Finland AML Obligations for Auditors: Rahanpesulaki 444/2017 and PRH

In Finland, auditors are a regulated group under the national money laundering act, rahanpesulaki, and the Finnish Patent and Registration Office (PRH) supervises them. This guide summarises the PRH's published guidance for auditors, so readers can compare how Finland sets out the duties. It covers auditors only, not bookkeeping firms. If you are new to the topic, start with our guide to KYC and customer due diligence for accountancy practices.

Where this guide comes from

The source is PRH's web guidance "Rahanpesulain velvoitteet tilintarkastajille" (AML obligations for auditors), reference PRH/1119/1006/2023. The page does not show a publication date, and the 2023 in the reference number is our only clue. The guidance points to the Finnish auditors' association recommendations 6/2020 as related material. It is guidance, not the law. This is general information, not legal advice.

Legal basis and who is covered

The law is the act on preventing money laundering and terrorist financing (444/2017). According to the guidance, covered auditors are those performing statutory audits or public-sector audits, or acting in other audit-related roles under the Auditing Act (1141/2015) and the Public Sector Auditing Act (1142/2015). Sole practitioners and audit firms are both covered, though some obligations apply only to firms.

Risk assessment

Each firm and sole practitioner must prepare a written risk assessment, update it regularly (the guidance gives annual updates as an example) and provide it to PRH on request. Policies must be approved by top management.

Customer identification and due diligence

Auditors must identify customers and verify identity when the relationship starts, using accepted official identity documents, strong electronic identification, or trade register extracts for companies. Anyone acting for a company must be identified and shown to have authority (3 luku 2 §). The guidance also asks auditors to understand the client's business and monitor activity for unusual transactions (3 luku 4 §).

Beneficial owners must be identified and, where necessary, verified, with data kept accurate (1 luku 7 §). If a client's data differs from PRH's register, the auditor must first ask the client, and unresolved discrepancies must be reported to PRH without delay (6 luku 5 §). See our guide to ultimate beneficial ownership for the concept in general terms.

Enhanced due diligence is required for higher-risk relationships, clients or transactions linked to high-risk non-EEA countries, politically exposed persons (3 luku 13 §) and remote identification. Measures include senior management approval and more frequent monitoring.

Reporting suspicious transactions

Auditors report suspicious transactions to the Rahanpesun selvittelykeskus, the financial intelligence unit within the National Bureau of Investigation. This applies whether or not the relationship was established or the transaction was completed. The guidance says no particular level of evidence is needed and auditors need not decide whether a crime occurred. Auditors must also answer the unit's information requests within the deadline it sets. The guidance gives no fixed deadline for filing a suspicious transaction report.

Tipping off, records and internal controls

Auditors must not disclose a report or related investigation to anyone, including the client. Exceptions cover staff with a direct work need and limited information sharing with certain entities supervised by the financial supervisor that are involved in the transaction (4 luku 4 §). Our guide to suspicious activity reports and tipping off explains the principle.

Due diligence records must be kept for at least five years after the relationship ends (3 luku 3 §). Reporting-related records are kept for five years, longer where needed, with their necessity reviewed every three years and recorded, and stored separately from the client register. Firms must have written internal procedures, train staff and keep an internal channel for reporting suspected violations (9 luku 1 § and 7 luku 8 §). Very small firms with fewer than ten people may ask PRH for an exemption from the internal channel requirement.

Supervision and penalties

PRH supervises compliance, can request information free of charge and can issue prohibitions and correction orders. It can also temporarily bar a person from firm management. PRH may propose a rikemaksu (a fine for intentional or negligent breaches), a seuraamusmaksu (a higher penalty for serious, repeated or systematic breaches) or a public warning, and the Auditing Board decides on penalties based on PRH's proposal (chapters 7 and 8 of the act).

Practical steps (our suggestions)

• Keep your risk assessment in writing and approve it at top-management level.
• Compare each audit client's beneficial owner data with the PRH register before you finalise onboarding.
• Store reporting records away from the client register and diarise the three-year necessity review.
• Check whether a small firm exemption for the internal reporting channel applies to you.

What we could not confirm

This guide covers auditors only, and we have not covered the rules for bookkeeping or accounting firms in Finland. We read PRH's guidance, not the act, and the page has no clear date. The guidance gives no penalty amounts and no reporting deadline, and we did not check amendments to the act since 2023. Confirm details with PRH and the current text of the act before relying on this guide.

Frequently asked questions

Who supervises Finnish auditors on AML?

PRH, with penalties decided by the Auditing Board on PRH's proposal.

Where are suspicious transactions reported?

To the Rahanpesun selvittelykeskus.

How long are records kept?

At least five years after the relationship ends.

Do small firms need a whistleblowing channel?

Yes, but firms with fewer than ten people may ask PRH for an exemption.

Explore more country guides in our AML and KYC hub, or build your team's skills with Learnsignal CPD courses.