## 1eurea2023003 — Nordic-Baltic Region: Financial Flows Analysis, AML/CFT Supervision, and Financial Stability (excerpts) ## Source details **Canonical URL:** [1eurea2023003 — Nordic-Baltic Region: Financial Flows Analysis, AML/CFT Supervision, and Financial Stability (excerpts)](https://www.imf.org/-/media/files/publications/cr/2023/english/1eurea2023003.pdf) ## Other formats - [Markdown version](/-/media/files/publications/cr/2023/english/1eurea2023003.pdf.md) - [Structured JSON version](/-/media/files/publications/cr/2023/english/1eurea2023003.pdf.json) --- ### Purpose, scope, and context - Project purpose: - conduct an analysis of cross-border money laundering (ML) threats and vulnerabilities in the Nordic-Baltic region (Denmark, Estonia, Finland, Iceland, Latvia, Lithuania, Norway, Sweden — the Nordic-Baltic Constituency or NBC) and issue recommendations to mitigate potential risks. - Mandated by AML/CFT supervisors and Financial Intelligence Units (FIUs) in the Nordic-Baltic region. - Report focus: - analyzes selected aspects of the region’s AML/CFT regimes; - focuses on key money-laundering threats using a novel financial flows analysis (cross-border payments data); - examines vulnerabilities in AML/CFT supervision of the banking sector and crypto asset service providers (CASPs); - assesses potential impact of financial integrity (FI) failures on financial stability. - Notable case example: - Danske Bank (Estonian branch): during 2007–2013, 44% of all deposits at the Estonian branch came from non-resident customers; around 7.5 million transactions aggregating to approximately 200 billion euros; approximately 15,000 customers implicated in suspicious transactions; bank closed the Estonian branch in 2019 and forfeited $2 billion and an additional fine for EUR 470 million in Denmark. ### Financial flows analysis — methodology and key macro-trends - Data and scope: - Payments analyzed are wire transfers between customers of financial institutions; origination/beneficiary countries determined by registration country of initiating/receiving financial institution. - Excludes trade mis-invoicing, cross-border cash, crypto assets, does not fully capture card payments or some money transfer arrangements; correspondent banking services analyzed separately. - Payments data aggregated and anonymized (monthly at bank payments corridor level); customer and purpose information not available. - Analysis timeframe: contextual 2013–2019, results based on data since January 2020; analysis presented on a nominal basis. - Regional macro-trends (2013–2022): - Average aggregate monthly flows decreased by 8% from 2013–2014 to 2015–2016, then increased by 23% from 2015–2016 to 2020–2022, resulting in an overall 13% increase in average monthly aggregate flows from 2013 to date. - Regional inflows and outflows are notably stable and balanced (R squared for regional inflows and outflows of 0.94). - Country materiality: - Sweden, Denmark, and Finland have the most material flows in nominal terms and benchmarked against GDP and value of deposits. - Estonia is fourth most material and the most material in the Baltic region; Iceland has the least material flows. - Six of eight countries saw increases in aggregate flows since 2013: Denmark, Finland, Sweden, Iceland, Estonia, Lithuania. Norway and Latvia have lower aggregate flows in July 2022 than in January 2013. - Geographic spread and counterparties: - Material flows with seventy-one countries; main counterparties: EU (UK, Germany, Luxembourg, France, Belgium, Ireland, Netherlands, Switzerland, Spain), U.S., Hong Kong. - Aggregate flow changes since 2013: - G7 increased by 28%; - intraregional flows increased by 38%; - North America increased by 54%; - Asia increased by 29%; - Oceania increased by 23%; - Africa increased by 27%; - EU increased by 121% (2013–2022 comparison period noted as 2017–2018 to 2020–2022 for shares); - International Financial Centers (IFCs) increased by 238%. - EU’s share increased from 37% in 2017 -2018 to 58% in 2020–2022. - IFC’s share increased from 7% in 2018 -2019 to 15% in 2020–2022. - Brexit effects: - Initial growth in flows with the UK after June 2016 referendum and March 2017 Article 50 trigger, then steady decline approaching January 2020 formal exit; concurrent growth with EU financial centers (Germany, Ireland, Luxembourg). ### Outlier detection, IFCs, and correspondent banking findings - Unsupervised outlier detection (Isolation Forest) — share of outliers in overall payments by value (January 2020–July 2022): - Lithuania: 13.3% - Finland: 9.0% - Denmark: 8.0% - Sweden: 7.0% - Latvia: 3.6% - Norway: 2.5% - Iceland: 2.4% - Estonia: 2.3% - Interpretation: - Outlier activity decreased from elevated 2013–2015 levels, increased since 2020. - Elevated and accelerating outlier shares merit further scrutiny in Lithuania, Denmark, Finland, and Sweden. - IFC dynamics: - Ireland and Luxembourg account for 48% and 14% of all flows with the IFC grouping respectively. - Year-on-year increases in average aggregate monthly flows with IFCs: - 2018: 22% vs 2017 - 2019: 38% - 2020: 46% - 2021: 31% - Ireland: strong net inflows to the region (average monthly net inflows surged, trend continued into 2020 and 2021 reaching 21.2 bln. USD for the period noted). - Luxembourg: increasing net outflows from the region. - Correspondent banking: - Regional correspondent banking flows increased with some volatility since 2013; by 2017–2018 average monthly flows increased by half from 2013 levels. - Regional concentration of correspondent banking flows: - Denmark: 50% - Sweden: 22.5% - Finland: 17.7% - Norway: 9% - Lithuania: 0.4% - Estonia: 0.3% - Latvia: 0.1% - Iceland: 0.01% - Regional: 100% - Top-10 countries represented originator of 85% and recipient of 88% of all correspondent banking flows in the region; Denmark originator 15%, Sweden recipient 20%, UK originator 14%/recipient 13%, Luxembourg originator 6%/recipient 6%, Ireland originator 2%/recipient 5%. ### Economic fundamentals analysis and “insufficiently explained” flows - Geographic reach defined as jurisdictions with overall payments of 0.1 percent of a country’s annual GDP or USD 100 million (whichever lower) during January 2020–July 2022. - Payments considered “sufficiently explained” if: - ratio of economic fundamentals value to payments value (inflows/outflows separately) > 30 percent, or - overall ratio of economic linkages’ value to payments value > 75 percent. - Summary of material flows and jurisdictions with insufficiently explained flows (material flows / insufficiently explained flows / breakdown both/outflows/inflows): - Denmark: 148; 44; 15 (both); 22 (unexplained outflows); 7 (inflows) - Estonia: 91; 43; 20 (both); 15 (outflows); 8 (inflows) - Finland: 115; 36; 14 (both); 15 (outflows); 7 (inflows) - Iceland: 69; 23; 7 (both); 11 (outflows); 5 (inflows) - Latvia: 88; 33; 17 (both); 11 (outflows); 5 (inflows) - Lithuania: 100; 40; 11 (both); 25 (outflows); 4 (inflows) - Norway: 127; 48; 14 (both); 17 (outflows); 17 (inflows) - Sweden: 135; 49; 20 (both); 25 (outflows); 4 (inflows) - Observations: - Sweden, Norway, Denmark have the highest number of countries with insufficiently explained flows; for Sweden and Denmark these are predominantly outflows; Norway has a high number of inflows insufficiently explained. - UK remains main counterparty by payments value for most countries but payments with the UK are insufficiently explained by fundamentals for all countries except Iceland. - Luxembourg and Ireland show rapid increases in payments not explained by fundamentals; acceleration coincided with decrease in payments with the UK. ### NRAs, geographic risk analysis, and tailored higher-risk country lists - Variation in NRA geographic ML/TF analysis: - Baltic NRAs analyze foreign ML threats in detail; majority of NRAs do not include foreign ML threats analysis. - Few NRAs analyze cross-border payments, non-resident deposits, and related indicators comprehensively. - Use of external lists: - Authorities use FATF grey list and EC higher-risk third country lists; region has minimal flows with these lists (0.5% with FATF grey list countries; 0.1% with EC higher-risk third countries since 2013). - Two-thirds of flows with FATF grey list driven by Turkey and United Arab Emirates. - Recommendation: - Develop national higher-risk country lists reflecting country-specific ML/TF threats and cross-border payment patterns. - Incorporate macro-economic external sector statistics, business model scrutiny, and payment service provider linkages into cross-border ML/TF risk methodology. - Countries exposed to higher ML cross-border payment risks should consider more regular updates (e.g., annual) of cross-border payments indicators. ### Supervisory ML/TF risk assessment models — findings and model enhancements - Common supervisory approach: inherent ML/TF risk + controls adequacy → residual risk score. - Key model issues: - Inherent ML/TF risk often underweighted relative to controls, potentially understating high inherent risk entities. - Significant variance in entity-level risk ratings across comparable banks, suggesting methodological inconsistencies. - Over-reliance on control adequacy can be misleading; controls cannot fully mitigate inherent risk. - Inherent risk weightages — product risk: - Most countries assign product risk typically 20-25% (anonymized country values presented including 25%, 41%, 50%, 25%, 10%, 20%20% etc. as in Figure values). - Recommendation: increase weight attributed to product risk; product risk should drive inherent risk determination. - Product risk indicators should measure volume of activity across product categories rather than binary presence/absence. - Granularity gaps: - Product, customer, geographic, and delivery channel indicators often lack disaggregation by values/volumes and specific high-risk subcategories. - Recommendation: enhance granularity of supervisory returns, especially transaction-level data and cross-border payment breakdowns. - “Nature, scale and complexity”: - Most models lack formal assessment of business complexity and size; recommendation to include such indicators and seek regional supervisory college inputs. - Data analytics: - Some authorities use excel-based models; recommendation to adopt machine learning, network analysis, and big data tools to refine risk assessments. - Good-practice examples: De Nederlandsche Bank (network analysis, supervised ML), FINTRAC heuristic model. ### AML/CFT supervisory practices, colleges, and cooperation - Supervisory enhancements implemented regionally: - greater prioritization of AML/CFT, establishment of AML/CFT divisions, standalone inspections, advanced supervisory tools, improved statistical-gathering, increased outreach. - Thematic inspections: - Shift from repeated full-scope inspections to targeted/thematic inspections; thematic scope varies and should be risk-sensitive. - Recommendation: continue moving towards better-targeted thematic inspections guided by data and risk analysis. - AML/CFT supervisory colleges and cross-border cooperation: - EBA framework and EuReCA reporting system; first AML/CFT colleges for banks set up in 2020. - Colleges intended where institutions operate in at least three EU Member States; lead supervisor responsible for head office supervision. - Regional good practice: a regional supervisory college conducted coordinated supervision in 2021 with simultaneous onsite inspections across three countries. - Recommendation: further leverage colleges for proactive detection, joint inspections, cross-border supervisory strategies, and coordinated follow-up on deficiencies. - Regional initiatives and PPPs: - Nordic-Baltic Stability Group (formed 2018) and Nordic Baltic AML/CFT Working Group (mandate August 2019) promote cooperation, methodological exchange, and coordinated supervision. - Public-private partnerships (PPPs) and private-private pilots (Tribank, MAS COSMIC, BIS Project Aurora) demonstrate data-pooling and collaborative analytics potential, subject to data protection constraints. - Cooperation between prudential and AML/CFT supervisors: - Strong structured information exchange recommended, including authorization/licensing, fit-and-proper tests, governance, risk management, enforcement actions. - Recommendation: maintain and deepen channels of communication; AML/CFT supervisors should deepen understanding of nexus between AML/CFT weaknesses and financial stability. ### Crypto assets (CAs) and CASPs — risks, regulatory status, and recommendations - Sector risk characteristics: - Crypto assets have heightened anonymity, limited traceability, low-cost global reach, options for limited intermediation and regulatory arbitrage; FATF (2021) noted mainstreaming of criminal activity using crypto assets. - CASP population and concentration: - "fewer than 10 registered CASPs in 4 out of the 8 countries." - Two countries have sizeable CASP populations as of April 2023; one country is an outlier with "around 300 registered CASPs." - Small number of CASPs account for majority market share. - Legal and supervisory gaps: - All countries amended domestic legal frameworks to regulate CASPs, but some frameworks do not fully align with FATF recommendations (gaps in covering all five FATF activity categories, lowered occasional transaction thresholds to 1000 EUR/USD, and incorporation of the travel rule). - Seven out of eight countries have registration regimes; one uses licensing; registration regimes vary from light-touch notifications to detailed assessment. - MiCA (May 2023) and recast Transfer of Funds Regulation (TFR) will affect market entry, travel rule, and harmonization (MiCA expected after an "18-month transitional period"). - Data and supervisory capacity gaps: - Entity-level risk assessment for CASPs is nascent; most countries have not begun systematic entity-level assessments. - Data collection is underdeveloped; many countries revising returns to collect CASP-specific information (scale of operations, product mix, anonymity-enhancing services). - Recommendations: - Align legal frameworks with FATF standards. - Tailor sectoral/entity risk models with CASP-specific indicators and weightages. - Ensure resourcing and capacity (blockchain analytics, specialized skills) match sector growth and risks. - Develop regional information-sharing network for CASP authorizations and supervision data. ### Financial integrity (FI) events and financial stability — empirical findings and stress-testing guidance - Objective and approach: - Pilot stress testing framework to integrate FI issues into banking-sector risk analysis using past FI events and market/supervisory data. - Event-study comparisons of equity prices, CDS spreads, and deposits around FI events vs an EU benchmark; data limitations and small sample size noted. - Key empirical findings: - Equity prices: affected banks average decline 11 percent; third quartile decline 18 percent; up to 23 percent in examples. - Credit risk (5Y CDS): affected bank increases ~15 basis points; other banks see smaller increases. - Deposits and liquidity: - Affected banks experienced deposit declines between month before and month after FI events; largest withdrawals from Other Financial Corporations (OFCs), credit institutions, and non-financial corporates. - Other domestic banks often saw deposit increases (substitution effects). - Example historic metric: ABLV experienced 23% deposit outflows in three days in February 2018. - Run-off comparison: actual OFC run-offs higher than FSAP stress-testing assumptions for certain cases; volatility of OFC deposits noted. - Stress-test illustrative calibration: - Affected bank shocks: - Equity price decline: 18 percent - CDS spreads increase: 15 basis points - Deposit outflows: 7 percent (pilot; actual could be higher) - Note: ABLV example 23 percent in three days. - Other banks in country shocks: - Stock price decline: 6 percent - CDS increase: 5 basis points - Deposit outflows: 4 percent - Recommendation: authorities should explore calibrating stress test scenarios featuring FI issues and apply them to banks vulnerable to FI issues, using financial flow analysis and supervisory ML/TF risk assessment. - Contagion analysis: - Equity contagion: conditional on one bank facing a large negative equity shock, other banks experience declines; large regional banks (Swedbank, SEB, Svenska) associated with largest contagion (declines > 8% on average). - CDS contagion: Nordea highest level of spillovers (Average TO for NOR = 37.5); Swedbank most vulnerable (other-bank shocks associated with ~38 basis points increase). - Liquidity contagion: FI events transnational in dimension could be associated with deposit outflows for other banks in the region with exposure to the origin country. - Data and methodological caveats: - Small sample of FI events (four events 2018–2019 for deposit analysis; limited direct observations). - Uncontrolled overlapping events may bias estimates. - Results exploratory and subject to uncertainty; further work and supervisory data needed to improve robustness. ### Country-specific highlights and targeted recommendations (selected) - Denmark: - Material flows with 148 jurisdictions; second highest ratio of cross-border payments’ value to GDP and deposits; IFCs increased fivefold since 2017; staff detect increasing outlier activity since early 2021. - Recommendations: develop national mechanism for monitoring cross-border flows and correspondent payments; collect data on correspondent banking provision. - Estonia: - Aggregate flows dropped by three-fourths from 2013 peak to 2017 monthly average, doubled since January 2020; ratio of payments to GDP above regional average. - Recommendations: focus monitoring on payment service provider business models; refine higher-risk country list (currently extensive at 110 jurisdictions) to prioritize material flows. - Finland: - Material financial flows with 115 jurisdictions; outlier activity elevated since end-2021; IFCs account for a third of jurisdictions with insufficiently explained flows. - Recommendations: develop national monitoring mechanism; enhance granularity of supervisory data; consider supervisory resource increases. - Iceland: - Lowest aggregate cross-border flows and geographic reach; flows stable; minimal outlier activity. - Recommendations: develop higher-risk country list based on flows and strengthen toolkit to detect unauthorized VASPs. - Latvia: - One of the smallest aggregate flows; sharp contraction after 2018 reforms; 2020 NRA detailed on cross-border and non-resident risks (good practice). - Recommendations: incorporate economic linkages into cross-border ML/TF analysis; develop VASP licensing regime (expected in 2024). - Lithuania: - Material flows with 100 jurisdictions; high outlier activity since 2020 (machine learning detected); fintech hub growth increased cross-border payments (CENTROlink data not fully captured). - Recommendations: develop national monitoring mechanism and operationalize ML/TF higher-risk country understanding. - Norway: - Material flows with 127 jurisdictions; IFCs (Luxembourg, Ireland) now major counterparties with outlier patterns; recommendation to deepen cooperation with Tax Administration and FIU to enhance payments data use. - Sweden: - Most material cross-border activity (135 jurisdictions); increasing outlier activity since early 2021 (Belgium as main outflow-outlier destination; Ireland main inflow-outlier source). - Recommendations: expand periodic reporting granularity; assess correspondent banking ML/TF risks on a tiered basis; ensure supervisory resourcing aligned to minimum engagement model. ### Key cross-cutting policy recommendations (condensed) - Financial flows monitoring: - Develop national mechanisms for comprehensive AML/CFT monitoring of cross-border payments (including correspondent banking) for countries with material flows; update regularly (e.g., annual). - Integrate aggregate payments data and economic fundamentals into NRAs and supervisory risk models. - Supervisory models and data: - Rebalance supervisory ML/TF risk models to assign greater weight to inherent/product risk; increase granularity of product/customer/geographic/delivery channel indicators and collect transaction-level data where feasible. - Adopt minimum engagement models calibrated to entity risk and review resource adequacy against these models. - Expand use of data analytics (unsupervised/supervised ML, network analysis, NLP) to detect outliers and refine supervisory targeting. - Cross-border cooperation: - Strengthen use of AML/CFT supervisory colleges for proactive cross-border strategies, joint inspections, and coordinated follow-up. - Enhance regional information-sharing platforms (including CASP authorization/rejection data) and leverage PPPs and pilots with data protection safeguards. - Crypto assets and CASPs: - Align domestic legal frameworks with FATF standards (including FATF travel rule and lowered occasional transaction thresholds). - Tailor CASP risk models, collect CASP-specific supervisory returns, and invest in blockchain analytics and supervisory capacity. - Financial stability integration: - Incorporate FI scenarios into stress tests using illustrative calibrations (e.g., equity decline 18 percent, CDS +15 basis points, deposit outflows 7 percent for affected bank), refine with more event data and supervisory inputs. - Use financial flow analysis and supervisory assessments to identify vulnerable banks and calibrate Pillar 2/other supervisory measures accordingly. *Source: INTRODUCTION and selected excerpts (content unit 1eurea2023003) from the IMF Technical Assistance Report — Nordic-Baltic Region: Financial Flows Analysis, AML/CFT Supervision, and Financial Stability.