Finland FI

The second architecture is the legal, rather than covert, processing of Russian-origin nickel at the Nornickel Harjavalta refinery in Finland. Approximately USD 1.3 billion of Russian-mined nickel has been legally imported into the EU since the US and UK banned the metal in April 2024, with roughly two-thirds of that value flowing to Finland, where refining changes the country of origin and permits onward re-export in a manner that circumvents the US import ban. This is the clearest instance this cycle of enablement through legal architecture rather than through enforcement failure: the flow persists not because Finnish authorities decline to act on it, but because the EU has not aligned its sanctions regime with the US and UK metal bans. A planned capacity expansion at Harjavalta to over 100,000 tonnes per year appears to have been placed on hold as of spring 2026, though this rests on a single trade-press source pending primary confirmation. An analytical challenge review has separately flagged that the current severity classification attached to this scheme may understate its documented scale and confirmed circumvention mechanism; this is a calibration judgment under review, not an independent new finding, and no final severity rating is asserted here.

Layered onto both architectures is a widening sanctions-regime divergence between the EU, the US, and the UK. The OFAC designation of Lukoil PJSC in October 2025 forced its Finnish subsidiary, Oy Teboil Ab, into restructuring proceedings at the Western Uusimaa District Court in November 2025, in the absence of an equivalent EU listing at the same date. This is a direct extraterritorial financial-intermediary impact: a Finnish corporate entity was forced into insolvency proceedings by a foreign designation before its home jurisdiction regime caught up. Separately, EU sanctions packages have continued to expand vessel-designation lists, 41 additional vessels in December 2025 and 120 further listings in the April 2026 twentieth package bringing the EU total above 630 vessels, but these lists do not fully match OFAC and OFSI designations, creating a documented mismatch that complicates Finnish port and customs enforcement of port-access bans. Delegated Regulation (EU) 2026/46, adding Russia to the EU AMLD high-risk third-country list, adopted 3 December 2025 and entered into force 29 January 2026, raises the enhanced due-diligence bar for Finnish obliged entities dealing with Russian counterparties and sits as the compliance-facing counterpart to the sanctions-designation activity.

Enforcement capacity is demonstrably real but partial. A Finnish transport-company executive received a custodial sentence of three years and eight months for sanctions-busting exports of trucks and trailers to Russia, evidencing that Finnish courts will prosecute individual export-control breaches. But this single-source enforcement episode, evidencing capacity against the export-evasion architecture, does not by itself indicate that the architecture has been materially degraded; the shadow-fleet transit corridor and the Nornickel processing pathway both persist alongside it. The scheme-level red-flag indicators identified for the shadow-fleet corridor, AIS spoofing on transiting tankers, repeated flag-switching between non-sanctioning third countries, and opaque layered vessel-ownership chains sold through those same jurisdictions, are primarily observable at the trade-documentation and onboarding stage rather than through transaction monitoring alone, a distinction relevant to how Finnish and correspondent-bank compliance functions should weight this typology within the trade-finance and correspondent-banking customer segments.

Outlook

Over the coming cycles the key variable for Finnish sanctions-architecture exposure is not domestic enforcement capacity, which is not in question, but whether the EU aligns its critical-minerals and vessel-designation regimes with the US and UK. Absent that alignment, the Nornickel pathway and the vessel-list mismatch will continue to generate compliance friction for Finnish firms and customs authorities regardless of enforcement intensity. The Nordea verdict, expected after summer 2026, and the entry into force of the EU high-risk third-country designation for Russia will both continue to shape the enhanced due-diligence posture that Finnish obliged entities must maintain toward Russian-linked counterparties.

Standing structural backdrop: the EU AML Package that will eventually reshape this picture is composed of three distinct legal instruments operating on different mechanisms. The AML Regulation, Regulation (EU) 2024/1624, is directly applicable across all member states without national transposition and becomes applicable on 10 July 2027. The sixth AML Directive, by contrast, requires transposition into each national legal system on its own member-state timetable, and this cycle could not independently confirm the specific Finnish transposition instrument or date against a primary Finlex or Ministry of Finance source, a confirmed gap rather than an assumed failure. The third instrument, the AMLA Regulation, Regulation (EU) 2024/1620, establishes the Anti-Money Laundering Authority and creates a hybrid supervisory perimeter in which AMLA will directly supervise a first cohort of roughly 40 high-risk cross-border obliged entities from 2028, shifting supervision for that cohort away from purely national authorities such as the Finnish Financial Supervisory Authority toward EU-level direct oversight, while indirect AMLA oversight extends further across the remaining obliged-entity population. This three-instrument architecture is the durable backdrop against which the current Finnish beneficial-ownership access model, and the AML-control failures discussed below, should be read; it is a structural fact of the EU regulatory landscape rather than a development specific to this cycle.

