Norway -- Sanctions Compliance Regulatory Overview

Norway, while not a member of the European Union, is part of the European Economic Area (EEA) and the Schengen Area. As such, it generally aligns with and implements sanctions regimes adopted by the United Nations (UN) and the European Union (EU). For Virtual Asset Service Providers (VASPs), this translates into a robust set of compliance obligations, encompassing anti-money laundering (AML) and counter-terrorist financing (CFT) measures, alongside specific sanctions screening requirements.

Here's a breakdown of the cryptocurrency sanctions and restrictions in Norway:

I. International Framework Adopted by Norway

Norway implements international sanctions through its national legislation, primarily the Sanctions Act and accompanying regulations.

1. United Nations (UN) Sanctions:

   • Norway, as a UN member state, is legally bound to implement sanctions resolutions adopted by the UN Security Council. These are considered international law and are directly transposed into Norwegian law.
   • Compliance Requirement: VASPs must screen against the UN Security Council Consolidated List.
   • Legal Basis: Implemented through Lov om iverksetting av internasjonale sanksjoner (sanksjonsloven) (Act on the implementation of international sanctions (the Sanctions Act)) and specific regulations (forskrifter) for each sanctions regime.

2. European Union (EU) Sanctions:

   • While not an EU member, Norway largely aligns with EU sanctions regimes due to its EEA membership and foreign policy considerations. EU sanctions regulations are typically implemented in Norway through national regulations that mirror the EU measures.
   • Compliance Requirement: VASPs must screen against the EU Consolidated Sanctions List.
   • Legal Basis: Implemented through the Sanksjonsloven and subsequent "forskrifter" (regulations) issued by the Ministry of Foreign Affairs, which effectively transpose EU measures into Norwegian law.

3. OFAC Sanctions (U.S. Office of Foreign Assets Control):

   • OFAC sanctions are U.S. law and do not directly apply to Norwegian entities unless they have a U.S. nexus (e.g., U.S. persons involved, transactions in U.S. dollars, use of U.S. infrastructure, or operations with a U.S. presence).
   • Compliance Requirement for VASPs: Despite not being Norwegian law, most international VASPs, including those operating in Norway, choose to comply with OFAC sanctions due to the global reach of the U.S. financial system, the prevalence of USD-denominated crypto transactions, and the severe extraterritorial penalties for non-compliance. Failure to comply can lead to being cut off from critical banking services or correspondent relationships.
   • Key Lists: OFAC Specially Designated Nationals (SDN) and Blocked Persons List, and other OFAC sanctions lists.

II. Norwegian Legal Framework for Sanctions Compliance

The core legislative framework governing sanctions and AML/CFT for VASPs in Norway includes:

1. Lov om iverksetting av internasjonale sanksjoner (sanksjonsloven) (Act on the implementation of international sanctions (the Sanctions Act)).

   • This is the primary legal framework for implementing international sanctions in Norway. It grants the King in Council (the government) the authority to issue regulations to implement UN Security Council resolutions and other international obligations concerning sanctions.
   • Legal Reference: Lovdata - Sanksjonsloven

2. Lov om tiltak mot hvitvasking og terrorfinansiering (hvitvaskingsloven) (Act on measures against money laundering and terrorist financing (the Anti-Money Laundering Act)).

   • This is the fundamental AML/CFT law in Norway. It designates VASPs as "reporting entities" (rapporteringspliktige) and imposes extensive obligations, including customer due diligence (CDD), ongoing monitoring, and reporting of suspicious transactions. Sanctions screening is an integral part of these obligations.
   • Legal Reference: Lovdata - Hvitvaskingsloven

3. Forskrift om virtuell eiendelstjenesteyting (Regulation on Virtual Asset Service Provision).

   • This regulation specifically defines and governs VASPs, bringing them under the supervision of Finanstilsynet (the Financial Supervisory Authority of Norway). It reiterates that VASPs are subject to the Anti-Money Laundering Act and must comply with its requirements.
   • Legal Reference: Lovdata - Forskrift om virtuell eiendelstjenesteyting

4. Specific Regulations (Forskrifter):

   • For each sanctions regime (e.g., against Russia, North Korea, Syria), the Norwegian government issues specific regulations under the Sanctions Act. These regulations detail the specific prohibitions, asset freezes, and individuals/entities targeted, mirroring the UN and EU lists.
   • Example: Lovdata - Forskrift om sanksjoner mot Russland (Regulation on sanctions against Russia)

III. Compliance Requirements for VASPs in Norway

VASPs operating in Norway, whether domestic or foreign-based, must comply with a stringent set of requirements:

1. Registration and Supervision: VASPs must register with Finanstilsynet and are subject to its supervision. This registration confirms their obligation to comply with AML/CFT and sanctions regulations.

   • Finanstilsynet Information: Finanstilsynet - Virtual currency service providers

2. Sanctioned Entity Screening Obligations:

   • Mandatory Screening: VASPs must screen all customers, beneficial owners, and, where applicable, transaction counterparties against all relevant sanctions lists (UN, EU, and practically, OFAC).
   • Ongoing Screening: Screening is not a one-time event at onboarding but must be performed on an ongoing basis to identify any changes in sanctions status.
   • Adverse Media & PEPs: Screening for politically exposed persons (PEPs) and adverse media is also required as part of enhanced due diligence (EDD) for higher-risk customers.

