Finland

**Regulator Name:** Financial Supervisory Authority (FIN-FSA)

The entity targeted by the FIN-FSA public warning on October 25, 2023, is Tesseract Finance Oy. The company may currently operate under the name "Stableton" (listed on FIN-FSA's registered providers list), but the enforcement action cited only refers to Tesseract Finance Oy.

**Violation Type:** Providing virtual currency services without proper registration for a period, and deficiencies in internal control mechanisms, risk assessment, and customer due diligence processes for Anti-Money Laundering (AML) and Counter-Terrorist Financing (CTF).

**Penalty Amount:** Public warning (julkinen varoitus). While not a monetary fine, it's a formal and significant disciplinary measure by the FIN-FSA, obliging the company to rectify its shortcomings.

**Date:** Decision issued on **October 25, 2023**.

**Outcome:** The company was required to implement corrective measures to comply with the Virtual Currency Providers Act and AML/CTF obligations. The public warning serves as a significant mark on the company's regulatory record.

**Source URL:** Finanssivalvonnalta julkinen varoitus Tesseract Finance Oy:lle (FIN-FSA Press Release, 25.10.2023)

The entity targeted by the FIN-FSA public reprimand on February 9, 2022, is Coinmotion Oy.

Violation Type: Deficiencies in compliance with AML/CTF obligations, specifically regarding customer due diligence, risk assessment, and internal control mechanisms. The FIN-FSA found that Coinmotion's practices did not fully meet the requirements of the Act on Virtual Currency Providers and the Anti-Money Laundering Act.

Penalty Amount: Public reprimand (julkinen huomautus). This is a formal, non-monetary disciplinary action indicating serious shortcomings that required immediate correction.

**Date:** Decision issued on **February 9, 2022**.

**Outcome:** Coinmotion Oy was instructed to rectify the identified deficiencies in its AML/CTF processes to ensure full compliance with regulatory requirements.

**Source URL:** Finanssivalvonnalta julkinen huomautus Coinmotion Oy:lle (FIN-FSA Press Release, 09.02.2022)

**Providing services for exchanging virtual currency and fiat currency:** This covers entities facilitating the purchase or sale of virtual currencies using traditional currencies (e.g., EUR, USD).

**Providing custodial wallet services:** This refers to services where an entity holds, stores, or transfers virtual currencies or private cryptographic keys on behalf of customers.

**Exchanges:** Both exchanges offering fiat-to-crypto and crypto-to-crypto trading services are clearly defined as "virtual currency providers" and require **registration** with the FIN-FSA.

**Custody Providers:** Entities providing "custodial wallet services" are also explicitly defined as "virtual currency providers" and require **registration** with the FIN-FSA. This includes services where the private keys are held by the provider on behalf of the client.

**Payment Processors:** This depends on the nature of the service:

If a payment processor *handles virtual currencies* directly (e.g., converts virtual currency payments received from customers into fiat currency for a merchant, or facilitates direct virtual currency transfers), they would likely fall under the definition of a virtual currency provider (specifically "exchanging virtual currency and fiat currency" or "exchanging virtual currency and other virtual currencies") and require **registration** with the FIN-FSA.

If a payment processor *only facilitates fiat currency payments* to or from virtual currency platforms (e.g., a traditional payment service provider (PSP) that processes bank transfers or card payments for a crypto exchange, but does not touch the virtual currency itself), they would generally be regulated under the Payment Services Act (implementing PSD2/PSD3) and would require a payment institution license from the FIN-FSA, but not necessarily a "virtual currency provider" registration, unless their activities extend to handling the virtual assets themselves.

For the purposes of *crypto* licensing, if the payment processor is directly involved in the acceptance, transfer, or conversion of virtual assets, registration as a VCP is required.

The applicant must be a **Finnish limited liability company (osakeyhtiö)** or a **branch of a limited liability company incorporated in an EEA country**.

The **management** of the applicant must be located in Finland. This includes the CEO and at least one other member of the board of directors.

**Capital Requirements (Professional Indemnity Insurance):**

Unlike many traditional financial services, there is **no specific minimum share capital requirement** for virtual currency providers under Finnish law.