Against that backdrop, the Nordea Bank Abp prosecution in Denmark supplies the clearest illustration this cycle of how corporate and correspondent-banking opacity from an earlier period reaches enforcement consequence only after a substantial lag. Danish prosecutors are now seeking a record fine of approximately DKK 6.6 billion, roughly EUR 880 million, over transactions with Russian clients between 2012 and 2015, with the trial ongoing and a verdict expected after summer 2026. The scale of the demand, described in trade coverage as the largest criminal case ever brought against a bank in Denmark, illustrates the multi-year interval between architecture-level exposure, documented years earlier through investigative reporting, and a quantified enforcement outcome; FIM methodology treats that lag itself as an analytically significant signal rather than as a footnote to the case.

The technical-compliance position of Finland at FATF also bears on this domain. The October 2023 follow-up upgraded Finland to Largely Compliant on Recommendations 13, 19, 27, and 35, while Recommendation 28 remained Partially Compliant. Confidence in the precise aggregate compliant, largely-compliant, and partially-compliant breakdown across the full 40 Recommendations is held at Assessed rather than High, pending direct verification against the primary Follow-Up Report.

Outlook

The dominant medium-term development for this domain is not a Finnish reform but the phased arrival of the EU AML Package: AMLR direct applicability on 10 July 2027, the associated 6AMLD transposition deadline whose Finnish instrument remains unconfirmed, and AMLA methodology finalisation ahead of 2027 entity selection. Whether the current legitimate-interest and fee-based Finnish beneficial-ownership access model survives that harmonisation intact, or is required to align with a more open EU standard, is the key open question. Separately, the Nordea verdict expected after summer 2026 will establish whether the record penalty demand is sustained, reduced, or appealed, with direct relevance to how comparable Nordic correspondent-banking exposure is assessed going forward.

A second, narrower but structurally unresolved gap is the continued non-participation of Aland provincial authorities in the national AML/CFT coordination mechanisms of Finland, a coordination deficiency that has persisted since at least the 2021 FATF follow-up. This is a minor seam relative to the DNFBP-supervision gap, but it remains an unresolved jurisdictional coordination question within an otherwise well-coordinated national AML/CFT architecture, and it illustrates that Finnish enabler-jurisdiction risk is not confined to professional-services sectors alone.

The most consequential enabler-role finding this cycle concerns the historic correspondent-banking conduct of Nordea, DNB, and Danske Bank at their Baltic branches. Confidential banking documents indicate that these institutions banked high-risk Russian and CIS clients while ignoring internal audit red flags, with funds moved through UK LLP and LP shell-company layers ahead of deposit into Baltic accounts and onward through New York correspondent banking. This finding sits at Tier 2 source quality, drawn from investigative reporting rather than a primary regulatory or judicial source, but the gap between that Tier 2 architecture finding and the Tier 1 enforcement outcome now unfolding in the Danish prosecution of Nordea is itself a signal under FIM source-hierarchy doctrine: architecture documented by investigative journalism years before enforcement catches up illustrates how long professional-facilitator and correspondent-banking exposure can persist as a known but unprosecuted risk. The customer-typology profile attached to this enabler-role finding, correspondent-banking and high-net-worth individual relationships, mirrors the profile associated with the parallel Nordea prosecution tracked under Beneficial Ownership and Corporate Transparency, reinforcing that Finnish enabler-jurisdiction exposure and its beneficial-ownership transparency exposure are, in this instance, two readings of the same underlying architecture rather than two separate problems.

None of these three findings indicates that Finland functions as a jurisdiction of choice for illicit-finance facilitation in the way some permissive secrecy jurisdictions do; Finland source-quality profile is strong, with a national-primary and institutional-primary evidence base and no grey-list or black-list exposure. The gaps identified are better characterised as capacity deficits, persistent under-resourcing of DNFBP supervision and an unresolved provincial-coordination seam, than as a deliberate policy choice to enable illicit flows. Neither the DNFBP-supervision gap nor the Aland coordination seam has attracted a documented remediation initiative this cycle; both remain open items carried forward from the 2021 and 2023 FATF follow-up cycles without an identified Finnish corrective action plan specific to this reporting period.

