Anti-money-laundering duties for non-financial firms: what to do in the first weeks is concrete. A firm newly caught by the obligated-entity regime, whether a real estate agent, an auditor, or a dealer in high-value goods, must name a responsible officer, complete a written risk assessment, and run customer due diligence before the next client is onboarded.
Who this concerns
The obligated-entity regime under Swedish law as it currently stands does not sort firms by industry sector; it sorts them by activity. A firm that has never called itself a financial institution can still fall inside the perimeter because it brokers property, forms companies, holds client funds in escrow, deals in art or jewellery above a value threshold, or runs a gambling operation. Accountants, tax advisors, notaries, company and trust service providers, and lawyers handling property or company transactions sit in the same list, alongside firms that would never describe themselves as part of the financial sector.
The trigger is usually external. A bank counterparty refuses to process a payment until the firm can show its own onboarding file. A tender requires proof of a registered risk assessment. A supervisor writes asking for the name of the responsible officer. By the time that letter arrives, the firm has usually been inside scope for months without having built anything, and the gap between what exists and what the regime expects has been growing quietly the entire time.
The first irreversible step is not a filing, it is an onboarding decision. A client accepted without due diligence stays a client with an unverified file for as long as the relationship runs, and the gap does not close itself retroactively. The second is a missed suspicious-activity report: once a transaction has cleared, the window to flag it before it becomes a completed, unreported event has already passed. Everything else, the policy document, the training log, the register entry, can be built after the fact. These two cannot.
What the law says
Under Swedish law as it currently stands, an entity carrying out one of the listed activities is an obligated entity (verksamhetsutövare, the party on which the anti-money-laundering duties fall) regardless of how it is otherwise regulated, taxed, or supervised. Being a small company, a sole trader, or a firm that has never handled cash does not remove the duty; it can narrow what a risk-based programme has to cover, but it does not remove the requirement to have one.
The duty runs in three layers. The firm assesses its own risk of being used for money laundering or terrorist financing, given its client base, its products, and its delivery channels. It applies customer due diligence calibrated to that risk before establishing the relationship, and ongoing monitoring for as long as the relationship lasts. It reports a transaction it cannot explain to Finanspolisen, the Swedish financial intelligence unit, without telling the client that a report has been made. Records supporting all three layers have to remain retrievable for as long as the regulation requires, not just for as long as it is convenient to keep them.
Where the client, the ultimate owner, or the counterparty sits outside Sweden, none of these three layers shrinks; the due-diligence layer typically expands. A client structure with a beneficial owner established in a jurisdiction that Sweden or the EU treats as higher-risk pulls the firm into enhanced due diligence, meaning more documents, more source-of-funds questions, and no ability to rely on a foreign notary's or a foreign law firm's own checks without keeping a record of exactly what was verified and how. The compliance, sanctions and cyber practice at Lodline sees this most often in property transactions with an offshore purchasing vehicle and in company formations where the instructing party sits abroad.
How it works in practice
Building the risk assessment first
Everything downstream depends on a written, firm-specific risk assessment: which clients, which products, which delivery channels and which geographies carry the higher exposure for this particular business. A generic template copied from an industry association will not survive a supervisory review; the document has to reflect the firm's own client book, not a sector average.
Appointing someone who actually owns the file
The regime expects a named person with real authority to stop a transaction, not a title added to an organisation chart after the fact. In a small firm this is often the owner; in a larger one it is a compliance function with a reporting line that does not run through the person closing the deal.
Customer due diligence before, not after, onboarding
Identity verification, purpose of the relationship, and expected pattern of activity have to be established before the client is accepted, not filled in retrospectively once a file is requested. A due diligence record built after the fact is a due diligence failure with paperwork attached to it.
Checking the real owner, not the signatory
Verifying the person who signs is not the same as verifying the person who benefits. Ownership structures are sometimes built around a nominee, a bulvan (a front person holding formal title on someone else's instruction) who signs documents while another party controls the outcome. A firm that stops at the signatory and does not trace to the actual controller has not completed the check the regime requires.
What monitoring looks like once the client is onboarded
The file is not closed at onboarding. A pattern that does not match the stated purpose of the relationship, a sudden change in transaction size, or a counterparty that appears without explanation are all triggers for a fresh look, not events to be logged and left unread.
Reporting a suspicion without tipping off the client
A report to Finanspolisen is made without informing the client that it has been made. Continuing to service the client normally while the report is pending is standard practice, not a contradiction; alerting the client defeats the purpose of the report and can itself be a separate breach.
Training that supervisors actually check
A supervisor asks who was trained, when, and on what material, not whether a training programme exists in principle. A single onboarding session delivered years ago to staff who have since left the firm does not satisfy an ongoing training duty, and a supervisor will ask to see the log, not the policy statement about training.