Instead, registered VCPs must have **professional indemnity insurance or comparable security** to cover potential liability for damage caused to customers. The required minimum amount of this security is:

**€250,000** for providers offering *only* virtual currency exchange services.

**€500,000** for providers offering *custodial wallet services*, or both exchange and custodial services.

**AML/KYC (Anti-Money Laundering / Know Your Customer):**

This is a cornerstone requirement. Virtual currency providers are subject to the **Act on Preventing Money Laundering and Terrorist Financing (Rahanpesun ja terrorismin rahoittamisen estämisestä annettu laki 050/2017)**.

They must establish and implement a comprehensive AML/CTF program, including:

**Customer Due Diligence (CDD):** Identifying and verifying the identity of customers (KYC).

**Enhanced Due Diligence (EDD):** For higher-risk customers or transactions.

**Ongoing Monitoring:** Monitoring customer transactions for suspicious activity.

**Risk Assessment:** Conducting a comprehensive risk assessment of their business operations.

**Reporting Suspicious Activity:** Reporting suspicious transactions or activities to the Finnish Financial Intelligence Unit (FIU).

**Record Keeping:** Maintaining records of customer identification and transactions for at least five years.

The management (board members, CEO) must be **fit and proper**. This means they must have:

A sound reputation (no criminal record, especially for financial crimes).

Sufficient knowledge, skills, and experience to manage the business.

No history of bankruptcy or business prohibitions.

The company must have sound and reliable administrative and accounting procedures.

Robust IT systems, cybersecurity measures, and data protection protocols are required to safeguard customer assets and data.

Providers must have appropriate security arrangements for their operations.

**Application Form:** Completed application form provided by the FIN-FSA.

Official name and contact details of the company.

Articles of association and trade register extract.

Proof of local presence (e.g., office address in Finland).

**Business Plan:** Detailed description of the business model, services offered, target market, and operational structure.

Curriculum Vitae (CV) for all board members, CEO, and key personnel.

Documentation proving their fit and proper status (e.g., criminal record extracts, financial history).

Detailed written policies and procedures for AML/CTF compliance, including CDD, transaction monitoring, risk assessment, and reporting.

Description of the internal control mechanisms and designated AML officer.

**Security Measures:** Description of IT systems, cybersecurity framework, data protection policies, and operational resilience plans.

**Professional Indemnity Insurance:** Proof of professional indemnity insurance or comparable security, meeting the minimum required amounts.

**Internal Control and Risk Management:** Description of the company's internal control framework and risk management policies.

**Fee:** Payment of the FIN-FSA application processing fee.

**Act on Virtual Currency Providers (Laki virtuaalivaluutan tarjoajista 572/2019)**

**Act on Preventing Money Laundering and Terrorist Financing (Rahanpesun ja terrorismin rahoittamisen estämisestä annettu laki 050/2017):**

**FIN-FSA's Information on Virtual Currency Providers:**

This page provides guidance and application forms for registration: https://www.finanssivalvonta.fi/en/regulated-entities/virtual-currency-providers/

Specific details on the application process and requirements can be found here.

**Finnish Financial Supervisory Authority (FIN-FSA - Finanssivalvonta)**

**Role:** The primary national regulator for virtual currency providers. It is responsible for licensing, supervision, and enforcing compliance with the Act on Virtual Currency Providers and other relevant financial legislation. It also supervises compliance with AML/CTF obligations.

**Role:** Responsible for preparing national legislation related to financial markets, including proposals for implementing EU directives and adapting national law to new EU regulations like MiCA. It sets the overall policy framework.

**Bank of Finland (Suomen Pankki)**

**Role:** While not a direct regulator of individual crypto-asset service providers, the central bank monitors developments in the virtual asset market from a financial stability perspective and provides expertise to the government and FIN-FSA.

**Key Provisions:** This act transposes parts of the EU's 5th Anti-Money Laundering Directive (5AMLD) into Finnish law specifically for virtual currency providers. It defines virtual currency providers (exchanges, wallet providers, issuers) as obliged entities, requires them to register with FIN-FSA, and mandates compliance with strict AML/CTF requirements (e.g., customer identification, transaction monitoring, suspicious transaction reporting). It also sets out basic requirements for safeguarding customer funds and provides FIN-FSA with supervisory powers.