* ### INTRODUCTION __________________________________________________________________ 8 ### INTRODUCTION ### Purpose and scope - Recent money laundering cases exposed financial integrity risks from cross-border payments and potential impact on financial stability to the integrated Nordic-Baltic financial sector, attracted international scrutiny of anti-money laundering and combating the financing of terrorism (AML/CFT) supervision throughout the region, and accelerated the momentum for reform. - The purpose of the project is to conduct an analysis of cross-border money laundering (ML) threats and vulnerabilities in the Nordic-Baltic region — encompassing Denmark, Estonia, Finland, Iceland, Latvia, Lithuania, Norway, and Sweden (the Nordic-Baltic Constituency or NBC) — and issue a final report containing recommendations for mitigating the potential risks. - The IMF was mandated by AML/CFT concerned authorities, including the AML/CFT supervisors and Financial Intelligence Units (FIUs) in the Nordic Baltic region, to conduct the analysis and produce this report in response to the authorities’ expressed wish to improve cooperation with other authorities across borders, particularly for AML/CFT risk-based supervision. - This regional report: - analyzes selected aspects of the Nordic-Baltic region’s AML/CFT regimes; - focuses on key money-laundering threats resulting from a novel financial flows analysis (based on cross-border payments data); - examines vulnerabilities related to AML/CFT supervision of the banking sector and crypto asset service providers; and - assesses the potential impact of financial integrity failures on financial stability. - The report provides recommendations to strengthen the effectiveness of AML/CFT frameworks in relation to those three areas while distinguishing what falls within the AML/CFT international standards and what is considered good practices. ### Key contextual findings and background on risk - Various international banking scandals concerning AML/CFT breaches have taken place in the Nordic Baltic region, with far-reaching economic and reputational consequences. - Many of these scandals occurred when AML/CFT standards and their application were nascent, with some instances in 2005 although they would be discovered well into 2015 and beyond, including some taking place up to 2017. - These scandals underscored the importance of international cooperation and strong AML/CFT regulatory frameworks. ### Case example: Danske Bank (Estonian branch) - Timeline and corporate links: - The Danish bank acquired in 2007 the Finland-based Sampo Bank, which also had an Estonian branch. - At the Estonian branch, during 2007–2013, 44% of all deposits came from non-resident customers. - Transaction volume and flows: - These customers conducted around 7.5 million transactions with an aggregated flow of money added up to approximately 200 billion euros. - Operational and compliance deficiencies: - The Estonian branch had its own IT platforms, and the procedural documentation was written in Estonian or Russian, contributing to Danske Bank’s lack of adequate awareness of branch activities. - Danske Bank wrongly assumed that the branch was compliant with AML/CFT requirements established by the applicable regulations in Estonia. - Around 15,000 customers were involved in suspicious transactions, including politically exposed persons and their business associates or family members. - As per the Danish FSA reports, in 2012, non-resident Russian portfolios made up to 35% of the profits of the Estonian branch while the overall percentage of Russian clients in the branch was 8%. - A critical report sent by the Estonian FSA was discussed at Danske’s board but went ignored; the minutes of those meetings did not include any changes to the bank’s AML/CFT controls. - Outcomes and penalties: - The bank was forced to close the Estonian branch in 2019 and pled guilty to fraud in the U.S, forfeiting $2 billion along with an additional fine for EUR 470 million in Denmark. ### Institutional oversight and acknowledgements - The report was prepared under the oversight and guidance of Mr. Chady El Khoury (Deputy Division Chief, IMF Legal Department). - The authors received comments and advice from the European Department, Mr. Mindaugas Leika and Mr. Ivo Krznar (Monetary and Capital Markets Department), and research assistance from IMF Legal Department externs and other contributors. *Source: INTRODUCTION (content unit 1eurea2023003) from the IMF technical assistance report.* ### 3. The geographical closeness to other former Soviet countries and the Commonwealth of ### 3. The geographical closeness to other former Soviet countries and the Commonwealth of ### Geographical proximity, oligarch-related flows, and structural vulnerabilities - The fall of the Soviet Union and subsequent privatization gave rise to a class of high-net worth individuals ("oligarchs"). - A subset of these customers has been involved in opaque business practices and the obfuscation of their source of wealth, and in well documented cases, they have been acting as strawmen on behalf of powerful political figures. - Several Nordic-Baltic countries became significant recipients of these funds, sometimes ill-gotten either due to political connections or due to illicit business practices and lack of accountability. - Tracing funds and sources of wealth is challenging due to the lack of accurate or verifiable sources of information. - Oligarchs have used complex legal structures to layer and separate themselves from income sources, including trusts, shelf companies, compartmentalized societies, special purpose vehicles, and offshore financial centers. ### IMF engagement and common supervisory recommendations - IMF surveillance covered the Nordic-Baltic region through Article IV Consultations and Financial Sector Assessment Programs with several common recommendations: - ensure accurate beneficial ownership information; - enhanced risk-based supervision and a risk-based approach on its implementation; - ensure adequate resources to the involved authorities; - address ML/TF issues from non-resident and cross-border financial activities; - fine-tune inspections of banks; - consolidate the fintech sector for countries where it is mature; - step up cross-border supervision, including cooperation with international authorities; - improve supervisors’ capabilities, in particular to fintech; - strengthen regulatory frameworks for crypto asset service providers (CASPs). ### FATF mutual evaluations and implementation gaps - Several AML/CFT-related banking scandals occurred while countries were undergoing or preparing for the FATF Fourth Round of Mutual Evaluations. - The FATF fourth round focuses on the effectiveness of AML/CFT frameworks. - Although all Nordic-Baltic countries improved legal frameworks and cooperation capabilities, effective implementation remains a challenge as observed in FATF assessments (to date) with respect to risk-based supervision. ### Financial integrity events and risks to financial stability - The Nordic-Baltic region has seen several cases of high-profile AML/CFT failings events over the last few years, potentially affecting banking sector financial soundness. These events involved banks with significant cross-border activity. - Given the high degree of integration in the region, assessing their impact is key to understanding how financial integrity events can affect financial stability at country and regional levels. - Potential short- and medium-term risks from financial integrity (FI) issues: - Short-term: tensions related to wholesale funding (reputational impact and higher credit risk) and liquidity (due to outflows and a possible decline in counterbalancing capacity). - Medium-term: higher funding costs for affected banks and reduced exposures to countries where FI issues occurred. - Resulting actions could include cutbacks in financial services to residents (if domestic banking sectors rely on cross-border banking groups) and de-risking or termination of correspondent bank relationships, which could weigh on financing activity and ultimately reduce economic activity (Erbenova et al, 2016). ### Methodological note on financial flows analysis - Payments data analyzed are wire transfers between customers of financial institutions (households, non-financial corporates, and non-bank financial corporates). - Origination and beneficiary countries are determined by the registration country of the financial institution whose customer is the initiator or final recipient. - Exclusions and limitations: - Does not cover non-financial instruments to transfer value, such as trade mis-invoicing, cross-border cash transportation, and crypto assets. - Does not fully capture credit and debit card payments and some money transfer settlement arrangements. - Provision of correspondent banking services is not included in payments by customers and is analyzed separately (Section E). - Payments data are aggregated and anonymized (monthly on a bank payments corridor level) and customer and purpose information was not available. - Analysis timeframe: while payments data for 2013–2019 are included as contextual information, results presented are based on data since January 2020. - Analysis is presented on a nominal basis; when benchmarked against regional GDP, volatility in year-on-year flows is reduced. - Project findings are aimed at contributing to understanding ML risk from cross-border payments at country and regional levels rather than identifying illicit activity. ### Macro-trends and materiality of aggregate flows - Regional trends: - Average aggregate monthly flows decreased by 8% from 2013–2014 to 2015–2016, then increased by 23% from 2015–2016 to 2020–2022, resulting in an overall 13% increase in average monthly aggregate flows from 2013 to date. - Regional inflows and outflows are notably stable and balanced, with inflows and outflows closely correlated (R squared for regional inflows and outflows of 0.94). - Country materiality: - Sweden, Denmark, and Finland have the most material flows both in nominal terms and benchmarked against GDP and value of deposits. - Estonia has the fourth most material flows and the most of any country in the Baltic region, followed by Norway, Latvia, and Lithuania. - Iceland has the least material flows in the region. - Changes since 2013: - Six out of the eight Nordic-Baltic countries have seen an increase in aggregate flows since 2013: Denmark, Finland, Sweden, Iceland, Estonia, Lithuania. - Norway and Latvia have lower aggregate flows in July 2022 than in January of 2013; Latvia averaged around 20% of the aggregate flow’s levels of January 2013 since mid-2019. - Estonia experienced a drop from elevated 2013–2014 levels but has seen increasing flows in recent years. - Lithuania’s fintech hub growth increased cross-border payments, with most transactions conducted by non-residents with origination and destination outside Lithuania, increasing transnational ML risks (data for Lithuania does not fully capture payments via Bank of Lithuania’s CENTROlink). - Most Nordic-Baltic countries registered an upward trend in cross-border payments value starting in 2020. ### Geographic spread and counterparty trends - The region has material flows with seventy-one countries. - Main payments counterparties include Europe (UK, Germany, Luxembourg, France, Belgium, Ireland, Netherlands, Switzerland, Spain), as well as the U.S. and Hong Kong. - Regional counterparty groupings: - The G7 and EU are dominant counterparties. - From 2013 to 2022, CIS experienced a 67% reduction in inflows to the Nordic-Baltic region. - Aggregate flows changes since 2013: - G7 countries increased by 28%; - intraregional flows increased by 38%; - North America increased by 54%; - Asia increased by 29%; - Oceania increased by 23%; - Africa increased by 27%. - Two groupings with very significant increases since 2013: - EU increased by 121%; - International Financial Centers (IFCs) increased by 238%. - EU’s share of total aggregate flows increased from 37% in 2017 -2018 to 58% in 2020–2022. - IFC’s share increased from 7% in 2018 -2019 to 15% in 2020–2022. ### Brexit effects (Box 1) - UK referendum and formal exit processes led to: - Initial growth in flows with the UK after the June 2016 referendum and March 2017 Article 50 trigger, then steady decline approaching January 2020 formal exit. - Concurrent growth of flows with EU financial centers Germany, Ireland, and Luxembourg, consistent with relocation of entities from the UK to EU financial centers. - Implication: shifting of higher ML/TF risk transactions due to relocations requires consideration by national AML/CFT authorities. ### Monitoring, analytics, and country-level recommendation - Monitoring cross-border financial flows provides deeper understanding of external ML threats and evolving cross-border risks. - National ML/TF Risk Assessments (NRAs) could be strengthened by including analysis of aggregate payments data to assess materiality of cross-border payments and associated ML risks. - Countries exposed to higher ML cross-border payment risks should consider more regular updates and analysis (e.g., annual) of cross-border payments indicators, particularly when exposures to potentially higher-risk countries increase. - Leveraging advanced analytical methods (outlier detection algorithms, neural networks) on transaction-level data can provide detailed insights on unusual patterns but requires substantial investment in resources and capacity. - Country-Level Recommendation: Countries with the most material financial flows could increase their AML/CFT effectiveness by developing a national mechanism for comprehensive AML/CFT monitoring of cross-border payments. ### Intraregional flows and country shares - Nordic countries account for most regional cross-border financial flows; their share has increased over time. - Country share changes (2013 to 2021) highlighted: - Sweden increased from 41% in 2013 to 47% in 2021. - Denmark increased from 18% in 2013 to 22% in 2021. - Finland increased from 13% to 15%. - Iceland unchanged at 0.2% of total aggregate Nordic-Baltic flows. - Norway decreased from 19% in 2013 to 13% in 2021. - Baltic countries decreased: Latvia from 6% to 0.5%; Estonia from 1.9% to 0.8%. - Lithuania increased from 0.7% in 2013 to 0.9% in 2021. - Overall Baltic share decreased from 8.7% in 2013 to 2.2% in 2021. - Intraregional integration patterns: - Almost all Nordic countries’ flows with the Nordic-Baltic region go to other Nordic countries. - Nearly two thirds of Baltic countries' intraregional flows go to other Baltic countries. - Table: Intraregional aggregate flows as a share of total aggregate flows (2020 – July 2022) - Norway 31% - Finland 27% - Denmark 26% - Estonia 25% - Iceland 22% - Sweden 22% - Lithuania 18% - Latvia 9% - Norway has the largest share of total flows accounted for by flows with other Nordic-Baltic countries (31%), followed by Finland (27%) and Denmark (26%). Latvia’s share is notably smaller at 9%. *IMF | Technical Assistance Report — Nordic-Baltic Region: Financial Flows Analysis, AML/CFT Supervision, and Financial Stability* ### 17. The depth of geographic ML/TF risk analysis and understanding differs among the Nordic- ### 17. The depth of geographic ML/TF risk analysis and understanding differs among the Nordic- ### Variation in NRA geographic ML/TF risk analysis - The NRAs of the Baltic countries analyze foreign ML threats in detail and identify specific predicate offences and typologies. - The majority of NRAs in the region do not include an analysis of foreign ML threats. - Only few NRAs analyze relevant statistics on cross-border payments, non-resident deposits, and other indicators of non-resident activity that could be combined with other data to develop a comprehensive understanding of non-resident ML risks. - A potential area for strengthening NRAs is adding an analysis of ML vulnerabilities (e.g., of various sectors or of the jurisdiction overall) to non-resident and cross-border activity. - Deepening and broadening understanding of foreign ML/TF risks is particularly important for countries in the region with material levels of cross-border payments and non-resident activity. ### Use of external lists and actual regional flows - Nordic-Baltic country authorities utilize the FATF grey list, European Commission (EC) higher-risk third country list and non-cooperative tax jurisdictions lists to identify higher-risk countries. - Countries follow the FATF increased monitoring list as required by international standards on AML/CFT. - The EC produces a list of high risk third countries that largely overlap with the FATF list. - The Nordic-Baltic region has minimal flows with FATF and EC higher-risk countries, representing 0.5% and 0.1% of all the region’s cross border financial flows respectively since 2013. - The majority of flows with these externally identified higher-risk countries are driven by flows with Turkey and United Arab Emirates, which represent more than two thirds of the flows with FATF grey list countries. - Because these external higher-risk lists correspond to immaterial flows for the region, countries could produce more robust risk analysis by developing their own understanding of cross-border and non-resident activity risks and a customized list of high-risk jurisdictions. ### Improving national understanding of higher-risk countries and cross-border ML/TF risks - Recommendation: Develop national understanding of higher-risk countries reflecting country-specific ML/TF threats and recent changes in cross-border payment patterns. - Suggested additional inputs to ML/TF cross-border risk methodology: - Macro-economic external sector statistics (e.g., trade in services, portfolio, and direct investments). - Scrutiny of economic rationale for financial flows with potentially higher-risk countries. - Information on business models and cross-border links of the Nordic-Baltic financial sector, with focus on payment service providers. - Because flows with FATF grey list and EC third-party higher-risk jurisdictions are immaterial for all Nordic-Baltic countries, refocus enhanced monitoring on jurisdictions with substantial flows that have the potential for material ML threat. - Higher risk jurisdictions can be identified through in-depth assessment of cross-border ML/TF risks specific to the risk profile, context, and financial sector of Nordic-Baltic countries. - Enhanced country risk understanding would allow targeted AML policies, for example: - Requirement of enhanced due diligence measures for customers from or related to higher-risk countries. - Enhanced reporting mechanisms of financial transactions with entities in higher-risk countries. - Information sharing and regional cooperation (e.g., Nordic-Baltic AML/CFT Working Group) would be beneficial given commonality of ML/TF cross-border threats. ### Value of economic fundamentals and outlier detection analyses - Monitoring cross-border payments combined with economic fundamentals and outlier detection analyses provides an up-to-date understanding of cross-border ML risks and helps identify emerging threats. - Countries tend to focus on jurisdictions involved in past breaches that now have drastically decreased levels of payments (example: flows with CIS countries). - Leveraging data analytics (economic fundamentals analysis and transaction-level outlier detection) yields a more granular understanding of threat level by payment direction and pattern. - A comprehensive understanding of geographic ML/TF risks requires domestic coordination, including as part of NRAs, and informs risk-based AML/CFT supervision and FIU tactical and strategic analyses. - Tax authorities can provide important information regarding vulnerabilities in tax frameworks or practices of other countries that can be abused for tax offences. - Authorities could distinguish higher ML risk countries for monitoring financial flows and risk scoring of cross-border payments from the risk of provision of non-transparent corporate vehicles or harmful tax practices that do not involve financial flows but represent a customer risk factor. ### Country-Level Recommendation - National understanding of ML/TF cross-border and non-resident risks could be enhanced further by incorporating additional sources of data (e.g., macro-economic variables such as trade and investments) and other information (e.g., business models of financial institutions and their foreign linkages) into the national/sectoral risk assessments. ### Economic context and economic fundamentals analysis (method and high-level findings) - Main cross-border economic linkages for Nordic-Baltic countries are with each other, G7 and European Economic Area (EEA) countries; financial centers Luxembourg and Ireland are top-10 counterparties for most countries, predominately due to investment flows and services trade. - Geographic reach is defined as the number of