A. Macro-Trends: Aggregate Financial Flows

Methodological note: The financial flows analysis presented in this report is based on the IMF staff’s analysis of cross-border payments data. The payments data analyzed in the report (except Section F) is composed of wire transfers between the customers of financial institutions, namely payments by households, non-financial corporates, and non-bank financial corporates. The origination and beneficiary countries are determined based on the registration country of a financial institution whose customer is the initiator or the final recipient of the payment order respectively.⁴ This analysis does not cover non-financial instruments to transfer value, such as trade mis-invoicing, cross-border cash transportation and crypto assets.⁵ While the payments data for 2013-2019 are included as contextual and background information, results of the data analytical approaches presented below are based on the data since January 2020. The analysis is presented on a nominal basis - factors such as inflation and growth in economic activity account for some of the changes in patterns of flows.⁶ Due to the aggregation and anonymization of the payments data⁷ and macro-level nature of economic and other indicators used in the analysis, the project’s findings are aimed at contributing to the understanding of ML risk from cross-border payments on the country and regional levels rather than identify illicit activity.

8. The Nordic-Baltic region’s cross-border financial flows have increased steadily since 2013. Average aggregate monthly flows initially decreased by 8% from 2013-2014 to 2015-2016, but subsequently increased by 23% from 2015-2016 to 2020-2022, resulting in an overall 13% increase in average monthly aggregate flows over the time from 2013 to date. Regional flows have remained notably stable and balanced, with inflows and outflows closely correlated.⁸

View Full Size

Regional Inflows, Outflows, and Net Flows, 2013-July 2022 (USD B)

Citation: IMF Staff Country Reports 2023, 320; 10.5089/9798400252389.002.A001

• Download Figure
• Download figure as PowerPoint slide

9. Nordic-Baltic countries’ aggregate financial flows are highly material, including after adjustment to the gross domestic product (GDP) and the value of deposits. In general, the Nordic countries have more material flows, with Sweden, Denmark, and Finland having the most material flows both in nominal terms and benchmarked against GDP and value of deposits. Estonia has the fourth most material flows and the most of any country in the Baltic region, followed by Norway, Latvia, and Lithuania. Iceland has the least material flows in the region. Overall, these highly material flows for most of the countries in the Nordic-Baltic region indicate that a focus on cross-border financial flows is merited.

10. Six out of the eight Nordic-Baltic countries have seen an increase in aggregate flows since 2013⁹. Denmark, Finland, Sweden, and Iceland have all seen steadily increasing flows during this period. Only Norway and Latvia have lower aggregate flows in July 2022 than in January of 2013, with Latvia experiencing the most significant drop in flows during this period and averaging around 20% of the aggregate flow’s levels of January 2013 since mid-2019. Estonia experienced a drop in aggregate flows from the elevated 2013-2014 levels but has seen increasing flows in recent years. Due to the recent growth of the fintech hub in Lithuania, the country’s banking sector has been facilitating more crossborder payments, with most transactions conducted by non-residents with origination and destination outside Lithuania, increasing the associated transnational ML risks facing the country.¹⁰ Most of the Nordic-Baltic countries have registered upward trend in the value of cross-border payments starting in 2020.

View Full Size

Nordic-Baltic Countries Aggregate Flows, 2013-July 2022

Citation: IMF Staff Country Reports 2023, 320; 10.5089/9798400252389.002.A001

• Download Figure
• Download figure as PowerPoint slide

11. The region’s cross-border financial flows have a significant geographic spread. The region has material flows with seventy-one countries. This strong geographic spread is driven by the open, large, and advanced Nordic economies. The main payments counterparties of the Nordic-Baltic countries are from Europe (UK, Germany, Luxembourg, France, Belgium, Ireland, Netherlands, Switzerland, Spain as well as the U.S. and Hong Kong.

View Full Size

Nordic-Baltic Main Payments Counterparties, 2020-July 2022

Citation: IMF Staff Country Reports 2023, 320; 10.5089/9798400252389.002.A001

• Download Figure
• Download figure as PowerPoint slide

12. The G7 and EU are the dominant counterparty country groupings. Most regions have increased their share of total flows with the Nordic-Baltic region since 2020, with the notable exception of the CIS,¹¹ a country grouping with historically elevated ML risk to the Nordic-Baltic region, which experienced a 67% reduction in inflows from 2013 to 2022. Financial flows between the Nordic-Baltic countries and most regions have grown, with aggregate flows with G7 countries increasing by 28%, intraregional flows increasing by 38%, North America 54%, Asia 29%, Oceania 23%, and Africa 27%. Notably, two country groupings saw a very significant increase in flows since 2013, the EU with an 121% increase, and International Financial Centers (IFCs)¹² seeing a 238% increase. For the EU and IFCs, most of this growth has occurred recently. EU’s relative share of total aggregate flows increased from 37% in 2017 -2018 to 58% in 2020-2022. Similarly, IFC’s relative share of total aggregate flows increased from 7% in 2018 -2019 to 15% in 2020-2022.

