Finland FI

Finland functions this cycle as a frontline jurisdiction for two interlocking sanctions-evasion architectures rather than as the origin of either. The first is the Russian shadow-fleet oil transit corridor through the Gulf of Finland, a persistent, multi-jurisdictional evasion infrastructure built on flag-switching, AIS spoofing, and opaque vessel-ownership chains sold through Panama, the Cook Islands, the Marshall Islands, Vietnam, and Seychelles. Framed architecture-over-incident, the relevant analytical unit is not any single tanker transit but the standing infrastructure that makes repeated transits possible; Finnish and allied Joint Expeditionary Force interdiction activity in the Baltic is an enforcement response to that infrastructure, not evidence that the infrastructure itself has been dismantled.

The second architecture is the legal, rather than covert, processing of Russian-origin nickel at the Nornickel Harjavalta refinery in Finland. Approximately USD 1.3 billion of Russian-mined nickel has been legally imported into the EU since the US and UK banned the metal in April 2024, with roughly two-thirds of that value flowing to Finland, where refining changes the country of origin and permits onward re-export in a manner that circumvents the US import ban. This is the clearest instance this cycle of enablement through legal architecture rather than through enforcement failure: the flow persists not because Finnish authorities decline to act on it, but because the EU has not aligned its sanctions regime with the US and UK metal bans. A planned capacity expansion at Harjavalta to over 100,000 tonnes per year appears to have been placed on hold as of spring 2026, though this rests on a single trade-press source pending primary confirmation. An analytical challenge review has separately flagged that the current severity classification attached to this scheme may understate its documented scale and confirmed circumvention mechanism; this is a calibration judgment under review, not an independent new finding, and no final severity rating is asserted here.

Layered onto both architectures is a widening sanctions-regime divergence between the EU, the US, and the UK. The OFAC designation of Lukoil PJSC in October 2025 forced its Finnish subsidiary, Oy Teboil Ab, into restructuring proceedings at the Western Uusimaa District Court in November 2025, in the absence of an equivalent EU listing at the same date. This is a direct extraterritorial financial-intermediary impact: a Finnish corporate entity was forced into insolvency proceedings by a foreign designation before its home jurisdiction regime caught up. Separately, EU sanctions packages have continued to expand vessel-designation lists, 41 additional vessels in December 2025 and 120 further listings in the April 2026 twentieth package bringing the EU total above 630 vessels, but these lists do not fully match OFAC and OFSI designations, creating a documented mismatch that complicates Finnish port and customs enforcement of port-access bans. Delegated Regulation (EU) 2026/46, adding Russia to the EU AMLD high-risk third-country list, adopted 3 December 2025 and entered into force 29 January 2026, raises the enhanced due-diligence bar for Finnish obliged entities dealing with Russian counterparties and sits as the compliance-facing counterpart to the sanctions-designation activity.

Enforcement capacity is demonstrably real but partial. A Finnish transport-company executive received a custodial sentence of three years and eight months for sanctions-busting exports of trucks and trailers to Russia, evidencing that Finnish courts will prosecute individual export-control breaches. But this single-source enforcement episode, evidencing capacity against the export-evasion architecture, does not by itself indicate that the architecture has been materially degraded; the shadow-fleet transit corridor and the Nornickel processing pathway both persist alongside it. The scheme-level red-flag indicators identified for the shadow-fleet corridor, AIS spoofing on transiting tankers, repeated flag-switching between non-sanctioning third countries, and opaque layered vessel-ownership chains sold through those same jurisdictions, are primarily observable at the trade-documentation and onboarding stage rather than through transaction monitoring alone, a distinction relevant to how Finnish and correspondent-bank compliance functions should weight this typology within the trade-finance and correspondent-banking customer segments.