jurisdictions with overall payments of 0.1 percent of given country’s annual GDP or USD 100 million (whichever is lower) during January 2020-July 2022 (material financial flows). - The IMF economic fundamentals analysis compares inflows to and outflows from each Nordic-Baltic country with underlying economic linkages (i) trade in goods; (ii) trade in services; (iii) portfolio investments; (iv) direct investments. - Financial flows are considered “sufficiently explained” if: - the ratio of economic fundamentals value to the payments value (inflows and outflows separately) is higher than 30 percent, or - the overall ratio of economic linkages’ value to payments value is higher than 75 percent. - Insufficiently explained financial flows do not indicate illicit activity; they can include interpersonal transfers, cross-border payment intermediation by a regional financial group, or other economic activity not captured by trade and investment statistics. ### Economic fundamentals results (Table 2 highlights) - Denmark: Material flows (jurisdictions) 148; Insufficiently explained flows (jurisdictions) 44; Insufficiently explained flows (breakdown by directions): 15 (both directions); 22 (unexplained outflows); 7 (inflows) - Estonia: Material flows (jurisdictions) 91; Insufficiently explained flows (jurisdictions) 43; Breakdown: 20 (both); 15 (outflows); 8 (inflows) - Finland: Material flows (jurisdictions) 115; Insufficiently explained flows (jurisdictions) 36; Breakdown: 14 (both); 15 (outflows); 7 (inflows) - Iceland: Material flows (jurisdictions) 69; Insufficiently explained flows (jurisdictions) 23; Breakdown: 7 (both); 11 (outflows); 5 (inflows) - Latvia: Material flows (jurisdictions) 88; Insufficiently explained flows (jurisdictions) 33; Breakdown: 17 (both); 11 (outflows); 5 (inflows) - Lithuania: Material flows (jurisdictions) 100; Insufficiently explained flows (jurisdictions) 40; Breakdown: 11 (both); 25 (outflows); 4 (inflows) - Norway: Material flows (jurisdictions) 127; Insufficiently explained flows (jurisdictions) 48; Breakdown: 14 (both); 17 (outflows); 17 (inflows) - Sweden: Material flows (jurisdictions) 135; Insufficiently explained flows (jurisdictions) 49; Breakdown: 20 (both); 25 (outflows); 4 (inflows) ### Observations on counterparties and specific jurisdictions - Sweden, Norway, and Denmark have the highest number of countries with insufficiently explained financial flows in the Nordic-Baltic region. - For Sweden and Denmark the payments insufficiently explained by the fundamentals are predominantly on the outflows side. - Norway recorded a high number of inflows insufficiently explained by the economic fundamentals. - Iceland and Latvia have a low share of and the lowest number of countries-payment counterparties with insufficiently explained financial flows. - Top-10 counterparties: - Majority of Nordic-Baltic countries have financial flows with their top-10 counterparties well explained by economic fundamentals. - Iceland: economic linkages sufficiently explain inflows from and outflows to all top-10 payments counterparties. - Estonia and Lithuania: flows with the majority of top-10 counterparties can be explained by fundamentals. - Finland and Norway: payments with top-10 counterparties are less explained by fundamentals. - Sweden and Denmark: few countries/directions of payments with main counterparties are explained by fundamentals. - United Kingdom: - Despite decreases since Brexit, the UK remains the main counterparty by payments value for majority of Nordic-Baltic countries (and in top-10 for all). - Payments with the UK are insufficiently explained by economic fundamentals for all countries in the region except Iceland. - Estonia and Lithuania are the only countries with financial flows with the UK that have increased since the UK’s decision to leave the EU, with growth starting mid-2020 due to entry of payment service providers. - Norway’s and Denmark’s flows with the UK registered a mild increase in mid-2021 but remain significantly lower than levels of several years ago. - United States: - Payments with the US are well explained by economic fundamentals in all Nordic-Baltic countries. - Luxembourg and Ireland: - Rapid increases in payments with Luxembourg that are not explained by the economic fundamentals have placed Luxembourg among the five main counterparties for the majority of countries in the region. - Ireland increased financial flows with all countries in the region and entered the top-10 counterparties for most countries, with higher rate of increase in inflows from Ireland. - High inflows from Ireland are not explained by fundamentals in Norway, Denmark, and Sweden, while lower increase in outflows to Ireland is explained by substantial investment inflows and imports of services from Ireland. - The acceleration in payments with Luxembourg and Ireland coincided with the decrease in payments with the UK, potentially related to the UK leaving the EU and associated relocation of some financial institutions and activity. *IMF | Technical Assistance Report — Nordic-Baltic Region: Financial Flows Analysis, AML/CFT Supervision, and Financial Stability* ### 29. The accelerating flows with Ireland and Luxembourg are part of the broader upward trend ### The accelerating flows with Ireland and Luxembourg are part of the broader upward trend in Nordic-Baltic region’s share of flows with IFCs since 2017 ### Flows with International Financial Centers (IFCs): aggregate trends and concentration - Ireland and Luxembourg account for 48% and 14% of all flows with the IFC country grouping respectively. - The value and total share of aggregate flows with financial centers began to increase in 2017, increasing by 22% from the 2016 levels. - Year-on-year increases in average aggregate monthly flows with IFCs: - 2018: 22% increase compared to 2017 - 2019: 38% increase - 2020: 46% increase - 2021: 31% increase - All countries in the Nordic-Baltic region experienced a rapid increase in payments with IFCs in the last few years; the trend was driven primarily by Ireland and Luxembourg, but a similar increasing trend was observed across the majority of other IFCs as well. ### Ireland and Luxembourg: direction and composition of flows - Composition differences: - Ireland: strong net inflows to the Nordic-Baltic region. - Average monthly net inflows from Ireland jumped by nearly two and a half times in 2019 following stable flows between 2013 and 2018. - The trend of doubling of flows every year continued into 2020 and 2021 (21.2 bln. USD), moderating in the first six months of 2022. - Luxembourg: increasing net outflows from the Nordic-Baltic region. - Both inflows and outflows increased, but the rate of increase in outflows was more significant, resulting in large net outflows. - The increase in flows with both countries should be monitored closely given their position as financial centers, with a focus on the strong net inflows from Ireland and net outflows to Luxembourg. ### Other counterparties and regional patterns not explained by fundamentals - Accelerating flows with Germany, France and Belgium are not sufficiently explained by the economic fundamentals in some Nordic countries and to a lesser extent Baltic countries. - Outflows to Switzerland from the three Baltic countries (end of their top-10 counterparties) and from Sweden and Denmark (top-20 counterparties) are not well explained by fundamentals. - Secondary IFCs with insufficiently explained flows (often as outflows from the Nordic-Baltic countries) and appearing in the top-25 counterparties for most Nordic-Baltic countries include: - Hong Kong, Singapore, UAE, Liechtenstein, Isle of Man, Jersey, Gibraltar, Mauritius, Bahrain, Bahamas. - Regional country-groupings with flows insufficiently explained by fundamentals: - Middle Eastern countries: Qatar, Jordan, Kuwait most often identified; less material flows with Iraq and Yemen. - CIS exposure has decreased overall, including drastic decrease in payments with Russia and Belarus since the invasion of Ukraine; remaining insufficiently explained flows vary by country (examples: Azerbaijan, Georgia, Kazakhstan, Armenia). - Balkan countries (identified for all Nordic-Baltic countries except Finland): Albania, Montenegro; less material flows with North Macedonia, Bosnia-Herzegovina, Kosovo. - Sub-Saharan Africa: Kenya, Angola, Uganda—particularly material for Finland, Denmark, and Sweden. - Note on risk: Some countries face potential ML and bilateral sanction evasion risks since March 2022 from increasing flows with Georgia, Azerbaijan and Kazakhstan as sanctioned Russian entities may attempt to abuse the financial sectors of these countries for illicit activity. ### Unsupervised outlier detection algorithm: methodology and key findings - Methodology: - IMF staff developed an unsupervised machine learning algorithm based on the Isolation Forest to detect unusual and potentially suspicious patterns of financial flows using transactional payments data and indicators of higher (weak AML/CFT regime, higher economic crimes, financial secrecy, and harmful tax practices) and lower (underlying trade and investments) ML risks. - Economic fundamentals variables (trade and investments) have the largest impact on whether payments are identified as outliers. - Identified outlier activity does not indicate illicit financial flows per se; exogenous shocks can generate outliers. - Temporal and country-level summary (share of outliers in overall payments by value, January 2020–July 2022): - Lithuania: 13.3% - Finland: 9.0% - Denmark: 8.0% - Sweden: 7.0% - Latvia: 3.6% - Norway: 2.5% - Iceland: 2.4% - Estonia: 2.3% - Additional observations: - Outlier financial flows in the Nordic-Baltic region decreased from elevated levels in 2013–2015 and recorded an increase since 2020. - Estonia: outliers decreased since end-2013/early-2014, reemerged since end-2020 at 2.3 percent of overall flows. - Iceland: most outlier activity between 2016 and early 2019; since January 2020 outlier level 2.4 percent of overall flows. - Norway: outliers decreased since mid-2019, slight uptick since late 2021 to 2.5 percent of overall flows. - Latvia: down from 2013–2015 elevated levels; slight uptick in late 2020; 3.6 percent of overall flows. - Sweden and Denmark: outliers grew since early 2021 to 7 and 8 percent of overall flows respectively; notable because they have the highest level of cross-border payments in the region. - Finland: outliers decreased after early 2019 peak but reemerged since end-2021 to 9 percent of overall flows. - Lithuania: outliers have grown rapidly since January 2020, reaching 13.3 percent of overall flows—an elevated level. - Interpretation: Low level of flows outliers for Iceland, Latvia, Norway and Estonia suggests lower ML threat; outlier activity in Lithuania, Denmark, Finland, and Sweden is higher and accelerating and merits further scrutiny and monitoring. ### Outlier geography: inflows and outflows - Inflows-outliers: - Ireland has become the main source of inflows outliers to the Nordic-Baltic countries, replacing Netherlands, with inflows from Ireland accelerating since January 2020. - Other IFC sources of inflows outliers include Liechtenstein, Guernsey, Monaco, and Gibraltar; Cyprus was the main IFC source in earlier periods. - Rapidly increasing inflows from Germany and Belgium to most Nordic-Baltic countries included outlier activity. - Other inflow outlier source countries included Greece, Albania, Montenegro, Uganda, Bangladesh, Angola. - Notably, inflows-outliers since January 2020 do not include inflows from the CIS countries (previously a major source). - Outflows-outliers: - The UK remains the main destination by number of outflows outliers, though value decreased since January 2020. - Accelerating outflows to Belgium comprised the highest value of outflows outliers, particularly for Sweden and Denmark. - Other important destinations by outflow outliers value: US (particularly for Denmark), Germany (for Lithuania and other Baltic countries). - Luxembourg entered top-5 destinations by value of outflows outliers: - First largest destination by value outflows outliers from Iceland - Second for Norway - Third for Lithuania - Outlier activity also identified in outflows to Switzerland, Ireland, Hong Kong, France, Netherlands, Spain. ### Correspondent banking flows: scale, concentration, and counterparties - Trends and materiality: - Value and volume of correspondent banking flows increased, with some volatility, since 2013. - By 2017–2018, the average monthly correspondent banking flows for the region increased by half from 2013 levels with further minor growth in August 2020–July 2022. - Provision of correspondent banking services where material should be monitored as an increase could represent a heightened ML risk. - Regional concentration of correspondent banking activity (share of Nordic-Baltic correspondent banking flows): - Denmark: 50% - Sweden: 22.5% - Finland: 17.7% - Norway: 9% - Lithuania: 0.4% - Estonia: 0.3% - Latvia: 0.1% - Iceland: 0.01% - Regional: 100% - Originator and recipient concentration since 2020 (top-10 countries represent major shares): - Ten countries represented the originator of 85% of all correspondent banking flows and the recipient of 88% of all correspondent banking flows in the region. - Denmark is the largest originator: 15% of all correspondent banking flows that flow through the region. - Sweden is the largest recipient: 20% of all correspondent banking flows that flow through the region. - UK: originator 14% and recipient 13%. - Luxembourg: originator 6% and recipient 6%. - Ireland: originator 2% and recipient 5%. - Interpretation: Correspondent banking flows are heavily concentrated in a small number of originator and recipient countries; the UK, Luxembourg, and Ireland’s significance merits further monitoring given higher-risk designations by several Nordic-Baltic countries. ### Key policy recommendations (country-level and regional) - Country-Level Recommendation (on ML country risks and payment patterns): - Deepen understanding of ML higher-risk countries and payment patterns based on country-specific risk factors and focus on the countries with the most material financial flows, in coordination with all agencies with AML/CFT-relevant mandate, including tax administration. - Country-Level Recommendation (on correspondent banking): - Countries in the region with material provision of correspondent banking services should intensify scrutiny, risk assessments and monitoring of correspondent activities, including those conducted for financial institutions in high-risk countries. *IMF | Technical Assistance Report — Nordic-Baltic Region: Financial Flows Analysis, AML/CFT Supervision, and Financial Stability* ### 41. The Nordic-Baltic region’s cross-border payments between financial institutions ### 41. The Nordic-Baltic region’s cross-border payments between financial institutions ### Cross-border MT202 flow trends and concentration - Aggregate flows between financial institutions are considerably larger than retail payments. - Flows have been stable and balanced since mid-2017. - Prior to mid-2017, inflows and in particular outflows were larger, driven by heightened flows between Nordic-Baltic and US financial institutions. - Nordic-Baltic financial institutions' monthly average outflows in 2015–July 2022 dropped by 82% from 2013–2014 levels. - The US is the largest outflows counterparty (21% of all outflows) and fourth largest counterparty for inflows (11% of all inflows). - The US, Sweden, United Kingdom, and Finland represent the majority of the region’s flows between financial institutions, representing 62% of outflows and 54% of inflows. - Payments between financial institutions (SWIFT Message Type 202, MT202) are presented as low ML/TF risk in the region given the maturity of the country’s financial sector and controls in place; the MT202 analysis is informational and not part of the report’s recommendations. ### Mutual evaluations, legal framework reforms, and supervisory effectiveness - All Nordic-Baltic countries finalized their FATF 4th or MONEYVAL 5th Round Mutual Evaluation Reports (MERs) between 2014 and 2022 with initially weak ratings on Recommendation 26 (supervision of financial institutions). - The overhaul of AML/CFT legal frameworks since 2012 has led to re-ratings on Recommendation 26; current ratings across the region are either “Largely Compliant” or “Compliant”. - Based on the latest Mutual Evaluations, effectiveness remains a significant challenge: Immediate Outcomes 3 and 4 were assessed with “Low” or “Moderate” effectiveness levels across all countries. ### National Risk Assessments (NRAs) — past deficiencies and recent improvements - Common historical NRA shortcomings: methodological failures, lack of coordination between agencies, inadequate data and statistics, and inadequate understanding of ML/TF risks. - These deficiencies undermined country-wide AML/CFT policy formulation and prioritization, cascading into weaker supervisory risk assessments and preventive measures by banks. - Recent developments: all Nordic-Baltic countries have conducted methodological developments and expanded stakeholder engagement (public and private), and have carried out outreach to disseminate NRA findings. ### Common high ML risk sectors identified across NRAs - Sectors/areas frequently identified as high ML risk include: - fintech and crypto assets (mentioned as the highest ML risk in half of the NRAs) - money remittances - physical cross-border transfer of currencies and payments - lawyers and other legal service providers (tax consultants and accountants) - banks - legal business structures and arrangements (including trusts) - payment and e-money institutions - gambling - The recurrence of these common risk areas provides a baseline for regional cooperation and joint supervisory actions. ### Notable AML/CFT vulnerabilities and consequences - Various cases revealed vulnerabilities including: - domestic supervision weaknesses - deficient fit and proper testing of management and shareholders - inadequate preventive measures and transaction monitoring - poor understanding of complex legal vehicles - lack of surveillance on foreign branches - international sanctions breaches - interconnectedness to offshore financial centers - lack of coordination on joint surveillance actions - Consequences include settlements, ongoing legal cases, reputational challenges, and a need to rebuild public confidence. ### Enhancements to AML/CFT supervision and remaining gaps - Supervisory strengthening measures implemented: - greater prioritisation of AML/CFT - enhancements to supervisory ML/TF risk assessment tools - creation of full-fledged AML/CFT divisions with specialized recruitment - standalone AML/CFT inspections - development of advanced supervisory tools (including risk assessment models, supervisory strategy and procedures) - improved statistical-gathering tools enabling more targeted supervisory feedback - increased outreach and guidance to supervised entities - Remaining work: further refinements to methodologies, more detailed data collection and integration, and narrowing residual gaps between banks and other institutions in ML/TF risk understanding. ### Supervisory ML/TF risk assessment of banks — framework and issues - All countries follow the standard supervisory ML/TF risk assessment approach: assessment of inherent ML/TF risk and the adequacy of the AML/CFT control environment, combined to produce a residual risk score (e.g., low, medium, high). - Inherent ML/TF risk factors generally include product/services; customer; geography; and delivery channel. - Key issues identified: - Inherent ML/TF risk is often not attributed sufficient weight in residual risk calculations; equivalent or higher weight to controls over inherent risks can understate entities with high inherent risk. - Entity-level risk ratings for comparable banks vary significantly across the region without adequate explanation, suggesting re-examination may be warranted. - Over-reliance on control adequacy can produce misleading residual ML/TF risk conclusions because controls cannot fully mitigate inherent money laundering risk. - Country-level recommendation: supervisors should consider assigning a higher weighting to inherent risk in supervisory ML/TF risk assessments, with less focus on the adequacy of AML/CFT controls. ### Good practices and model design considerations - Good practice: sectoral risk ratings used as a de-facto baseline for entity-level risk scores — entity scores may exceed sectoral ratings but cannot go lower without sufficient justification; accompany this with documented guidance on ‘exceptions’. - Calculation of inherent risk: some models include additional factors (risk appetite, elements of internal controls) that may distort inherent risk assessment or overlap with control considerations. - Granularity gaps in inherent risk indicators: - Product risk: often lacks full range of product/service offerings and scale of activity. - Customer risk: often lacks disaggregation (e.g., domestic v. foreign PEPs, customers from high-risk jurisdictions); few models measure exposure to high-risk industries. - Geographic risk: some models do not account for average values and volumes of transactions to various country categories. - Delivery