View Full Size

Nordic-Baltic Inflows, Outflows, and Net Flows with UK, 2013-July 2022

Citation: IMF Staff Country Reports 2023, 320; 10.5089/9798400252389.002.A001

• Download Figure
• Download figure as PowerPoint slide

View Full Size

Nordic-Baltic Inflows, Outflows, and Net Flows with CIS countries, 2013-July 2022¹³

Citation: IMF Staff Country Reports 2023, 320; 10.5089/9798400252389.002.A001

• Download Figure
• Download figure as PowerPoint slide

View Full Size

Aggregate Flows with Select Country Groupings, 2020-July 2022

Citation: IMF Staff Country Reports 2023, 320; 10.5089/9798400252389.002.A001

• Download Figure
• Download figure as PowerPoint slide

13. Monitoring cross-border financial flows provides countries with a deeper understanding of their external ML threat environment and evolving cross-border related risks they are facing. National ML/TF Risk Assessments (NRAs) for Nordic-Baltic countries could be strenghtened further if they include an analysis of aggregate payments data to assess the materiality of cross-border payments and associated ML risks to the country and its financial sector. Material financial flows, as adjusted for the size of country’s economy and financial sector, require appropriate ML/TF risk mitigation measures, starting with deepening understanding of ML/TF risks inherent in the country’s financial flows. Countries in the region exposed to higher ML cross-border payments risks should consider a more regular update and analysis (e.g., annual) of cross-border payments indicators to monitor changing patterns of flows, particularly increasing exposures to potentially higher-risk countries. Analysis of trends in cross-border payments and their ML/TF risk implications could benefit a variety of AML/CFT-relevant agencies, such as FIUs, AML/CFT supervisors, and tax authorities. Leveraging advanced analytical methods, such as outlier detection algorithms and neural networks, for the analysis of transaction-level (or with some degree of aggregation) payments data, can provide a more detailed insight on the unusual and potentially suspicious patterns of flows, but, in contrast to higher-level monitoring of trends in financial flows described above, requires substantial investment in resources, including development of capacity.

B. Intraregional Flows

14. Nordic countries account for most of the regional cross-border financial flows and their share has been increasing over time. Three of the five Nordic countries have seen an increase in their share of intraregional flows. Sweden’s share of the region’s total aggregate flows increased slightly from 41 % in 2013 to 47% in 2021. Denmark increased from 18% in 2013 to 22% in 2021. Finland increased from 13% to 15% while Iceland remained unchanged at 0.2% of total aggregate Nordic-Baltic flows. The only Nordic country to see a decreasing share of flows was Norway which decreased from 19% in 2013 to 13% in 2021. Conversely, two out of the three Baltic countries in the region have seen a decrease in their share of Nordic-Baltic total aggregate flows, decreasing from 6% to 0.5% (Latvia), and 1.9% to 0.8% (Estonia) respectively. Lithuania has seen a slight increase in its share of Nordic-Baltic total aggregate flows, increasing from 0.7% in 2013 to 0.9% in 2021. Overall, the Baltic countries’ share of Nordic-Baltic total aggregate flows has decreased from 8.7% of total flows in 2013 and only 2.2% in 2021.

View Full Size

Nordic-Baltic Aggregate Flows by Share of Country, 2013-July 2022

Citation: IMF Staff Country Reports 2023, 320; 10.5089/9798400252389.002.A001

• Download Figure
• Download figure as PowerPoint slide

15. Intraregional flows are strongly bifurcated, with Nordic countries accounting for nearly all the flows within the region. Countries in both subregions (Nordic countries and Baltic countries) tend to be more integrated with other countries in their subregions. Almost all the Nordic countries flows with the Nordic-Baltic region go to other Nordic Countries. Similarly, but less pronounced, most of Baltic countries flows go to other Baltic countries, as almost two thirds of Baltic countries’ intraregional flows go to other Baltic countries.

View Full Size

Chord Diagram of Intraregional Flows by Country, 2020-July 2022

Citation: IMF Staff Country Reports 2023, 320; 10.5089/9798400252389.002.A001

• Download Figure
• Download figure as PowerPoint slide

Table 1.

Intraregional Aggregate Flows as a Share of Total Aggregate Flows, 2020-July 2022

Table 1.

Intraregional Aggregate Flows as a Share of Total Aggregate Flows, 2020-July 2022

Country	Intraregional aggregate flows as a share of total aggregate flows (2020 - July 2022)
Norway	31%
Finland	27%
Denmark	26%
Estonia	25%
Iceland	22%
Sweden	22%
Lithuania	18%
Latvia	9%

View Table

Table 1.

