooperation (near-term and medium-term actions):
  - Pursue MOUs with DFSA counterparts in all non-EU/EEA countries where Danish banks maintain or intend to open overseas branches or subsidiaries. — Lead: DFSA — Time Frame: Near-Term
  - Ensure MLS proactively shares with DFSA analysis of STRs that may indicate shifts in banks’ institutional risk profiles. — Lead: MLS — Time Frame: Near-Term
  - Complete and adopt the planned update to the MLF MOU. — Lead: All Authorities — Time Frame: Near-Term
  - Participate, as feasible, in periodic and event-driven joint inspections of Danish banks’ higher-risk overseas branches and subsidiaries. — Lead: DFSA — Time Frame: Near-Term
  - Reinforce MOUs with foreign counterparts to fill procedural gaps and establish automaticity for cooperation (e.g., information exchange, joint inspections). — Lead: DFSA — Time Frame: Medium-Term
  - Hold Cabinet discussions, with relevant authorities, on integration/consolidation of AML/CFT supervision at regional/sub-regional levels and arrive at a formal governmental position. — Lead: Cabinet — Time Frame: Medium-Term
  - Issue findings on the feasibility and benefits of a private sector-led CDD utility and its potential support for AML/CFT supervision. — Lead: MLF+ — Time Frame: Medium-Term
- Implementing the Risk-Based Approach:
  - Adopt a comprehensive institutional risk assessment model or “scoreboard” that includes specific cross-border ML risk factors. — Lead: DFSA — Time Frame: Near-Term
  - Issue annual electronic questionnaires to banks and other critical financial sector segments or establish automatic reporting to gather institution-level data required for the DFSA “scoreboard.” — Lead: DFSA — Time Frame: Near-Term
  - Conduct an internal review after the 2019–2020 inspection cycle to determine whether the on-site inspection plan was sufficiently flexible to address fast-moving developments and follow-up. — Lead: DFSA — Time Frame: Medium-Term
- DFSA resources, procedures, and powers:
  - Fully and expeditiously implement, in law, the March 2019 political agreement to expand DFSA powers, including authority to issue administrative fine notices for AML/CFT non-compliance. — Lead: Cabinet, Parliament — Time Frame: Near-Term
  - Develop a comprehensive AML/CFT on-site inspection manual. — Lead: DFSA — Time Frame: Near-Term
  - Intensify AML/CFT on-site inspections by increasing their length and depth, particularly for higher-risk FIs and risk-based sampling of customer files. — Lead: DFSA — Time Frame: Near-Term
  - Complete hiring and training to bring the DFSA’s AML Division to full strength and develop a formal staff retention plan. — Lead: DFSA — Time Frame: Near-Term
  - Update DFSA’s standard follow-up procedures to incorporate the full range of current and future sanctioning powers. — Lead: DFSA — Time Frame: Medium-Term
  - Maintain comprehensive statistics on DFSA actions in line with current and future enforcement powers to ensure consistent treatment of FIs and enable evaluation of effectiveness. — Lead: DFSA — Time Frame: Medium-Term
- Note: Priority recommendations are noted in italics in the source. Near-Term is one year; Medium-Term is two–three years.

### Comparative FATF ratings (selected)
- Nordic countries’ FATF ratings for AML/CFT supervision (R.26 technical compliance; IO.3 effectiveness):
  - Denmark (2017): R.26 — Partially Compliant; IO.3 — Low
  - Finland (2019): R.26 — Largely Compliant; IO.3 — Low
  - Norway (2014): R.26 — Compliant; IO.3 — Moderate
  - Sweden (2017): R.26 — Partially Compliant; IO.3 — Moderate

_Italic: Prepared by IMF staff; source content from the IMF chapter titled "1. Key AML/CFT Institutions in Denmark."_

