Arms trafficking insider trading and market manipulation are not crimes in the Penal Code. Therefore, these actions cannot constitute predicate offences for money laundering.

Participation in an organised criminal group or racketeering is not separately criminalised and not a ML predicate offence; ancillary offences do not appear otherwise to cover adequately “participation” in the profit-generating crimes of organised criminal groups-conspiracy is not fully covered.

It is unclear whether self-laundering is adequately criminalised.

The offence is not effectively implemented, as witnessed by the limited number of indictments and convictions.

Penalties appears to be too low, especially in comparison with penalties for similar types of offences (e.g. enrichment offences (6 years)) and do not seem to be effective, proportionate and dissuasive.

Actual penalties applied have been low, even in cases involving narcotics trafficking where a penalty of up to 12 years is available.

Criminal liability of legal persons is very narrow.

The offence is not effectively implemented, as witnessed by the limited number of indictments and convictions.

The high burden of proof lying on prosecutors inhibits effective implementation of the confiscation provisions.

The lack of any data or other information on results does not allow the examiners to be satisfied that the confiscation provisions are effective.

There are some indications in the whole system that confiscation of criminal property is treated as a low priority issue.

CDD measures are limited to customer identification requirements and not the full range of measures has been effectively implemented (just been introduced in the new MLA).

Undertaking CDD measures is not required when carrying out occasional transactions that are wire transfers in circumstances covered by the Interpretative Note to SR VII.

There is no general requirement to identify beneficial owners for all customers. Financial institutions are not required to determine actively if the customer is acting on behalf of someone else.

There is no supervision of money remittance or money transfer occurring outside of banks and therefore no means to verify if CDD measures are effectively applied.

No clear requirements regarding the need to take reasonable measures to understand the ownership and control structure regarding legal persons, nor to verify that the natural person purporting to act on behalf of a legal person or legal arrangement is so authorised;

The possibilities for financial institutions to apply no CDD measures are overly broad. There is no assessment to limit the application of such measures to those countries that Icelandic authorities (or financial institutions) are satisfied are in compliance with and have effectively implemented the FATF Recommendations.

No requirement to terminate the business relationship and to consider making a suspicious transaction report when the identification cannot be performed properly after the business relationship has commenced.

There are no general requirements to apply CDD measures (other than on-going due diligence) to existing customers on the basis of materiality and risk.

A series of obligations have just come into force and therefore have not yet been effectively implemented:

• conducting CDD when there is a suspicion of terrorist financing or when there are doubts about the veracity or adequacy of previously obtained customer identification data;

• the requirements on the verification of the identity of a legal person or arrangement;

• CDD requirements regarding the beneficial owner of legal persons, including the requirement to determine the natural persons who ultimately own or control the legal person;

• the obligation to obtain information on the purpose and intended nature of the business relationship;

• enhanced CDD legislation for higher risk categories of customers, business relationships or transactions;

• the requirement to stop the financial institution from opening an account, commence business relations or performing the transaction when it is unable to identify the beneficial owner satisfactorily.

Iceland has not implemented any AML/CDD measures regarding the establishment and maintenance of customer relationships with politically exposed persons (PEPs). Provisions in the new MLA will enter into force in 2007.

There are no requirements applicable to banking relationships with institutions in EEA countries.

There is no requirement to ascertain that the respondent institution’s AML/CFT controls are adequate and effective and, regarding payable through accounts, to be satisfied that the respondent has performed all normal CDD obligations. Regarding the latter, this is limited to the obligation to identify/verify the customer and to perform ongoing due diligence.

Measures regulating correspondent relationships have just been adopted and are not yet effectively implemented.

The requirement for financial institutions to have policies in place or take such measures as may be needed to prevent the misuse of technological developments in ML or TF schemes is only partially covered.

The requirement to acquire additional information on the customer “when needed” is an open provision which needs further regulation or guidelines to make it effective.

Certain requirements concerning reliance on third parties in practice are unenforceable, in case of a third party outside Iceland, since the obligations are placed on the third party to provide information upon request.

Financial institutions are not required to take adequate steps to satisfy themselves that copies of the relevant documentation will be made available from the third party upon request without delay.

There is no requirement that the financial institution must be satisfied that the third party is regulated and supervised and has measures in place to comply with the CDD requirements. In determining in which countries the third party that meets the conditions can be based, competent authorities do not take into account information available on whether those countries adequately apply the FATF Recommendations.

The requirement to examine as far as possible the background and purpose of the transaction is not dealt with explicitly in the legislation and only partly covered in the explanatory notes.

The monitoring requirements for insurance and securities intermediaries are new and not yet fully implemented.