Intraregional Aggregate Flows as a Share of Total Aggregate Flows, 2020-July 2022

Country	Intraregional aggregate flows as a share of total aggregate flows (2020 - July 2022)
Norway	31%
Finland	27%
Denmark	26%
Estonia	25%
Iceland	22%
Sweden	22%
Lithuania	18%
Latvia	9%

16. Norway is the country in the region for which aggregate flows with other Nordic-Baltic countries accounts for the greatest share of total flows. Flows with Nordic-Baltic countries account for 31% of Norway’s total flows, followed by Finland (27%) and Denmark (26%). Estonia (25%), Iceland (22%), Sweden (22%), and Lithuania (18%) all have significant shares of flows with the Nordic-Baltic region, while Latvia has a notably smaller share, accounting for 9% of its total aggregate flows.

C. Regional Financial Flows with Higher-Risk Countries

17. The depth of geographic ML/TF risk analysis and understanding differs among the Nordic-Baltic countries. While the NRAs of the Baltic countries analyze foreign ML threats in detail and identify specific predicate offences and typologies, the majority of the NRAs in the region do not include an analysis of foreign ML threats. Similarly, only few NRAs of Nordic-Baltic countries analyze relevant statistics on cross-border payments, non-resident deposits, and on other indicators of non-resident activity, which could be also usefully combined with other data and contextual information to develop a comprehensive understanding of non-resident ML risks. Another potential area for strengthening the NRAs in the region is adding an analysis of ML vulnerabilities (e.g., of various sectors or of the jurisdiction overall) to non-resident and cross-border activity. Deepening and broadening understanding of foreign ML/TF risks appears particularly important for countries in the region with material levels of cross-border payments and non-resident activity.

18. For the identification of higher-risk countries, Nordic-Baltic country authorities utilize the FATF grey list, European Commission (EC) higher-risk third country list and non-cooperative tax jurisdictions lists. As required by the international standards on AML/CFT, country authorities are following the list of jurisdictions under the FATF increased monitoring. In addition, the EC produces a list of high risk third countries, which to a large extent overlap with the FATF list. The Nordic-Baltic region has minimal flows with FATF and EC higher-risk countries, representing 0.5% and 0.1% of all the region’s cross border financial flows respectively since 2013.¹⁵ The majority of the flows with these externally identified higher-risk countries are driven by flows with Turkey and United Arab Emirates, which represent more than two thirds of the flows with FATF grey list countries. As countries in the region maintain minimal flows with the countries in these higher risk jurisdiction lists, they could produce a more robust risk analysis if they develop their own understanding of their cross-border and non-resident activity risks, and add a focus on their own customized list of high-risk jurisdictions.

View Full Size

Aggregate Flows with FATF, EU High Risk Countries, and EU Non-Cooperative Jurisdictions for Tax Purposes since 2013

Citation: IMF Staff Country Reports 2023, 320; 10.5089/9798400252389.002.A001

• Download Figure
• Download figure as PowerPoint slide

19. Leveraging broader analysis of ML/TF cross-border risk, the Nordic-Baltic countries should develop their own understanding of higher-risk countries reflecting country-specific ML/TF threats. Considering the recent increase in cross-border payments across the region and associated changes in the patterns of flows, national understanding of ML/TF geographic risk can be usefully updated. Further enhancement of ML/TF cross-border risk methodology would benefit from incorporating additional inputs, including the macro-economic external sector statistics (e.g., trade in services, portfolio, and direct investments) and scrutiny of economic rationale for the financial flows with potentially higher-risk countries. Another useful input is the information on the business model and cross-border links of Nordic-Baltic financial sector, with a focus on payment service providers. As all Nordic-Baltic countries have immaterial flows with countries on the external lists of higher-risk countries, namely the FATF grey list and European Commission third-party higher risk jurisdictions list, it could be beneficial to refocus the enhanced monitoring on jurisdictions with substantial flows that have the potential for material ML threat. The higher risk jurisdictions can be identified as part of an in-depth assessment of cross border ML/TF risks specific to the risk profile, context, and financial sector of Nordic-Baltic countries. Enhanced understanding of the country risk would allow application of targeted AML policies to mitigate crossborder ML/TF risk, for example application of countermeasures, such as the requirement of enhanced due diligence measures for customers from or related to higher-risk countries or enhanced reporting mechanisms of financial transactions with entities in higher-risk countries.¹⁶ Considering commonality of ML/TF cross-border threats to many countries in the Nordic-Baltic region, information sharing and regional cooperation in identification of potentially higher-risk countries, for example as part of the Nordic-Baltic AML/CFT Working Group, would be beneficial.

