Anti-Money Laundering – Regulatory Guide

3. Key Obligations – What Must Entities Ensure Compliance With?

The AML framework is extensive and imposes detailed requirements. The obligations are risk-based, but this does not mean that individual requirements can be disregarded where the reporting entity considers the overall risk to be low.

Some of the fundamental elements of the framework are set out below.

3.1. Enterprise-Specific Risk Assessment

Section 7 of the Norwegian Anti-Money Laundering Act requires reporting entities to identify and assess the risks of money laundering and terrorist financing associated with their business.

The assessment must take into account, among other things, the nature and scale of the entity's business, its products and services, its customers and customer groups and relevant geographical factors. It must be adapted to the particular business, documented and kept up to date.

A useful risk assessment should distinguish between the entity's inherent exposure, the measures implemented to mitigate that exposure, vulnerabilities in those measures and the resulting residual risk.

Industry or group-wide templates can be useful, but they should not substitute for an assessment of the reporting entity's own risk exposure. This is particularly important for Norwegian branches of international groups, where group-wide methodologies may need to be adapted to Norwegian products, customers, regulatory requirements and risk factors.

Terrorist financing should be considered separately rather than treated merely as an extension of money-laundering risk. Finanstilsynet's 2025 thematic review of ten banks emphasised the importance of understanding the factors that distinguish terrorist-financing risk from money-laundering risk and of reflecting those factors in risk assessments, customer classification and transaction-monitoring rules.

The risk assessment should draw on both internal experience and relevant external sources. For financial institutions, these will typically include assessments and guidance from Norwegian authorities, FATF and the relevant European supervisory bodies.

The assessment must be kept up to date and should be revisited where the business, products, customer base, technology or external risk environment changes.

3.2. Procedures

Reporting entities must establish operational procedures setting out how AML obligations will be implemented in practice. There should be a clear connection between the risks identified in the enterprise-specific risk assessment and the procedures adopted to address those risks.

Section 8 requires the procedures to be documented, kept up to date, adapted to the nature and scale of the business and adopted at the highest level of the reporting entity.

Procedures should explain how assessments and decisions are actually made. Checklists, system workflows or user interfaces may support compliance, but they should not replace written procedures explaining the entity's methodology, responsibilities and controls.

Procedures should also be reviewed when the risk assessment changes, when new regulatory requirements apply, when new products or technology are introduced or when experience shows that existing controls are insufficient.

3.3. Risk Classification, Customer Due Diligence and Ongoing Monitoring

Reporting entities must apply customer due diligence and ongoing monitoring on a risk-sensitive basis. Customer risk classification should therefore reflect both the enterprise-specific risk assessment and the circumstances of the individual customer relationship.

Standardised risk profiles and automated models may be used, but the reporting entity must be able to demonstrate that the measures applied are proportionate to the relevant risk.

The Norwegian framework distinguishes between standard, simplified and enhanced customer due diligence. Enhanced measures are required in higher-risk situations and must be sufficient to enable the reporting entity to understand and manage the specific risk.

Identification of beneficial owners is a central part of CDD for corporate customers. The reporting entity must identify beneficial owners and take reasonable measures to verify their identity. The assessment may involve ownership, voting rights, rights to appoint or remove board members, agreements and other mechanisms through which ultimate control may be exercised.

Reporting entities may in certain circumstances rely on CDD performed by specified third parties. Such reliance does not transfer the ultimate responsibility for compliance from the reporting entity.

Banks, credit institutions and financing undertakings are required to use electronic monitoring systems to support transaction monitoring. The systems must be appropriate for the nature and scale of the business and should reflect the entity's risk assessment.

Automated monitoring does not remove the need for professional judgement. The entity should understand the limitations of its monitoring systems, apply appropriate scenarios and thresholds and document the basis for its transaction-monitoring methodology.

3.4. Investigation and Reporting Obligation

Where circumstances may indicate that funds are connected with money laundering or terrorist financing, the reporting entity must investigate.

If the investigations do not dispel the suspicion and the statutory conditions are met, the matter must be reported to the Norwegian Financial Intelligence Unit in Økokrim.

The reporting obligation is one of the central mechanisms through which the AML framework connects the private financial sector with public enforcement against financial crime.

3.5. Internal Control and Training

Reporting entities must maintain internal controls sufficient to ensure compliance with the AML framework.

Where a risk assessment of the nature and scale of the business indicates the need, section 35 requires the reporting entity to appoint a compliance officer, conduct fitness assessments of employees and establish an independent control function.

Section 8 also requires a member of management to have particular responsibility for following up the entity's AML procedures. The allocation of responsibilities should be clear and documented.

Training is required for employees and others carrying out relevant work for the reporting entity. It must be provided regularly so that knowledge remains current.

Training should be adapted to the person's role and the entity's actual risk exposure. Generic e-learning alone may therefore be insufficient where employees or management require more specific knowledge of the entity's products, customers, systems and procedures.

3.6. Customer Relationships, De-risking and Sanctions Screening

AML requirements can affect whether a reporting entity may establish or continue a customer relationship, but the rules do not provide a general basis for avoiding categories of customers merely because they present elevated risk.

In HR-2024-761-A, the Norwegian Supreme Court held that the assessment under section 24(4) must focus on the specific CDD measures that cannot be carried out. The Court also emphasised the requirement to identify beneficial owners. Following further proceedings, the Borgarting Court of Appeal held in LB-2024-184938 in June 2025 that the insurer was required to terminate the customer relationships because the applicable CDD requirements could not be fulfilled.

A related perspective appears in HR-2024-1184-A. Although that case was decided under the Insurance Contracts Act, the Supreme Court expressly considered the AML framework and held that general concerns relating to trust, social responsibility or business policy were not in themselves sufficient to justify non-renewal of the insurance relationship.

The interaction between AML requirements and de-risking has also been addressed at EU level. In Case C-81/24 Jenec, decided on 11 June 2026, the Court of Justice held that inclusion of a customer on a United States OFAC sanctions list is not, for that reason alone, sufficient to refuse access to a payment account with basic features without an individual assessment of the relevant AML/CFT risk.

For banks and other financial institutions, sanctions screening and third-country risk information may therefore be relevant inputs into the risk assessment, but they should not automatically replace the individual AML analysis required by the applicable legal framework.

This distinction is particularly important because sanctions legislation applies alongside, but is legally distinct from, the AML framework.