channel risk: frequently marginally covered and mainly measured in customer counts (e.g., number of remotely onboarded customers). - Good practice: comprehensive assessment of risk variables measuring nominal values, ratios of relevant aggregates, and percentage change; use of percentile and threshold-based calculations to reflect supervisory risk appetite. ### Suggested country-level enhancement - Many countries should consider enhancing the granularity of risk indicators across inherent risk factors, with weightages attributed in proportion to their risk relevance. *Source: IMF Technical Assistance Report — Nordic-Baltic Region: Financial Flows Analysis, AML/CFT Supervision, and Financial Stability* ### 57. In most instances, the models would benefit from the reassessment of weightages ### 57. In most instances, the models would benefit from the reassessment of weightages ### Inherent risk weightages — product, customer, geography, delivery - Finding: When assessing inherent risk, the analysis of product, customer and geography are the risk factors that should drive the determination. - Finding: Most countries accord an equal (or lower) weightage to product risk as compared to other risk factors, most commonly 20-25% (Figure 31). - Finding: Product risk, in particular, should be the key driver of an entity’s inherent risk assessment; higher risk products (e.g., correspondent banking) significantly drive up an entity’s risk exposure when compared to lower risk products (e.g., mortgages). - Finding: A bank’s attractiveness for money laundering is often driven by the products offered; customer base and geographic spread influence the significance of the risk. - Finding: Delivery risk is a worthwhile consideration but should not equate with the emphasis placed on other risk factors; its significance is diminishing with improvements in remote onboarding measures, industry-wide provision of online services, and increased investments in digital ID systems. - Country-Level Recommendation: Inherent risk assessment in ML/TF risk assessment models should increase weightage attributed to product risk, as part of the methodology. - Figure values as presented (anonymized product risk weightage across countries): 25% 41% 50% 25% 10% 20%20% 0% 10% 20% 30% 40% 50% 60% Country A Country B Country C Country D Country E Country F Country G Country H Not available ### Increased granularity in product risk indicators - Finding: In most instances, product risk ratings are based on a binary assessment of the types of products/services offered by the entity. - Finding: Product risk indicators should measure volume of activity across different product categories to distinguish entities with extensive operations in higher risk products from entities with much lower business in higher risk products. - Country-Level Recommendation: Product risk indicators should be more granular and include measures of volume of activity across product categories. ### “Nature, scale and complexity” considerations - Finding: Almost all risk models lack a formalized and comprehensive assessment of variables related to the ‘nature, scale, and complexity’ of an entity. - Finding: Indicators of this risk type include business structure, complexity in operations, industry and materiality, and key financial indicators (including assets, turnover, deposits, flows, etc.). - Finding: A few regional models incorporate elements such as complexity of structure (measured through the number of domestic branches) or size of the entity, but lack comprehensive analysis. - Regional Recommendation: Countries may explore seeking input from regional counterparts through supervisory colleges in the assessment of a potential ‘nature, scale and complexity’ risk factor to develop a consistent understanding of ML risks related to the entity’s size, scale, and type of operations. ### Internal controls assessment in ML/TF risk methodology - Finding: There is wide variance in the list of control factors considered across the region. - Finding: A few countries include a comprehensive methodology for assessment of internal controls with weightages assigned to various elements and effectiveness of key control measures. - Finding: More commonly, countries use a range of sources (offsite and onsite inspections) to inform controls assessment but do not prescribe specific criteria or indicators. - Recommendation: The model should provide guidance on key elements to consider in an assessment of the entity’s controls framework and relative weightings for these elements to ensure systematic and consistent controls assessments. ### Data collection and granularity - Finding: All countries undertake data collection through supervisory returns as the primary input for risk models. - Finding: Covered countries vary in level of transactional data collected; some collect disaggregated data across inherent risk factors. - Good practice examples: collection of input on cross-border payments, average and total values, disaggregated by geographic spread and customer type (high-risk customers/financial institutions and CASPs), and values of non-resident deposits disaggregated by geography and client type. - Finding: In the main, data and information collected to inform sectoral and entity level assessments of banks lacks granularity. - Common data gaps: lack of information on scale of business across product offerings, exposure to higher risk industries and geographic regions, volume of business conducted through third parties. - Finding: Data collection often emphasizes transaction/customer counts rather than values/volumes of activity, presenting an incomplete understanding of risks. - Country-Level Recommendation: Enhance granularity of supervisory returns for banks, in particular transaction-level data, to better inform assessment and understanding of cross-border, non-resident ML/TF risk. ### Use of data analytics to refine ML/TF risk assessment - Finding: Some risk models are excel-based with limited functionality for large volumes of data; other countries have automated models but could benefit from machine learning, big data mining, and other data analytic tools. - Finding: Several countries are revamping data collection tools and strategies either for AML/CFT supervisory divisions or coordinated with other supervisory workstreams. - Recommendation: Authorities should improve their data toolkit, move towards greater automation, and explore data analytics tools to streamline collection and ensure effective analysis of available data. - Box 3 summary: Advanced data analytics techniques including supervised/unsupervised machine learning, data mining, and network analysis can enhance entity and sectoral risk assessments by identifying risk trends, detecting patterns and anomalies, as well as ascertaining transactional links. - Illustrative examples included: - De Nederlandsche Bank (DNB) developing a network analysis tool to detect links in transfer of funds to high-risk jurisdictions and a text-mining/supervised machine learning tool to analyze submissions on entities’ internal controls framework. - FINTRAC has developed a heuristic model to gauge the effectiveness of an entity’s controls framework and likelihood of non-compliance using extensive data from supervisory returns and external sources. ### AML/CFT supervision of banks — resourcing, engagement models, and strategy - Finding: Increased priority for the AML/CFT supervisory function has generally correlated with resource augmentation, but in some instances resources remain insufficient relative to supervisory population. - Finding: Limitations in resourcing can impact effectiveness, leading to deprioritization of resource-intensive functions (onsite inspections, development of entity risk assessment models). - Finding: Several supervisors have developed ‘minimum engagement models’ to guide depth and frequency of supervisory engagement based on assessed entity risk; the model sets minimum frequency for onsite inspections, offsite assessments, and data collection with activity increasing by risk level. - Recommendation: Supervisors should adopt a sufficiently detailed and calibrated minimum engagement model to ensure adequate risk-sensitive supervisory presence. - Finding: There has been a significant increase in supervisory resources across almost all countries; nevertheless, adequacy of resourcing should be assessed against a minimum engagement model on an ongoing basis. - Country-Level Recommendation: Countries should assess the adequacy of resources on an ongoing basis against changes in size and risk profiles of the supervisory population. - Finding: AML/CFT supervisory strategies are often underdeveloped or not in place; no examples of entity-level strategies for the highest ML/TF risk banks were found. - Finding: Sectoral/entity supervisory strategies can link supervisory activity to identified ML/TF risks and set out specific mitigating activities (onsite full-scope inspections/thematic focus/deep dives, desk-based reviews, outreach, guidance, collaboration, supervisory colleges). - Recommendation: All countries should consider developing specific strategies for the highest risk banks, in collaboration with regional counterparts via supervisory colleges, to exploit synergies and conserve resources. - Finding: Countries are actively carrying out supervision through onsite and offsite activities; there is an increasing trend in number of onsite inspections, partly facilitated by a shift towards targeted or thematic inspections. - Finding: Further work is needed on risk-based prioritization of supervisory activity; in some instances medium/medium-low risk entities receive near equal onsite attention as high-risk entities. *IMF | Technical Assistance Report Nordic-Baltic Region: Financial Flows Analysis, AML/CFT Supervision, and Financial Stability* ### 71. While countries have noted im ro ements in ban ’s com liance ith re enti e ### 1eurea2023003 - 71. While countries have noted im ro ements in ban ’s com liance ith re enti e ### Supervisory effectiveness and current state of bank AML/CFT controls - Findings: - While countries have noted im ro ements in ban ’s com liance ith re enti e measures, there was consensus that banks (across the region) need to take further steps to ensure that AML/CFT systems and controls are effective which points to a need to also step-up AML/CFT supervisory activities. - The level of adequacy of control frameworks varied significantly across banks in the region. - Supervisory activities need to continue to evolve further and adapt. - In the main, supervisory activity is guided by detailed manuals or procedures that map out the su er isor rocess an set out criteria to gui e the assessment o entities’ controls framework and application of key control measures. - Countries have made significant progress to establish risk-based supervisory frameworks; country-level materials often included clear criteria and guidance to ensure thorough and consistent engagement. - Most supervisors pointed to a need for banks to further improve their preventive frameworks with several noting transaction monitoring systems as a particular area of focus. - Country-Level Recommendation: - Countries could consider developing complementary additional best practice guidance – with gathered experience from past inspections and other qualitative input and insights in order to support and assist the supervisory team in their work making proper and aligned assessments. ### Use of data analytics in supervisory activities (Box 4) - Rationale and capabilities: - Advanced data analytics techniques can be used to support supervisory activities by detecting patterns in large volumes of data, identifying system-wide risks and exposure to networks.32 - It allows supervisors to detect and examine outlier transactions in real time, using tools such as machine learning (both supervised and unsupervised) and natural language processing.33 - The COVID-19 pandemic accelerated the use of data analytics tools for offsite supervision.34 - Examples of jurisdictional practices: - Transaction monitoring and anomaly detection: - Monetary Authority of Singapore (MAS) uses analytical supervisory tools to target unusual accounts and transactions, removing the need to manually review transactional data (e.g., review of trade allocations and prices).35 - MAS uses a multi-factor logistic regression model for predicting misconduct risk in entities based on prior compliance, allowing targeted selection of supervisory activities.37 - The Dutch Central Bank uses an isolation forest model to detect outlier transaction and clients for further scrutiny.38 - Unstructured data sources: - Bank of Thailand (BoT) and Bank of Italy (BdI) are developing text analysis tools to analyze board and committee minutes, company filings and analyst reports to identify topics, sentiment, and interaction patterns.39,40 - Information classification: - Guernsey Financial Services Commission uses a natural language processing tool to flag documents requiring material review and to assist categorizing electronic documents; anticipated to be useful for offsite supervision of small firms.41 - Regional Recommendation: - Countries may further explore use of data analytics to support supervisory engagement and share lessons learned through regional working groups. ### Thematic AML/CFT supervisory inspections - Findings: - Countries carry out thematic inspections across several key risk areas and controls, including correspondent banking, sanctions screening, risk assessment, transaction monitoring, internal controls systems, suspicious transaction reporting, internal audit, resources, customer due diligence and risk management processes for cash-in-store. - There are positive examples of thematic work being directed to high-risk areas and key AML/CFT controls and responding to emerging threats (e.g., sanctions screening). - In many countries, it is unclear how a particular theme is selected. - The move from repeated full-scope inspections to targeted and thematic inspections is welcome and consistent with the maturing of supervisory frameworks. - A regional look-across indicates divergence in scope of thematic inspections: predominantly focused on control functions (risk assessment, transaction monitoring, suspicious transactions reporting); more rarely, thematic scope is significantly wide and resembles full-scope inspections, which may reduce gains of risk-specificity and frequency. - Some thematic inspections focus on specific higher-risk products (e.g., correspondent banking) and assess a range of preventive controls in relation to identified higher-risk products—which can beneficially correlate supervisory activity with identified risks. - Country-Level Recommendation: - Countries that have carried out comprehensive full-scope inspections should continue moving towards thematic inspections that are better targeted at the areas of highest ML/TF risk (based on data and analysis of relevant information). ### Development of geographic risk understanding to better target supervisory activities - Findings: - In nearly all cases, countries rely on external lists of high-ris juris ictions to in orm the assessment o entities’ geographic ris . - Most supervisory risk models across the region measure geographic risk with reference to external lists, most commonly, the FATF and EU Commission’s list of high-risk jurisdictions. - Sole reliance on such lists misses country-specificity needed for comprehensive supervisory risk assessment. - Key information on geographic risk could be obtained through more detailed supervisory returns. - Good Practice: - One country developed a list of high-risk jurisdictions that informs both ML/TF risk assessment and risk-based supervisory engagement; the list draws from multiple sources (including external lists developed by the European commission and the FATF, a national level list and a list of offshore financial centers), is publicly available and currently includes nearly 70 countries. References to this list are integrated into the determination of geographic risk, with inclusion of indicators that assess payments to countries featuring in sub-categories of this list. - Recommendation: - Supervisors should consider developing tailored lists of higher-risk jurisdictions taking into account respective country-specific factors and expanding thematic inspections to themes driven by supervisory high-risk country assessments (e.g., inspecting systems and controls related to a specific high-risk country, sampling high-risk customer due diligence files, transaction monitoring typologies, and STRs). ### AML/CFT supervisory cooperation and information sharing; AML/CFT supervisory colleges - Developments and framework: - European authorities have taken steps to develop structures to facilitate information sharing and coordination in response to AML/CFT-related banking scandals and lack of cooperation between international AML/CFT supervisors. - The formal framework for AML/CFT supervisory colleges is a key initiative; the first AML/CFT colleges for banks were formally set up in 2020. - EBA’s European reporting System for material CFT/AML weaknesses, EuReCA, serves as a central database for AML/CFT and informs EBA’s view of ML/TF risks affecting the EU financial sector. - Structure and participation: - The EBA framework includes EU AML/CFT supervisors; prudential supervisors, third country AML/CFT and/or prudential supervisors, and FIUs are observers. - For an AML/CFT college to be required, under the EBA framework, the relevant institutions must operate on a cross-border basis in at least three EU Member States. - In each AML/CFT college, the lead supervisor is the permanent member responsible for AML/CFT supervision of the institution’s head office or parent entity and is responsible for establishing and maintaining the college. - The EBA participates in selected AML/CFT colleges in a monitoring role, sharing relevant information and providing technical assistance. - Regional participation and challenges: - Due to high connectivity among banks in the region, most Nordic Baltic countries are well connected and jointly involved across several AML/CFT and prudential colleges, in line with the EBA Guidlines.43 - Participation levels are often tied to the level of activities by foreign banks in each country; countries with low numbers of foreign institutions tend to have lower participation levels. - Implementation across Europe is still at a nascent stage, with many colleges having held their first meeting only in 2021. - Challenges include operationalization, the need to shift from descriptive “after the fact” approaches to more predictive and preventive modes, and implementation hurdles in international legal cooperation slowing participation of key stakeholders (e.g., non-EU countries). - EBA-identified actions and recommendations: - The EBA recognized six actions for supervisors and college participants: finalizing structural elements (cooperation agreements and terms of participation); enhance discussions during meetings; foster ongoing exchange within colleges; apply risk-based approach; identify areas for common approach or joint action; enhance supervisory convergence in AML/CFT colleges. - Countries should strive to use colleges for early detection of threats, patterns, or suspicious transactions, and to shift from a purely descriptive reactive mode to a proactive mode. - Supervisors may explore leveraging colleges to develop cross-border supervisory strategies to engage with high-risk institutions and undertake coordinated onsite activity, enabling targeted follow-up on significant gaps in entities’ controls frameworks. - Where a lead supervisor identifies a weakness that could have broader ramifications across a group, such issues should be brought to the attention of college members and countries should proactively follow-up to determine whether the deficiency exists elsewhere; if not prioritized for further offsite/onsite activity, host supervisors should challenge firms to include testing on this deficiency as part of their regular second and/or third line of defense activities. - Regional-Level Good Practice: - A supervisory college led by and comprising members of the region coordinated supervision of a cross-border financial institution in 2021, including simultaneous onsite inspections in all three countries with constant cooperation via the AML college; the joint team reviewed AML/CFT systems and internal rules and compliance with local regulations in each country. - Regional-Level Recommendation: - Countries may explore further leveraging supervisory colleges to ensure coordinated supervisory efforts, for instance through the development of cross-border AML/CFT supervision strategies, joint inspections, and coordinated follow-up on deficiencies identified in onsite inspections by counterparts in entities in a group structure. *IMF | Technical Assistance Report — Nordic-Baltic Region: Financial Flows Analysis, AML/CFT Supervision, and Financial Stability* ### 88. The environment for information sharing appears proactive, where information can be ### The environment for information sharing appears proactive, where information can be shared in an efficient and flexible manner. ### Regional initiatives enhancing cross-border AML/CFT cooperation - Nordic-Baltic Stability Group (formed in 2018 by the Ministries of Finance and central banks of the region) - Objective: facilitate cooperation and coordination to promote financial stability in the region, with a focus on functioning of the financial system and counteracting rise/spread/escalation of a financial crisis. - Topics covered: international reviews and evaluations, cooperation and information exchange, AML/CFT colleges, public-private partnership models, risk-based approach, risk scoring models, risk assessments of different sectors, and the FinCEN Files. - Meetings include a standing agenda item for relevant cases, inspections and status of each country’s supervisory activities. - Key topics in 2020: financial stability outlook, the COVID19 impact and an overview of financial sector specific policy measures in the region. - At the final meeting for 2020, the NBSWG established a two-year work plan based on common priorities and focus areas. - Nordic Baltic AML/CFT Working Group (mandate adopted in August 2019 by the Director Generals of the Nordic and Baltic Financial Supervisory Authorities) - Purpose: strengthen cooperation between financial supervisory authorities in the Nordic-Baltic countries and enhance cross-border information sharing regarding ML and FT. - Supplements supervisory colleges and other international engagements; allows exchange of information, knowledge and experiences and coordinates supervision regionally. - Workplan activities: sector-based risk assessment to identify common ML/TF risks, identification of sectors as high-risk, trends and patterns on emerging risks, risk classification of institutions by ML/TF risks. - Methodological exchanges: transaction monitoring systems, crypto assets/crypto currencies, E-money institutions and agents of foreign payment institutions, on-site inspections and criteria for measuring severity, institutions’ risk assessment, ongoing supervision and fintech companies. - Ongoing discussions on coordinated supervisory activities (e.g., parallel/joint inspections). - EBA observation: further work needed on preventive and proactive analysis and early warning activities. ### Domestic cooperation, public-private partnerships, and country-level practices - Domestic AML/CFT–prudential–FIU cooperation - Most countries show strong frameworks allowing exchange of extensive information between AML and prudential supervisors, and between other agencies (including FIUs). - In several instances AML and prudential supervision functions are performed by the same authority, leading to strong cooperation and high frequency of interactions. - Public-private partnerships (PPPs) - Several Nordic Baltic countries use PPPs extensively to discuss preventive measures, thematic risks, supervision, AML/CFT controls and procedures, and quality of STR filings. - Recommendation: countries are encouraged to further strengthen PPPs for effective and holistic joint work on tackling ML/TF. - Country-level good practice example - FIU-managed PPP forum enabling information sharing and coordination via task forces, methodological materials, and exchange of good practices. - Outputs include material on indicators of corruption in public procurement, foreign bribery, and suspicious transactions involving politically exposed persons or other officials. - Forum uses targeted cooperation for sanctions-related matters in the context of the Russian invasion of Ukraine; entities can exchange information because it is considered information provided to the FIU itself. ### Private-private information sharing (Box 5): benefits, pilots, and constraints - Benefits and capabilities - Public-private and private-private data-sharing mechanisms can enhance understanding of ML/TF risks, improve efficiency and may reduce cost of compliance. - Data pooling and collaborative analytics can promote efficient and dynamic identification of ML/TF activities while respecting data protection and privacy frameworks. - Examples and pilots - Tribank Pilot (United Kingdom): collected pseudonymized transactional data from three participant financial institutions, analyzed centrally to identify suspicious patterns and create a cross-border transaction monitoring framework. - MAS digital platform (partnership with six major commercial banks: DBS, OCBC, UOB, Standard Chartered Bank, Citibank, and HSBC): the ‘Collaborative Sharing of ML/TF Information & Cases’ (COSMIC) Platform to allow request and exchange of customer-specific risk information and place customer alerts when behavior crosses thresholds of red-flag activity. - BIS Innovation Hub proof of concept (‘Project Aurora’, developed by BIS Innovation Hub, Nordic Center in partnership with Lucinity): created a synthetic dataset of payments transactions and tested machine learning/network analysis for detecting suspicious flows; compared centralized, de-centralized and hybrid collaborative analysis approaches. - Constraints and considerations - Need to balance proactive sharing of customer information (including beneficial ownership) with data protection requirements. - Private-private sharing boundaries are being explored, particularly for customer-level data. - Prerequisite: ensure banks collect accurate information and implement effective AML/CFT preventive frameworks under active supervision; sharing inaccurate information would be counter-productive. - FATF note - FATF stock-take on data pooling and collaborative analytics emphasizes benefits while underscoring respect for national and international data protection and privacy frameworks. ### Cooperation between prudential and AML/CFT supervisors - Rationale and guidance - BIS: AML/CFT supervision in the banking sector aims to ensure compliance with countering ML/FT requirements, assess ML/FT risks, processes and internal control systems, and enable supervisory actions based on such assessments. - AML/CFT supervisors should carry out ML/FT risk assessments and these should be considered within prudential supervision; prudential supervisors should share insights on overall risk management, internal controls and governance. - Importance of communication - Strong channels of communication are essential; deficiencies can have bi-directional consequences (e.g., an improperly vetted board member can weaken AML/CFT frameworks; AML/CFT cases can affect bank reputation and capital adequacy). - Information exchange should be structured and ongoing at jurisdictional and international levels, covering authorization/licensing, fit and proper tests, governance, risk management, profitability drivers, operational risks, AML requirements and history, and enforcement actions. - Examples include bilateral and multilateral exchanges, with or without memoranda of understanding, between prudential colleges and AML/CFT counterparts. - Country-level recommendation - Continue to ensure strong channels of communication between prudential and AML/CFT supervisors to facilitate regular and structured information exchange. - AML/CFT supervisors should deepen understanding of the nexus between AML/CFT weaknesses and financial stability (including initiating discussions with prudential supervisors). ### Recent EU developments: EU Anti-Money Laundering Authority (AMLA) - Overview - AMLA represents a positive development for better coordination on risk-based AML/CFT supervision at EU level; assessment of effectiveness is premature. - Benefit: ability to tackle cross-border AML/CFT supervision of the highest risk-banks in a consistent and coordinated manner. - Direct supervision expected to commence in 2026. - Countries must continue bilateral efforts to address cross-border supervision gaps until 2026 and for firms below AMLA’s “high risk” threshold thereafter. - Box 6 highlights - AMLA will be a new EU-level authority to counter ML/TF and shape the supervisory landscape; expected to start direct supervision in 2026. - AMLA will be part of a system integrating the authority with national AML/CFT supervisory authorities and will support EU FIUs by establishing a cooperation mechanism among them. - Proposal notes insufficient arrangements for handling cross-border AML/CFT incidents; an integrated EU-level system is considered necessary. - EU Council decision: allow AMLA to directly supervise certain types of credit and financial institutions, including CASPs, if considered risky; AMLA to supervise up to 40 of the riskiest groups and entities after initial selection. - For non-selected obliged entities, AML/CFT supervision remains primarily at national level; AMLA will not be a FIU but will act as a coordination hub between national FIUs and develop standardized STR templates. - Recommendation - Countries should prepare legal and operational frameworks to integrate and collaborate with centralized EU institutions and the AMLA. ### Crypto assets (CAs) and Crypto Asset Service Providers (CASPs): trends, risks, and frameworks - Risks and features - Inherent features of crypto assets that increase susceptibility to criminal misuse: heightened anonymity and limited traceability, low-cost global reach, options for limited intermediation, regulatory arbitrage, and widespread peer-to-peer transactions. - FATF (2021) noted a mainstreaming of criminal activity using crypto assets. - CASP population and regional concentration - CASP sector generally nascent in the region: "fewer than 10 registered CASPs in 4 out of the 8 countries." - Two countries have sizeable CASP populations as of April 2023; one country is an outlier with "around 300 registered CASPs." - Sector concentration: a relatively small number of CASPs account for the majority of market share. - Regulatory arbitrage and market entry - Early trends: strengthening market entry controls in one jurisdiction correlated with an inflow of CASP registrations to another jurisdiction with weaker controls. - De-risking by banks: many CASPs (particularly in countries with larger sectors) are primarily serviced by payment service providers. - International and regional policy & regulatory influences (Box 7) - IMF Board Paper on the Elements of Effective Policies for Crypto Assets (2023): sets nine core elements for mitigating risks (including ML/TF) and harnessing benefits; calls for market entry controls, implementation of international standards, and enhanced international collaboration; explicitly refers to FATF standards and FATF guidance on risk-based approach to CAs and CASPs. - FATF Standards (revised 2018): require countries to assess ML/TF risks associated with CAs and mitigate risks via AML/CFT preventive controls by CASPs, risk-based supervision (or ban), investigations, prosecutions and confiscation of CA as proceeds/instrumentalities of crime. - AMLA: will assume direct supervision of selected CASPs (based on ML/TF risk assessment) when operational. - EU Markets in Crypto-Assets Regulations (MiCA) adopted in May 2023: aims to set harmonized legal frameworks for crypto-assets to ensure investor protection and market integrity; MiCA covers CASPs not covered by existing EU law and issuers of asset-referenced tokens and electronic money tokens; includes provisions on issuance and trading, authorization of covered service providers, and governance and risk management requirements. - MiCA expected to come into effect after an "18-month transitional period." *IMF | Technical Assistance Report — Nordic-Baltic Region: Financial Flows Analysis, AML/CFT Supervision, and Financial Stability (excerpts).* ### 98. All countries have a good appreciation of the ML/TF risks associated with the crypto asset ### 1eurea2023003 - 98. All countries have a good appreciation of the ML/TF risks associated with the crypto asset sector ### Risk appreciation of the crypto asset sector - All countries have a good appreciation of the ML/TF risks associated with the crypto asset sector. - Recent National Risk Assessments include a discussion of ML risks associated with CASPs, which are informed by EU and FATF assessments. - The sector is considered medium-high – high-risk due to anonymity, low traceability, and easy cross-border reach of crypto assets as well as immature regulatory frameworks for crypto asset service providers. - For countries with a small CASP population, the small size of the sector is considered a risk-limiting factor. ### Legal frameworks and remaining gaps (Box 8) - All countries have amended their domestic legal frameworks to regulate CASPs, setting out definitions for crypto assets and crypto asset services providers. - CASPs are designated as reporting entities and required to comply with AML/CFT preventive controls. - In some instances, legal frameworks are not fully aligned with FATF recommendations on crypto assets. Box 8 — Remaining Gaps in the Legal Frameworks for Crypto assets (in certain countries) - Definition of CASPs: - Under the FATF definition, CASPs are legal or natural persons, undertaking (as a business), (i) exchange between VAs and fiat currencies, or between one or more forms of VA; (ii) the transfer of VAs; (iii) safekeeping or administration of VAs or instruments enabling their control; (iv) or participation in and provision of financial services related to an issuer’s offer and/or sale of a VA. - In some cases, countries’ domestic legal frameworks do not incorporate all five of the FATF identified activities. - Covered activities are most commonly limited to CA exchange and administration/safekeeping services in those cases, weakening market entry controls by allowing some CASP categories to operate outside the regulatory frameworks. - Lowering of the occasional transactions' threshold: - FATF prescribes lowering the occasional transactions threshold in customer due diligence to 1000 EUR/USD (from 15,000 EUR/USD) for VA activity. - While legal frameworks generally require CASPs to comply with preventive measures, in a few instances legal frameworks do not incorporate the FATF prescribed lowered thresholds for occasional transactions in VA. - Incorporation of the travel rule: - The wire transfer rule as per FATF Recommendation. 16 has been modified into the ‘travel rule’ requiring CASPs obtain, hold, and submit information about the originators and beneficiaries of crypto asset transfers. - The ‘travel rule’ stipulates that the ordering CASP should submit the required originator and beneficiary information immediately and securely to the beneficiary CASP; the beneficiary CASP is required to hold originator as well as accurate beneficiary information and make it available to the appropriate authorities upon request. - In most instances, countries have not incorporated the travel rule for CA transfers, awaiting EU regulation on the subject. - The recast Transfer of Funds Regulation (TFR) extends the travel rule to CASPs. The TFR requires that transfers of crypto-assets be accompanied by specified originator and beneficiary information. These requirements apply regardless of the amount of transfer and are applicable to both domestic or international transactions. The regulations also include provisions related to transfers from self-hosted addresses. The revised TFR will come into effect after the 18 month transition period. (REGULATION (EU) 2023/1113 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on information accompanying transfers of funds and certain crypto-assets and amending Directive). ### Market entry controls and authorization regimes - Seven out of the eight covered countries have registration regimes, with one country opting for a licensing framework for CASPs. - Within registration regimes, there is considerable variation: - Some countries have light-touch registration frameworks comprising mainly a notification obligation without options for assessment or rejection. - Others have more extensive registration requirements with detailed assessment by regulators, covering adequacy of AML/CFT controls. - Countries are increasingly moving towards more elaborate frameworks for market entry, with fit and proper testing now included even in most light-touch registration frameworks. - The MiCA regulations include specific provisions on market entry controls for covered crypto-asset service providers: - Requiring all entities that seek to provide covered services to seek authorization in their home jurisdiction. - Authorization applications require detailed information including the description of the entities’ internal controls policies and procedures to mitigate ML/TF risks. - Authorization process envisages fit and proper testing for management and beneficial owners of CASPs. - Competent authorities are required to withdraw authorizations of entities that do not have effective systems and procedures to detect and mitigate risks of money laundering in line with relevant EU Directives. - Harmonized authorization mechanisms once implemented can significantly reduce regulatory arbitrage and inflows of non-compliant CASPs. - All countries should continue efforts to detect and sanction unauthorized CASP activity: - Regulators are taking steps to identify unauthorized CASPs, usually in collaboration with other competent authorities (e.g., law enforcement agencies). - Regulators use open-source information, information from other reporting entities, and blockchain analysis tools to identify illicit actors. Country-Level Recommendation: Countries should align their legal framework on crypto assets with the FATF standards and should take steps to proactively identify unauthorized CASPs using a broad toolkit including open-source searches, whistleblowing mechanisms and information with other competent authorities, blockchain analytics tools as well as information exchange with foreign supervisors. ### Supervisory models, entity-level risk assessment, and data collection - Application of the supervisory entity risk assessment model to the CASP sector is nascent. - In most instances, countries have not begun systematic entity level risk assessments for the CASP sector. - Countries with more elaborate registration regimes gain insight into CASP risks during the registration process; in one instance this formed the basis for a temporary risk classification pending a formal risk assessment model. - Most countries use their standard risk assessment model for the financial sector without CASP-specific tailoring; only one country has developed a separate risk assessment model for the CASP sector. - Countries should incorporate CASP-specific variables and tailor weightages: - Entity risk assessments for CASPs should consider classical inherent risk factors and AML/CFT controls frameworks. - Risk model should include CASP-specific indicators: types of CASP services provided and volume of activity in each service offered are key determinants of risk (e.g., fiat-CA or CA-CA exchanges v. custodial wallets). - Delivery channel related indicators may be less relevant due to commonality of virtual onboarding; countries could consider lesser weightage to delivery channel related risks. Country-Level Recommendation: Countries should tailor sectoral and entity risk assessment models to include CASP specific indicators with weightages determined in line with their risk-relevance. - Data collection is underdeveloped: - Some countries have not commenced regular data collection for the sector; others collect little or no CASP specific information. - Many countries are revising returns to seek CASP specific information and aim to formalize data collection. - Relevant returns questions: scale of operations across product, customer, geography, delivery channel; entities’ AML/CFT control frameworks; range of CASP services offered; types of virtual currencies used; any anonymity enhancing services provided. Country-Level Recommendation: Countries should seek granular sector specific information in supervisory returns, collecting information related to the scale of activity in the CASP sector as well as VA/CASP specific characteristics. ### Supervisory capacity, strategies, and tools - Supervisory engagement increased in 2021 – 2022, but supervision is not fully risk-based due to lack of systematic entity-level risk assessments. - Capacity investments have not been commensurate with assessed ML/TF risks in the sector. - Authorities should ensure active supervisory engagement in line with assessed risk levels; subjecting CASPs to a minimum engagement model can help ensure risk-sensitive engagement while assessing resource adequacy on an ongoing basis. Countries-Level Recommendation: Countries should ensure resourcing and capacity investments are in line with the growth and risk levels assessed in the sector. Subjecting CASPs to the minimum engagement model can allow the ongoing assessment of resource adequacy. - Countries should consider formulating specific supervisory strategies for the sector to match supervisory activity to sector-specific risks (e.g., horizontal thematic inspections on CDD/ECDD for non-resident customers, mitigation measures for nested accounts). - Supervisors should invest in specialized skills and tools, including blockchain analytic tools, and engage external consultants for onsite inspections of CASPs to assess adequacy of CASP solutions. Country-Level Recommendation: Countries should consider developing sector-specific supervisory strategies (in line with the size of the sector and commensurate to the assessed level of ML/TF risks) and assess the need for