Finland -- Sanctions Compliance Regulatory Overview

Finland, as a Member State of the European Union, is subject to a multi-layered framework of international sanctions regimes, which are directly applicable or implemented through national law. This framework significantly impacts Virtual Asset Service Providers (VASPs) operating in Finland.

Here's a comprehensive breakdown:

I. Overarching Sanctions Frameworks

Finnish sanctions compliance requirements for VASPs stem from:

A. United Nations Sanctions

The UN Security Council can impose sanctions to maintain international peace and security. These resolutions are legally binding on all UN Member States, including Finland.

• Compliance Requirement: Finland implements UN sanctions through EU regulations. VASPs must identify and freeze assets belonging to, or controlled by, individuals and entities listed by the UN.
• Legal Basis: UN Security Council Resolutions (e.g., those relating to terrorism financing, proliferation of WMDs, specific country regimes). Finland, as an EU member, implements these through EU Council Regulations.

B. European Union Sanctions

The EU implements all UN sanctions and also imposes its own autonomous sanctions (restrictive measures) based on its Common Foreign and Security Policy (CFSP). EU regulations are directly applicable in all Member States without the need for national implementing legislation, though Member States must legislate for penalties.

• Compliance Requirement: EU financial sanctions, asset freezes, and restrictions on making funds or economic resources available directly apply to VASPs in Finland. This includes screening against the EU Consolidated Financial Sanctions List. Specific EU regulations have explicitly extended financial restrictions to virtual assets.
• Legal Basis:
  • Treaty on European Union (TEU), Article 29: Basis for CFSP decisions.
  • Treaty on the Functioning of the European Union (TFEU), Article 215: Basis for EU Council Regulations implementing CFSP decisions.
  • Key Regulation Example: Council Regulation (EU) 2022/398 (and subsequent amendments) concerning restrictive measures in view of Russia's actions destabilising the situation in Ukraine explicitly includes "crypto-assets" within the definition of "transferable securities" and "funds," and imposes prohibitions on providing crypto-asset wallet, account or custody services to Russian persons or entities if the total value exceeds €10,000 (initially, later tightened).
    • Reference: Council Regulation (EU) 2022/398 of 9 March 2022 amending Regulation (EU) No 833/2014 concerning restrictive measures in view of Russia’s actions destabilising the situation in Ukraine (specifically Art. 5b and 5f). EUR-Lex Link
  • EU Consolidated Financial Sanctions List: The primary list for EU sanctions screening. EU Sanctions Map & Consolidated List

C. OFAC Sanctions (U.S. Department of the Treasury's Office of Foreign Assets Control)

While OFAC is a U.S. authority, its sanctions (especially those related to Specially Designated Nationals, or SDNs) have significant extraterritorial reach. Global financial institutions, including VASPs with U.S. nexus (e.g., U.S. customers, servers, dollar transactions, or even processing transactions that clear through the U.S. financial system) must often comply with OFAC sanctions to avoid secondary sanctions or being cut off from the U.S. financial system.

• Compliance Requirement: Although not directly legally binding on Finnish entities without a U.S. nexus, prudent VASPs with international operations often screen against OFAC's SDN List due to the risk of indirect impact or reputational damage. OFAC has also issued specific guidance on virtual currency.
• Legal Basis: U.S. statutes and Executive Orders.
  • OFAC's Virtual Currency Guidance: U.S. Treasury, OFAC Recent Actions (regularly updated with specific crypto designations).
  • SDN List: OFAC SDN List

II. Sanctions Compliance Requirements for VASPs in Finland

VASPs in Finland are regulated by the Financial Supervisory Authority (FIN-FSA - Finanssivalvonta) and must comply with comprehensive Anti-Money Laundering (AML) and Counter-Terrorist Financing (CFT) legislation, which inherently includes sanctions compliance.