Outlook

Over the coming cycles the key variable for Finnish sanctions-architecture exposure is not domestic enforcement capacity, which is not in question, but whether the EU aligns its critical-minerals and vessel-designation regimes with the US and UK. Absent that alignment, the Nornickel pathway and the vessel-list mismatch will continue to generate compliance friction for Finnish firms and customs authorities regardless of enforcement intensity. The Nordea verdict, expected after summer 2026, and the entry into force of the EU high-risk third-country designation for Russia will both continue to shape the enhanced due-diligence posture that Finnish obliged entities must maintain toward Russian-linked counterparties.

The beneficial-ownership picture for Finland this cycle is defined by a persistent access architecture rather than by any single reform event. The Finnish beneficial-ownership register gates public search behind a legitimate-interest test, with fees running to approximately EUR 7 per company search on a case-by-case basis, or a EUR 200 setup cost for a contract-client account carrying a EUR 22 annual fee and EUR 0.90 per subsequent extract. Among EU member states tracked for beneficial-ownership access cost, this places Finland toward the more restrictive end of the range, and the practical effect is to materially slow third-party ownership verification for banks, correspondent counterparties, and professional gatekeepers alike.

Standing structural backdrop: the EU AML Package that will eventually reshape this picture is composed of three distinct legal instruments operating on different mechanisms. The AML Regulation, Regulation (EU) 2024/1624, is directly applicable across all member states without national transposition and becomes applicable on 10 July 2027. The sixth AML Directive, by contrast, requires transposition into each national legal system on its own member-state timetable, and this cycle could not independently confirm the specific Finnish transposition instrument or date against a primary Finlex or Ministry of Finance source, a confirmed gap rather than an assumed failure. The third instrument, the AMLA Regulation, Regulation (EU) 2024/1620, establishes the Anti-Money Laundering Authority and creates a hybrid supervisory perimeter in which AMLA will directly supervise a first cohort of roughly 40 high-risk cross-border obliged entities from 2028, shifting supervision for that cohort away from purely national authorities such as the Finnish Financial Supervisory Authority toward EU-level direct oversight, while indirect AMLA oversight extends further across the remaining obliged-entity population. This three-instrument architecture is the durable backdrop against which the current Finnish beneficial-ownership access model, and the AML-control failures discussed below, should be read; it is a structural fact of the EU regulatory landscape rather than a development specific to this cycle.

Against that backdrop, the Nordea Bank Abp prosecution in Denmark supplies the clearest illustration this cycle of how corporate and correspondent-banking opacity from an earlier period reaches enforcement consequence only after a substantial lag. Danish prosecutors are now seeking a record fine of approximately DKK 6.6 billion, roughly EUR 880 million, over transactions with Russian clients between 2012 and 2015, with the trial ongoing and a verdict expected after summer 2026. The scale of the demand, described in trade coverage as the largest criminal case ever brought against a bank in Denmark, illustrates the multi-year interval between architecture-level exposure, documented years earlier through investigative reporting, and a quantified enforcement outcome; FIM methodology treats that lag itself as an analytically significant signal rather than as a footnote to the case.

The technical-compliance position of Finland at FATF also bears on this domain. The October 2023 follow-up upgraded Finland to Largely Compliant on Recommendations 13, 19, 27, and 35, while Recommendation 28 remained Partially Compliant. Confidence in the precise aggregate compliant, largely-compliant, and partially-compliant breakdown across the full 40 Recommendations is held at Assessed rather than High, pending direct verification against the primary Follow-Up Report.

Outlook

The dominant medium-term development for this domain is not a Finnish reform but the phased arrival of the EU AML Package: AMLR direct applicability on 10 July 2027, the associated 6AMLD transposition deadline whose Finnish instrument remains unconfirmed, and AMLA methodology finalisation ahead of 2027 entity selection. Whether the current legitimate-interest and fee-based Finnish beneficial-ownership access model survives that harmonisation intact, or is required to align with a more open EU standard, is the key open question. Separately, the Nordea verdict expected after summer 2026 will establish whether the record penalty demand is sustained, reduced, or appealed, with direct relevance to how comparable Nordic correspondent-banking exposure is assessed going forward.