**Regulation (EU) 2023/1114 on Markets in Crypto-Assets (MiCA Regulation)**

**Date:** Entered into force on June 29, 2023.

**Rules concerning asset-referenced tokens (ARTs) and e-money tokens (EMTs) will apply from June 30, 2024.**

**Rules concerning other crypto-assets and crypto-asset service providers (CASPs) will apply from December 30, 2024.**

**Key Provisions:** MiCA is a landmark regulation creating a comprehensive, harmonized framework for crypto-assets not already covered by existing financial services legislation. It covers:

**Transparency and disclosure requirements** for the issuance and admission to trading of crypto-assets.

**Authorization and supervision** of crypto-asset service providers (CASPs), including exchanges, custodians, and advisors. CASPs will require a license to operate across the EU.

**Operational requirements** for CASPs, including governance, conflict of interest management, and safeguarding client assets.

**Consumer protection measures**, including clear information, marketing rules, and complaint handling procedures.

**Measures to prevent market manipulation** and ensure market integrity.

**Regulation (EU) 2023/1113 on information accompanying transfers of funds and certain crypto-assets (TFR - "Travel Rule")**

**Date:** Entered into force on June 29, 2023, and will **apply from December 30, 2024.**

**Key Provisions:** This regulation extends the "Travel Rule" (requiring originators and beneficiaries of transfers to be identified) to crypto-asset transfers. It aims to prevent money laundering and terrorist financing by ensuring that information about the sender and recipient accompanies crypto-asset transfers, similar to traditional wire transfers.

**Registration and Licensing:** Crypto-asset service providers (exchanges, wallet providers, etc.) operating in Finland must currently be **registered with the FIN-FSA** under the *Act on Virtual Currency Providers*. This registration process involves rigorous checks on the company, its management, and its AML/CTF procedures. Once MiCA fully applies, these entities will need to obtain a **MiCA license** from their respective national competent authority (likely FIN-FSA in Finland) to continue operating across the EU.

**AML/CTF Compliance:** All registered/licensed providers are subject to strict Anti-Money Laundering and Counter-Terrorist Financing (AML/CTF) obligations. This includes:

**Know Your Customer (KYC)** procedures: Verifying the identity of users.

**Customer Due Diligence (CDD)**: Ongoing monitoring of business relationships.

**Transaction Monitoring:** Identifying and reporting suspicious transactions to the financial intelligence unit.

**Data Retention:** Keeping records of transactions and customer data.

**Consumer Protection:** FIN-FSA also provides guidance and warnings to consumers regarding the risks associated with crypto assets. MiCA will significantly enhance consumer protection by mandating clear disclosures, preventing misleading advertising, and ensuring robust complaint handling mechanisms for CASPs.

**Safeguarding of Client Funds:** Registered providers must have measures in place to safeguard client funds and assets.

**Adopted:** Yes, the FATF Travel Rule requirements are adopted in Finland.

**Legal Basis:** The primary legal framework is the **Act on Virtual Currency Providers (572/2019)**, which came into force in Finland on **May 1, 2019**. This Act places virtual asset service providers (VASPs) under the supervision of the **Finnish Financial Supervisory Authority (FIN-FSA)** and subjects them to AML/CFT obligations akin to traditional financial institutions.

**Relevant Sections:** The requirements for information accompanying transfers of virtual assets are generally derived from the broader AML obligations within the Act, which mandate customer due diligence and monitoring of transactions. Specific provisions related to the transfer of funds and the information accompanying such transfers for virtual assets mirror the FATF recommendations and the EU's FTR (Funds Transfer Regulation, which the FATF Travel Rule is based on for traditional wires).

**Act on Virtual Currency Providers (572/2019):**

Finlex (Finnish Government database) - Laki virtuaalivaluutan tarjoajista 572/2019 (Finnish)

**Regulator Guidance:** FIN-FSA provides guidance on virtual currency providers' obligations, including AML/CFT requirements.

FIN-FSA - Virtual Currency Providers

The **Act on Virtual Currency Providers (572/2019)** became effective on **May 1, 2019**. This means VASPs operating in Finland have been subject to these AML/CFT obligations, including the Travel Rule principles, since that date.

**VASP-to-VASP Transfers:** For transfers between two regulated VASPs, the Travel Rule applies **without a de minimis threshold**. This means that *all* relevant originator and beneficiary information must be collected and transmitted, regardless of the transaction amount.