Outlook

Finland forthcoming fifth-round FATF mutual evaluation, with an on-site window calendared around November 2027, is the structural test of whether the Recommendation 28 DNFBP-supervision gap and the Aland coordination seam have been resolved by the time assessors return. Absent a specific Finnish reform initiative in this space, both gaps should be expected to persist into that evaluation cycle. The concurrent Nordea trial outcome will also bear on how much residual reputational and regulatory weight attaches to the historic Baltic correspondent-banking enabler role once a Tier 1 judicial outcome is finally in hand.

The second channel is structurally different because it operates entirely within the law. Approximately USD 1.3 billion of Russian-mined nickel has been legally imported into the EU since the US and UK banned the metal in April 2024, with roughly two-thirds of that value processed at the Nornickel Harjavalta refinery in Finland, sustaining Russian extractive-sector revenue despite the sanctions intent of allied jurisdictions. The legal continuity of this trade, in the absence of EU alignment with the US and UK bans, creates a structural loophole through which Russian-origin goods acquire Finnish and EU origin through refining, without any Finnish enforcement failure being implicated. This is precisely the kind of enablement-through-absence-of-alignment finding that FIM architecture-over-incident framing is designed to surface: no Finnish authority is failing to enforce an obligation that exists, because the relevant prohibition simply does not exist at EU level for this commodity.

Both channels sustain Russian state revenue during an active conflict, and both are appropriately read alongside SCEM conflict-finance tracking of the Russian war economy and ERM commodity-flow evasion tracking, given the quantified scale of the nickel flow and the ongoing nature of the shadow-fleet transit activity. The reported spring-2026 hold on the planned Harjavalta capacity expansion to over 100,000 tonnes per year, if confirmed against a primary source, would be a modest trajectory-relevant development, but it does not address the underlying sanctions-alignment gap that permits the existing throughput to continue.

The red-flag indicators associated with the Nornickel processing pathway, a country-of-origin change on re-export following EU-based refining of Russian-origin feedstock, and sustained cross-border rail-freight volumes of the sanctioned-adjacent commodity despite the conflict, are observable primarily at the trade-documentation stage, meaning that customs and trade-finance compliance functions rather than transaction-monitoring systems carry the practical detection burden for this channel. Similarly, the shadow-fleet corridor red-flag indicators, AIS spoofing, repeated flag-switching among non-sanctioning third countries, and opaque layered vessel-ownership chains, are best captured at onboarding and trade-documentation review rather than through standard transaction monitoring alone, a distinction relevant to how correspondent-banking and trade-finance compliance functions allocate detection resources against this domain.

Outlook

The trajectory of this domain for Finland depends almost entirely on decisions taken at EU level rather than in Helsinki. Absent EU alignment with the US and UK critical-minerals bans, the Harjavalta processing pathway will continue to generate quantified Russian extractive-sector revenue regardless of Finnish enforcement posture. Continued Joint Expeditionary Force interdiction activity in the Baltic will likely continue to manage, without eliminating, the shadow-fleet transit risk, since interdiction addresses individual vessels rather than the underlying flag-switching and ownership-opacity infrastructure that sustains the corridor.

That transition intersects directly with the emerging AMLA supervisory perimeter. AMLA has identified crypto-asset service providers as an early direct-supervision priority from 2028, a timing that coincides closely with the Finnish VASP-to-CASP transition ahead of the July 2027 application date. Read together, the NRA-scope gap and the AMLA CASP-priority signal suggest that Finnish crypto-sector supervision is entering a period of structural transition in which the national risk-assessment basis, the applicable legal category, and the ultimate supervisory authority may all shift within a relatively short window.

Also relevant to this domain is the broader FATF work programme: the FATF June 2026 Plenary approved forthcoming reports on hawala and underground banking exploitation and on decentralised-finance-related money-laundering, terrorist-financing, and proliferation-financing risk, due for publication in September 2026. These reports will shape VASP and CASP supervisory expectations more broadly across the FATF membership, including Finland, ahead of the AML Regulation application date, though no Finland-specific implementation timeline for incorporating that guidance has yet been published.