Finland enabler-jurisdiction profile this cycle is defined by persistent capacity gaps rather than by any coordinated systemic exploitation. The most consequential is the continued Partially Compliant FATF rating on Recommendation 28, reflecting weak risk-based supervision of designated non-financial businesses and professions, lawyers, real-estate agents, and casinos among them, sectors that rarely file suspicious-transaction reports despite their structural exposure to layering and beneficial-ownership concealment. This is a persistent gatekeeper gap: professional facilitators operating in these sectors can exploit weak supervision for layering purposes even where bank-level AML controls, which are comparatively robust in Finland, function as intended.

A second, narrower but structurally unresolved gap is the continued non-participation of Aland provincial authorities in the national AML/CFT coordination mechanisms of Finland, a coordination deficiency that has persisted since at least the 2021 FATF follow-up. This is a minor seam relative to the DNFBP-supervision gap, but it remains an unresolved jurisdictional coordination question within an otherwise well-coordinated national AML/CFT architecture, and it illustrates that Finnish enabler-jurisdiction risk is not confined to professional-services sectors alone.

The most consequential enabler-role finding this cycle concerns the historic correspondent-banking conduct of Nordea, DNB, and Danske Bank at their Baltic branches. Confidential banking documents indicate that these institutions banked high-risk Russian and CIS clients while ignoring internal audit red flags, with funds moved through UK LLP and LP shell-company layers ahead of deposit into Baltic accounts and onward through New York correspondent banking. This finding sits at Tier 2 source quality, drawn from investigative reporting rather than a primary regulatory or judicial source, but the gap between that Tier 2 architecture finding and the Tier 1 enforcement outcome now unfolding in the Danish prosecution of Nordea is itself a signal under FIM source-hierarchy doctrine: architecture documented by investigative journalism years before enforcement catches up illustrates how long professional-facilitator and correspondent-banking exposure can persist as a known but unprosecuted risk. The customer-typology profile attached to this enabler-role finding, correspondent-banking and high-net-worth individual relationships, mirrors the profile associated with the parallel Nordea prosecution tracked under Beneficial Ownership and Corporate Transparency, reinforcing that Finnish enabler-jurisdiction exposure and its beneficial-ownership transparency exposure are, in this instance, two readings of the same underlying architecture rather than two separate problems.

None of these three findings indicates that Finland functions as a jurisdiction of choice for illicit-finance facilitation in the way some permissive secrecy jurisdictions do; Finland source-quality profile is strong, with a national-primary and institutional-primary evidence base and no grey-list or black-list exposure. The gaps identified are better characterised as capacity deficits, persistent under-resourcing of DNFBP supervision and an unresolved provincial-coordination seam, than as a deliberate policy choice to enable illicit flows. Neither the DNFBP-supervision gap nor the Aland coordination seam has attracted a documented remediation initiative this cycle; both remain open items carried forward from the 2021 and 2023 FATF follow-up cycles without an identified Finnish corrective action plan specific to this reporting period.

Outlook

Finland forthcoming fifth-round FATF mutual evaluation, with an on-site window calendared around November 2027, is the structural test of whether the Recommendation 28 DNFBP-supervision gap and the Aland coordination seam have been resolved by the time assessors return. Absent a specific Finnish reform initiative in this space, both gaps should be expected to persist into that evaluation cycle. The concurrent Nordea trial outcome will also bear on how much residual reputational and regulatory weight attaches to the historic Baltic correspondent-banking enabler role once a Tier 1 judicial outcome is finally in hand.

Two parallel conflict-finance and extractive-integrity channels persist through Finland this cycle, one covert and one entirely legal. The first is the shadow-fleet oil transit corridor through the Gulf of Finland, traced under FIM three-stage methodology: the source is sanctioned Russian crude production, the channel is the flag-switched shadow-tanker fleet transiting the Gulf of Finland and wider Baltic, and the deployment is continued Russian war-economy revenue generation despite Western price-cap and sanctions measures. This is a covert-architecture conflict-finance channel in the conventional sense: sanctioned production reaching market through deliberately obscured vessel identity and ownership.