The register entry that ties the file together
The responsible officer, the risk assessment, the due diligence files, and the training log only work as a defence if a register entry shows who held the role and when, so that a supervisor reviewing a transaction from an earlier period can see who was accountable at that time, not only who holds the title now.
What to check now, before a supervisor asks:
- Whether the firm's activity actually falls within the obligated-entity list, rather than assuming it does not because it is small or unregulated in other respects
- Whether a named responsible officer exists with documented authority, not just a job title
- Whether the risk assessment reflects this firm's actual client base, or is a copied template
- Whether due diligence files exist for every client accepted in the last reporting period, not a sample
- Whether beneficial ownership has been traced past the signatory on every corporate client
- Whether a reporting line to Finanspolisen exists and has been tested, not just documented
Where the parallel exposure sits
An anti-money-laundering finding rarely arrives alone. If the underlying transaction also raises a tax question, the parallel tax case can run on its own track with a different decision-maker and a different timetable, and the firm has to manage both without letting one file contradict the other.
After a restructuring
A group that has just gone through an intra-group restructuring does not inherit a clean due-diligence file for the entity that emerges. Ownership has changed, sometimes the activity has changed, and the risk assessment has to be redone rather than carried over from the predecessor company.
Frequently asked questions
#### Does an anti-money-laundering finding automatically trigger a parallel tax investigation?
Not automatically, but the two frequently move together because the same transaction can raise both questions at once. The parallel tax case is decided separately, on its own evidence and its own timetable, and a firm managing both has to treat them as related but distinct files rather than assume one outcome determines the other.
#### Do the same due diligence duties apply after a group restructuring or an intra-group transfer?
Yes, and they do not carry over automatically from the predecessor entity. A group restructuring changes the ownership and sometimes the activity of the surviving entity, so the risk assessment and the due diligence files have to be rebuilt for the entity as it exists after the change, not inherited from before it.
#### What is a bulvan and why does it matter for ownership checks?
A bulvan is a front person who holds formal title, signs documents, or appears as the registered owner while someone else actually controls the outcome. The term matters because a due diligence check that stops at the signatory rather than tracing to the person giving instructions has not verified the beneficial owner the regime requires the firm to identify.
The numbers
Under Swedish law as it currently stands, no single figure fixes what remediation costs or how long it takes; both depend on what already exists inside the firm rather than on the regime itself. A firm with a named officer, a live risk assessment, and complete due diligence files for its recent client book faces a light gap to close. A firm with none of these, and a client book built up over several years without a single verification, faces a backlog that has to be worked through client by client, not fixed by a single policy rewrite.
The variables that move the figure most are the number of client files that need retrospective review, whether any of those files involve a foreign counterparty or beneficial owner, whether enforcement contact has already started, and whether the firm's activity also brings it within a separate regime, such as the entities covered by the Cyber Security Act, which runs its own registration and timeline requirements in parallel rather than as a substitute for the anti-money-laundering duty. A firm reviewing both at once should treat them as separate scoping exercises with separate deadlines, not a single combined project.
Where it usually goes wrong
A firm assumes it is excluded because its transaction volume is small, and discovers only when a bank counterparty pushes back that volume is not the test the regime applies; activity is. A firm treats a single occasional transaction as outside scope because the activity is not its main business, when the regime can capture a one-off transaction of the right kind regardless of how central it is to the firm's normal work.
A firm relies on a counterparty bank's own know-your-customer check as if it satisfied its own due diligence duty. It does not. The duty is the firm's own and is not discharged by pointing at someone else's file, except through a formal reliance arrangement that is documented as such, which most firms have not actually put in place even when they believe they have.
A firm outsources the compliance function to an external provider and assumes the outsourcing also transfers the personal liability of the responsible officer. It does not; the named officer remains accountable for the file even where day-to-day work is performed by someone else, and a supervisor's questions go to the officer, not to the vendor.
A firm also sometimes confuses sanctions screening with anti-money-laundering due diligence and assumes that one covers the other. The two overlap in practice but rest on separate obligations and separate registers, and a file that satisfies one does not automatically satisfy the other.
What to do next
This material gets a firm to the point of naming what applies and what its current file is missing. Whether the existing risk assessment, due diligence records, and reporting line would actually hold up against a supervisory review is a document-by-document question that cannot be answered in the abstract. That is where an assessment with Lodline starts: a review of what exists against what the regime requires, and a plain answer on where the gap sits.
Firms that also fall within the parallel cyber compliance regime often ask the scoping and cost questions at the same time; the NIS2 scoping, registration and authority timeline is covered separately. To move from this material to a review of your own file, start with an assessment.