20. Incorporating elements of the economic fundamentals and outlier detection analyses contributes to a targeted and up-to-date understanding of countries with higher ML risks and related payment patterns. Monitoring of cross-border payments activity combined with the economic fundamentals and outlier detection analyses provides with an up-to-date understanding of cross-border ML risks, including of high-risk countries and potentially identifying areas of emerging cross-border ML threats. The up-to-date understanding is important as Nordic-Baltic countries tend to focus on the countries involved in the past breaches with drastically decreased levels of payments in recent years, for example the flows with the CIS countries. Figure 10 illustrates significantly decreased share of payments with the higher-risk countries as defined by the authorities of one Nordic-Baltic country, and a continuous focus of ML/TF risk mitigation measures on countries that no longer have past levels of materiality. Leveraging data analytics, such as economic fundamentals analysis and transaction-level outlier detection, provides a more granular understanding of the level of threat posed by a given direction and patterns of payments. A comprehensive understanding of geographic ML/TF risks requires domestic coordination, including as part of the NRAs and can provide important inputs to inform - among others- risk-based AML/CFT supervision and FIU tactical and strategic analyses. In addition, considering that the tax offences are among the main proceed-generating crimes and increasing flows between the Nordic-Baltic region and IFCs, the tax authorities can provide important information regarding vulnerabilities in tax frameworks or practices of other countries that can be abused for tax offences. The authorities could also distinguish higher ML risk countries for the purposes of monitoring financial flows and risk scoring of cross-border payments from the risk of provision of non-transparent corporate vehicles or harmful tax practices that do not involve financial flows but represent a customer risk factor.

View Full Size

Nordic-Baltic Country X: Share of Flows with Higher-Risk Countries in Overall Flows

Citation: IMF Staff Country Reports 2023, 320; 10.5089/9798400252389.002.A001

• Download Figure
• Download figure as PowerPoint slide

D. Countries that Could Present Higher ML Risks

Economic Context of Cross-Border Payments¹⁷

21. Nordic-Baltic countries’ main cross-border economic linkages are with each other, G7 and European Economic Area (EEA) countries. The Nordic-Baltic countries are economically well integrated, as Nordic-Baltic countries are each other’s top trading and investment partners, with a higher degree of economic integration in the Baltic region. The G7 countries are top economic partners to the Nordic-Baltic countries: the US is the first economic partner for three Nordic countries, Germany (the first partner for two Baltic countries) as well as the UK and France are prominent economic partners. Some of the EEA countries, such as Netherlands, Poland (mostly for the Baltic countries) and Belgium are other important economic partners. Notably, financial centers of Luxembourg and Ireland are top-10 economic counterparties for most of the Nordic-Baltic countries, predominately due to the investment flows, but also services’ trade with the latter. Other IFCs, such as Switzerland, Hong Kong, Cayman Islands and Singapore are material investment partners.

22. The Nordic-Baltic countries vary in the geographic reach¹⁸ of their financial sectors and associated level and nature of cross-border financial flows. Some countries, notably Iceland, Latvia, and Estonia, have material financial flows with limited number of countries, which decreases the complexity of cross-border ML risks to which these countries are exposed. The largest economies in the Nordic region have material flows with the majority of the countries around the world. Such flows are expected given the countries’ developed financial sector, advanced open economies, and extensive cross-border economic linkages.

23. Such extended geographic reach exposes Nordic countries to additional complexity and different nature of cross-border ML/TF risks, indicating importance of these ML/TF risks for countries in the region, notably for Denmark, Sweden, Norway and to a lesser degree Finland. Mitigating crossborder ML/TF risks for countries with an extended geographic reach of financial sector requires enhanced understanding of risk and context of various countries and regions and the nature of different ML/TF threat arising from cross-border payments with them (e.g., integration, layering). Complex cross-border and non-resident ML/TF risks are challenging the AML/CFT systems and controls in the financial sectors of these countries as well as capacity of relevant AML/CFT agencies, primarily AML/CFT supervisors and the financial intelligence units.

24. Analysis of main macro-economic variables underlying Nordic-Baltic countries’ crossborder payments allows for a better understanding of the cross-border illicit financial flows risk. The IMF conducted an economic fundamentals analysis, in which staff compared the inflows to and outflows from each Nordic-Baltic country with underlying economic linkages with all jurisdictions in the world to identify countries where cross-border payments are not supported by the main macro-economic cross-border indicators.

25. The Nordic-Baltic countries differ in the degree their cross-border payments are explained by the selected macro-economic variables. Sweden, Norway, and Denmark have the highest number of countries with insufficiently explained financial flows in the Nordic-Baltic region.While for Sweden and Denmark the payments insufficiently explained by the fundamentals are predominantly on the outflows side, Norway also recorded a high number of inflows insufficiently explained by the economic fundamentals. Iceland and Latvia have a low share of and the lowest number of countries-payment counterparties with insufficiently explained financial flows, potentially indicating lower ML/TF risks facing these countries from cross-border payments.

Table 2.

Economic Fundamentals Results

Table 2.

Economic Fundamentals Results

Country	Material flows (jurisdictions)	Insufficiently explained flows (jurisdictions)	Insufficiently explained flows (breakdown by directions)
Denmark	148	44	15 (both directions); 22 (unexplained outflows); 7 (inflows)
Estonia	91	43	20 (both); 15 (outflows); 8 (inflows)
Finland	115	36	14 (both); 15 (outflows); 7 (inflows)
Iceland	69	23	7 (both); 11 (outflows); 5 (inflows)
Latvia	88	33	17 (both); 11 (outflows); 5 (inflows)
Lithuania	100	40	11 (both); 25 (outflows); 4 (inflows)
Norway	127	48	14 (both); 17 (outflows); 17 (inflows)
Sweden	135	49	20 (both); 25 (outflows); 4 (inflows)

View Table

Table 2.