Similar deficiencies for CDD that apply to financial institutions (See ratings boxes for Recommendation 5) also apply to DNFBPs.

At the time of the on-site visit, real estate agents and traders in precious metals and gems did not appear adequately aware of existing AML requirements.

There are no requirements for PEPs in force-the requirements in the new law will enter into force until 1 January 2007. There will not be a requirement to obtain senior management approval to continue the business relationship, where a customer has already been accepted and the customer or beneficial owner is subsequently found to be, or subsequently becomes a PEP.

The requirement to have policies in place or take such measures as may be needed to prevent the misuse of technological developments in ML or TF schemes is only partially covered. The requirement to acquire additional information on the customer “when needed” is an open a provision which needs further regulation or guidelines to make it effective.

Certain rules for reliance on 3rd party introducers are unenforceable. For DNFBPs relying on a third party there is not a general requirement that the DNFBP be satisfied that the third party is regulated and supervised and has measures in place to comply with the CDD requirements.

The provisions have just begun applying to the full range of DNFBPs and have not yet been put effectively into practice.

The reporting obligation does not cover transactions related to insider trading/marked manipulation, arms trafficking, participation in an organised criminal group (or otherwise fully cover this through conspiracy) as these are not predicate offences for money laundering in Iceland.

The clear obligation to report an STR related to terrorist financing has just been adopted in June 2006; its effectiveness cannot yet be assessed.

There are some concerns about the effectiveness of the system: the insurance and securities sectors have not filed an STR; exchange offices have not filed STRs (and are not subject to supervision).

There has been little guidance given to reporting entities on the form and manner of reporting, and there have been few results shown from the increased reporting.

Neither the MLA 1999 nor the AML/CFT Act 2006 includes rules on the subjects that the internal controls should cover.

There is no requirement that the AML compliance officer and other appropriate staff have timely access to CDD, transaction, and other relevant information.

There is no specific requirement to maintain an adequately resourced and independent audit function to test compliance (including sample testing) with AML/CFT procedures, policies and controls.

The training requirements do not specify that the training programs be on-going so as to be kept informed of new developments, or specify that they should cover ML and FT techniques, methods and trends.

There are some preliminary concerns about how effectively internal controls have been implemented. For instance, there is no legal obligation to implement internal controls to ensure that full CDD is performed.

The requirement for all financial institutions to have a compliance officer at the managerial level is new and not yet fully implemented.

The reporting obligation does not cover transactions related to insider trading, market manipulation, arms trafficking, and participation in an organised criminal group, as these are not predicate offences for money laundering in Iceland.

There is a concern that this broad secrecy requirement for lawyers might conflict with the obligation to report.

It is not required that the compliance officer and other appropriate staff have timely access to CDD, transaction, and other relevant information. There is no requirement to maintain an adequately resourced and independent audit function to test compliance (including sample testing) with AML/CFT procedures, policies and controls.

In addition, the training requirements do not specify that the training programs be ongoing so as to be kept informed of new developments, or specify that they should cover ML and FT techniques, methods and trends.

DNFBPs would not receive the notices and instructions issued by the FSA if there is a need for special caution in transactions with a state or region.

There are no provisions dealing with the possibility to apply appropriate counter-measures where a country continues not to apply or insufficiently applies the Recommendations.

The provisions have just begun applying to the full range of DNFBPs and have not yet been put effectively into practice.

It is not clear in the MLA 1999 whether sanctions can be applied to the directors and senior management of the FI that was responsible for the violation by the FI. Under the AML/CFT Act 2006, criminal sanctions would not be available for directors or senior management of financial institutions.

There are concerns about the effectiveness of these criminal sanctions since no such sanction has ever been applied for a violation of any version of the money laundering act (dating back to 1993).

The range of administrative sanctions is not sufficiently broad. There are no administrative penalties which can be imposed against directors and controlling owners of financial institutions directly for AML/CFT breaches, only indirectly by not meeting fit and proper criteria. Sanctions for other senior managers appear more limited. The available sanctions do not include the possibility to directly bar persons from the sector, unless they are convicted of an offence. There is not the general possibility to restrict or revoke a license for AML/CFT violations.

Administrative sanctions for AML/CFT have not yet been effectively applied.

The requirement to examine as far as possible the background and purpose of such transactions is not dealt with explicitly in the legislation and only partly covered in the explanatory notes.

No provisions regulating application of counter-measures.

There are no requirements for branch/subsidiaries in EEA countries (the vast majority of foreign activities of Icelandic financial institutions)-without any assessment of the particular AML/CFT risk of that country-to:

• apply AML/CFT rules consistent with the Icelandic standard.

• pay particular attention that this principle is observed with respect to their branches and subsidiaries in countries within the EEA which do not or insufficiently apply the FATF Recommendations.