### 11.      International and domestic cooperation are critical to effective cross-border banking

### 11.      International and domestic cooperation are critical to effective cross-border banking

### International Cooperation to Mitigate Cross-Border ML/TF Risks
- Danish law permits the DFSA to exchange information with EU/EEA counterparts and within supervisory colleges, even in the absence of specific bilateral agreements; enabled since Act No. 1556 of 21 December 2010.
- Supervisory college agreements contain “embedded” MOUs that address the conduct of joint inspections, the sharing of the results, and cooperation in the case of possible violations.
- The DFSA interprets Danish law (specifically, Section 56, Sub-Section 3 of the AML Act) as establishing an “obligation” to cooperate with EU/EEA counterparts, even if foreign authorities may not recognize any reciprocal obligation.
- Prior to the full, EU-wide transposition of AMLD V, the absence of bilateral MOUs between the DFSA and its closest (EU/EEA) counterparts represents a temporary gap: DFSA requests for information or cooperation from EU/EEA partners may be denied or delayed without any law, MOU, or other agreement having been breached.
- Outside the EU/EEA and supervisory colleges, the DFSA may only exchange information on the basis of a bilateral MOU or international cooperation agreement; to date the DFSA has concluded only one AML/CFT-specific MOU, with its counterpart in Dubai.
- The DFSA’s international supervisory cooperation arrangements are too narrow given Denmark’s banking groups: some Danish banks maintain branches or subsidiaries in non-EU, non-EEA countries where the DFSA has yet to conclude MOUs, specifically Australia, Brazil, Hong Kong SAR (China), India, Russia, Singapore, and Switzerland.
- Empirical testing of arrangements is limited:
  - Over the past three years, the DFSA has not exchanged AML/CFT-related information with non-EU/non-EEA counterparts, nor made or received AML/CFT-related spontaneous disclosures to/from such counterparts.
  - Outside the two supervisory colleges in which it participates, the DFSA has not shared inspection reports with foreign counterparts, although abridged versions of those reports are published on-line.
  - The first joint AML/CFT on-site inspection of a Danish FI took place at Danske Bank in March 2019, with participation by the Finnish, Norwegian, and Swedish financial supervisory authorities (members of the Danske supervisory college).
  - As of April 2019, the DFSA had not taken part in a joint AML/CFT on-site inspection outside of Denmark.
- Authorities are exploring enhanced information-sharing nationally and at the EU level; on May 8, 2019, financial supervisory authorities of all the Nordic-Baltic states formed a permanent working group to maintain regular contact and exchange experiences and information.
- There is no settled national view on formal integration of AML/CFT supervision at regional or sub-regional levels; a political decision (likely Cabinet) would be necessary to support or pursue formal/legal integration.
- Primary options for deeper integration (described conceptually, see Table 4 in source) include:
  - (i) Strengthening existing structures and mechanisms for ad hoc AML/CFT supervisory cooperation;
  - (ii) Consolidating off-site supervision at the regional (European) or sub-regional (Nordic-Baltic) levels;
  - (iii) Integrating AML/CFT supervision at the Nordic or Nordic-Baltic levels outside EU treaties;
  - (iv) Integrating AML/CFT supervision among interested European partners via the EU’s “enhanced cooperation” procedure;
  - (v) Fully integrating AML/CFT supervision with the EU under an EU agency.