Economic Fundamentals Results

Country	Material flows (jurisdictions)	Insufficiently explained flows (jurisdictions)	Insufficiently explained flows (breakdown by directions)
Denmark	148	44	15 (both directions); 22 (unexplained outflows); 7 (inflows)
Estonia	91	43	20 (both); 15 (outflows); 8 (inflows)
Finland	115	36	14 (both); 15 (outflows); 7 (inflows)
Iceland	69	23	7 (both); 11 (outflows); 5 (inflows)
Latvia	88	33	17 (both); 11 (outflows); 5 (inflows)
Lithuania	100	40	11 (both); 25 (outflows); 4 (inflows)
Norway	127	48	14 (both); 17 (outflows); 17 (inflows)
Sweden	135	49	20 (both); 25 (outflows); 4 (inflows)

Main Counterparties

26. Financial flows of several Nordic countries with majority of their main counterparties are not sufficiently explained by the economic fundamentals. The majority of Nordic-Baltic countries have financial flows with their top-10 counterparties by payments value well explained by the economic fundamentals. As one example, the value of economic linkages in Iceland is sufficiently high to explain Iceland’s inflows from and outflows to all of the top-10 payments counterparty-countries, indicating lower ML risks from Iceland’s cross-border payments activity with its main counterparties. Estonia’s and Lithuania’s flows with the majority and Latvia’s flows with half of their top-10 counterparties can be explained by the economic fundamentals. Payments with top-10 counterparties are less explained in Finland and Norway, while Sweden and Denmark have few countries and directions of payments with main counterparties explained by the economic fundamentals.

27. While the financial flows between the UK and Nordic-Baltic region have decreased in recent years, the UK remains the main counterparty with flows insufficiently explained by the economic fundamentals. Despite the general trend towards the decrease in payments with the UK since the Brexit, the UK remains first by payments value counterparty for majority of the Nordic-Baltic countries (and in top-10 for all). Notably, the payments with the UK are insufficiently explained by the economic fundamentals for all of the countries in the region (except Iceland). Estonia and Lithuania are the only countries with financial flows with the UK that have increased since the UK’s decision to leave the EU, started growing in mid-2020 due to the entry of payment service providers, while Norway’s and Denmark’s flows with the UK registered a mild increase in mid-2021, but remaining still significantly lower than the levels of several years ago. In contrast, payments with the US, which is in top-10 counterparties for most of the countries in the region, are well explained by the economic fundamentals in all Nordic-Baltic countries.

28. Following significant acceleration in recent years, Luxembourg and Ireland became main IFC counterparties of Nordic-Baltic with financial flows mostly insufficiently explained by the fundamentals. Most of countries in the Nordic-Baltic region rapidly increased payments with Luxembourg that are not explained by the economic fundamentals, which entered the five main counterparties for majority of the countries in the region. Ireland was another IFC that increased financial flows with all the countries in the region, entering the top-10 counterparties for most of the countries in the region, with a higher rate of the increase in the inflows from Ireland. These high inflows from Ireland are not explained by the fundamentals in Norway, Denmark, and Sweden, while the lower increase in outflows to Ireland is explained by substantial investment inflows and imports of services from Ireland. The acceleration in payments with Luxembourg and Ireland coincided with the decrease in payments with the UK, which may potentially be related to the UK leaving the EU and associated relocation of some financial institutions and activity, as well as associated ML/TF risks, to Luxembourg and Ireland.

29. The accelerating flows with Ireland and Luxembourg are part of the broader upward trend in Nordic-Baltic region’s share of flows with IFCs since 2017. Ireland and Luxembourg are two of the largest counterparties in the IFC country grouping, accounting for 48% and 14% of all flows with this country grouping respectively. The value and total share of aggregate flows with financial centers began to increase in 2017, increasing by 22% from the 2016 levels. This trend continued year on year, with average aggregate monthly flows with IFCs - with often higher ML risks- increasing in 2018 (22% increase compared to 2017), 2019 (38% increase), 2020 (46% increase), and 2021 (31% increase).

30. While both Ireland and Luxembourg have seen significant increases in the aggregate flows with the Nordic-Baltic region, the composition of these increased flows is different, with strong net inflows from Ireland and increasing net outflows to Luxembourg. Average monthly net inflows from Ireland have jumped by nearly two and a half times in 2019 following stable flows between 2013 and 2018. This trend of doubling of flows every year continued into 2020 and 2021 (21.2 bln. USD), moderating in the first six months of 2022. Conversely for Luxembourg, while there has been an increase in inflows and outflows, the rate of increase in outflows has been more significant, resulting in large net outflows. The increase in flows with both of these countries should be monitored closely given their position as financial centers, with a focus on the strong net inflows from Ireland and net outflows to Luxembourg.