• inform the FSA if its foreign branch or subsidiary is unable to observe appropriate AML/CFT measures because this is prohibited by the laws or regulations of the host country.

There is no requirement that foreign branches or subsidiaries (either within or outside EEA countries) observe Icelandic standards for AML/CFT other than for CDD.

Where the AML/CFT standards differ, there is no requirement to apply the higher AML/CFT standards.

The obligations that do exist are new and have not yet been put effectively into practice; there has not yet been adequate focus on the issue within the FSA.

The AML Regulation in place at the time of the on-site visit did not cover insurance/securities intermediaries.

While fit and proper tests apply for directors and board members, they do not apply to other senior management.

There is no general requirement for money or value transfer services to be licensed or registered.

Money value transfer services and money exchange services are not subject to any system for monitoring and ensuring compliance with the AML/CFT requirements.

At on-site inspections, it is normal procedure to not make spot checks of how institutions carry out the mandatory customer identification checks.

At the time of the on-site visit, financial institutions were not subject to adequate supervision of compliance with CFT requirements.

There are concerns about how effectively the financial sector has been supervised regarding AML/CFT; while the FSA indicated that AML/CFT assessments of financial institutions are part of regular visits, the very limited findings - and number of warnings - indicates that the focus on AML/CTF has been inadequate.

There is no system for effective monitoring and ensuring compliance with AML/CFT requirements for DNFBPs.

Competent authorities have not established guidelines that will assist financial institutions or DNFBPs to implement and comply with STR requirements.

The activity initiated by the authorities has so far been very limited in order to provide feedback. There is only basic specific feedback and no substantive general feedback such as statistics on the number of disclosures and results, information on techniques, methods and trends, or sanitised case examples.

Overall, the FIU does not appear to be effectively addressing AML/CFT issues.

At the time of the on-site visit, the FIU did not have sufficient structural or operational independence.

Insufficient human and financial resources to effectively perform FIU functions.

The FIU staffing, activities, and results have not increased despite a large increase in the financial sector, drug trafficking crimes, and STRs.

Limited AML/CFT training provided to FIU personnel.

There has been no written guidance or forms to reporting entities.

No annual public reports concerning FIU activities, typologies or AML/CFT trends analysis have yet been issued.

There is no standardised or uniform process for reporting STRs.

Overall it did not appear that investigation and prosecution authorities adequately pursued money laundering cases.

AML/CFT training is inadequate, and there is no mechanism in place to ensure that those who investigate/prosecute ML remain current in their knowledge and experience.

No supervisory powers exist for financial institutions not under FSA’s supervision, such as foreign exchange companies or foreign remittance dealers that may operate outside of banks.

While there is a range of sanctions available, the range is not sufficiently broad. There are no administrative penalties which can be imposed against directors and controlling owners of financial institutions directly for AML/CFT breaches, only indirectly by not meeting fit and proper criteria. Available sanctions for other senior management appear more limited. The available sanctions do not include the possibility to directly bar persons from the sector, unless they are convicted of an offence. In addition, there is not the general possibility to restrict or revoke a license for AML/CFT violations.

The number of dedicated staff is not sufficient: the FIU remains a “one person entity” which inhibits its ability to function in an effective manner.

Furthermore, the FIU does not have sufficient budget or budgetary control. This restricts the unit’s ability to make long-term strategic plans, to hire additional resources, to fund training and to buy analytical equipment and software.

There appears to be very little formal training provided to law enforcement personnel, both upon engagement as well as on an ongoing basis regarding AML and CFT investigations.

Considering the number of entities that the FSA is responsible for supervising, its number of staff seems inadequate. It was the view of the evaluation team that adequate staff had not been provided for AML/CFT supervision.

It did not appear that there was yet adequate training on AML/CFT issues.

Iceland has not reviewed the effectiveness of its systems for combating money laundering and terrorist financing on a regular basis.

There are no comprehensive statistics on the number of STRs analysed and disseminated.

There are no statistics on ML or FT investigations.

Statistics for money laundering prosecutions and convictions were produced; however, there is no system for recording these figures and making them easily available.

No statistics on the number of cases and the amounts of property frozen, seized, and confiscated relating to (i) ML, (ii) FT, and (iii) criminal proceeds.

No statistics on mutual legal assistance and extradition requests (including requests relating to freezing, seizing and confiscation) that are made or received, relating to ML, the predicate offences and FT, including the nature of the request, whether it was granted or refused, and the time required to respond.

No statistics on formal requests for assistance made or received by the FIU, including whether the request was granted or refused; or spontaneous referrals made by the FIU to foreign authorities.