**Transfers involving Unhosted Wallets/Non-Obligated Entities:**

If a VASP initiates or receives a transaction where the counterparty is an unhosted wallet (private wallet) or a non-obligated entity, the VASP is expected to apply enhanced due diligence (EDD) and risk-based assessment.

While the Travel Rule's direct "information transmission" between VASPs isn't applicable, VASPs are generally required to collect and verify originator information from their customer for *any* transaction and screen for suspicious activities.

**EU FTR Analogy:** For traditional wire transfers, the EU's Funds Transfer Regulation sets a €1,000 threshold for information collection when one side is not a payment service provider (e.g., cash payment). While not directly specified for virtual assets in the same way, the overarching AML/CFT framework means VASPs must assess risks and perform CDD for transactions above certain amounts or when higher risk is identified, and *always* verify their own customer's identity.

**Providers of virtual currency exchange services:** Entities that exchange virtual currencies for fiat currency or other virtual currencies.

**Providers of virtual currency wallet services:** Entities that offer safekeeping services for virtual currencies on behalf of customers (custodial wallet providers).

**Providers of virtual currency issuance services:** Entities that issue virtual currencies (e.g., initial coin offerings where the issuer acts as a service provider).

**Providers of transfer services for virtual currencies:** Entities that facilitate the transfer of virtual assets.

**Information to be Collected and Transmitted (Travel Rule data points):**

Account number of the originator (or unique transaction identifier)

Address of the originator (or customer identification number, date and place of birth, or national identity number)

Account number of the beneficiary (or unique transaction identifier)

**Secure Storage:** VASPs must securely store all collected information for at least five years after the transaction.

**Data Protection:** Compliance with GDPR is mandatory for handling personal data.

**Transmission Capabilities:** VASPs must have technical capabilities to transmit the required information to the beneficiary VASP immediately and securely upon request or as part of the transaction process.

**Record-Keeping:** Comprehensive records of all transactions and accompanying information must be maintained and readily available to FIN-FSA or law enforcement.

**Risk-Based Approach:** VASPs are expected to implement a risk-based approach to identify, assess, and mitigate money laundering and terrorist financing risks, which includes developing appropriate technical solutions.

**Internal Control Systems:** Establishing and maintaining adequate internal control systems, procedures, and training for personnel to ensure compliance with Travel Rule and broader AML obligations.

**Public Warning:** FIN-FSA can issue a public warning.

**Public Reprimand:** A more severe public reprimand.

**Administrative Fines:** Significant financial penalties can be imposed on the VASP, its management, or individuals responsible for breaches. These fines can range from thousands to millions of euros, depending on the severity and nature of the non-compliance (e.g., up to €5 million or 10% of total annual turnover, or twice the benefit derived from the breach, whichever is higher, for serious AML breaches).

**Order to Cease and Desist:** FIN-FSA can order a VASP to cease specific activities or practices that violate regulations.

**Withdrawal/Revocation of Registration:** For serious or repeated breaches, FIN-FSA can withdraw a VASP's registration, effectively preventing it from operating in Finland.

**Criminal Penalties:** In cases of severe or intentional violations related to money laundering or terrorist financing, individuals responsible (e.g., management, employees) can face criminal charges, leading to imprisonment and substantial fines under the Finnish Penal Code.

**Compliance Requirement:** Finland implements UN sanctions through EU regulations. VASPs must identify and freeze assets belonging to, or controlled by, individuals and entities listed by the UN.

**Legal Basis:** UN Security Council Resolutions (e.g., those relating to terrorism financing, proliferation of WMDs, specific country regimes). Finland, as an EU member, implements these through EU Council Regulations.

**Compliance Requirement:** EU financial sanctions, asset freezes, and restrictions on making funds or economic resources available directly apply to VASPs in Finland. This includes screening against the EU Consolidated Financial Sanctions List. Specific EU regulations have explicitly extended financial restrictions to virtual assets.

**Treaty on European Union (TEU), Article 29:** Basis for CFSP decisions.

**Treaty on the Functioning of the European Union (TFEU), Article 215:** Basis for EU Council Regulations implementing CFSP decisions.