### Domestic Cooperation to Mitigate Cross-Border ML/TF Risks
- The role of the MLF was enshrined in law in 2017 via Section 74 of the AML Act; the MLF is the primary forum for AML/CFT-related cooperation within Denmark and is required to “coordinate the authorities’ risk assessments and general measures against money laundering and financing of terrorism.”
- The MLF has existed for over 13 years and has an MOU dating from 2013; the full scope and modalities of its work are laid out in an MOU that is currently being updated.
- DFSA and the financial intelligence unit (FIU, the MLS) have a collaborative working relationship; Danish law effectively requires cooperation between DFSA and MLS, including on sharing information originally obtained from the private sector.
- The National AML/CFT Strategy calls for an analytical center to be stood up as the “operational arm” of the MLF; this initiative is mentioned in the March 2019 political agreement and aims to ensure administrative, intelligence, and law enforcement tools are combined in handling individual ML/TF cases.
- Information-sharing practices between DFSA and MLS:
  - Prior to AML/CFT on-site inspections, the DFSA requests information from the MLS on the quantity and quality of STRs received from the relevant bank or money remitter.
  - The MLS provides insight into changes in FIs’ reporting patterns and sends the DFSA occasional spontaneous disclosures based on MLS analysis or information from foreign counterparts.
  - It appears relatively rare that the MLS shares impromptu analysis of emerging ML risks, trends, or methods with the DFSA and other domestic supervisors—an area identified for increased interaction.
  - The MLS prepares quarterly reports detailing STR reporting patterns and highlighting new or evolving ML/TF threats, with heavy emphasis on cross-border financial flows.
  - The DFSA is a reporting entity by law and has both the ability and obligation to submit STRs when appropriate; in practice, it is somewhat exceptional for the DFSA to submit an STR, as it may order an FI to revisit transactions and report them to the MLS directly.
- DFSA and the State Prosecutor for Serious Economic and International Crime (SPSEIC) have a close working relationship; they concluded an MOU in 2016 covering DFSA referrals to SPSEIC and DFSA support of financial investigations led by SPSEIC.
  - DFSA and SPSEIC meet quarterly at the technical level and at least twice a year at the top management level.
  - Since 2016, the DFSA has reported three FIs to the SPSEIC for (potential) violations of the AML Act: the first was fined for failure to obtain adequate information on its correspondents; the second is still being investigated; and the third was referred for resolution.

### Public-Private Cooperation and the MLF+
- The authorities established the “MLF+” to foster public-private cooperation and explore a common customer due diligence (CDD) utility.
- The MLF+ enables FIs and private actors to discuss “problems and experiences” with MLF authorities and advance private-sector AML/CFT cooperation initiatives.
- A potential common CDD infrastructure (vision refined based on the March 2019 political agreement) could include tools to:
  - verify customers’ identities;
  - track familial connections;
  - capture names of individuals and entities that present higher ML/TF risks according to agreed criteria.
- The Danish authorities are also keen to explore establishment of such a utility at the EU level.
- Potential advantages of a common CDD utility: efficiency, accuracy, and facilitation of AML/CFT supervision—dependent on the DFSA’s access to the data maintained by the utility, which would enable identification of networks of high-risk customers and assessment of FIs’ monitoring.
- Potential drawbacks to consider: privacy, data protection, and due process of law.
- Recommendation for the private sector: prioritize completion of the visioning process in consultation with authorities, balancing advantages and drawbacks.

### Recommendations (as stated in source)
- Pursue MOUs with DFSA counterparts in all the non-EU/EEA countries where Danish banks maintain (or intend to open) overseas branches or subsidiaries.
- Ensure that the MLS is proactive in sharing with the DFSA analysis of STRs that may indicate a shift in banks’ institutional risk profiles or changes in the approach or quality of their reporting.
- Complete and adopt the planned update to the MLF MOU.
- Participate, as feasible, in both periodic and event-driven joint inspections of Danish banks’ higher-risk overseas branches and subsidiaries.
- Reinforce existing stand-alone or embedded MOUs with foreign counterparts, as necessary and feasible, to fill procedural gaps and establish a certain degree of automaticity with respect to key forms of cooperation (e.g., information exchange and the conduct of joint inspections).
- Hold discussions within the Danish Cabinet, in consultation with all relevant domestic authorities, as to ways to further the integration/consolidation of AML/CFT supervision at the regional or sub-regional levels and arrive at a formal governmental position on this issue.
- Issue findings on the feasibility and benefits of a private sector-led CDD utility, and its potential mobilization to support AML/CFT supervision.