No comprehensive statistics regarding on-site examinations conducted by supervisors relating to or including AML/CFT and any sanctions applied.

Access to beneficial ownership does not appear to be available in an adequately timely fashion for Icelandic companies or foundations.

No beneficial ownership information for foreign companies is available.

Even though any change of managers and directors has to be notified to the Register, the Tax Directorate in practice does not perform any further inquiry to verify this.

Nominee directors are allowed.

conspiracy to commit ML offences is not fully covered.

The scope of “terrorist act” does not fully cover all the acts defined in Article 2 (1), and there is a concern that the financing of a terrorist act as defined in the legislation.

Iceland’s implementation of Recommendation 5 does not include adequate measures to ascertain the identity of beneficial owners.

Iceland has not ratified the Palermo Convention.

Key elements of the Convention are not yet implemented: Participation in organised criminal group is not criminalised; nor is conspiracy to commit money laundering and other crimes fully covered so as to otherwise adequately criminalise “participation” in the crimes commitment by organised criminal groups.

It is unclear whether self-laundering (as required by Article 6(2)(e)) is covered. There do not appear to be effective, proportionate, and dissuasive sanctions for ML.

Iceland’s implementation of Recommendation 5 does not include adequate measures to ascertain the identity of beneficial owners.

Since it is not clear if self-laundering is covered, conspiracy to commit money laundering is not fully criminalised, and not all predicate offences are fully covered, it is unclear how effectively Iceland could provide assistance relating to these cases.

Legal provisions on mutual legal assistance would not encourage or facilitate the voluntary appearance of witnesses or persons providing information to the requesting country, as this seems to be out of the scope of Act 13/1984.

The limitations on the scope of “acts of terrorism” as defined in Iceland also present some concerns about Iceland’s ability to effectively provide assistance in cases involving the financing of acts not defined as terrorist acts in Iceland.

Effectiveness of the current laws cannot be demonstrated due to the lack of quantitative and qualitative data. There is no evidence of how expeditiously requests are answered.

Dual criminality would still apply to requests for less intrusive and non-compulsory measures such as company commercial records or other publicly available information.

Since it is not clear if self-laundering is covered, conspiracy to commit money laundering is not fully criminalised, and not all predicate offences are fully covered, it is unclear how effectively Iceland could provide assistance relating to these cases.

Foreign judgments cannot be executed if the person is not domiciled in Iceland.

Iceland has not considered authorising the sharing of confiscated assets when confiscation is directly or indirectly a result of co-ordinated law enforcement action. Icelandic authorities have not considered establishing an asset forfeiture fund.

Since it is not clear if self-laundering is covered, and conspiracy to commit money laundering and all the required predicate offences are not fully covered, it is not clear how effectively Iceland could extradite relating to these offences.

Given the complete lack of statistical data, the evaluation team was not able to determine that the mechanisms for international cooperation are fully effective.

The scope of “terrorist act” does not fully cover all the acts defined in Article 2 (1), and there is a concern that the financing of a terrorist act as defined in the legislation is not fully covered. Iceland’s implementation of Recommendation 5 does not include adequate measures to ascertain the identity of beneficial owners.

There are no formal procedures for authorising access to frozen resources when deemed necessary for basic expenses, the payment of certain types of fees, etc pursuant to S/RES/1452(2002).

Iceland does not have an adequate mechanism to implement S/RES/1373. There is not a comprehensive mechanism in place to examine and give effect to actions initiated under the freezing mechanisms of other jurisdictions.

The Public Announcement’s definition of terrorism and all subsequent obligations are limited to certain violent acts in the Penal Code-it does not fully cover all persons who commit or attempt to commit terrorist acts.

The Public Announcement does not specifically cover funds of entities that are controlled directly or indirectly by such persons. Nor does it cover funds or other assets derived or generated from funds or other assets owned or controlled directly or indirectly by designated persons, terrorists, those who finance terrorism, or terrorist organisations.

The direct obligation to freeze funds pursuant to designations in the context of S/RES/1373 is contained Sec 16(a) of the revised Law 87/1998 which does not apply to entities not supervised by the FSA, such as money exchange and money transfer and non financial business and professionals

Iceland has not fully implemented the CFT Convention as required by S/RES/1373.

Financing of a terrorist act directly is not specifically covered by Sec. 100(b), although it appears most cases would be covered by other provisions.

The definition of “acts of terrorism” does not fully cover all those activities Article 2, par.1 of the CFT Convention; the financing of acts not specifically designated as terrorist acts in the Penal Code (but within the Annexes of the Convention) would not be criminal acts in Iceland.

The need to show that the act was committed for the purpose of intimidation/coercion, and the need to show that the act could damage a state or international establishment further limits the scope of FT offences and their effectiveness.