A. Legal Basis for VASPs in Finland

• Act on Virtual Currency Service Providers (2019/572, as amended): This Act governs the registration and supervision of VASPs in Finland. It mandates compliance with AML/CFT legislation.
  • Reference: Laki virtuaalivaluutan tarjoajista (572/2019) (Act on Virtual Currency Service Providers). Finlex (Finnish Law Database) - Finnish only (An English unofficial translation might be available through legal services providers, but the Finnish is the official one).
• Act on Preventing Money Laundering and Terrorist Financing (2017/444, as amended): This is Finland's primary AML/CFT law, implementing the EU Anti-Money Laundering Directives (currently 5AMLD, soon MLD6).
  • Reference: Laki rahanpesun ja terrorismin rahoittamisen estämisestä (444/2017) (Act on Preventing Money Laundering and Terrorist Financing). Finlex (Finnish Law Database) - Finnish only

B. Core Compliance Requirements for VASPs

Finnish VASPs must implement robust compliance programs that include:

1. Customer Due Diligence (CDD) and Enhanced Due Diligence (EDD): Identifying and verifying the identity of customers and beneficial owners. EDD for high-risk customers or transactions.
2. Sanctioned Entity Screening:
   • Obligation: Screen all new and existing customers (individuals, entities, and beneficial owners) against the EU Consolidated Financial Sanctions List (UN and EU lists), and often OFAC's SDN list for prudent international practice.
   • Scope: This extends to screening associated crypto wallet addresses if possible, transaction counterparties, and any parties involved in virtual asset transfers.
   • Frequency: Screening must be ongoing, not just at onboarding, as sanctions lists are updated frequently.
3. Transaction Monitoring: Monitoring transactions for unusual patterns, amounts, or destinations that could indicate sanctions evasion or illicit activity.
4. Reporting Obligations: Reporting any identified matches (hits) or suspicious transactions (SARs/STRs) to the Finnish Financial Intelligence Unit (FIU), which is part of the National Bureau of Investigation (Keskusrikospoliisi - KRP).
5. Asset Freezing: Immediately freezing any virtual assets belonging to, or controlled by, sanctioned individuals or entities upon identification. This means preventing any access to or transfer of such assets.
6. "No Funds" Rule: Not making any funds or economic resources available, directly or indirectly, to or for the benefit of sanctioned persons or entities. This applies to virtual assets.
7. Record Keeping: Maintaining records of CDD, transactions, screening results, and internal policies for a specified period (typically 5 years).

C. Specific Considerations for Crypto-Assets

• Blockchain Analysis: VASPs should leverage blockchain analytics tools to trace the origin and destination of virtual assets, identify suspicious addresses, and link them to known illicit actors or sanctioned entities where possible.
• Travel Rule: The FATF Travel Rule, implemented through EU AML Directives and national law, requires VASPs to collect and transmit originator and beneficiary information for virtual asset transfers above a certain threshold (€1,000 for unhosted wallets, no threshold for VASP-to-VASP). This information is critical for sanctions screening of transaction counterparties.
• Wallet Addresses: VASPs should collect and screen wallet addresses known to be associated with sanctioned entities, although direct identification can be challenging.
• Geographic Restrictions: The EU's Russia sanctions explicitly prohibit the provision of crypto-asset wallet, account, or custody services to Russian persons or entities if the total value of crypto-assets exceeds €10,000 (or as amended), regardless of their location. This requires VASPs to verify the nationality/residency of their clients.

III. Sanctioned Entity Screening Obligations

Finnish VASPs must screen against:

• UN Sanctions Lists: Primarily implemented via EU regulations.
• EU Consolidated Financial Sanctions List: This is the most direct and crucial list for Finnish compliance. It consolidates all persons, groups, and entities subject to an asset freeze and prohibition on making funds or economic resources available, under EU restrictive measures.
  • Reference: EU Sanctions Map & Consolidated List
• OFAC Specially Designated Nationals (SDN) List: Recommended for VASPs with any international exposure or those dealing with USD-denominated stablecoins or U.S. counterparties.
  • Reference: OFAC SDN List
• The "50% Rule": Both EU and OFAC sanctions often extend to entities that are directly or indirectly owned 50% or more by one or more sanctioned persons/entities. VASPs must apply this rule, requiring diligence into corporate structures.

IV. Geographic Restrictions

Sanctions often impose restrictions based on geographic location:

• EU-Imposed Restrictions:
  • Russia/Ukraine: Extensive sanctions are in place, including restrictions on financial services, investment, and explicit prohibitions on providing crypto-asset wallet, account, or custody services to Russian individuals/entities (subject to value thresholds and subsequent amendments). Other restrictions target specific regions like Crimea, Sevastopol, and non-government controlled areas of Ukraine.
  • Other Regimes: Sanctions are also in place against countries like North Korea, Iran, Syria, Venezuela, etc., with varying degrees of financial and trade restrictions that can impact crypto activities.
• OFAC-Imposed Restrictions:
  • Sanctioned Jurisdictions: Comprehensive sanctions programs target specific countries/regions (e.g., Cuba, Iran, North Korea, Syria, Crimea, certain parts of Ukraine), generally prohibiting virtually all transactions and dealings with persons and entities in these areas or involving their governments.
• Geolocation and IP Addresses: While not foolproof, VASPs are expected to use available tools (e.g., IP address blocking, geo-fencing) to prevent services from being accessed from comprehensively sanctioned jurisdictions or by known sanctioned entities, to the extent technically feasible.