*Source: 1dnkea2019002 - 11.      International and domestic cooperation are critical to effective cross-border banking*

### 26.      The MLS finalized a new ML national risk assessment (NRA) in April 2019 and

### 1dnkea2019002 - 26.      The MLS finalized a new ML national risk assessment (NRA) in April 2019 and

### ML National Risk Assessment (NRA) and DFSA Guidance
- The MLS finalized a new ML NRA in April 2019 and published a sanitized version on its website.
- The FATF assessors raised concerns with Denmark’s 2015 ML NRA including:
  - insufficient coordination in its preparation;
  - failure to adopt a whole-of-government approach;
  - methodological deficiencies related to input, design, and scope;
  - lack of statistics regarding the effectiveness and efficiency of the country’s AML systems.
- The new ML NRA was prepared by the MLS based on:
  - interviews with all the relevant authorities;
  - a full analysis of ML cases concluded in 2016;
  - an updated risk matrix;
  - a certain degree of input from the private sector.
- A confidential version was circulated within the Danish government and provided to industry associations; an outreach strategy will be discussed at the next meeting of the MLF.
- The public version is currently available only in Danish; an English-language translation will be complete by the end of June 2019.
- The DFSA issued comprehensive new guidance on the AML Act in October 2018:
  - Finanstilsynet’s Guide on the Act on Preventive Measures against Money Laundering and Financing of Terrorism (the Money Laundering Act).
  - The guidance contains explanatory notes on the AML Act, ML/TF risk factors and typologies, and examples of higher vs. lower risk scenarios/transactions.
  - The working group that prepared the guidance has been made permanent to facilitate annual updates; the first annual update is to be released in late 2019.

### DFSA Sectoral Risk Assessments (SRA) and ML Risk Conclusions
- The DFSA updates its sectoral risk assessment twice a year; the most recent update includes a substantial ML component.
- The SRA analyzes evolving macro-financial and “transverse” risks and risks specific to supervised market segments: banks, mortgage and credit institutions, pension and life insurance companies, property and casualty insurance, and capital markets.
- The most recent sectoral assessment available (dated November 21, 2018) considers ML to be a macro-financial risk, addressing it in detail for the banking sector, mortgage sector, and “transverse” risks.
- An updated SRA will be made public in August 2019 and will contain an extended chapter on AML/CFT and address AML/CFT issues within each sub-sector chapter.
- The DFSA’s November 2018 SRA concludes that ML risks have diminished owing to “increased attention” generated by the Danske Bank case but notes:
  - the underlying information supporting this conclusion is not specified in the assessment;
  - the DFSA sees the possibility for ML risk to shift from larger to smaller banks as larger banks tighten controls.
- Going forward, ML risks are to be analyzed and included in every DFSA SRA.

### Conducting Institution-Level Risk Assessments
- The DFSA overhauled its risk model in 2018 and now updates institution-level assessments on an ongoing basis.
- The new model calculates each FI’s inherent risk as a function of:
  - (i) the overall risk assigned to credit institutions by the ML NRA;
  - (ii) the overall risk assigned to credit institutions by the most recent SRA;
  - (iii) two bank-specific factors, one objective and the other based primarily on tips or other information obtained by the DFSA.
- Residual risk is assigned by producing a subjective DFSA rating based on specific tips or other information, including from prudential inspections.
- The institution-level “scoreboard” (a spreadsheet of inherent and residual risk ratings) is updated each time the DFSA receives new information.
- The model should be further developed over 2019–2020 to aggregate and account for specific, cross-border ML risk factors.
- Recommended cross-border ML risk factors to include:
  - the number, locations, and size of overseas branches or subsidiaries;
  - the gain or loss of CBRs;
  - the number of non-resident customers;
  - the volume of international financial flows, both at group and branch-level, particularly as compared to associated bank assets or customer deposits.
- To gather such information, staff recommends issuance of (electronic) questionnaires or establishment of automatic reporting requirements for banks and other critical segments; the DFSA is studying this possibility and will propose amendments to relevant law(s) to specify an obligation to transmit certain proprietary data on an annual or semi-annual basis.