The second channel is structurally different because it operates entirely within the law. Approximately USD 1.3 billion of Russian-mined nickel has been legally imported into the EU since the US and UK banned the metal in April 2024, with roughly two-thirds of that value processed at the Nornickel Harjavalta refinery in Finland, sustaining Russian extractive-sector revenue despite the sanctions intent of allied jurisdictions. The legal continuity of this trade, in the absence of EU alignment with the US and UK bans, creates a structural loophole through which Russian-origin goods acquire Finnish and EU origin through refining, without any Finnish enforcement failure being implicated. This is precisely the kind of enablement-through-absence-of-alignment finding that FIM architecture-over-incident framing is designed to surface: no Finnish authority is failing to enforce an obligation that exists, because the relevant prohibition simply does not exist at EU level for this commodity.

Both channels sustain Russian state revenue during an active conflict, and both are appropriately read alongside SCEM conflict-finance tracking of the Russian war economy and ERM commodity-flow evasion tracking, given the quantified scale of the nickel flow and the ongoing nature of the shadow-fleet transit activity. The reported spring-2026 hold on the planned Harjavalta capacity expansion to over 100,000 tonnes per year, if confirmed against a primary source, would be a modest trajectory-relevant development, but it does not address the underlying sanctions-alignment gap that permits the existing throughput to continue.

The red-flag indicators associated with the Nornickel processing pathway, a country-of-origin change on re-export following EU-based refining of Russian-origin feedstock, and sustained cross-border rail-freight volumes of the sanctioned-adjacent commodity despite the conflict, are observable primarily at the trade-documentation stage, meaning that customs and trade-finance compliance functions rather than transaction-monitoring systems carry the practical detection burden for this channel. Similarly, the shadow-fleet corridor red-flag indicators, AIS spoofing, repeated flag-switching among non-sanctioning third countries, and opaque layered vessel-ownership chains, are best captured at onboarding and trade-documentation review rather than through standard transaction monitoring alone, a distinction relevant to how correspondent-banking and trade-finance compliance functions allocate detection resources against this domain.

Outlook

The trajectory of this domain for Finland depends almost entirely on decisions taken at EU level rather than in Helsinki. Absent EU alignment with the US and UK critical-minerals bans, the Harjavalta processing pathway will continue to generate quantified Russian extractive-sector revenue regardless of Finnish enforcement posture. Continued Joint Expeditionary Force interdiction activity in the Baltic will likely continue to manage, without eliminating, the shadow-fleet transit risk, since interdiction addresses individual vessels rather than the underlying flag-switching and ownership-opacity infrastructure that sustains the corridor.

The Finnish digital-asset picture this cycle centres on a scope question rather than an enforcement or infrastructure failure. The FATF October 2023 follow-up flagged that the scope of the 2021 National Risk Assessment of Finland may understate crypto-sector risk relative to the actual registered virtual-currency-provider population. This is a structural methodology gap: if the risk assessment that underpins supervisory resourcing and expectations does not fully capture the actual population of registered providers, the resulting supervisory posture may be calibrated against an incomplete picture of the sector it is meant to cover. This gap sits ahead of a more consequential structural transition, the shift of Finnish virtual-asset service providers from the current national regime, derived from the fifth AML Directive, to the Crypto-Asset Service Provider category under MiCA and the AML Regulation, with the AML Regulation becoming directly applicable on 10 July 2027.

That transition intersects directly with the emerging AMLA supervisory perimeter. AMLA has identified crypto-asset service providers as an early direct-supervision priority from 2028, a timing that coincides closely with the Finnish VASP-to-CASP transition ahead of the July 2027 application date. Read together, the NRA-scope gap and the AMLA CASP-priority signal suggest that Finnish crypto-sector supervision is entering a period of structural transition in which the national risk-assessment basis, the applicable legal category, and the ultimate supervisory authority may all shift within a relatively short window.

