Latvia LV

Latvia's beneficial-ownership disclosure threshold is set at 10 percent, below the roughly 25 percent baseline applied by most EU member states, according to a European Commission impact-assessment figure carried this cycle through a single Tier-4 vendor secondary source; the underlying Commission document itself was not independently reached this cycle, so this figure should be treated as assessed rather than confirmed pending direct verification. As an EEA member state, Latvia's beneficial-ownership regime sits within, rather than outside, the EU's structural reform architecture, so that architecture is directly rather than contextually relevant here.

That architecture is durable and worth stating plainly as standing context: the EU AML Package now comprises three distinct instruments rather than one. The AML Regulation (Regulation (EU) 2024/1624, the AMLR) is directly applicable across the EU and enters full effect on 10 July 2027. The sixth AML Directive (6AMLD) requires national transposition, with its beneficial-ownership-register provisions (Articles 11, 12, 13 and 15) due for transposition by 10 July 2026. Separately, the AMLA Regulation (Regulation (EU) 2024/1620) establishes the Anti-Money Laundering Authority, operational since 1 July 2025, which is progressively shifting supervision of the highest-risk obliged entities from purely national authorities toward a hybrid EU-level regime, with direct supervision of roughly forty of the highest-risk cross-border entities beginning in January 2028. Latvia's 10 percent threshold is read against this backdrop as a live divergence that the 6AMLD transposition deadline, and ultimately the AMLR's direct applicability, are specifically designed to close.

Outlook

The concrete date to watch is 10 July 2026, when Latvia's national transposition of the 6AMLD beneficial-ownership-register provisions falls due; whether the 10 percent threshold moves toward the EU common baseline at that point, or persists into the AMLR's 2027 direct-applicability window, is the open question this monitor will test at the next material-change cycle. Given the single-source, unverified nature of the underlying figure, confirmation against a primary Commission or Latvian legislative document remains the priority gap to close before this signal can be upgraded beyond assessed confidence.

Latvia has become one of the more active MiCA crypto-asset-service-provider licensing jurisdictions in the EU, with roughly eight to ten CASP authorisations granted by Latvijas Banka by mid-2026, including Backpack EU/Trek Technologies, Paybis Europe, TWINO Investments, BlockBen, Nexdesk, GR8 Pay, AlphaRoute and Neverless. The legacy, pre-MiCA VASP registration regime closed to new entrants on 30 December 2024, and since 1 July 2026 any crypto-asset service provider that has not obtained full CASP authorisation is required to exit the EEA. Both figures rest on secondary vendor and law-firm reporting rather than a directly reached Latvijas Banka register page, so the precise licence count and exact grant dates should be treated as assessed rather than confirmed.

The supervisory-perimeter tightening represented by the EEA-exit deadline is the analytically significant element here, independent of the exact licence count: it converts a previously mixed registered/unregistered population into a binary licensed/excluded one, and the illicit-finance question this raises is not whether Latvia's licensed rails are well supervised, but whether activity displaced by the exit deadline migrates to unlicensed venues elsewhere rather than dissipating. This is a supervisory-design question rather than an observed enforcement pattern, and no evidence of post-deadline migration was available this cycle. Latvia's rapid licensing growth also sits alongside a MONEYVAL evaluation that assessed the jurisdiction's overall AML/CFT effectiveness as high across most Immediate Outcomes, though that assessment predates the bulk of this CASP licensing wave and does not speak directly to crypto-specific supervisory capacity.

Outlook

The most useful confirming evidence for this domain going forward would be a direct Latvijas Banka register page establishing the exact current CASP count, and any post-1-July-2026 reporting on the disposition of previously non-compliant providers. Absent that, this domain's signal remains assessed-tier and should be read as a structural development to track rather than a confirmed enforcement or displacement finding.

Latvijas Banka's published 2026 supervisory priorities pair financial-crime supervision directly with technology-resilience supervision. Of twelve on-site inspections planned for the year, three are dedicated specifically to prevention of money laundering and sanctions violations and three to information-and-communications-technology resilience under the Digital Operational Resilience Act, with the remaining programme addressing internal governance and Instant Payments Regulation implementation. This is a high-confidence, directly sourced finding — Latvijas Banka's own published statement is the primary source — and it is best read architecturally rather than as a set of discrete enforcement events: the inspection allocation is a planning document, not a record of findings, and its significance lies in what it signals about where the central bank expects risk to concentrate this year rather than in any confirmed control failure.

The pairing of AML/sanctions and ICT/DORA inspection quotas within the same limited annual programme is itself the notable structural fact. In a supervisory calendar of only twelve total inspections, devoting a full quarter to financial-crime prevention and a further quarter to technology resilience indicates that Latvijas Banka is treating both categories of risk as first-order priorities for 2026, rather than folding them into broader prudential review as secondary considerations. This allocation sits against the backdrop of a fast-growing licensed fintech and crypto-asset-service-provider segment in Latvia — the same segment generating this cycle's D5 signal — where outsourced third-party technology dependencies have separately been flagged by the central bank as a source of significant operational risk. Read together, the compliance-technology picture this cycle is one of a supervisor explicitly building inspection capacity toward a segment whose growth it has also flagged as carrying elevated dependency and financial-crime risk, rather than one of a supervisor reacting after the fact to an identified failure.

This compliance-technology posture also connects analytically to the D5 crypto-licensing signal in this cycle's brief: a jurisdiction issuing MiCA CASP authorisations at pace, while simultaneously earmarking a substantial share of its limited annual inspection capacity to ICT resilience, is one where the technology-risk implications of rapid fintech licensing growth are at least nominally on the supervisory radar, even though inspection capacity is finite and cannot cover every newly licensed entity in a single cycle. The active-defence framing that this domain foregrounds — as distinct from the enforcement framing foregrounded elsewhere — treats the existence of a proactive, technology-aware inspection allocation as itself a meaningful compliance-technology data point, independent of whether any individual inspection surfaces a finding.