### Implications for On-Site Supervision and Inspection Planning
- Annual and institution-specific on-site inspection plans are increasingly risk-based:
  - Each April, the DFSA draws up an annual inspection plan based on a snapshot of the scoreboard.
  - The DFSA balances more frequent inspections for higher-risk institutions with ensuring periodic inspections of lower-risk institutions.
  - The DFSA may conduct “ordinary”/full scope or “thematic”/targeted inspections to cover higher-risk areas.
- Typical AML/CFT on-site inspection process:
  - On-site component lasts one to two days (as little as one day for lowest risk, as many as two days for highest risk).
  - The overall process spans three-to-four-months with a rough average of 300 (or more) hours of work before and after the inspection.
  - Compared to foreign counterparts, DFSA on-site durations appear far shorter and less intense based on wide-ranging anecdotal evidence.
- The DFSA is refining inspection planning to increase length/intensity while reducing number:
  - 2017: 10 AML/CFT on-site inspections within Denmark.
  - 2018: 45 AML/CFT on-site inspections within Denmark.
  - 2019 planned: 35 AML/CFT on-site inspections within Denmark (a planned 22 percent reduction in number versus 2018).
  - The 2019 plan reserves certain dates without specifying FI names or staff to allow flexibility for snap inspections or to extend inspections as warranted.
- Recommendation that DFSA evaluate the 2019–2020 approach to determine whether sufficient flexibility exists to address fast-moving developments and enable adequate follow-up on suggestive initial findings.

### Resources, Procedures, and Powers — DFSA Capacity
- Resources:
  - As of FY2018, the DFSA’s annual budget stood at DKK 348.8M ($52.7M).
  - The DFSA’s budget was DKK 350.8M ($53M) at the start of FY2019 but was increased by 20 percent in March; it now stands at DKK 421M ($63.6M).
  - The March 2019 political agreement envisions further DFSA budget increases of DKK 54 million ($8 million) in 2020, and an increase of DKK 48 million ($7 million) per year starting in 2021. The agreement specifies the planned increases “must be spent on the enhanced efforts against financial crime”.
  - The DFSA’s budget is set by the government, but funded by the Danish financial sector.
- Staffing:
  - The AML Division, established in June 2017, currently has 14.5 dedicated staff with 11.5 dedicated AML/CFT inspectors.
  - The division hired 11 (new) staff over the last two years to reach the 14.5 full-time employees responsible for AML/CFT supervision of approximately 1,500 financial companies, including 104 Danish banks and foreign bank branches.
  - The mid-year budget increase will enable the AML Division to create and fill 5.5 new positions, giving a planned complement of 20 staff by the end of 2019.
  - This is in addition to the four staff members working on AML/CFT outside the AML Division; by the end of 2019 there will be 24 total staff working on AML/CFT at the DFSA.
  - The DFSA places strong emphasis on staff training and retention via on-the-job apprenticeship and external continuing education.
- Information Technology and Cooperation:
  - The AML Division uses the same IT system as prudential counterparts for real-time sharing; all Danish banks have secure, government-assigned e-mail addresses for official correspondence.
  - The DFSA contributes to a Finance Denmark-led visioning process for a country-wide common platform for CDD; the supervisory colleges in which the DFSA participates maintain closed systems for secure exchanges.
- Procedures:
  - The DFSA maintains general inspection procedures but lacks an AML/CFT-specific inspection manual and tailored guidance for on-site visits to large, complex FIs.
  - A near-term objective is to (re)develop AML/CFT-specific business procedures “from scratch”.
  - The manual should at minimum cover inspection techniques, interview subjects, AML/CFT-specific sampling methodology, systems and processes to verify, and special procedures for large international banking groups.
  - Procedures to verify compliance with the new requirement that banking groups establish and implement group-wide AML/CFT policies (Act No. 651 (8 June 2017)) have yet to be developed; such procedures should be included in the planned manual or a supplement related to banking groups.
- Expected effects of comprehensive new procedures:
  - Should result in more intense AML/CFT inspections, particularly for higher-risk FIs.
  - The planned 22 percent reduction in number of on-sites for 2019 could result in a desirable lengthening of average inspection duration, but further lengthening is likely required for optimal intensity.
  - Increased inspection intensity could be achieved via allocation of additional staff time and use of additional resources from the March 2019 political agreement.
- Powers:
  - The DFSA’s powers are generally provided for in law and include authorities to compel information, exchange information domestically and internationally, conduct inspections, and levy sanctions; changes to powers may be harder to effect than changes to resources or procedures.