Overall, Iceland does not have effective laws and procedures to give effect to freezing designations in the context of S/RES/1373.

There is not a national mechanism to designate persons in the context of S/RES/1373, nor a comprehensive mechanism in place to examine and give effect to actions initiated under the freezing mechanisms of other jurisdictions.

The Public Announcement’s definition of terrorism and all subsequent obligations are limited to certain violent acts in the Penal Code, which do not fully cover all persons who commit or attempt to commit terrorist acts.

There is not a mechanism to enforce the freezing obligation for designations in the context of S/RES/1373, if any were made, for entities that are not supervised by FSA, such as money exchange and money transfer and non-financial business and professionals.

The freezing obligation in Law 87/1998 allows only for the FSA to forward lists pursuant to international obligations. As a practical matter, the only lists that can be enforced are those from the 1267 designation committee.

The Announcement implementing S/RES/1373 does not cover fully freezing funds associated with terrorism, etc; nor does it not specifically cover funds of entities that are controlled directly or indirectly by such persons, nor funds or other assets derived or generated from funds or other assets owned or controlled directly or indirectly by designated persons, terrorists, those who finance terrorist, or terrorist organisations.

It is not required that action take place without delay and without prior notice to the persons involved.

There are no formal procedures at national level for evaluating de-listing requests, for releasing funds or other assets of persons or entities erroneously subject to the freezing and for authorising access to frozen resources when deemed necessary for basic expenses, the payment of certain types of fees, etc pursuant to S/RES/1452(2002).

No specific measures to protect the rights of bona fide third parties consistent with Article 8 of the CFT Convention.

Even though the freezing obligation is already in place for financial institutions concerning persons and entities on the lists distributed by the FSA, no practical indications have been released to clarify related duties and responsibilities.

The clear obligation to report an STR related to terrorist financing was adopted in June 2006; its effectiveness cannot be assessed yet.

Some concerns raised above in Recommendation 13 about the effectiveness of the reporting system apply equally to SR IV.

Since dual criminality applies, the limitations on the scope of “acts of terrorism” as defined in Iceland also present some concerns about Iceland’s ability to effectively provide assistance in legal assistance and extradition cases involving the financing of acts not defined as terrorist acts in Iceland.

Foreign judgments cannot be executed if the person is not domiciled in Iceland.

There are currently no requirements to license or register natural and legal persons that perform money or value transfer services (MVT operators).

There is no authority that maintains a list of names and addresses of such operators.

The deficiencies regarding the extent of CDD and other AML/CFT requirements apply also to MVT operators.

MVT operators are not required to maintain a current list of their agents which must be made available to the designated competent authorities.

The evaluation team had serious concerns regarding supervision, since there is no mechanism for monitoring and ensuring compliance with the FATF Recommendations, including the practical inability to apply sanctions for AML/CFT deficiencies.

Sanctions for failure to comply with the other obligations of SR VI would not be available.

Iceland has not implemented any requirement regarding obtaining and maintaining information with wire transfers.

Iceland has not yet reviewed the adequacy of domestic laws and regulations that relate to non-profit organisations (NPOs) vis-à-vis terrorist financing.

It is unclear if there is adequate access to information so as to identify the features and types of NPOs, especially non-commercial foundations, at risk for terrorist financing purposes.

Iceland has not yet undertaken outreach to the NPO sector.

It is not clear that detailed information on the administration and management of noncommercial foundations is available during the course of an investigation with regard to non-commercial foundations.

Non-commercial foundations are not required to maintain information on the purpose and objectives of their stated activities.

There are not adequate measures in place to sanction violations of oversight measures or rules by NPOs or persons acting on behalf of NPOs, especially with regard to non-commercial foundations.

Iceland has not identified specific points of contacts and procedures to respond to international requests for information regarding particular NPOs that are suspected of terrorist financing or other forms of terrorist support.

The assessment team did not view that the current system for detecting and preventing cross border movements of currency or bearer negotiable instruments related to money laundering or terrorist financing is effective. No currency declaration had yet been made.

The requirement to declare bearer negotiable instruments does not appear adequately addressed in the law or in guidance to the public.

The system authorises, but does not require, the customs to create separate customs clearance channels, and therefore the mechanism to declare does not apply everywhere.

There is no practical mechanism in place for declaring outgoing currency movements.

There are no specific criminal sanctions available for persons who carry out a physical cross-border transportation of currency or bearer negotiable instruments that are related to terrorist financing or money laundering contrary to the obligations under SR IX.