View Full Size

Nordic-Baltic Inflows, Outflows, and Net Flows with Ireland, 2013-July 2022

Citation: IMF Staff Country Reports 2023, 320; 10.5089/9798400252389.002.A001

• Download Figure
• Download figure as PowerPoint slide

View Full Size

Nordic-Baltic Inflows, Outflows, and Net Flows with Luxembourg, 2013-July 2022

Citation: IMF Staff Country Reports 2023, 320; 10.5089/9798400252389.002.A001

• Download Figure
• Download figure as PowerPoint slide

View Full Size

Nordic-Baltic Inflows, Outflows, and Net Flows with Switzerland, 2013-July 2022

Citation: IMF Staff Country Reports 2023, 320; 10.5089/9798400252389.002.A001

• Download Figure
• Download figure as PowerPoint slide

View Full Size

Inflows, Outflows, and Net Flows with International Financial Centers, 2013-July 2022 (USD B)

Citation: IMF Staff Country Reports 2023, 320; 10.5089/9798400252389.002.A001

• Download Figure
• Download figure as PowerPoint slide

View Full Size

Aggregate Financial Flows with International Financial Centers as a Share to Total Regional Aggregate

Citation: IMF Staff Country Reports 2023, 320; 10.5089/9798400252389.002.A001

• Download Figure
• Download figure as PowerPoint slide

View Full Size

Nordic-Baltic Flows with IFCs by Country

Citation: IMF Staff Country Reports 2023, 320; 10.5089/9798400252389.002.A001

• Download Figure
• Download figure as PowerPoint slide

31. The financial flows with several other main counterparties of many Nordic-Baltic countries are not sufficiently explained by the economic fundamentals. Accelerating flows with Germany, France and Belgium are not sufficiently explained by the economic fundamentals in some Nordic countries and to a lesser extent Baltic countries. In addition, outflows to Switzerland from the three Baltic countries (at the end of their top-10 counterparties) as well as from Sweden and Denmark (top-20 counterparties) are not well explained by the same fundamentals.

Secondary Counterparts

32. After the top-10 payments counterparties of Nordic-Baltic countries, most of the jurisdictions with financial flows not sufficiently explained by the economic fundamentals are IFCs. In addition to accelerating payments with Luxembourg and Ireland, which became Nordic-Baltic’s main counterparties, as well as stable flows with Switzerland, the Nordic-Baltic countries also registered less material flows insufficiently explained by the economic fundamentals with a significant number of other IFCs. Among the IFCs with financial flows insufficiently explained by the fundamentals, Hong Kong, Singapore, and UAE are the most material, being in the top-25 counterparties for most of the Nordic-Baltic countries. In particular, the outflows from the Nordic-Baltic countries to these IFCs are insufficiently explained by the economic fundamentals, which for IFCs consist of investment flows and trade in services. Some of the other IFCs identified by the economic fundamentals analysis for multiple Nordic-Baltic countries, include Liechtenstein, Isle of Man, Jersey, Gibraltar, Mauritius, and, for a fewer countries, Bahrain, and Bahamas. Notably, all countries in the Nordic-Baltic region experienced a rapid increase in payments with IFCs in the last few years, a trend which was driven by Ireland and Luxembourg, as countries with the highest level of flows in this grouping, but the same increasing trend was observed across the majority of other IFCs as well.

33. Payments between several regional country groupings and the Nordic-Baltic countries were also identified as not explained by the economic fundamentals. All the Nordic-Baltic countries have flows insufficiently explained by the fundamentals with the Middle Eastern countries - Qatar, Jordan, Kuwait are the most often identified, followed by less material flows with Iraq and Yemen. Exposure to the CIS countries, an area of historic elevated risk to the Nordic-Baltic region, has decreased, including drastic decrease in payments with Russia and Belarus since the invasion of Ukraine. The Nordic countries have limited flows with the CIS countries: Norway has no significant unexplained flows with this regional country grouping, Denmark has low level insufficiently explained flows with Moldova and Turkmenistan, Finland has insufficiently explained inflows from Azerbaijan and Georgia, and Sweden with Georgia as well as less material flows with Armenia and Moldova. The Baltic countries have a higher number of CIS countries with flows insufficiently explained by the fundamentals, most often Kazakhstan, Georgia, Armenia, and Azerbaijan and, less materially, Moldova and Kyrgyzstan. Some countries face potential ML and bilateral sanction evasion risks since March 2022 from increasing flows with Georgia, Azerbaijan and Kazakhstan as sanctioned Russian entities may attempt to abuse the financial sectors of these countries for illicit activity. Another country grouping identified by the economic fundamentals analysis for all Nordic-Baltic countries (except Finland) includes Balkan countries - Albania, Montenegro and less material flows with North Macedonia, Bosnia-Herzegovina, and Kosovo. Majority of the Nordic-Baltic countries registered fewer material flows insufficiently explained by the fundamentals with sub-Saharan African countries (Kenya, Angola and Uganda being the most important), particularly significant for Finland, Denmark, and Sweden.