upskilling and specialized tools to efficiently engage with the sector. ### Cooperation, information sharing, and data gaps - Acute data gaps hamper risk assessment and active supervision in the CASP sector: - CASP supervisors operate with markedly insufficient data on scale of CASP activity in their jurisdiction. - Cross-border reach of CASP services and ease to operate without authorization impacts comprehensiveness of returns data. - Close collaboration and information sharing with foreign supervisors can address persistent data gaps (e.g., foreign counterparts’ information on application/regulatory history of a CASP). - Regional cooperation can enhance domestic risk assessment and risk-based supervisory engagement: - Countries should move from fragmented domestic data collection to collaborative cross-border data sharing. - Countries indicate preliminary hurdles to supervisory information exchange, including lack of information on CASP authorizations by foreign counterparts. - A regional network to exchange information on CASP authorizations and rejections, and to share data on CA activity, could address persisting data gaps and allow more effective regional cooperation. Regional-Level Recommendation: Countries could leverage regional platforms to share sector-specific information, including through the development of a centralized network to exchange information about CASP authorizations, scale of activity, and supervision. ### AML/CFT failings and financial stability (introduction) - The report seeks to assess to what extent threats and vulnerabilities identified through financial flows analysis and AML/CFT risk-based supervision can impact financial stability of individual banks and banking sectors more broadly. - Literature finds misconduct and financial penalties have a negative impact on bank performance; misconduct can create uncertainty about banks’ business models and solvency and lead to a reduction in the provision of financial services. *IMF | Technical Assistance Report Nordic-Baltic Region: Financial Flows Analysis, AML/CFT Supervision, and Financial Stability* ### 113. While the authorities recognize the benefit of exploring this work, there were limited ### 1eurea2023003 - 113. While the authorities recognize the benefit of exploring this work, there were limited ### Overview and objectives - Authorities recognize benefits of exploring quantification of Financial Integrity (FI) issues on financial stability, but there were limited examples of country-level analysis. - The overarching objective: provide a pilot stress testing and risks analysis framework that further integrates FI issues in risk analysis and stress testing for the banking sector. - Country-Level Recommendation: Countries should take steps to explore the impact of financial integrity on financial stability. This analysis should be supported by AML/CFT supervisors, prudential supervisors, and financial stability experts within the respective agencies. ### Empirical approach and methodological notes - The approach used data on past FI events in the Nordic-Baltic region to estimate impacts on affected banks and contagion effects by comparing changes in financial variables (equity prices, credit default swaps (CDS) spreads, or deposits) around past FI events. - Each financial market variable was measured against an EU benchmark to control for shocks affecting the EU banking sector as a whole. - Caveats: "This work remains exploratory, and preliminary results are therefore subject to uncertainty due to the lack of empirical benchmark and the very small sample size of FI events." - Annex provides additional methodology details. The pilot exercise used supervisory maturity-ladder data (EBA COREP templates) to measure deposit changes one month before versus one month after events, excluding the event month. ### Key empirical findings — equity prices and credit risk - Equity prices: - Affected banks experience a large decline in stock prices around FI events: - Average decline: 11 percent - Third quartile decline: 18 percent - Up to 23 percent - Other banks from the same country and banks from the region with similar cross-border exposures also experience declines; large regional banks associated with the largest contagion effects. - Credit risk (CDS spreads): - Credit risk increases around FI events: - For the affected bank: increase of around 15 basis points (5Y CDS) - Other banks in the same country or with similar exposures also saw increases to a lesser extent. ### Key empirical findings — liquidity and deposits - Deposit flows around FI events: - Affected banks faced a decline in deposits between the month before and the month after an FI event. - Largest withdrawals were from Other Financial Corporations (OFCs), credit institutions, and to a lesser extent non-financial corporates. - Other domestic banks, non-directly affected, tended to see an increase in deposits — suggesting short-term substitution effects as depositors moved from affected banks to other domestic banks. - Regional contagion on liquidity: - FI events affecting cross-border regional banks could be associated with deposit outflows for other banks in the region with similar cross-border exposure to the origin country. - Run-off rate comparison: - Actual deposits run-off rates for OFCs experienced by banks were higher than assumptions used for liquidity stress testing in FSAPs. - While actual run-off rates were lower than FSAP assumptions for most depositors, outflows for Other Financial Corporations were substantially higher, reflecting volatile nature of those depositors. - Pilot findings and limitations: - Sample of supervisory events was very limited (four FI events in 2018–2019, and only one event to measure the affected bank directly), reducing robustness. - Changes in liquidity may be driven by other uncontrolled factors; overlapping events within estimation windows complicate identification. ### Stress-test calibration and illustrative scenario - Proposed illustrative calibration (Figure 46): - Affected bank shocks: - Equity price decline: 18 percent - CDS spreads increase: 15 basis points - Deposit outflows: 7 percent (based on pilot; actual could be higher) - Note: ABLV bank experienced deposit outflows of 23 percent in three days in February 2018. - Other banks in the country shocks: - Stock price decline: 6 percent - CDS spreads increase: 5 basis points - Deposit outflows: 4 percent - Country-Level Recommendation: Authorities should explore further work to calibrate stress test scenarios featuring FI issues and apply them where relevant to banks more vulnerable to FI issues, relying among other factors on financial flow analysis and supervisory ML/TF risk assessment. - Outcome uses: - Assess vulnerability of banks to FI events and impact on cross-border banking relationships. - Estimate spillover effects by contagion analysis to emphasize interconnectedness and cross-border linkages. ### Pilot exercise for liquidity calibration (Box 9) — main points - Supervisory data used: maturity ladder template (EBA COREP template C) with monthly detail on potential outflows by contractual maturity, inflows, and counterbalancing capacity. - Impact estimation: compared deposit levels one month before and one month after events, excluding the event month. - Findings: - Decline in deposits visible when FI event directly affects one bank. - Domestic banks with cross-border exposures to the affected country may also experience liquidity effects; other domestic banks did not necessarily decline. - Suggested extensions: - Explore other dimensions of liquidity (inflows, counterbalancing capacity). - Apply analysis to other countries and banks to increase robustness. - Use other reporting information to assess funding composition and associated costs. ### Data, algorithm, and methodological annex (Isolation Forest application) - Concept: Formulate money laundering as outlier payments activity; use unsupervised Isolation Forest algorithm for anomaly detection on aggregated cross-border payments data. - Isolation Forest steps summary: - Random partitioning: select feature and split value (example: transaction amount and USD 1,000). - Recursive partitioning until subsets isolate single transactions. - Build isolation tree for each transaction; path length measures isolation. - Score anomalies by average path length across trees; threshold set so 0.01 percent of all transactions constitute an anomaly. - Data inputs used for model and analysis: 1. Payments data: aggregated on financial institution level (anonymized to country), includes originator, correspondent, beneficiary countries, currency, number and value of transactions per corridor. 2. Compliance with AML Standards: index based on FATF and regional assessments; time series incorporating new and follow-up assessments; earlier periods may use technical compliance. 3. Portfolio and direct investments: Coordinated Portfolio and Direct Investment surveys. 4. Foreign trade: IMF Direction of Trade export data; mirror trade statistics; WTO and OECD trade in services. 5. Trade in Services: OECD-WTO Balanced Trade in Services Database. 6. Corruption: Control of corruption indicator from the Worldwide Governance Indicators. 7. Financial Secrecy and Tax Haven Indexes: Financial Secrecy Score and Tax Haven Score from the Tax Justice Network. - Important methodological cautions: - Unsupervised methods may generate false positives. - Aggregated payments data differs from transaction-level applications; identified outliers do not indicate illicit financial flows. - Results should be used as input to risk assessments and operational analyses alongside expert judgment. _ IM F | Technical Assistance Report Nordic-Baltic Region: Financial Flows Analysis, AML/CFT Supervision, and Financial Stability _ ### 1. We use only cross-border payments, dropping the payments that originate and are received in ### 1eurea2023003 - 1. We use only cross-border payments, dropping the payments that originate and are received in ### Data selection and normalization - Use only cross-border payments, dropping the payments that originate and are received in the same country. - Two core payment variables are normalized using z-scores: - (i) the value of transactions, normalized using means and standard deviations for the outflows from the ordering country. - (ii) the average transaction sent through a given payment corridor, normalized using means and standard deviations for the outflows from the ordering country. - Additional normalization at the payment-corridor level (unique payment chain of originator-correspondents-beneficiary) using z-scores, means and standard deviations for: - (i) the value of transactions for the payment corridor. - (ii) the average transaction for the payment corridor. - Purpose of normalization: avoid bias towards advanced economies and established financial centers with higher values and averages, and detect new or unusually large payment corridors that may indicate abuse of a financial institution. ### Incorporation of AML/CFT and other risk weightings - AML Compliance data is incorporated via interactions between the AML index for the ordering country and the normalized variables: - Multiply the normalized value of transactions and the normalized average transaction by the AML index of the ordering country. - AML index range: 0 to 1 (0 being the lowest level of compliance with the AML/CFT Standards). - Effect: value of transactions and average transaction are weighted proportionate to the degree of weakness of AML compliance, increasing the likelihood of a payment corridor being an outlier. - Flows to/from jurisdictions with high financial secrecy or harmful tax practices are weighted by multiplying financial secrecy and tax haven indexes with: - (i) value of transactions normalized by ordering country and by payment corridor. - (ii) average transaction normalized by ordering country and by payment corridor. - Effect: higher indexes increase the weighting and the likelihood of being an outlier. - Corruption risk incorporated by multiplying the control of corruption indicator with: - (i) value of transactions normalized by ordering country and by payment corridor. - (ii) average transaction normalized by ordering country and by payment corridor. - Effect: higher corruption perceptions increase the product and the likelihood of being an outlier. ### Economic activity controls (trade and investment) - Introduce a ratio of the value of transactions between two given countries and the portfolio/direct investment between these two countries. - Interpretation: the lower the amount value of investments between the two countries, the higher this ratio, thus increasing the likelihood of being an outlier. - Portfolio and direct investment frequencies: - Portfolio: semiannual frequency. - Direct investment: annual frequency. - For the ratio, sum up all flows between the two countries over 6 or 12 months correspondingly, then add to all payments between the two countries over the respective periods. - Introduce a ratio of the value of transactions between two given countries and the foreign trade in goods and services (imports and exports) between these two countries. - Interpretation: the lower the amount of trade between the two countries, the higher this ratio, thus increasing the likelihood of being an outlier. - Trade and investment data lag payments data; to run the model when payments data are available: - Extrapolate trade and investment data using the average of previous periods, adjusted for the projected GDP growth and for seasonality of the trade data (monthly). ### Outlier threshold, macro-criticality, and important variables - Threshold for outlier payments: set at the 0.0001 percent of all payment corridors. - Macro-criticality measure: - Add ratio of the value of transactions (nominal values, not normalized) to the GDP of the ordering country to focus on outflows big enough to potentially destabilize external or domestic stability of the ordering country. - Variables with highest contribution to the algorithm’s output (based on Shapley values analysis): - (i) foreign direct investment, - (ii) foreign portfolio investment, - (iii) foreign trade. - Interpretation: whether high financial flows between two countries correspond to high trade or portfolio or direct investment flows is the most important determinant of whether payments are identified as outliers. ### Annex II — Methodological approach for assessing impact of financial integrity events on banking sector stability (selected points) - Literature and empirical focus: - Empirical literature focuses mainly on impact of misconduct costs on banks' soundness; few studies analyze financial stability aspects, including contagion. - Misconduct costs and financial stability (selected findings): - Financial penalties reduce bank profitability: a one standard deviation increase in financial penalties leads to a decrease of pre-tax profitability by 0.14 percent (Köster and Pelster, 2017). - Penalties have no impact on after-tax profitability in general because penalties are generally tax deductible; however, European banks' after-tax profitability can be negatively impacted where penalties relate to criminal law cases and are not tax deductible. - Reputational costs dominate fines: reputational losses (proxied by abnormal returns) are nearly nine times the size of the fines (Armour et al., 2017). - A standard deviation increase in misconduct costs is associated with a 0.2 standard derivation drop in equity returns (ECB, 2019b). - Financial penalties are associated with higher bank risk; penalties linked to higher systemic risk for individual banks though not necessarily significant contagion to the entire banking system (Köster and Pelster, 2018). - Funding and liquidity effects: - DNB (2018): Danske Bank money laundering case associated with funding costs increase of around 50 basis points for the bank compared to peers end-2018. - IMF (2019) Latvia liquidity stress test calibration: - Weekly outflows of 5.5 percent observed for banks servicing foreign clients (consistent with a run-off rate of 28 percent over a 30-day period). - Valuation haircuts applied: around 5 percent on government bonds and 13 percent on other marketable securities. - Results: all banks would exceed statutory liquidity ratios, but banks remain vulnerable to large outflow shocks due to limited alternative sources. - Short-term and medium-term transmission channels (summary): - Short-term channels: equity price fall, increase in funding costs (including in foreign currencies), deterioration of liquidity (outflows and decline in counterbalancing capacity), higher refinancing risk, and potential contagion to other banks via direct exposures or market confidence. - Medium-term channels: higher funding costs, higher cost of equity, higher regulatory requirements (Pillar 2/SREP), reduced correspondent banking relationships and de-risking, potential exit of foreign banks, reduced competition, and higher funding costs for the real economy. - Stress-testing and scenario analysis (framework highlights): - Scenario calibrated to a financial integrity issue affecting one bank, with shocks calibrated using past events and expert judgment. - Apply scenario to vulnerable banks identified via financial flow analysis and vulnerability assessment. - Perform liquidity stress test with assumed haircuts on mobilizable assets, outflows, and reduction of wholesale funding; conduct implied cash flow analysis as in Latvia (IMF, 2019). - Identification of vulnerable banks relies on: - Financial flow outlier detection (including exposure to high-risk countries and financial centers). - Risk-based supervision findings (inherent risk assessment factors, AML/CFT internal controls). - Bank characteristics associated with FI issues (e.g., large share of non-resident deposits, exposure to high-risk countries, product risks, contribution of individual business units to profitability). *IMF | Technical Assistance Report — Nordic-Baltic Region: Financial Flows Analysis, AML/CFT Supervision, and Financial Stability* ### 18. Expertise from authorities could also support the identification of vulnerable banks. ### 18. Expertise from authorities could also support the identification of vulnerable banks. ### Identification approach - Combine threat and vulnerabilities’ assessment with expertise from Authorities to establish a list of banks. - Authorities can expand the list based on willingness to apply the framework to banks not identified in earlier stages. - Banks already subject to additional requirements under Pillar 2 for financial integrity issues could be integrated in the sample. ### Data and documented events - A dataset of past FI events in the region was used to identify stress episodes. For each event the dataset includes the exact date of the event, the directly affected bank(s) and additional relevant information. - Table 5. Recent Financial Integrity Issues (selected entries): - 13 February 2018 — ABLV Bank (Latvia): FinCEN proposed to ban ABLV from having a correspondence account in the US due to ML concerns. The bank entered liquidation on 24 February after being assessed as failing or likely to fail by the ECB. In July 2022, the criminal case against ABLV Bank and its employees for alleged money laundering was submitted to the Court, which has started adjudication of the case. - 4 July 2018 — Danske Bank (Denmark, Estonia): Danish newspaper Berlingske reports that as much as DKr 53bn of money may have flowed through the Estonian branch of Danske. - 19 September 2018 — Danske Bank (Denmark): Danske Bank presents an independent investigation related to ML in Estonia and its CEO resigns. - 20 February 2019 — Swedbank (Sweden): A Swedish television program reports that the bank was involved in suspicious transfers with Danske Bank’s branch in Estonia. - 4 March 2019 — Nordea (Finland): A Finnish broadcaster reports that the bank may have handled EUR 700mn in suspicious transactions. - 27 March 2019 — Swedbank (Sweden): Police raid Swedbank headquarters over ML; the Chief Executive is dismissed. - Footnote: Authorities have provided information on other financial integrity events further in the past which were not directly included in the analysis as they occurred before 2016. - Example historic metric: ABLV saw 23% deposit outflows over three days in February 2018. ### Market and supervisory inputs - Market data: stock prices for the largest banks in the region and CDS spreads. - Supervisory data: information on liquidity, funding and non-resident deposits; focus on the ‘maturity ladder’ template (labelled C in EBA CO EP templates) providing monthly potential outflows by contractual maturity, inflows by contractual maturity and counterbalancing capacity. - Equity sample: Danske Bank, Jyske (Denmark), Nordea (Finland), Swedbank, SEB, Handelsbanken (Sweden), DNB (Norway). - CDS sample: Danske Bank, Nordea, Swedbank, SEB, DNB. ### Estimation methodology (event study and example) - Event study: impact assessed by comparing changes in prices (shares and CDS spreads) before and after a FI event, measured against an EU benchmark to control for EU banking sector shocks. - Box 9 (Swedbank, February 2019) — identification approach: - Rebasing: 100 = 19/02/2019 (day before the report). - Results after three days (T+3): affected bank equity price 18 percent lower than the benchmark; other banks around 5 percent lower (except Jyske). - CDS results: affected bank spreads around 12 bps higher than the benchmark; other banks around 6 bps higher (for which CDS data are available). - Overall estimates from this example: - Affected bank: 18 percent drop in equity prices, 12 bps increase in CDS. - Other banks in the region: 5 percent drop in equity prices, 5 bps increase in CDS. ### Liquidity impact estimation - Impact measured by comparing deposit levels one month before and one month after the event; data for the specific month of the event excluded. - Four FI events occurring in 2018–2019 were chosen for deposit analysis. - Findings: - Some decline in liquidity — measured by deposits — can be observed around FI events. - When a FI event directly affects one bank, the impact on liquidity is visible for that bank. - FI events related to banks outside the country can still produce liquidity effects on domestic banks with cross-border exposures; other domestic banks may not experience declines. - Limitations noted: - Only one event measures direct impact on liquidity of the affected bank, reducing robustness. - Overlapping events in the estimation window complicate identification. - Changes in liquidity may be driven by factors other than ML events which are not controlled for. - Suggested extensions: - Explore other liquidity dimensions (inflows and counterbalancing capacity). - Apply analysis to other countries and banks to increase robustness. - Use other supervisory reporting to assess funding composition and associated costs. ### Contagion analysis: equity and CDS dependence - Method: - Weekly equity returns for seven banks (Swedbank, SEB, Nordea, DNB, Danske Bank, Jyske) over 2015-2022. - Marginal distributions modelled with a Student distribution with degrees of freedom 휈 ranging between 3 and 6. - Dependence between banks modelled using a Student copula (tail dependence). - Define distress as equity returns below the lowest 5 percent of their distribution (threshold = 5 percent). - Expected returns in distress computed as conditional expectations using joint density ℎ and numerical integration. - Equity contagion findings: - Conditional on one bank facing a large negative shock to equity prices, other banks would also experience declines in stock prices. - Large regional banks such as Swedbank, SEB and Svenska associated with the largest contagion effects (declines higher than 8 percent on average). - Danske Bank and Nordea would appear as the most vulnerable banks in terms of contagion effects, suffering an average drop in equity prices higher than 9 percent if other banks face large shocks. - Example interpretation from Table 6: if SEB were to face a ML event its stock price would drop by 9.6 percent and Danske Bank would decline by 13 percent. - CDS contagion findings: - Conditional on one bank facing a shock to CDS spreads following a ML event, other banks would experience increases in CDS spreads. - Nordea would be the bank with the highest level of spillovers: 37.5 basis point increase in CDS spreads for other banks (Average TO for NOR = 37.5). - Swedbank would be the most vulnerable bank: ML events affecting other banks would be associated with an average increase in CDS spreads for Swedbank of around 38 basis points. - Example interpretation from Table 7: if Nordea were to face a ML event its CDS spread would increase by around 27 basis points and the CDS spread of Danske Bank would increase by around 32 basis points. ### Contagion analysis: liquidity side - Preliminary results indicate possible contagion effects in deposits. - FI events with transnational dimensions affecting banks headquartered in another country could be associated with deposit outflows for other banks in the region that have exposure to the region where the FI event originated. - Figure 51 indicates banks similar to the one facing a FI event might also experience declines in deposits. ### Stress test scenario calibration - Illustrative calibration based on Nordic-Baltic experience: - Affected bank shocks: - Decline in equity price: 18 percent. - Increase in CDS spreads: 15 basis points. - Deposit outflows: 7 percent. - Other banks in the country (secondary banks) shocks: - Decline in stock price: 6 percent. - Increase in CDS spreads: 5 basis points. - Deposit outflows: 4 percent. - Application: - Scenario can be applied at individual bank level or at sector/regional level. - For system-wide application, apply simultaneously to a range of banks with primary and secondary bank shocks reflecting contagion effects. - Note: This calibration is illustrative; contagion analysis results could imply higher shocks to other banks. The calibration of total deposit outflows for banks with similar exposures was done by applying actual outflow rates by deposit types to the deposit structure of cross-border banks in the country. ### Limits and possible extensions - Main limitation: analysis based on a small sample of events; needs extension with more FI cases to improve robustness. - Further supervisory data use could assess AML/CFT failings’ impact on different liquidity dimensions and funding costs. - Enrichments suggested: - Integrate inflows and counterbalancing capacity into liquidity measures. - Reproduce work in other countries and for small to medium-size banks that were directly targeted. - Use other supervisory datasets to cover funding composition and funding cost changes around ML events. *IMF | Technical Assistance Report — Nordic-Baltic Region: Financial Flows Analysis, AML/CFT Supervision, and Financial Stability* ### 37. Information on past and ongoing supervisory actions could help improve the analysis. ### 37. Information on past and ongoing supervisory actions could help improve the analysis. ### Supervisory capital add-ons and FI issues - Banks exposed to significant FI issues could be subject to additional capital requirements under Pillar 2 (EBA, 2020). - The calibration used by supervisory authorities to estimate the add-on could also be used to assess the impact of FI issues on banks. - Example practice noted: when there are concerns about financial integrity issues related to one business unit, the add-on would be based on the loss of income if that unit were to be excluded from the consolidation of income at group-level. ### A. BACKGROUND - Money laundering (ML) cases in the Nordic-Baltic region exposed financial stability and integrity risks to the integrated Nordic-Baltic banking sector, including Denmark and Estonia. - International collaboration among supervisory entities is emphasized as necessary to combat ML and TF risk. - Denmark and Estonia have undergone initiatives and legislative changes to improve AML/CFT frameworks and systems and controls. ### B. FINANCIAL FLOWS ANALYSIS — Denmark - Denmark’s aggregate cross-border financial flows have grown steadily since 2013, accelerating since late 2020. - Main payment counterparties: the U.K., Sweden, Germany, and Luxembourg. - Key observations and recommendations: - Denmark has the second highest ratio of cross-border payments’ value to GDP and the value of deposits in the Nordic-Baltic region. - Authorities should consider developing a national mechanism for comprehensive monitoring of macro-trends in cross-border financial flows, including correspondent payments, to identify and assess ML/TF risks. - Denmark has material financial flows with 148 jurisdictions. - Payments with IFCs (listed examples: Luxembourg, Ireland, Switzerland, Hong Kong, United Arab Emirates, Malta, Mauritius, Bahrain, Gibraltar, Isle of Man) increased fivefold since 2017. - IFCs account for a third of jurisdictions with payments insufficiently explained by economic fundamentals. - Other countries with flows insufficiently explained by fundamentals include Montenegro, Bosnia-Herzegovina, Kenya, Angola, Uganda, and Kuwait. - Staff analysis indicates increasing outlier activity in Denmark since early 2021 via financial integrity screening using machine learning. - Recommendation: incorporate additional sources of data (e.g., on foreign trade and investments) and information on business models of payment service providers into national/sectoral risk assessments. - Recommendation: collect data to monitor provision of correspondent banking services and assess ML/TF risks arising from correspondent banking. ### B. FINANCIAL FLOWS ANALYSIS — Estonia - Estonia’s aggregate cross-border financial flows decreased significantly from their high at the end of 2013 and began to grow again since 2020. - The value of cross-border payments dropped by three-fourths between the 2013 peak and the 2017 monthly average. - Aggregate cross-border financial flows doubled in the two years since January 2020. - Main payment counterparties: the U.K., Germany, and Lithuania. - Key observations and recommendations: - Estonia’s ratio of payments flows to GDP is above the Nordic-Baltic region average. - IFCs account for a third of jurisdictions with flows insufficiently explained by fundamentals (examples: Switzerland, Hong Kong, Liechtenstein, Singapore, Malta, United Arabs Emirates, Isle of Man, Gibraltar, Mauritius, Monaco). - Machine learning identified a low, although increasing in 2020, level of outlier activity in Estonia; the U.K. has become the main destination for outflows-outliers. - Recommendation: incorporate foreign trade and investment data and business models/client bases of payment service providers into national/sectoral risk assessments. - Estonia maintains an extensive list of higher-risk countries numbering 110 jurisdictions; recommendation to focus on jurisdictions with substantial flows that have potential for material ML threat and to incorporate economic fundamentals and outlier detection analyses. ### C. ML/TF RISK ASSESSMENT — Denmark - The Danish Financial Supervisory Authority (DFSA) has a detailed risk assessment model. - Recommendations to improve the model: - Assess inherent risk factors through a broader range of risk-relevant indicators. - Increase focus on product risk in the calculation of inherent risk and consider higher weighting for product risk. - Incorporate volume of activity for each product offering to ensure more accurate determination of product risk. - Develop a more comprehensive list of higher-risk countries tailored to Denmark. - Enhance granularity of supervisory returns by collecting volumes and values of transactions. - Use advanced data analytic tools (network analysis, data mining, machine learning, clustering methods) to enhance ML/TF risk assessment. - Authorities are planning advancements in data analytics and development of tailored software solutions. ### C. ML/TF RISK ASSESSMENT — Estonia - The Estonian Financial Supervision Authority (EFSA) follows a standard ML/TF risk assessment approach with comprehensive data. - Recent model update assigned an equal weighting to both inherent risk and control environment. - Recommendations: - Reconsider the move towards less emphasis on inherent risk; control environment should not equate to inherent ML/TF risk in weightings. - Consider higher weighting for geographic risk to avoid overlapping elements and ensure adequate risk representation. ### D. AML/CFT SUPERVISION — Denmark - Authorities have increased resources assigned to AML/CFT supervision, have a documented risk assessment framework, and are finalizing a minimum supervisory engagement model. - Observations and recommendations: - Finalize updates to the AML/CFT supervisory strategy, including the documented minimum engagement model. - Ensure adequate supervisory presence in the highest risk banks with activities driven by the ML/TF risk assessment. - The current supervisory manual does not describe risk and controls in a manner corresponding with the risk assessment model; methodology for Customer Due Diligence test sampling needs more detail. - Manual lacks adequate guidance to support supervisory assessment of transaction monitoring system design; manual is currently undergoing revisions. ### D. AML/CFT SUPERVISION — Estonia - EFSA inspection coverage appears adequate, using targeted, thematic and full-scope on-site and off-site inspections or ad hoc inspections. - Recommendations: - Fine-tune the engagement model and specify strategies for banks deemed at highest ML/TF risk. - Outline ML/TF risks in the banking sector and link them directly to supervisory strategy. - Implement coordinated strategy to supervise key cross-border ML/TF risks (colleges and Nordic-Baltic working groups useful but additional coordinated supervisory strategies needed). - Implement mechanisms for consistent supervisory assessments and ML/TF risk assessments across supervisors, including peer reviews of findings and reports from other supervisors. ### E. VIRTUAL ASSETS & VIRTUAL ASSET SERVICE PROVIDERS (VASPS) — Denmark - Denmark has a small VASP sector; AML/CFT Act (as amended in 2021) covers all FATF-defined VASP categories, but the Act does not apply to Greenland and Faroe Islands. - DFSA conducts testing for applicants, management, and beneficial owners during registration, but performs minimal assessment of applicant’s compliance with the AML/CFT Act and proposed preventive controls framework. - The authorities have not commenced entity-level risk scoring of registered VASPs and intend to subject the sector to the DFSA’s risk model. - Recommendations: - Develop an entity risk assessment model for the VASP sector. - Increase the level of data collected from VASPs. - Use tailored questions and subject VASPs to a detailed minimum engagement model to ensure risk-graded supervisory engagement. *IMF | Technical Assistance Report — Nordic-Baltic Region: Financial Flows Analysis, AML/CFT Supervision, and Financial Stability.* ### 7. Estonia is exposed to ML/TF risks related to its (relatively) large VA/VASP sector; recent ### 7. Estonia is exposed to ML/TF risks related to its (relatively) large VA/VASP sector; recent ### Estonia — findings - The authorities strengthened market entry controls, and the FIU has a good understanding of risks, although there are data gaps affecting the comprehensiveness of the ML/TF risk assessment. - The strengthening of market entry controls has corresponded with a decline in the VASP population, with some early indication of regulatory arbitrage in the region (impacting countries outside Estonia). - The legal framework has been aligned with FATF standards, although some deficiencies remain regarding the travel rule.5 - The FIU and authorities have improved mitigating measures for AML/CFT in the VA/VASP sector, but data gaps limit comprehensiveness of the national risk assessment. ### Estonia — noted deficiencies (footnote text preserved) - These deficiencies include the lack of a requirement for originator VASPs to obtain and hold beneficiary name and a lack of provisions to make the originator and beneficiary information available to law enforcement. ### Estonia — recommendations - Continue efforts to ensure comprehensiveness of the legal framework. - Develop supervisory strategies. - Further expand the minimum engagement model to include frequency of offsite examinations for higher-risk entities. --- ### Finland — background and financial flows - Finland has a large banking sector (191 credit institutions), with a concentration around two entities. - Finland is the headquarters of one of the biggest banking groups in the region that have been involved in well-known money laundering cases, including the Laundromat scandal. - Finland’s cross-border financial flows have increased together with the regional financial flows steadily since 2013. - Most cross-border payments are with G7 and EU countries; main counterparties include the U.K., Sweden, Germany, and the Netherlands. - The share of the EU countries has been increasing, while payments with the Commonwealth of Independent States countries are minimal. - Finland’s ratio of cross-border payments’ value to GDP and the value of deposits is above the Nordic-Baltic regional average. ### Finland — findings from analysis and risk assessment - Authorities should consider developing a national mechanism for comprehensive monitoring of macro-trends in cross-border financial flows, including correspondent payments, to identify and assess ML/TF risks.1 - Finland has material financial flows with 115 jurisdictions — extended geographical reach increases ML threats. - For the majority of counterparties, cross-border payments are strongly linked to economic fundamentals; exceptions include decreasing payments with the U.K. and accelerating payments with Germany and Luxembourg. - Financial integrity screening using machine learning identified elevated outlier activity in Finland since the end-2021, with the U.K. and Ireland being main destination for outflows-outliers from and main source of inflows-outliers to Finland, respectively. - Authorities’ understanding would benefit from incorporating additional sources of data (e.g., on foreign trade and investments) and other information (e.g., business models of payment service providers) into national/sectoral risk assessments. ### Finland — higher-risk jurisdictions and supervisory observations - For identification of higher-risk countries, Finnish authorities rely primarily on the Financial Action Task Force (FATF) grey list, the European Commission’s (EC) higher-risk third country list, and domestically identified higher-risk countries. - Finland has minimal payments with FATF and EC higher-risk countries and decreasing payments with countries identified as higher risk by the National Risk Assessment. - Payments with International Financial Centers (IFCs) have more than quadrupled since 2017; IFCs account for a third of jurisdictions with payments insufficiently explained by economic fundamentals (including Luxembourg, Hong Kong, Singapore, United Arab Emirates, Mauritius, Liechtenstein, Isle of Man, Curacao). - Rapidly growing flows with IFCs — importantly with Luxembourg and Ireland — were flagged by the outlier detection machine learning algorithm. - Other countries with flows insufficiently explained by economic fundamentals include Kuwait, Saudi Arabia, Iraq, Azerbaijan, Georgia, Congo, Mali, and Mozambique. - Recommendation: add focus on jurisdictions with substantial flows that have the potential for material ML threat based on Finland-specific risk factors, coordinated with all AML/CFT-relevant agencies, including tax administration. ### Finland — supervisory model and resources - Finland has a detailed model for supervisory ML/TF risk assessment; classical inherent risk factors (products, customer, geography, and delivery channel) and key internal controls are considered in risk-score calculation. - The significance of the size of the business is separately considered in determining depth of engagement; recommendation to factor size into inherent risk calculation instead of as a standalone assessment. - The model could benefit from more granular data input, including transaction-level information. - Authorities carry out a combination of offsite and onsite supervision of banks; work is underway to enhance effectiveness which may necessitate an increase in resources. - A documented supervisory strategy for the banking sector would enhance the effectiveness of risk-based supervision; an updated assessment of the adequacy of current resources should follow review/update of the minimum engagement model. - The annual number of onsite inspections has increased since 2019; the AML Division may need to consider stepping up onsite activities. ### Finland — VAs & VASPs - Finland has a small VASP sector comprising 11 registered VASPs. - The legal framework sets out a detailed assessment for VASP registration, but limitations in coverage (gaps in the definition of VASPs and absence of registration requirements for VASPs incorporated in Finland but providing and marketing services exclusively outside Finland) can affect the strength of market entry controls. - The lack of provision for the ‘travel rule’ for virtual asset transfers is a lacuna in the domestic legal framework. - VASPs are subject to the Finnish Financial Supervisory Authority’s risk tools, including entity and sectoral risk assessment models and supervisory returns, which would benefit from further tailoring for the VASP sector to allow risk-based coverage. - Recommendation: ensure active supervision in the sector commensurate with assessed risk levels, with appropriate upskilling as needed, and proactively identify and sanction unauthorized VASPs. --- ### Iceland — summary findings - Iceland’s banking sector is comparatively small and domestically focused, with low levels of non-resident deposits and cross-border activity; regional ML cases had less pronounced impact on Iceland. - Iceland has the lowest levels of aggregate cross-border financial flows in the Nordic-Baltic region, the most limited geographical reach, and the least material flows when benchmarked against GDP and deposits. - Cross-border financial flows have remained stable since 2013, with a slight reduction during FATF increased monitoring (‘grey-listing’). - Flows are predominately with the EU, G7, and Nordic-Baltic counterparty countries. ### Iceland — financial flows analysis and recommendations - Authorities could consider leveraging