### Recommendations (to further Denmark’s implementation of the RBA in AML/CFT supervision)
- Adopt a comprehensive institutional risk assessment model or “scoreboard” that includes specific, cross-border ML risk factors.
- Issue annual, electronic questionnaires to banks and other critical segments of the financial sector—or establish automatic reporting requirements—to gather institution-level data required for the planned DFSA “scoreboard.”
- Conduct an internal review, at the conclusion of the 2019-2020 inspection cycle, to determine whether the current on-site inspection plan was sufficiently flexible to address fast-moving developments and permit adequate follow-up on suggestive initial findings.

*DENMARK INTERNATIONAL MONETARY FUND*

### 44.      The DFSA will also benefit from the planned update to its internal procedures for

### The DFSA: Enforcement Powers, Planned Updates, and Recommendations

### Internal procedures and enforcement approach
- The DFSA has traditionally relied on a self-described “educational approach,” using “social trust” (the good faith of banks instructed to take remedial action) and “reputational risk” (the fear of reputational damage from the publication of compliance orders) to promote adherence to AML/CFT requirements.
- The DFSA is updating an enforcement-related policy paper for presentation to its managing board aimed at specifying circumstances and timeframes for using new and likely future sanctioning powers to:
  - maximize the consistency and predictability of DFSA enforcement actions; and
  - ensure violations do not linger unaddressed, whether indefinitely or over an extended period of time.

### New and expanded sanctioning powers
- Law No. 706 of 8 June 2018:
  - Gave the DFSA the power to revoke the license of a bank or other FI in response to gross violations of the AML Act.  
  - Note: this authority was previously available to the DFSA only in response to gross violations of the Financial Business Act.
  - Although likely to be used only in exceedingly rare circumstances, the existence of this sanction, together with substantially increased fines, should function as an important deterrent to the knowing facilitation of cross-border ML.
  - Footnote: In 2018, the DFSA revoked the license of an FI based on multiple violations of both prudential and AML/CFT-related requirements.
- Law No. 552 of 7 May 2019 (The Financial Business Act):
  - Extended fit and proper requirements to AML/CFT compliance officers.
  - Expanded fit and proper assessment of directors and management committee members to include a determination as to whether they have a sufficient understanding of the AML Act.
  - Empowered the DFSA to decide that board members and AML/CFT compliance officers are unsuitable to assume—or shall be required to resign—their positions based on involvement in past breaches of AML/CFT-related obligations.
  - Effective acquisition of the power to make critical fit and proper determinations related to AML/CFT in July 2019 (in line with the June 2017 political agreement).
- March 2019 political agreement (planned expansions):
  - The Danish Parliament intends to empower the DFSA to:
    - place short-term observers or “monitors” in banks;
    - temporarily bar the onboarding of new customers or of certain types of new customers (e.g., non-residents); and
    - issue administrative fine notices in response to non-compliance with key provisions of the AML Act.