There are no specific requirements that at a minimum, information on the amount of currency declared or otherwise detected, and the identification data of the bearer(s) shall be retained for use by the appropriate authorities in instances when: (a) a declaration which exceeds the prescribed threshold is made; (b) where there is a false declaration/disclosure; or (c) where there is a suspicion of money laundering or terrorist financing.

Iceland should fully cover all the necessary predicate offences for money laundering, and conspiracy should be fully criminalised. Review domestic laws, and if necessary, adjust them to ensure that self-laundering is fully criminalised.

Consider lowering the standard of proof to demonstrate the mens rea in the money laundering offence by allowing prosecutors and lower courts to adopt a full range of mental element including every degree of knowledge.

Specific training on money laundering investigations jointly with clear guidance by prosecutors on evidence requirements under Sec. 264 should be delivered to officials from law enforcement authorities.

Raise the criminal penalties for money laundering, to be in line with those of other profitgenerating offences in Iceland.

Criminal liability of legal persons for money laundering offence should be expanded and extended to any predicate offence.

Review the legislation to ensure that the financing of terrorist acts directly is included in the FT offence.

Broaden the definition of terrorist act to include all those activities referred to by Article 2 (1)(a) and (b) of the CFT Convention.

Remove the purpose elements-i.e., the need to demonstrate that the act occurred for the purpose of intimidating/coercing of a government, etc, and the need that the act also to be able to damage a State or international establishment in order for acts under the Convention to be valid FT offences.

Provisions on confiscation should be strengthened especially when the offender is not in possession of the assets, which are held by a third party.

Consider measures that require confiscation of property held by a perpetrator convicted of a serious offence generating profit, unless the offender can prove that the property was legally obtained (reversal of burden of proof).

Consider reducing the burden of proof when executing a forfeiture order after conviction, e.g. by adopting “a balance of probabilities approach” or other standard lower than the criminal standard.

Give higher priority to confiscation of criminal property.

Establish a central authority at national level to examine, integrate and update the received lists of persons and entities suspected to be linked to international terrorism before sending them to the financial sector.

A domestic mechanism to enact S/RES/1373(2001) should be implemented to be able to designate terrorists at a national level as well as to give effect to designations and requests for freezing assets from other countries.

Adopt procedures for evaluating de-listing requests, for releasing funds or other assets of persons or entities erroneously subject to the freezing and for authorising access to frozen resources pursuant to S/RES/1452(2002).

Release practical guidance to the financial institutions concerning their responsibilities under the freezing regime as well as for the reporting of suspicious transactions that may be linked to terrorist financing.

The direct obligation to freeze funds of persons and entities designated in the context of S/RES/1373 applies only to financial institutions supervised by FSA. This should be broadened to apply to all financial institutions and DNFBPs.

Improve the structural and operational independence of the FIU by fully implementing the new Regulation 626/2006.

Secure an increased level financial and human resources to enhance its ability to effectively perform the functions of an FIU.

Develop written guidance and direction to reporting entities concerning the manner of reporting STRs.

Develop a standardised STR reporting format for all reporting entities.

Initiate proactive analysis of STRs and police data to enhance the effectiveness of targeting entities involved in suspected ML and FT.

Increase international cooperation between the FIU and other international partners through more active participation in the Egmont Group.

Produce annual reports on trends and typologies (as required in the new regulation 626/2006).

Develop educational programs for the public on AML/CFT issues.

Pursue training and educational opportunities for FIU personnel, the financial sector and other police agencies. (The training issues could be pursued through the Training Working Group of the Egmont Group).

The FIU should consider taking measures regarding the “disaster recovery” of their database. Consideration should be given to having the system automatically back-up the information at regular intervals with the back-up information being stored off site.

Take a more proactive approach to investigating and prosecuting money laundering.

More frequent and in-depth training should also be provided to law enforcement and prosecution personnel.

Implement a system to comprehensively address the remaining requirements in SR IX. There should be a system that applies more explicitly to bearer negotiable instruments.

Provide additional guidance so as to better inform arriving and departing passengers about their obligations to make a declaration.

Implement procedures for declaring or disclosing outgoing movements of currency or bearer negotiable instruments.

Adopt criminal sanctions for persons who transport currency that is related to money laundering or terrorist financing.

Authorities should ensure that, at a minimum, information on the amount of currency declared or otherwise detected, and the identification data of the bearer(s) is retained for use by the appropriate authorities in instances when: (a) a declaration which exceeds the prescribed threshold is made; (b) where there is a false declaration/disclosure; or (c) where there is a suspicion of money laundering or terrorist financing.

Consider the implementation of new investigative techniques and methods similar to those outlined in the Best Practices Paper for SR IX, e.g. canine units specifically trained to detect currency.

