Norway AML Obligations for Bookkeepers: Hvitvaskingsloven and Finanstilsynet

Norwegian bookkeepers, known as regnskapsførere, are directly covered by the country's money laundering act, hvitvaskingsloven. The financial regulator, Finanstilsynet, has published a circular explaining what firms in this sector are expected to do. This guide summarises that circular for readers comparing anti-money-laundering rules across countries. If you want the basics first, our guide to KYC and customer due diligence for accountancy practices is a good start.

Where this guide comes from

The source is Finanstilsynet's Rundskriv 15/2019, published on 23 December 2019 and corrected on 20 January 2020. It gives guidance to regnskapsførere and regnskapsførerselskaper (bookkeeping firms) and replaces Rundskriv 4/2017. Finanstilsynet says it is not a full overview of every duty. Because it dates from 2019, some details may have moved on, and we flag that clearly below. Section numbers are as the circular gives them. This is general information, not legal advice.

Legal basis and scope

The circular refers to hvitvaskingsloven, its regulations (hvitvaskingsforskriften) and regnskapsførerloven section 2, second paragraph, which links good accounting practice to the client's reporting obligations. It says the rules apply to all bookkeeping firms, including certain services such as employer reporting, personal tax returns, payroll and advisory work (sections 2 j, 4 second paragraph b, and 42).

Risk assessment and organisation

Under section 7, firms must carry out a documented risk assessment and update it at least annually, with the board or managing director setting it. The circular says a firm needs a hvitvaskingsansvarlig, a money laundering officer in senior management (section 8, fifth paragraph), who cannot also be the compliance officer. Training is covered by section 36 and internal control by section 35, second paragraph. Procedures should be specific, risk-based and documented, and should cover due diligence, risk classification, ongoing follow-up at least annually, reliance on third parties (section 22) and outsourcing (section 23).

Customer due diligence (kundetiltak)

Due diligence must be completed before the relationship begins (section 11, with section 10). If it cannot be completed, the relationship must not be established (section 21, first paragraph). For individuals, identity verification follows section 12. For companies, section 13 applies, including the organisation number and management, and the circular says register extracts should be no more than three months old.

Beneficial owners are defined in section 2 e and identified under section 14. The circular uses a 25 percent threshold for ownership and control and says self-declaration alone is not enough: registers and the shareholder register must be checked. Our guide to ultimate beneficial ownership explains why. Customers start as normal risk, low risk needs a specific assessment, simplified measures fall under section 16 and enhanced measures under section 17. Politically exposed persons are defined in section 2 f, with family members and close associates in sections 2 g and 2 h. Enhanced measures include senior approval and continue for at least a year after the person leaves office.

Investigation and reporting to Økokrim

Section 25 sets an investigation duty with a low threshold: any indication that funds may be linked to money laundering or terrorist financing triggers it, several weak indicators can add up, and the investigation must be documented. Section 26 requires a report to Økokrim if suspicion is not dispelled, and the money laundering officer is responsible for sending it. Reports made in good faith do not breach confidentiality unless there is gross negligence (section 26, fourth paragraph).

On timing, the main rule in section 27 is that a suspicious transaction should not be carried out before Økokrim is notified, but the circular says this applies only to a limited extent to bookkeepers. It gives no fixed number of days.

Confidentiality and records

Section 28 prohibits disclosure of investigations, reports and proceedings to the customer and third parties. It has no time limit and continues after the relationship ends or an employee leaves. Limited exceptions exist, such as sharing with authorities and with other professionals in the same network on joint customers. See our guide to suspicious activity reports and tipping off for the wider principle.

Section 30 requires information to be stored for five years after the customer relationship ends, and personal data to be deleted after five years. Former beneficial owners must be kept on record, and backups stored separately from originals. Systems must allow quick answers to authorities about customer relationships over the past five years.

Supervision

Finanstilsynet supervises compliance, and supervisory requests are governed by section 3 of the financial supervision act. The circular does not describe inspections or penalties, so we do not describe them here either.

Practical steps (our suggestions)

• Review your written risk assessment at least once a year and record the date.
• Name a money laundering officer and make sure they are not also the compliance officer.
• Do not rely on a client's own statement of ownership. Check the registers and keep a copy.
• Keep a record of former beneficial owners and set a deletion date five years after each relationship ends.

What we could not confirm

The circular is from 2019, and we could not confirm whether the law, the regulations or Finanstilsynet's guidance have changed since then. It contains no sanctions or penalty provisions and gives no reporting deadline. We did not read the act itself. Check the current act and Finanstilsynet's latest guidance before relying on any detail here.

Frequently asked questions

Who supervises Norwegian bookkeepers?

Finanstilsynet, according to the circular.

Where are suspicious activity reports sent?

To Økokrim, under section 26.

How long are records kept?

Five years after the customer relationship ends (section 30).

Is a risk assessment mandatory?

Yes. Section 7 requires one, and the circular says it must be updated at least annually.

Explore more country guides in our AML and KYC hub, or build your team's skills with Learnsignal CPD courses.