detailed payments data collection and incorporating additional sources of data (e.g., economic indicators, tax vulnerabilities abroad) into national and sectoral risk assessments. - Iceland has minimal flows with higher-risk countries and low levels of outlier cross-border payments; countries on FATF increased monitoring and EU high-risk third-country lists accounted for a minimal share of Iceland’s aggregate flows since 2020. - Iceland had insignificant outlier payments activity as identified by AML screening using machine learning methods. - Iceland’s flows with International Financial Centers (IFCs) have accelerated in recent years; flows with Ireland and Luxembourg increased and became top-10 payments counterparties — these may be explained by economic fundamentals (investment flows). - Recommendation: develop a higher-risk country list based on financial flows analysis and country-specific risk factors in coordination with all relevant AML/CFT agencies. ### Iceland — AML/CFT supervision and VAs/VASPs - Authorities have conducted thorough full-scope inspections of all banks since the FATF Mutual Evaluation in 2018; a greater focus on thematic inspections is a welcome step. - Bank AML/CFT systems and controls are still maturing; enhanced supervisory presence and more targeted efforts would be beneficial, along with increased pace in completion of inspections. - Iceland has established a registration regime for VASPs established in or operating in the country; applicants are required to provide detailed information on proposed activity, place of business, AML/CFT preventive controls, board and management, shareholders, and beneficial owner. - Given borderless and transient nature of VAs, unlicensed activities may go undetected unless active monitoring is conducted. - Recommendation: expand toolkit to identify unauthorized VASPs (particularly foreign unauthorized VASPs serving Icelandic residents), including increased cooperation with domestic competent authorities, blockchain analysis tools, creation of whistleblowing mechanisms, and information-sharing with other licensing/registration authorities.3 --- ### Latvia — background, financial flows, and findings - Latvia’s aggregate financial flows are one of the smallest in the region on an absolute and relative basis, indicating lower ML threats from cross-border payments. - Geographical proximity to CIS countries contributed to higher ML risks in early 2010s; associated cross-border and nonresident activity decreased considerably following AML/CFT reform in 2018. - The nascency of the virtual asset (VA) sector in Latvia is a source of emerging cross-border ML/TF risk. ### Latvia — financial flows analysis - The value of Latvia’s cross-border payments, and associated ML risks, contracted sharply following financial sector reforms in 2018. - Average aggregate monthly flows with CIS and IFCs have dropped by around 90 percent from 2013 to 2022. - The European Union and Nordic-Baltic countries, notably Lithuania, Germany, and Estonia, have been Latvia’s largest payments counterparties — shift to lower-risk counterparties has lowered ML risks. - Following the reduction in cross-border financial flows between 2013–2018, Latvia’s flows are mostly explained by economic fundamentals and immaterial with the rest of the countries. - Among main counterparties, payments with Estonia, Sweden, Finland, Poland, and Russia (almost halted since the invasion of Ukraine) could be explained by economic fundamentals. - Inflows from Lithuania (Latvia’s main payments counterparty) and outflows to Germany and the United Kingdom are not sufficiently explained by economic fundamentals and show a high level of identified outlier activity. - Latvia’s national understanding of ML/TF risk is based on the 2020 national risk assessment, which analyses cross-border and non-resident risks in detail and represents good practice. - Recommendation: cross-border ML/TF risk analysis could further benefit from incorporating analysis of economic linkages that underly cross-border financial flows and of cross-border aspects of business models of financial institutions and their client base. *IMF | Technical Assistance Report — Nordic-Baltic Region: Financial Flows Analysis, AML/CFT Supervision, and Financial Stability* ### 4. The authorities developed a methodology to assess country risk on the financial sectoral ### 4. The authorities developed a methodology to assess country risk on the financial sectoral level, taking into account a variety of external sources of information using multiple ML/TF-relevant criteria. ### Country-risk methodology and financial flows findings - The Financial and Capital Market Commission (FCMC) developed a methodology to assess country risk on the level of the financial sector. - Latvia: - Has immaterial flows with higher-risk countries on the Financial Action Task Force (FATF) and the European Commission lists of higher ML/TF risk countries as well as with low tax jurisdictions as identified by Latvia’s Cabinet of Ministers. - Flows with some international financial centers (IFCs) — Switzerland, Hong Kong, Singapore, and the UAE — are not sufficiently explained by the economic fundamentals. - Some IFCs show an outlier pattern of payments (Luxembourg) or an accelerating trend (Ireland). - Payments are increasing and are insufficiently explained by the fundamentals with several Commonwealth of Independent States (CIS) (Kazakhstan, Azerbaijan) and Balkan countries (Albania, Montenegro). - Recommendation: The FCMC methodology can be enhanced to: - Focus on the countries with the most material flows with Latvia. - Consider Latvia-specific ML/TF cross-border threats by building on analysis of underlying economic linkages. ### ML/TF risk assessment (supervisory methodology) - The authorities follow the standard approach to supervisory ML/TF risk assessment and consider all relevant ML/TF inherent risk factors and AML/CFT internal controls. - The authorities have a detailed approach to the assessment of ML/TF risk, but further improvements are recommended: - The weightings assigned to inherent risk versus control environment would benefit from further consideration. - Product risk should be attributed more focus. - Current analytical focus: - Authorities aim to focus analysis (supported by data gathered from supervised banks) on the risk that the customer or its beneficial owner could be linked to a country or territory whose economic, social, legal, or political circumstances may indicate high ML/TF/proliferation financing risks. - While country risk as it relates to customers is important, authorities should extend assessment scope to include analysis of import/export related flow. ### AML/CFT supervision (Latvia) - Recent supervisory enhancements: - The FCMC has enhanced its supervisory approach to determine depth of engagement by entity risk levels and to implement a minimum engagement model and appears adequately resourced to deliver on the level of activities set out in the model. - AML/CFT supervisory activities for banks include full and targeted onsite inspections, off-site targeted inspections, and desk-based reviews. - Methodological gaps and recommendations: - The customer due diligence sample testing methodology would benefit from further enhancement and refinement (for example, the methodology does not include specific details for the review of existing customers for supervisors to assess the quality of ongoing customer due diligence measures, i.e., the focus is on newly onboarded customers). - Institutional note: - The institutional arrangement for the sectoral supervision of financial institutions is currently in a transitional stage. The October 2021 Amendment to the AML/CFT Law has shifted AML/CFT supervision of financial institutions from the FCMC to the Bank of Latvia. ### Virtual assets & Virtual Asset Service Providers (VASPs) - Latvia: - VASPs must register with the State Revenue Service (SRS) as obliged entities under the AML/CFT Law and provide information on their money laundering reporting officer. - Nine VASPs are currently registered with the SRS. - No market entry controls are in place prior to commencement of activity. - The legal framework does not adequately provision for the adaptation of the wire transfer rule to virtual assets (the “travel rule”). - Authorities are setting up a licensing regime for VASPs; the legal framework is expected to enter into force in 2024. - Recommendation: Further efforts to develop the VASP supervisory regime and a tailored minimum engagement model would strengthen the framework. - Lithuania (comparative findings in Annex VIII): - Amendments to the AML/CFT Law in 2019 and 2022 set out a detailed legal framework for VASPs, but gaps remain: no market entry control, no screening of VASP applications to assess compliance with registration requirements, and no explicit option to reject applications based on such assessment. - Recommendation: Continue efforts to ensure effective risk-based supervision of VASPs. ### Cross-country comparative findings and sectoral implications - Financial flows analysis across jurisdictions (selected findings): - Lithuania: - Cross-border financial flows increased since 2020 but remain less material relative to many regional peers. - Lithuania has material financial flows with 100 jurisdictions. - Accelerating flows in both directions with the U.K. and outflows to Switzerland are insufficiently explained by the fundamentals. - Machine learning screening identified a high level of outlier activity in Lithuania’s rapidly increasing financial flows since 2020, including outflow outliers to the U.K., Luxembourg, and Germany, followed by Switzerland and Ireland. - Lithuania relies primarily on FATF grey list, the European Commission higher-risk third country list, and the Ministry of Finance’s list of target territories for identifying higher-risk countries. - International financial centers with increasing financial flows insufficiently explained by fundamentals include: Switzerland, Hong Kong, Singapore, United Arabs Emirates, Gibraltar, Isle of Man, Liechtenstein, and Jersey. - Authorities should develop and operationalize an understanding of ML/TF higher-risk countries based on Lithuania-specific risk factors and refocus enhanced monitoring on jurisdictions with substantial flows that have potential for material ML threat. - Recommendation: Develop a national mechanism for comprehensive monitoring of trends in cross-border financial flows and assessing associated ML/TF risks; expand the National Risk Assessment to cover ML/TF risks from non-resident activity and cross-border payments and reflect evolution of the financial sector. - Norway: - Norway has material financial flows with 127 jurisdictions. - Majority of Norway’s financial flows are with G7 and EU counterparties; flows with CIS are at a low level. - Flows in both directions with the U.K. are not sufficiently explained by the fundamentals; outlier outflows destination: U.K., followed by Luxembourg; main inflow outlier source: Germany. - Authorities rely on external information (FATF and European Commission) but would benefit from developing a deeper understanding of ML/TF higher-risk countries based on country-specific risk factors, prioritizing countries with the most material flows and coordinating across AML/CFT agencies. - Supervisory risk assessment common recommendations: - Increase focus on product risk when calculating inherent risk. - Expand range of risk indicators for customer, product, and jurisdictional risk (including exposure to specific categories of high ML/TF risk clients). - Formalize recent model changes and review whether the broad range of residual ratings assigned to banks remains appropriate or indicates need for methodological refinements. - Consider inspection strategy adjustments: reduce period between inspections, allow greater flexibility in inspection type, and reassess resource allocation between full-scope and targeted inspections. *IMF | Technical Assistance Report — Nordic-Baltic Region: Financial Flows Analysis, AML/CFT Supervision, and Financial Stability* ### 4. or a ’s inancial lo s ith s ha e gro n ra i l in recent ears. The share of financial ### 4. or a ’s inancial lo s ith s ha e gro n ra i l in recent ears. The share of financial ### C. ML/TF RISK ASSESSMENT - Financial flows with IFCs has increased fourfold since 2018, predominately driven by a significant increase in flows with Luxembourg and Ireland, which became Norway’s main counterparties with payments marked by outlier activity and insufficiently explained by the economic fundamentals. - IFCs are the country grouping with the highest number of jurisdictions with financial flows not sufficiently explained by the economic fundamentals and identified outlier activity. - Outflows to Switzerland, Hong Kong, UAE, and Mauritius, as well as inflows from Jersey, Guernsey, and Monaco were identified by both analytical approaches as exhibiting outlier activity or insufficient explanation by fundamentals. - Recommendation: Norway should consider closer cooperation and information sharing between the Tax Administration and the Financial Supervisory Authority of Norway (NFSA) and financial intelligence unit (FIU) to leverage further detailed payments data collection by the Currency Registry for the purposes of enhancing cross-border ML risk understanding, AML supervision and development of financial intelligence. - Norway has significantly invested in the formulation of supervisory ML/TF risk assessment tools and should continue to refine these tools to ensure their effectiveness and to adequately reflect evolving ML/TF risks. - Norway has developed sector specific entity risk assessment models to guide the depth of supervisory engagement within each supervised sector. - Banking sector risk model enhancement needs: - Clear delineation between inherent risk and controls assessment. - Further deliberation on weightages for all classical inherent risk factors. - Greater specificity in internal controls assessment. - Data collection strengths and potential enhancements: - The banking sector’s risk assessment is based on detailed data collection across key classical risk factors (particularly customer risk inputs). - Further marginal enhancements could capture a wider range of risk indicators (including greater detail on product and delivery channel). ### D. AML/CFT SUPERVISION - Supervisory capacity and resource considerations: - While supervisors have a strong understanding of the ML/TF risks and demonstrate a good level of AML/CFT expertise, active supervisory engagement in the banking sector is constrained by a potential lack of resources, signaling the need for the formulation of a minimum engagement model. - The NFSA identifies AML/CFT supervision as an institutional priority, but resource limitations may be causing an unintended de-prioritization of resource-intensive supervisory activity, such as onsite inspections. - An appropriately calibrated minimum engagement model could assist the authorities to determine the required level of resources in order to carry out effective supervision, in line with a risk-based approach. - Supervisory practice strengths: - The NFSA has developed detailed modules to guide supervisory activity and engages a broad skill set (including IT expertise) in the assessment of banks’ controls systems. - The move towards thematic/targeted inspections (from full-scope inspection) is consistent with supervisory good practices; the NFSA should ensure that the choice of themes is risk-sensitive. ### E. VIRTUAL ASSETS & VIRTUAL ASSET SERVICE PROVIDERS (VASPs) - Norway VASP sector characteristics: - Norway’s small VASP sector comprises 9 registered VASPs with 3 accounting for 98% of the market share in customers. - The registration framework allows for detailed assessment at the time of registration, but gaps in the definition of VASPs (i.e., only service providers offering exchange and custodial services are obliged entities in Norway’s domestic legal framework) could affect the strength of entry controls. - Supervisory recommendations: - Formulation of a specific risk model for the VASP sector to ensure a consistent understanding of risk. - The NFSA has tailored returns of the VASP sector which can help bridge data gaps and will be a key input for a risk model. - Subjecting VASPs to an overall minimum engagement model will help ensure risk-sensitive supervisory focus and assist prioritization of NFSA resources across supervised sectors. ### Annex X: Sweden – Executive Summary A. BACKGROUND - Sweden has a comparatively extensive banking sector compared to other countries in the Nordic-Baltic region and has exposure to non-resident deposits. - As of the end of 2021, there were 88 domestic banks and 33 branches of foreign origin. - The foreign subsidiaries of some Swedish banks were affected by allegations of suspicious money laundering activities; fines were imposed on Swedish banks in 2020 due to deficiencies in their work to combat money laundering in the foreign subsidiaries. B. FINANCIAL FLOWS ANALYSIS - Sweden’s cross-border financial flows have increased steadily since 2013. - Main payment counterparties: U.K., Denmark, Norway, Germany, and the U.S.; most cross-border payments are with the EU and G7 countries. - Sweden’s cross-border activity is highly material: its ratio of cross-border payments’ value to GDP, and the value of deposits is the highest in the Nordic-Baltic region. - Recommendation: develop a national mechanism for comprehensive monitoring of macro-trends in cross-border financial flows, including correspondent payments, to identify and assess money laundering and terrorism financing risks. - Geographic spread and explainability: - Sweden’s banks have material financial flows with 135 jurisdictions. - Staff’s analysis indicates a strong link between the value of cross-border payments and underlying economic activity for the majority of counterparty countries. - Payments with the U.K. have been decreasing since mid-2018; accelerating payments with Germany and Luxembourg are insufficiently explained by economic fundamentals among the main counterparties. - Financial integrity screening using machine learning identified increasing outlier activity in Sweden since early 2021. - Belgium identified as the main destination for outflows-outliers from Sweden. - Ireland identified as the main source of inflows-outliers to Sweden. - Recommendation: enhance national understanding of ML cross-border and non-resident risk by incorporating additional data sources (e.g., on foreign trade and investments) and other information (e.g., business models of payment service providers) into national/sectoral ML/TF risk assessments. C. ML/TF RISK ASSESSMENT (Sweden) - Authorities follow standard approach for supervisory ML/TF risk assessment and consider all relevant ML/TF inherent risk factors and AML/CFT internal controls. - Current data gaps: - While information on levels of cross-border transactions is sought, granular detail on the countries involved is not gathered as part of the questionnaire. - Consideration should be given to expanding the scope of banks’ periodic reporting to inform ML/TF risk assessment. - Coordination steps: - Finansinspektionen has initiated a dialogue with Sveriges Riksbank to enhance ML/TF risk understanding through the collection of more granular data and information from banks. - Correspondent banking: - Number of correspondent banking relationships has decreased significantly in later years, but the value of correspondent banking transactions through Sweden has increased steadily since 2013–2014. - Supervisors should consider assessing ML/TF risks associated with correspondent banking on a tiered risk categorization basis. D. AML/CFT SUPERVISION (Sweden) - Supervisory activity mix: - Authorities carry out a mix of full-scope and targeted supervisory activities, including onsite and offsite supervision each year. - Several planned activities have been delayed; adequacy of resourcing should be considered in line with a minimum engagement model. - Supervisory planning recommendations: - Selection of supervisory activities (onsite vs offsite), depth (full scope or thematic), and thematic areas (e.g., transaction monitoring, CDD) should be risk-sensitive, well documented, and reviewed after conclusion. E. VIRTUAL ASSETS & VIRTUAL ASSET SERVICE PROVIDERS (VASPs) (Sweden) - Sweden VASP sector characteristics: - Sweden has a detailed registration regime and a small VASP sector comprising of 10 registered VASPs. - Sweden’s AML/CFT regime covers all categories of VASPs (as defined in the FATF standards). - Legal and supervisory gaps: - Framework not fully aligned with the FATF standards in lowering the occasional transactions threshold for VASPs. - Current legal framework does not provide for adaptation of the wire transfer rule to virtual asset transfers (the travel rule); revised EU regulation is due to enter into force shortly. - Recommendation: collection of more granular, ML/TF risk-relevant information on banks should encompass VASPs; efforts to effectively supervise VASPs should continue. *Source: https://www.imf.org/-/media/files/publications/cr/2023/english/1eurea2023003.pdf* --- _Source: https://www.imf.org/-/media/files/publications/cr/2023/english/1eurea2023003.pdf_