Customs officials should also consider working more closely with the Icelandic FIU and other law enforcement authorities to develop typologies, analyse trends and develop protocols for the sharing of information amongst themselves to more effectively combat cross border ML and FT issues.

Money exchange and money or value transfer should be fully and effectively brought under AML/CFT regulation and especially under customer due diligence requirements.

Financial institutions should be required to undertake CDD measures when carrying out occasional transactions that are wire transfer in circumstances covered by the Interpretative Note to SR VII.

The provisions regarding obtaining information concerning the legal person or arrangement should be extended to information concerning the directors and provisions regulating the power to bind the legal person or arrangement.

There should be a more general requirement to identify beneficial owners for all customers. The financial institution should be required to actively determine if the customer is acting for someone else and it should take reasonable steps to obtain sufficient identification data to verify the identity of the third person. Furthermore, reasonable measures should be taken to understand the ownership and control structure of the legal person. It should be made clear what is expected from the sector.

There should be some consideration/assessment made based on which there is a satisfaction about compliance with the Recommendations by countries which are currently seen as compliant without any doubt.

Rules regulating the CDD treatment of existing customers should be introduced.

The requirement to undertake CDD measures in cases where there is a suspicion of terrorist financing and in cases where there are doubts about the veracity or adequacy of previously obtained customer identification data.

Rules on the verification of the identity of legal persons.

The requirements regarding identification and verification of the beneficial owner for legal persons, including the obligation to determine the natural persons who ultimately own or control the legal person.

The obligation to obtain information on the purpose and intended nature of the business relationship.

Performing enhanced due diligence on higher risk categories of customers, business relationships or transactions.

In case of applying simplified or reduced due diligence there has been introduced a basic identification regime instead of no customer identification regime at all, but practice has to pick it up in an effective manner.

When regulating the identification and verification of beneficial owners, a requirement to stop the financial institution from opening an account, commence business relations or performing transactions when it is unable to identify the beneficial owner satisfactorily.

The requirement to terminate the business relationship and to consider making a suspicious transaction report when identification of the customer cannot be performed properly after the relationship has commenced.

Implement the necessary requirements pertaining to PEPs.

With regard to correspondent banking, financially institutions should be required to determine that the respondent institution’s AML/CFT controls are adequate and effective, and regarding payable through accounts, to be satisfied that the respondent has performed all normal CDD obligations.

Iceland should clarify the requirement to establish policies and procedures to address any specific risks associated with non-face to face business relationships or transactions.

Clarify that the financial institution is required to take adequate steps to satisfy itself that copies of the relevant information will be made available upon request without delay.

Some kind of risk assessment should take place to establish that third parties from outside Iceland actually meet the mentioned conditions.

Iceland should issue the regulation to implement the requirements of Special Recommendation VII as planned.

The scope of the requirement to pay special attention to all complex, unusual large transactions or unusual patterns of transactions that have no apparent or visible economic or lawful purpose should be now be put effectively into practice for insurance and securities intermediaries, as obligations for these entities are new.

The requirement to examine the background and purpose of the transaction needs to be clearly and effectively implemented.

Regarding Recommendation 21, it is recommended to implement provisions dealing with the application of appropriate counter-measures where countries continue not to apply or insufficiently apply the Recommendations.

Iceland should ensure that non-bank financial institutions, including money exchange and MVTS providers, are properly supervised so as to comply with their reporting obligations.

Steps should also be taken to refocus reporting in general to concentrate more on the nature of the transaction.

Comprehensive guidelines should be given to the financial sector which should be direct and broad and based on the different typologies, trends and techniques that focus more attention on the nature of transactions themselves.

Additional guidelines that are more tailored to particular types of financial institutions should also be issued.

The FIU should also deliver more specific feedback to reporting entities, particularly concerning the status of STRs and the outcome of specific cases.

Reporting FIs should be obligated to implement satisfactory internal controls with respect to audit functions for AML/CFT.

It should be clarified that the compliance officer should have timely access to CDD and other records, and that financial institutions should provide on-going training programs.

Iceland should also implement comprehensive obligations for all foreign branches and subsidiaries to observe full AML/CFT measures consistent with Icelandic requirements and the FATF Recommendations to the extent that host country laws and regulations permits and that the branches and subsidiaries should apply the higher standard, where the AML/CFT standards differ. Iceland should also implement a requirement that a financial institution inform the FSA if its foreign branch or subsidiary in an EEA country is unable to observe appropriate AML/CFT measures because this is prohibited by the laws or regulations of the host country.

Recommendation 17: The range of administrative sanctions should be broadened for directors and senior management of financial institutions, to include the more direct possibility to bar persons from the sector, to be able to more broadly replace or restrict the powers of managers, directors, or controlling owners for AML/CFT breaches.