Consistent with this monitor's architecture-over-incident framing, the absence of any confirmed 2026 enforcement action arising from Latvijas Banka's AML/sanctions or ICT inspections is not itself a null finding. A supervisor that has openly stated its inspection priorities and is partway through executing them, with no adverse findings yet public, is a materially different picture from a supervisor that has taken no stated action at all — and the former is closer to Latvia's 2026 position. This distinction matters for jurisdiction-level risk assessments that might otherwise treat 'no enforcement action reported' as a uniformly reassuring or uniformly concerning signal regardless of the underlying supervisory posture.

Outlook

The most direct test of this domain's trajectory will be whether Latvijas Banka's 2026 inspection round produces any AML/sanctions or ICT/DORA enforcement findings that reach the public record, and whether the outsourced-technology-dependency risk the central bank has already flagged materialises in any confirmed incident. Given that three of twelve inspections in each category are still in progress or newly commenced as of this cycle, findings-level detail is not yet available and should not be anticipated before a subsequent reporting cycle. A secondary marker worth tracking is whether Latvijas Banka's 2026 governance and Instant Payments Regulation workstreams generate any compliance-technology-relevant findings of their own, given that instant-payments infrastructure and DORA-scoped ICT resilience are adjacent technical domains a single supervisory programme may end up addressing jointly in practice even where the formal inspection categories treat them separately.

MONEYVAL published its 6th-round Mutual Evaluation Report of Latvia on 19 February 2026, the first evaluation of Latvia conducted under the FATF's 2022 Methodology. Latvia achieved high or substantial effectiveness ratings on ten of its eleven Immediate Outcomes, and compliant or largely compliant technical-compliance ratings on every FATF Recommendation except Recommendation 25, which was rated partially compliant. On the strength of this result, Latvia was placed into a regular follow-up reporting track, with its next report due in June 2028 — the standard, least-intensive monitoring track MONEYVAL applies to jurisdictions it assesses as performing well, as distinct from enhanced or intensified follow-up applied to weaker performers.

This is a materially positive result when read against Latvia's own regulatory history rather than in isolation. The 2026 sixth-round outcome represents a marked improvement on Latvia's fifth-round evaluation in 2018, a period during which Latvia undertook substantial de-risking of its non-resident-facing banking sector, including the liquidation of three banks since 2018. The AS LPB Bank enforcement action — a EUR 2,016,342 fine imposed by Latvijas Banka for anti-money-laundering and internal-control-system violations dating to 2018, concerning high-risk-customer money-laundering and terrorist-financing risk management — is a useful, if dated, illustration of exactly the kind of control failure at smaller non-resident-facing banks that the wider system-level reforms captured in the 2026 MER appear to have substantially addressed. Reading the historical enforcement action and the 2026 effectiveness rating together gives a before-and-after picture: a documented control failure at the institutional level, followed some years later by a system-level effectiveness assessment finding the broader AML/CFT architecture now performing to a high standard.

The structure of the FATF 2022 Methodology itself is relevant context for interpreting this result. Unlike earlier methodologies that weighted technical compliance more heavily, the 2022 framework places substantial emphasis on effectiveness — whether a jurisdiction's AML/CFT measures actually work in practice, not merely whether the correct laws exist on paper. Latvia's ten-out-of-eleven high-or-substantial-effectiveness result under this more demanding effectiveness-weighted standard is accordingly a stronger signal than an equivalent technical-compliance-only score would have represented under the prior methodology, and this is Latvia's first evaluation to be tested against it, meaning there is no directly comparable prior effectiveness baseline for Latvia specifically under the same standard.

It is important not to overstate the result, however. A 'largely compliant' or 'high effectiveness' rating under the FATF Methodology is a relative, peer-reviewed assessment against a defined international standard, not a certification that no further AML/CFT risk exists in Latvia. Recommendation 25's partial-compliance rating — concerning transparency of legal arrangements — remains an open item, and connects directly to this cycle's separate finding on Latvia's below-baseline beneficial-ownership disclosure threshold; the two findings should be read as related facets of the same transparency gap rather than as independent issues.

For institutions and counterparties assessing Latvia's AML/CFT regime as a matter of correspondent-banking or counterparty due diligence, the practical takeaway from this cycle is that Latvia's regime should now be read as assessed-mature at the system level, with the specific, named residual gap being beneficial-ownership and legal-arrangement transparency rather than a broader or less well-defined weakness. This is a materially more precise risk picture than 'AML/CFT regime unclear' or 'AML/CFT regime weak,' and due-diligence processes that have not yet incorporated the 2026 MER's findings are working from an outdated risk baseline.

Outlook

The most consequential open item within this domain is Recommendation 25 and its connection to Latvia's beneficial-ownership transparency architecture; progress here should be visible ahead of the June 2028 regular follow-up report, and the nearer-term 10 July 2026 AMLD6 beneficial-ownership-register transposition deadline provides an earlier checkpoint against which to assess movement. More broadly, this MONEYVAL result sets a high effectiveness baseline against which Latvia's fast-growing crypto-asset-service-provider segment — the subject of this cycle's separate D5 finding — has not yet been separately tested; whether the same effectiveness standard extends to the newer, faster-growing part of the regulated financial sector is the natural next question for this domain, and one this monitor is positioned to track as MiCA-era supervisory outcomes accumulate.