**Key Regulation Example:** Council Regulation (EU) 2022/398 (and subsequent amendments) concerning restrictive measures in view of Russia's actions destabilising the situation in Ukraine explicitly includes "crypto-assets" within the definition of "transferable securities" and "funds," and imposes prohibitions on providing crypto-asset wallet, account or custody services to Russian persons or entities if the total value exceeds €10,000 (initially, later tightened).

*Reference:* Council Regulation (EU) 2022/398 of 9 March 2022 amending Regulation (EU) No 833/2014 concerning restrictive measures in view of Russia’s actions destabilising the situation in Ukraine (specifically Art. 5b and 5f). EUR-Lex Link

**EU Consolidated Financial Sanctions List:** The primary list for EU sanctions screening. EU Sanctions Map & Consolidated List

**Compliance Requirement:** Although not directly legally binding on Finnish entities without a U.S. nexus, prudent VASPs with international operations often screen against OFAC's SDN List due to the risk of indirect impact or reputational damage. OFAC has also issued specific guidance on virtual currency.

**Legal Basis:** U.S. statutes and Executive Orders.

**OFAC's Virtual Currency Guidance:** U.S. Treasury, OFAC Recent Actions (regularly updated with specific crypto designations).

**Act on Virtual Currency Service Providers (2019/572, as amended):** This Act governs the registration and supervision of VASPs in Finland. It mandates compliance with AML/CFT legislation.

*Reference:* **Laki virtuaalivaluutan tarjoajista (572/2019)** (Act on Virtual Currency Service Providers). Finlex (Finnish Law Database) - Finnish only (An English unofficial translation might be available through legal services providers, but the Finnish is the official one).

**Act on Preventing Money Laundering and Terrorist Financing (2017/444, as amended):** This is Finland's primary AML/CFT law, implementing the EU Anti-Money Laundering Directives (currently 5AMLD, soon MLD6).

*Reference:* **Laki rahanpesun ja terrorismin rahoittamisen estämisestä (444/2017)** (Act on Preventing Money Laundering and Terrorist Financing). Finlex (Finnish Law Database) - Finnish only

**Customer Due Diligence (CDD) and Enhanced Due Diligence (EDD):** Identifying and verifying the identity of customers and beneficial owners. EDD for high-risk customers or transactions.

**Obligation:** Screen all new and existing customers (individuals, entities, and beneficial owners) against the EU Consolidated Financial Sanctions List (UN and EU lists), and often OFAC's SDN list for prudent international practice.

**Scope:** This extends to screening associated crypto wallet addresses if possible, transaction counterparties, and any parties involved in virtual asset transfers.

**Frequency:** Screening must be ongoing, not just at onboarding, as sanctions lists are updated frequently.

**Transaction Monitoring:** Monitoring transactions for unusual patterns, amounts, or destinations that could indicate sanctions evasion or illicit activity.

**Reporting Obligations:** Reporting any identified matches (hits) or suspicious transactions (SARs/STRs) to the Finnish Financial Intelligence Unit (FIU), which is part of the National Bureau of Investigation (Keskusrikospoliisi - KRP).

**Asset Freezing:** Immediately freezing any virtual assets belonging to, or controlled by, sanctioned individuals or entities upon identification. This means preventing any access to or transfer of such assets.

**"No Funds" Rule:** Not making any funds or economic resources available, directly or indirectly, to or for the benefit of sanctioned persons or entities. This applies to virtual assets.

**Record Keeping:** Maintaining records of CDD, transactions, screening results, and internal policies for a specified period (typically 5 years).

**Blockchain Analysis:** VASPs should leverage blockchain analytics tools to trace the origin and destination of virtual assets, identify suspicious addresses, and link them to known illicit actors or sanctioned entities where possible.

**Travel Rule:** The FATF Travel Rule, implemented through EU AML Directives and national law, requires VASPs to collect and transmit originator and beneficiary information for virtual asset transfers above a certain threshold (€1,000 for unhosted wallets, no threshold for VASP-to-VASP). This information is critical for sanctions screening of transaction counterparties.

**Wallet Addresses:** VASPs should collect and screen wallet addresses known to be associated with sanctioned entities, although direct identification can be challenging.