### Gaps, limitations, and cross-border cooperation
- As of the report:
  - The DFSA remained unable to issue administrative fine notices in response to non-compliance with the AML Act.  
    - The FATF cited this gap as a key deficiency in Denmark’s 2017 MER.
    - Consequences of this gap:
      - Reduces the DFSA’s leverage to effect corrective action by supervised entities.
      - Delays imposition of consequences for chronic, low-level non-compliance.
      - Requires referrals of observed (criminal) violations to the SPSEIC for investigation, with the DFSA’s standard for referral being the likelihood of eventual conviction — a potentially slow and cumbersome process.
    - The report notes that lawmakers should design the reform with a view to achieving technical compliance with the FATF Standard and that laws/regulations elsewhere in the Nordic region may be instructive (Finland, Norway, and Sweden already have the power to levy administrative sanctions for non-compliance with AML/CFT requirements).
- DFSA inquiries on behalf of foreign counterparts:
  - The DFSA is not required to conduct AML/CFT-related inquiries on behalf of foreign counterparts outside the context of established supervisory colleges.
  - Practical implications:
    - Not unique to Denmark and has not had significant practical consequences.
    - The DFSA may conduct inquiries on its own initiative and share results in accordance with existing laws and agreements.
    - The DFSA interprets Danish law as requiring cooperation with EU/EEA counterparts, including requests for the conduct of inquiries.
    - The DFSA reported receiving no such request in 2018.

### Recommendations (staff)
- Fully and expeditiously implement, in law, the March 2019 political agreement to expand the DFSA’s powers, including the authority to issue administrative fine notices for non-compliance with AML/CFT requirements.
- Develop a comprehensive AML/CFT on-site inspection manual. (Note: in some countries “inspection manuals” are referred to as “testing procedures.”)
- Intensify AML/CFT on-site inspections by increasing their length and depth, particularly for higher-risk FIs and with respect to the risk-based sampling of customer files.
- Complete the hiring and training of new inspectors to bring the DFSA’s AML Division to full strength and develop a formal staff retention plan.
- Update the DFSA’s standard follow-up procedures with respect to observed violations of AML/CFT requirements to incorporate the full range of its current and future sanctioning powers.
- Maintain comprehensive statistics regarding the DFSA’s actions in line with its current and future enforcement powers to ensure consistent treatment of FIs and enable accurate evaluation of effectiveness.

### Conclusion: next steps for reinforcing Denmark’s cross-border AML/CFT supervisory regime
- Political will is strong to strengthen Denmark’s AML/CFT regime and supervisory framework, driven by findings in Denmark’s 2017 FATF MER and scrutiny related to the Danske Bank case.
- Progress already achieved in a relatively short period includes:
  - increased resourcing of the DFSA;
  - hiring and training of new inspectors;
  - introduction of new legal requirements related to AML/CFT policies and information-sharing within banking groups;
  - stiffening of penalties for non-compliance with AML/CFT requirements; and
  - a political agreement to expand the DFSA’s sanctioning powers, potentially enabling issuance of administrative fine notices.
- ML risks in the Danish financial sector remain significant and are evolving:
  - Denmark is exposed to higher-threat regions via an extensive network of bank branches and subsidiaries and CBRs.
  - Overall vulnerability appears to have diminished owing to recent reforms, though it remains high.
  - Criminals may respond to strengthened controls at larger banks by seeking new relationships with smaller, potentially less sophisticated institutions or relying more heavily on complex corporate vehicles.
- The key priority is to maintain and build on current momentum:
  - The skills of newly hired inspectors, development of a comprehensive institutional risk assessment model and AML/CFT supervisory manual, and strengthened working relationships with foreign counterparts will take time.
  - Continued political and operational momentum is needed to avoid slowed or stalled reforms and to position Denmark for future stability and growth.

*Source: IMF staff report excerpt on Denmark’s DFSA AML/CFT supervisory regime (paragraphs 44–54, recommendations).*

---


_Source: https://www.imf.org/-/media/files/publications/cr/2019/1dnkea2019002.pdf_