Also relevant to this domain is the broader FATF work programme: the FATF June 2026 Plenary approved forthcoming reports on hawala and underground banking exploitation and on decentralised-finance-related money-laundering, terrorist-financing, and proliferation-financing risk, due for publication in September 2026. These reports will shape VASP and CASP supervisory expectations more broadly across the FATF membership, including Finland, ahead of the AML Regulation application date, though no Finland-specific implementation timeline for incorporating that guidance has yet been published.

From a technology-architecture perspective, the underlying supervisory question is not whether digital-asset activity is occurring within Finland, registered VASP activity already exists under the current national regime, but whether the population and risk profile of that activity is accurately captured in the instruments, principally the National Risk Assessment, that inform proportionate supervision. A scope gap of the kind FATF has flagged is a governance and data-completeness issue as much as a compliance-control issue, and it is the kind of finding that active-defence and compliance-technology functions, rather than enforcement teams, are best positioned to close ahead of the CASP transition. The convergence of three separate regulatory-technology deadlines, the AML Regulation direct-applicability date of 10 July 2027, the AMLA CASP direct-supervision priority from 2028, and the FATF DeFi and hawala reports due September 2026, means that Finnish crypto-asset service providers face a compressed window in which national risk-assessment scope, EU-level rulebook harmonisation, and international standard-setting guidance are all moving simultaneously.

Outlook

The defining question for this domain over the next several cycles is whether the Finnish transition from VASP to CASP status under MiCA and the AML Regulation, combined with the FATF DeFi and hawala guidance due in September 2026, prompts a refresh of the Finnish National Risk Assessment that closes the scope gap FATF flagged in 2023. Separately, whether the AMLA CASP-priority signal for 2028 direct supervision extends to any Finnish-domiciled crypto-asset service provider specifically remains an open question not yet addressed by any Finland-specific AMLA communication identified this cycle.

No Finland-specific regulatory-technology or AI-driven monitoring development was identified this cycle; the dominant signal for this domain is instead the continued structural build-out of the Anti-Money Laundering Authority ahead of its first direct-supervision cohort. AMLA continues its staffing and information-technology ramp-up toward approximately 430 staff by the end of 2027, and is expected to finalise a harmonised cross-border risk-categorisation methodology before selecting roughly 40 directly supervised entities in 2027, with direct supervision beginning in 2028. This build-out is properly read as the principal supervisory-technology and active-defence signal for Finland and the wider EEA bloc this cycle: its significance, as a structural shift in how cross-border AML supervision will be conducted, exceeds that of any single enforcement episode under FIM architecture-over-incident principle.

Nordea, given its active Danish AML prosecution and pan-Nordic correspondent-banking footprint, is noted as a plausible candidate for that initial AMLA direct-supervision cohort, though this specific candidacy is an inference rather than a confirmed selection, and the combined claim is accordingly held at Assessed rather than High confidence. The harmonised risk-categorisation methodology that AMLA must finalise ahead of the 2027 selection round is itself a supervisory-technology and governance deliverable, part of the broader SupTech build-out that will determine how consistently cross-border risk is measured once AMLA direct supervision begins.

For Finnish obliged entities, the practical active-defence implication is that internal compliance technology investment decisions over the next one to two years are being made against a regulatory horizon whose supervisory methodology is not yet finalised; firms preparing for AML Regulation direct applicability in July 2027 and possible AMLA direct or indirect oversight from 2028 are, in effect, building toward a moving target.

Outlook

AMLA methodology finalisation, expected ahead of the 2027 entity-selection round, is the key near-term marker to watch for this domain: its publication will materially clarify what harmonised risk-categorisation and supervisory-technology expectations Finnish and pan-Nordic obliged entities should build toward. Whether the Nordea specific candidacy for the initial direct-supervision cohort is confirmed will also be a significant signal for how AMLA calibrates its first selection round against active enforcement exposure.