From a technology-architecture perspective, the underlying supervisory question is not whether digital-asset activity is occurring within Finland, registered VASP activity already exists under the current national regime, but whether the population and risk profile of that activity is accurately captured in the instruments, principally the National Risk Assessment, that inform proportionate supervision. A scope gap of the kind FATF has flagged is a governance and data-completeness issue as much as a compliance-control issue, and it is the kind of finding that active-defence and compliance-technology functions, rather than enforcement teams, are best positioned to close ahead of the CASP transition. The convergence of three separate regulatory-technology deadlines, the AML Regulation direct-applicability date of 10 July 2027, the AMLA CASP direct-supervision priority from 2028, and the FATF DeFi and hawala reports due September 2026, means that Finnish crypto-asset service providers face a compressed window in which national risk-assessment scope, EU-level rulebook harmonisation, and international standard-setting guidance are all moving simultaneously.

Outlook

The defining question for this domain over the next several cycles is whether the Finnish transition from VASP to CASP status under MiCA and the AML Regulation, combined with the FATF DeFi and hawala guidance due in September 2026, prompts a refresh of the Finnish National Risk Assessment that closes the scope gap FATF flagged in 2023. Separately, whether the AMLA CASP-priority signal for 2028 direct supervision extends to any Finnish-domiciled crypto-asset service provider specifically remains an open question not yet addressed by any Finland-specific AMLA communication identified this cycle.

Nordea, given its active Danish AML prosecution and pan-Nordic correspondent-banking footprint, is noted as a plausible candidate for that initial AMLA direct-supervision cohort, though this specific candidacy is an inference rather than a confirmed selection, and the combined claim is accordingly held at Assessed rather than High confidence. The harmonised risk-categorisation methodology that AMLA must finalise ahead of the 2027 selection round is itself a supervisory-technology and governance deliverable, part of the broader SupTech build-out that will determine how consistently cross-border risk is measured once AMLA direct supervision begins.

For Finnish obliged entities, the practical active-defence implication is that internal compliance technology investment decisions over the next one to two years are being made against a regulatory horizon whose supervisory methodology is not yet finalised; firms preparing for AML Regulation direct applicability in July 2027 and possible AMLA direct or indirect oversight from 2028 are, in effect, building toward a moving target.

Outlook

AMLA methodology finalisation, expected ahead of the 2027 entity-selection round, is the key near-term marker to watch for this domain: its publication will materially clarify what harmonised risk-categorisation and supervisory-technology expectations Finnish and pan-Nordic obliged entities should build toward. Whether the Nordea specific candidacy for the initial direct-supervision cohort is confirmed will also be a significant signal for how AMLA calibrates its first selection round against active enforcement exposure.

The National Police Board's grant of the first confirmed operator licence under the reformed Gambling Act, to Hippos ATG Oy on 21 October 2026, is the clearest sign that the obliged-entity population this regime will supervise is now starting to take concrete shape, ahead of the market's 1 July 2027 opening. Each newly licensed operator entering the market from that date carries the full weight of the existing national CDD obligation from day one of live operation.

The EU Anti-Money Laundering Regulation then layers a second, sector-specific obligation on top of the national baseline: non-state online gambling is classified high-risk, with a 2,000 euro customer due diligence threshold introduced for occasional transactions. That threshold is directly applicable from 10 July 2027, ten days after the Finnish market itself opens. The ten-day gap between domestic go-live and the EU threshold's application is narrow enough that operators cannot treat it as a genuine compliance holiday; the practical expectation is that AML programmes built for the Finnish market opening will need to anticipate the EU threshold from the outset rather than retrofitting it after the fact.

The mechanism through which that EU-level obligation will acquire its full operative detail is the Anti-Money Laundering Authority's technical-standards process. AMLA published several draft Regulatory and Implementing Technical Standards under the AML/CFT regulatory framework on 16 October 2026, and FIN-FSA has invited Finnish stakeholders to sectoral roundtables in response. This is a cross-sector EU-level development rather than one confined to gambling, but it is the channel through which the specifics of the gambling-sector threshold and related obligations will ultimately be settled, and Finnish obliged entities across sectors, not only gambling operators, will be affected by its outcome.

Outlook

The period between 1 July 2027 and 10 July 2027 is the clearest structural watch point for this domain: Finnish gambling operators will need AML and CDD programmes calibrated to the EU's 2,000 euro threshold before that narrow window closes, even though the threshold itself is not domestically applicable until the later date. The AMLA technical-standards consultation now under way, with FIN-FSA engaging domestic stakeholders through sectoral roundtables, will determine the granularity of what operators must build. No Finland-specific sanctions, beneficial-ownership, or enforcement development intersects with this absorption at present, leaving the regulatory-architecture story, rather than an enforcement-incident story, as the dominant signal for this domain going into the market opening.