Identifying Unusual Cross-Border Flows Using Outlier Detection Methods

IMF staff developed an unsupervised machine learning algorithm²² to monitor global financial flows to detect unusual and potentially suspicious patterns of financial flows using transactional payments data and indicators of higher (weak AML/CFT regime, higher economic crimes, financial secrecy, and harmful tax practices) and lower (underlying trade and investments) ML risks (See Annex I for more information). The unsupervised outlier detection algorithm is aimed at identifying rare events that are statistically different from the rest of the observations. Merging and incorporating indicators of higher and lower ML/TF risk with the payments data and indicators of economic activity results in the identification of outlier activity potentially posing higher financial integrity risks. Analysis of contribution of various indicators used in the model’s output algorithm shows that the economic fundamentals variables (trade and investments, as above) have the largest impact on whether payments would be identified as outliers by the algorithm. The section below describes the results in the identification of global outlier payments for Nordic-Baltic region. While the machine learning algorithm is based on AML /CFT-specific risk factors, identified outlier activity does not indicate illicit financial flows²³.

34. According to algorithm’s results, outlier financial flows in the Nordic-Baltic region have gradually decreased from elevated levels in 2013-2015 recording an increase since 2020. Payment outliers in Estonia have gradually decreased since the end-2013/early-2014, but reemerged since end-2020, although still at a low level of 2.3 percent of overall flows. Most of the outlier activity in Iceland’s financial flows occurred between 2016 and early 2019, with insignificant value of inflows outliers and with low level of 2.4 percent of overall flows since January 2020. Outliers in Norway decreased since mid-2019 but recorded a slight uptick since late 2021, but to a low level of 2.5 percent of overall flows. The flows outliers in Latvia have gradually decreased from the elevated levels in 2013-2015, and despite the slight uptick in late 2020 remain at a low level (3.6 percent of overall flows). Financial flows outliers in Sweden and Denmark have grown since early 2021, equaling to 7 and 8 percent of overall flows respectively, a particularly important increase as these two countries have the highest level of cross-border payments in the Nordic-Baltic region. The outliers in Finland have gradually decreased since the peak in early 2019 but reemerged since end-2021, amounting to 9 percent of overall flows. Financial flows outliers in Lithuania have grown rapidly since January 2020, at a faster rate than the increase in Lithuania’s cross-border payments, reaching an elevated level of 13.3 percent. The low level of flows outliers for countries such as Iceland, Latvia, Norway and Estonia suggests lower level of ML threat, while outlier activity in payments in Lithuania, Denmark, Finland, and Sweden is higher and accelerating and merits further scrutiny and monitoring.

Table 3.

Share of Outlier Payments in Overall Flows

Table 3.

Share of Outlier Payments in Overall Flows

	Share of outliers24
Lithuania	13.3%
Finland	9.0%
Denmark	8.0%
Sweden	7.0%
Latvia	3.6%
Norway	2.5%
Iceland	2.4%
Estonia	2.3%

View Table

Table 3.

Share of Outlier Payments in Overall Flows

	Share of outliers24
Lithuania	13.3%
Finland	9.0%
Denmark	8.0%
Sweden	7.0%
Latvia	3.6%
Norway	2.5%
Iceland	2.4%
Estonia	2.3%

35. Ireland has become the main source of inflows outliers to the Nordic-Baltic countries, followed by accelerating inflows from Germany and Belgium. Ireland replaced Netherlands as the main source of inflows outliers to the Nordic-Baltic region as inflows from Ireland accelerated since January 2020. In addition to Ireland, inflows outliers were also detected in inflows from multiple IFCs, most material being Liechtenstein, Guernsey, Monaco, and Gibraltar, replacing Cyprus, which was the main IFC - source of inflows outliers in earlier periods, also underscoring the importance of developing up-to-date understanding of geographical ML risks. Rapidly increasing inflows from Germany and Belgium to most of the Nordic-Baltic countries also included outlier activity. Other countries with inflows outliers to Nordic-Baltic included other European countries of Greece, Albania, and Montenegro as well as other countries, such as Uganda, Bangladesh, and Angola. Notably, the inflows-outliers since January 2020 do not include inflows from the CIS countries, a major source of inflows-outliers in earlier periods, including Moldova and Ukraine that were in the top-5 sources of inflows outliers in 2013-2019.

View Full Size

Inflows-Outliers from Nordic-Baltic Region, 2020-July 2022

Citation: IMF Staff Country Reports 2023, 320; 10.5089/9798400252389.002.A001

• Download Figure
• Download figure as PowerPoint slide

36. The UK has remained the main destination by number of outflows outliers from the Nordic-Baltic countries, although with decreased value in line with the declining flows with the UK. The value of outflows outliers from the Nordic-Baltic countries to the UK, which was by far the most important destination for outflows outliers in 2013-2019, has decreased since January 2020, but the UK still remained the main destination for outflows outliers, as the outflows outliers to the UK were identified from all Nordic-Baltic countries. Accelerating outflows to Belgium comprised the highest value of outliers outflows from the Nordic-Baltic countries, particularly important in Sweden and Denmark. Two other important destinations for outflows outliers are the US (particularly for Denmark) and Germany (for Lithuania as well as other Baltic countries). Luxembourg has entered top-5 destinations by value of outflows outliers, as outlier activity was identified in accelerating outflows to Luxembourg in all Nordic-Baltic countries - being first largest destination by value outflows outliers from Iceland, second for Norway, and third for Lithuania. In addition, outlier activity was identified in outflows to other IFCs - Switzerland, Ireland, and Hong Kong. Other countries with identified outflows outliers include France, Netherlands, and Spain.