V. Penalties for Violations in Finland

Violations of sanctions can lead to severe penalties under Finnish law:

• Criminal Penalties:
  • Criminal Code of Finland (Rikoslaki, 39/1889): Chapter 46, Section 1-3, addresses violations of regulations on foreign relations.
    • Violation of Regulations on Foreign Relations (Ulkosuhteita koskevan säännöksen rikkominen): A person who intentionally violates or attempts to violate a regulation or prohibition imposed for the purpose of maintaining Finland's foreign relations (e.g., UN or EU sanctions) can be sentenced to a fine or imprisonment for up to two years.
    • Aggravated Violation: If the offense is considered aggravated (e.g., significant financial gain, extensive damage, highly organized), the penalty can be imprisonment for at least four months and up to six years.
  • Reference: Rikoslaki (39/1889), Luku 46 (Chapter 46). Finlex (Finnish Law Database) - Finnish only
• Administrative Penalties by FIN-FSA:
  • The FIN-FSA has powers to impose administrative sanctions on VASPs for breaches of the Act on Virtual Currency Service Providers or the AML Act. These can include:
    • Public Warning: (Julkinen varoitus)
    • Reprimand: (Huomautus)
    • Administrative Fine: (Seuraamusmaksu) – significant financial penalties, which can be substantial.
    • Withdrawal or Suspension of Registration: (Toimiluvan tai rekisteröinnin peruuttaminen tai rajoittaminen) – leading to the inability to operate.
  • Reference: Laki finanssivalvonnasta (878/2008) (Act on the Financial Supervisory Authority), particularly sections regarding administrative sanctions. Finlex (Finnish Law Database) - Finnish only
• Reputational Damage: Significant negative impact on the VASP's reputation, trust, and ability to attract customers or partners.

VI. Country-Specific Sanctions Lists for Crypto (Finland)

Finland does not maintain its own distinct "country-specific sanctions lists for crypto."

Instead, Finland, as an EU Member State, directly applies the EU Consolidated Financial Sanctions List which explicitly includes crypto-assets within its scope for certain regimes (e.g., Russia). It also implements UN sanctions, which are similarly integrated into the EU framework.

Therefore, the relevant lists for a Finnish VASP are the EU Consolidated Financial Sanctions List and, for prudential reasons, the OFAC SDN List.

VII. Key Finnish Authorities Involved

• Ministry for Foreign Affairs (Ulkoministeriö): Responsible for Finland's foreign policy, including the formulation and interpretation of sanctions policy at the national level.
• Financial Supervisory Authority (FIN-FSA - Finanssivalvonta): Regulatory and supervisory authority for VASPs, ensuring compliance with AML/CFT and sanctions regulations. Maintains the register of VASPs.
• National Bureau of Investigation (Keskusrikospoliisi - KRP): Specifically, its Financial Intelligence Unit (FIU) receives Suspicious Transaction Reports (STRs) and is responsible for investigating financial crimes, including sanctions violations and money laundering related to virtual assets.
• Customs (Tulli): Involved in enforcing trade-related sanctions, which can sometimes overlap with financial sanctions concerning dual-use goods or specific technologies.

Conclusion

Finnish VASPs face a stringent and complex sanctions compliance landscape. They must implement robust, risk-based compliance programs that incorporate real-time screening against relevant international and EU sanctions lists, rigorous customer and transaction monitoring, and proactive measures to identify and freeze sanctioned assets. Failure to comply can result in severe criminal and administrative penalties, as well as significant reputational damage. Given the dynamic nature of both the crypto industry and sanctions regimes, continuous monitoring and adaptation of compliance frameworks are essential.

Disclaimer: This information is for general informational purposes only and does not constitute legal advice. VASPs operating in Finland should consult with legal professionals specializing in Finnish and EU financial regulations to ensure full compliance with all applicable sanctions and AML/CFT laws.