Sweden AML Obligations for Accountants: Penningtvättslagen and Finanspolisen

Sweden treats bookkeeping, accounting and tax advice as regulated activities for anti-money-laundering purposes. If you work as a redovisningskonsult or skatterådgivare, the Swedish money laundering act applies to your practice whether or not you hold a protected professional title. This guide walks through what the Swedish police-led guidance says about risk assessment, customer due diligence, reporting and record keeping. For the general ideas behind these duties, see our guide to KYC and customer due diligence for accountancy practices.

Where this guide comes from

This guide is based on the document "Information till redovisningskonsulter och skatterådgivare om penningtvätt och finansiering av terrorism", published by Polismyndigheten (the Swedish Police Authority) through its coordination function against money laundering and terrorist financing. The version we read is dated March 2025, with input from Ekobrottsmyndigheten, Finanspolisen, three county administrative boards (länsstyrelserna) and Skatteverket. It is guidance, not the statute, so we attribute each point to it. This is general information, not legal advice.

The legal basis and who is covered

The guidance names lag (2017:630) om åtgärder mot penningtvätt och finansiering av terrorism, usually called penningtvättslagen, as the main law. It sits alongside förordning (2009:92), the regulations of the länsstyrelser, and the criminal provisions in lag (2014:307) om straff för penningtvättsbrott and the terrorism offences act.

According to the guidance, people who professionally carry out bookkeeping or accounting services, and people who professionally give tax advice, are covered (1 kap. 2 § first paragraph, points 19 and 20). The guidance notes that the titles "auktoriserad" are protected, while "redovisningskonsult" and "skatterådgivare" are not, so the label on your business card does not decide whether the law applies. Audit firms that are not registered with Revisorsinspektionen but employ such people must register with the register against money laundering kept by Bolagsverket.

Risk assessment comes first

The guidance asks for two layers. The first is a general risk assessment of your own business: threats and vulnerabilities in your services, customers, distribution channels and geography. It must be documented and kept up to date, and your internal routines should follow from it. The second is a risk profile for each customer, based on that general assessment and what you know about the customer. The profile sets how deep and how frequent your follow-up is.

Customer due diligence (kundkännedom)

Due diligence is triggered by a new business relationship, by a transaction of EUR 15,000 or more, or by linked transactions that reach that amount together, as the guidance describes it. The required measures are to identify the customer, establish whether there is a beneficial owner (verklig huvudman), assess whether the customer is a politically exposed person, and, for business relationships, understand the purpose and nature of the relationship. Our guides to beneficial ownership and politically exposed persons explain these concepts in general terms.

If you do not have enough knowledge of the customer, the guidance says you must refuse the relationship or transaction, or end an existing relationship. Customer knowledge must be kept current through ongoing follow-up.

An exemption for tax advisers

Due diligence, reporting and information duties do not apply, the guidance explains, when a tax adviser represents a client in legal proceedings, including advising on starting or avoiding them or assessing the client's legal position (3 kap. 1 § second paragraph and 4 kap. 8 §). Even then, the adviser may not take part in measures that can reasonably be presumed to aim at money laundering or terrorist financing.

Monitoring and reporting suspicions

Business relationships and individual transactions must be monitored, with intensity tied to the customer's risk profile. Where there are reasonable grounds to suspect money laundering, terrorist financing or that assets come from crime, you report to Finanspolisen. Proof is not required. Reports are made through the goAML system, and registration needs organisation and user registration that the guidance says is approved within two working days. The guidance does not state a specific reporting deadline.

You must also avoid starting a relationship or carrying out a one-off transaction if you suspect the service will be used for money laundering. The reporting duty continues even if you withdraw from the engagement or end the relationship.

Confidentiality and record keeping

You must not tell the customer or anyone outside that a closer review has taken place or a report has been filed. A report to Finanspolisen is not the same as a police report. Our guide to suspicious activity reports and tipping off covers why this matters in every jurisdiction.

Records must be kept for at least five years, counted from when the measure or transaction happened, from the end of the business relationship, or from the refusal where you turned down a transaction because of suspicion. The guidance also asks for a system that shows whether you had a business relationship with a customer in the last five years.

Internal controls, supervision and sanctions

The guidance lists internal control, a compliance function, whistleblowing systems and protection, staff vetting and training. The länsstyrelser supervise these professions, and the guidance gives contact details for Skåne, Stockholm and Västra Götaland. On criminal liability it describes money laundering offences under lag (2014:307): penningtvättsbrott (3 §) with up to two years, grovt penningtvättsbrott (5 §) with six months to six years, and näringspenningtvätt (7 §) with up to two years, rising to six months to six years for the aggravated form.

Practical steps (our suggestions)

• Write down your general risk assessment and date each review.
• Record a risk profile in every customer file at onboarding.
• Register for goAML before you need it, so a report is never delayed by account set-up.
• Diarise record retention dates for every closed relationship.

What we could not confirm

We read the police guidance, not the statute, so section references are as the guidance gives them. The guidance does not cover the administrative sanctions in penningtvättslagen or the financial sanctions lists, and we have not described them. It also gives no reporting deadline, and we could not check the current county board regulations. Confirm details with your länsstyrelse before relying on this guide.

Frequently asked questions

Do I need to be authorised to be covered?

No. The guidance says "redovisningskonsult" and "skatterådgivare" are not protected titles, but professionals doing the work are covered.

Who receives suspicious activity reports?

Finanspolisen, through goAML, according to the guidance.

How long do I keep records?

At least five years, counted as described above.

Can I tell a client I reported them?

No. The guidance says the report and any closer review must be kept confidential.

Explore more country guides in our AML and KYC hub, or build your team's skills with Learnsignal CPD courses.