3. Customer Due Diligence (CDD):

   • Identity Verification (KYC): Collecting and verifying the identity of customers and beneficial owners (e.g., name, address, date of birth, national ID, company registration).
   • Purpose and Nature of Relationship: Understanding the purpose and intended nature of the business relationship.
   • Source of Funds/Wealth: For higher-risk clients, understanding the source of funds and wealth.

4. Transaction Monitoring:

   • VASPs must monitor transactions for suspicious patterns, unusual activity, and attempts to circumvent sanctions. This includes identifying transactions linked to sanctioned jurisdictions or entities.
   • The FATF Travel Rule (Recommendation 16) requires VASPs to obtain and transmit originator and beneficiary information for crypto transfers above a certain threshold. Norway is committed to implementing this standard.

5. Reporting Obligations:

   • Suspicious Activity Reports (SARs): Any activity suspected of being related to money laundering, terrorist financing, or sanctions evasion must be reported promptly to Økokrim (the National Authority for Investigation and Prosecution of Economic and Environmental Crime).
   • Reporting of Frozen Assets: If a VASP identifies funds or other assets belonging to a sanctioned individual or entity, these assets must be immediately frozen, and the incident reported to the Ministry of Foreign Affairs and Finanstilsynet.

6. Internal Controls: VASPs must implement robust internal policies, procedures, and controls to ensure compliance, including regular training for staff, independent audits, and a designated compliance officer.

IV. Sanctions Lists and Geographic Restrictions

1. Key Sanctions Lists:

   • UN Security Council Consolidated List: Maintained by the UN.
   • EU Consolidated Sanctions List: Maintained by the EU (accessible via EUR-Lex and EEAS websites).
   • Norwegian Ministry of Foreign Affairs: Publishes current lists and relevant regulations implementing UN and EU sanctions. This is the primary source for Norway-specific implementation details.
     • Legal Reference: Utenriksdepartementet - Sanksjoner (Ministry of Foreign Affairs - Sanctions)
   • OFAC SDN List: Maintained by the U.S. Treasury.

2. Geographic Restrictions:

   • Sanctions regimes often target specific countries (e.g., Russia, North Korea, Iran, Syria, Venezuela, Myanmar).
   • Comprehensive Embargoes: Prohibit nearly all transactions with certain countries or regimes (e.g., North Korea).
   • Sectoral Sanctions: Target specific sectors of an economy (e.g., financial, energy, defense sectors in Russia).
   • Asset Freezes: Apply to designated individuals and entities regardless of their location, meaning any assets (including crypto) they own or control, directly or indirectly, must be frozen.
   • For VASPs, this implies implementing geo-blocking measures, transaction monitoring for IP addresses from sanctioned regions, and careful scrutiny of the origin and destination of virtual assets.

V. Penalties for Violations

Non-compliance with sanctions and AML/CFT regulations in Norway carries significant penalties, which can be administrative or criminal:

1. Under the Sanctions Act (Sanksjonsloven):

   • Criminal Penalties: Violations can lead to fines or imprisonment for up to 3 years. For aggravated circumstances, the penalty can be imprisonment for up to 6 years.
   • Legal Reference: Sanksjonsloven § 7

2. Under the Anti-Money Laundering Act (Hvitvaskingsloven):

   • Administrative Fines: Finanstilsynet can impose substantial administrative fines on legal persons (companies) for breaches of AML/CFT duties, including sanctions screening failures.
   • Criminal Penalties: Individuals responsible for serious breaches can face fines or imprisonment for up to 3 years. For aggravated offenses, the penalty can be imprisonment for up to 6 years.
   • Withdrawal of Registration: Finanstilsynet can revoke a VASP's registration, effectively preventing it from operating in Norway.
   • Legal Reference: Hvitvaskingsloven § 11 (Administrative Fines), § 50 (Criminal Penalties)

3. Under the Terrorism Act (Straffeloven):

   • Financing terrorism, even inadvertently through non-compliance with sanctions, carries severe penalties under Norwegian criminal law (terrorism offenses).

4. Reputational Damage: Beyond legal penalties, non-compliance can severely damage a VASP's reputation, leading to loss of trust from customers, banking partners, and investors.

VI. Country-Specific Sanctions Lists for Crypto

Norway does not maintain a unique "country-specific sanctions list" for crypto that is separate from its implementation of UN and EU sanctions. Instead, Norway's specific sanctions lists are the regulations (forskrifter) issued under the Sanctions Act that transpose UN and EU measures into Norwegian law.

These regulations specify:

• The countries or regimes targeted (e.g., Russia, North Korea, Iran).
• The specific individuals and entities subject to asset freezes.
• The types of prohibitions (e.g., restrictions on financial transactions, export/import bans).

For VASPs, the requirement is to consult the official Norwegian government sources (primarily the Ministry of Foreign Affairs and Lovdata) for the most current versions of these implementing regulations, which mirror the UN and EU lists.

In conclusion, VASPs operating in Norway face a comprehensive regulatory landscape that mandates strict adherence to UN and EU sanctions, along with the practical necessity of complying with OFAC sanctions. Robust AML/CFT programs, including diligent sanctions screening, are not merely best practice but legal obligations with severe penalties for non-compliance.