There should be the possibility to restrict or revoke a license for AML/CFT violations.

Recommendation 23: In general, the FSA should give more attention to AML/CFT matters.

While fit and proper tests apply for directors and board members, they should also apply to other senior management.

There should be a general requirement for money or value transfer services to be licensed or registered. Money value transfer services and money exchange services that operate outside of banks should also be made subject to a system for monitoring and ensuring compliance with the AML/CFT requirements.

Iceland should now ensure that AML/CFT assessments of Reporting FIs occur more regularly, particularly in high risk institutions.

Recommendation 25: The FSA and other authorities should complete and issue comprehensive AML/CFT guidance for the whole private sector covered by the obligations.

Recommendation 29: Icelandic authorities should give adequate powers to a designated authority to adequately supervise unlicensed financial institutions such as foreign exchange companies or foreign remittance dealers that may operate outside of banks.

Recommendation 30: The FSA should be given additional resources to be allocated for AML/CFT supervision.

The FSA should consider creating a well staffed stand alone AML/CFT unit or at least a team of examiners specialising in AML/CFT measures that check FIs compliance with AML/CFT on an on-going basis for all supervised entities.

Iceland should implement the measures in SR.VI.

Iceland should require all money or value transfer services (MVT operators) to be licensed or registered, maintain a list of such operators, and adopt a mechanism to adequately monitor and ensure compliance with the FATF Recommendations.

Iceland should adopt and fully implement the full range of CDD measures, as discussed in section 3.2 and 3.3 of this report, so as to also apply to DNFBPs. Iceland should fully implement the new measures that apply to DNFBPs.

Iceland should undertake the following actions to fully implement Recommendation 16:

• Overall, the measures in the new legislation should be fully and effectively implemented.

• DNFBPs should be made fully aware of their reporting obligations under the new legislation.

• DNFBPs should be made aware of their duty to give special attention to business relationships and transactions with (legal) persons from countries which do not or insufficiently apply the FATF Recommendations, in line with Recommendation 21.

• Measures should be taken to ensure that DNFBPs are advised of concerns about weaknesses in the AML/CFT systems of other countries.

• DNFBPs should be required to have training programs that are on-going so as to be kept informed of new developments.

Designate an authority, authorities, or SROs responsible for monitoring and ensuring compliance with the requirements of the AML/CFT Act 2006.

The authority/authorities should be provided adequate powers and sufficient technical resources to perform its/their functions.

The authorities and/or SROs should also issue adequate guidance on AML/CFT requirements to all DNFBP sectors.

Access to information on beneficial ownership of legal persons should be made more accurate and up to date.

The Tax Directorate could play a larger role in verifying beneficial ownership/control for the applications it receives.

Review the adequacy of the legal framework that relates to NPOs vis-à-vis terrorist financing and ensure that there is adequate access to information so as to identify the features and types of NPOs at risk for terrorist financing purposes.

Reach out to the NPO sector with a view to protecting the sector from terrorist financing abuse. This outreach should include i) raising awareness in the NPO sector about the risks of terrorist abuse and the available measures to protect against such abuse; and ii) promoting transparency, accountability, integrity, and public confidence in the administration and management of all NPOs.

In general, take more proactive steps to promote effective supervision or monitoring of those NPOs.

Authorities should ensure that detailed information on the administration and management of non-commercial foundations is available during the course of an investigation.

Implement an effective sanction regime for violations of oversight measures or rules by NPOs or persons acting on behalf of NPOs.

Continue the AML/CFT policy coordination now that the AML/CFT legislation has entered into force.

Iceland should more fully implement the CFT Convention.

The definition “terrorist act” should be broadened to fully cover all of the acts defined in Article 2 (1) of the Convention.

More comprehensive measures for identifying beneficial owners should also be adopted.

Iceland should also institute adequate comprehensive conspiracy provisions for money laundering.

Enact provisions on mutual legal assistance that would encourage or facilitate the voluntary appearance of witnesses or persons providing information to the requesting country.

Clarify the procedures to allow non-coercive measures to be applied in the absence of dual criminality.

Consider establishing an asset forfeiture fund.

Consider a mechanism to authorise the sharing of confiscated assets with other countries when confiscation is directly or indirectly a result of co-ordinated law enforcement actions.

In order to demonstrate the regime’s effectiveness, maintain statistics on the number of requests for assistance made or received by law enforcement authorities, the FIU, and supervisors including whether the request was granted or refused.

Increase the human and budgetary resources for the FIU

Provide additional training to law enforcement, both upon engagement as well as on an ongoing basis regarding AML and CFT investigations.

Consider additional staff for the FSA.

Increase training on AML/CFT issues for the FSA.