**Geographic Restrictions:** The EU's Russia sanctions explicitly prohibit the provision of crypto-asset wallet, account, or custody services to Russian persons or entities if the total value of crypto-assets exceeds €10,000 (or as amended), regardless of their location. This requires VASPs to verify the nationality/residency of their clients.

**UN Sanctions Lists:** Primarily implemented via EU regulations.

**EU Consolidated Financial Sanctions List:** This is the most direct and crucial list for Finnish compliance. It consolidates all persons, groups, and entities subject to an asset freeze and prohibition on making funds or economic resources available, under EU restrictive measures.

*Reference:* EU Sanctions Map & Consolidated List

**OFAC Specially Designated Nationals (SDN) List:** Recommended for VASPs with any international exposure or those dealing with USD-denominated stablecoins or U.S. counterparties.

**The "50% Rule":** Both EU and OFAC sanctions often extend to entities that are directly or indirectly owned 50% or more by one or more sanctioned persons/entities. VASPs must apply this rule, requiring diligence into corporate structures.

**Russia/Ukraine:** Extensive sanctions are in place, including restrictions on financial services, investment, and explicit prohibitions on providing crypto-asset wallet, account, or custody services to Russian individuals/entities (subject to value thresholds and subsequent amendments). Other restrictions target specific regions like Crimea, Sevastopol, and non-government controlled areas of Ukraine.

**Other Regimes:** Sanctions are also in place against countries like North Korea, Iran, Syria, Venezuela, etc., with varying degrees of financial and trade restrictions that can impact crypto activities.

**Sanctioned Jurisdictions:** Comprehensive sanctions programs target specific countries/regions (e.g., Cuba, Iran, North Korea, Syria, Crimea, certain parts of Ukraine), generally prohibiting virtually all transactions and dealings with persons and entities in these areas or involving their governments.

**Geolocation and IP Addresses:** While not foolproof, VASPs are expected to use available tools (e.g., IP address blocking, geo-fencing) to prevent services from being accessed from comprehensively sanctioned jurisdictions or by known sanctioned entities, to the extent technically feasible.

**Criminal Code of Finland (Rikoslaki, 39/1889):** Chapter 46, Section 1-3, addresses violations of regulations on foreign relations.

**Violation of Regulations on Foreign Relations (Ulkosuhteita koskevan säännöksen rikkominen):** A person who intentionally violates or attempts to violate a regulation or prohibition imposed for the purpose of maintaining Finland's foreign relations (e.g., UN or EU sanctions) can be sentenced to a fine or imprisonment for **up to two years**.

**Aggravated Violation:** If the offense is considered aggravated (e.g., significant financial gain, extensive damage, highly organized), the penalty can be imprisonment for **at least four months and up to six years**.

*Reference:* **Rikoslaki (39/1889)**, Luku 46 (Chapter 46). Finlex (Finnish Law Database) - Finnish only

The FIN-FSA has powers to impose administrative sanctions on VASPs for breaches of the Act on Virtual Currency Service Providers or the AML Act. These can include:

**Administrative Fine:** (Seuraamusmaksu) – significant financial penalties, which can be substantial.

**Withdrawal or Suspension of Registration:** (Toimiluvan tai rekisteröinnin peruuttaminen tai rajoittaminen) – leading to the inability to operate.

*Reference:* **Laki finanssivalvonnasta (878/2008)** (Act on the Financial Supervisory Authority), particularly sections regarding administrative sanctions. Finlex (Finnish Law Database) - Finnish only

**Reputational Damage:** Significant negative impact on the VASP's reputation, trust, and ability to attract customers or partners.

**Ministry for Foreign Affairs (Ulkoministeriö):** Responsible for Finland's foreign policy, including the formulation and interpretation of sanctions policy at the national level.

**Financial Supervisory Authority (FIN-FSA - Finanssivalvonta):** Regulatory and supervisory authority for VASPs, ensuring compliance with AML/CFT and sanctions regulations. Maintains the register of VASPs.

**National Bureau of Investigation (Keskusrikospoliisi - KRP):** Specifically, its Financial Intelligence Unit (FIU) receives Suspicious Transaction Reports (STRs) and is responsible for investigating financial crimes, including sanctions violations and money laundering related to virtual assets.

**Customs (Tulli):** Involved in enforcing trade-related sanctions, which can sometimes overlap with financial sanctions concerning dual-use goods or specific technologies.