View Full Size

Outflows-Outliers from Nordic-Baltic Region, 2020-July 2022

Citation: IMF Staff Country Reports 2023, 320; 10.5089/9798400252389.002.A001

• Download Figure
• Download figure as PowerPoint slide

37. Outlier detection algorithm findings reinforce the results of the economic fundamentals analysis, identifying patterns and directions of financial flows for further scrutiny. Notably, flows with the UK, main counterparty for majority of the Nordic-Baltic countries, were flagged by both economic fundamentals and outlier detection algorithm. Accelerating flows with Germany, France and Belgium were also identified by both analytical approaches. Importantly, rapidly growing payments with IFCs, specifically with Luxembourg, Ireland, Switzerland, and Hong Kong were identified by both analytical approaches. Flows with other IFCs, most material being Singapore, Malta, and UAE, while not having significant outlier patterns, are not sufficiently explained by the fundamentals and could merit further monitoring and scrutiny.

E. Correspondent Banking Flows

Methodological note: The correspondent bank flows analysis presented below analyzes Nordic-Baltic countries role as facilitators of correspondent banking transactions. Specifically, the analysis focuses on financial flows in which a country in the region acts as a correspondent banking location²⁵ in the payment chain. This analysis does not cover the data on Nordic-Baltic countries as originators or beneficiaries of correspondent banking transactions. This correspondent banking flows analysis covers only correspondent’s facilitation of payments between customers of financial institutions. It does not incorporate the findings of the outlier detection analysis or analyze correspondent banking flows for potential unexplained financial flows.

38. There are significant and growing levels of correspondent banking transactions in the region. Both the value and volume of correspondent banking flows have increased, with some volatility, since 2013. By 2017-2018, the average monthly correspondent banking flows for the region increased by half from 2013 levels with further minor growth in August 2020-July 2022. Provision of correspondent banking services, for Nordic-Baltic countries where it is material, should be monitored as an increase in correspondent banking activity could represent a heightened ML risk.

View Full Size

Value and Volume of Regional Correspondent Banking Flows, 2013-July 2022

Citation: IMF Staff Country Reports 2023, 320; 10.5089/9798400252389.002.A001

• Download Figure
• Download figure as PowerPoint slide

39. Denmark has the most significant correspondent banking activity in the region, with over half of all correspondent banking transactions in the region flowing through the country. Denmark (50%), Sweden (22%), Finland (17%), and Norway (9%) represent nearly all of the correspondent banking activity in the region, with the remaining four countries, (Lithuania, Latvia, Estonia, and Iceland) equaling less than 1% of flows combined. Denmark also has the most significant correspondent banking activity when benchmarked against economic indicators. No other country in the region is close to this level of materiality and the correspondent banking flows are heavily concentrated in the region.

Table 4.

Materiality of Correspondent Banking

Table 4.

Materiality of Correspondent Banking

Country	Share of Nordic-Baltic correspondent banking flows
Denmark	50%
Sweden	22.5%
Finland	17.7%
Norway	9%
Lithuania	0.4%
Estonia	0.3%
Latvia	0.1%
Iceland	0.01%
Regional	100%

View Table

Table 4.

Materiality of Correspondent Banking

Country	Share of Nordic-Baltic correspondent banking flows
Denmark	50%
Sweden	22.5%
Finland	17.7%
Norway	9%
Lithuania	0.4%
Estonia	0.3%
Latvia	0.1%
Iceland	0.01%
Regional	100%

40. Correspondent banking flows in the region are concentrated in a small number of originator and recipient countries. Since 2020, 10 countries have represented the originator of 85% of all correspondent banking flows and the recipient of 88% of all correspondent banking flows in the region. Denmark is the largest originator of correspondent banking flows, as the origin for 15% of all correspondent banking flows that flow through the region. Similarly on the recipient side Sweden represents the largest share at 20%. Norway and Finland both also feature within the top 10 countries, indicating that much of the correspondent banking activity is conducted by Nordic-Baltic banks for banks in other countries in the region. The UK is the second largest counterparty as both originator and recipient of correspondent banking flows, equaling 14% and 13% respectively. Given the UK’s place on several Nordic-Baltic countries self-developed lists of higher-risk countries the significance of the UK to Nordic-Baltic regions correspondent activity merits further monitoring. Two further countries that have been identified as potentially higher risk in the region, Luxembourg (originator of 6% and recipient of 6%) and Ireland (2% and 5%), also feature as significant originators and recipients of correspondent banking flows through the region and also merit further monitoring.

View Full Size

Largest Originators and Recipients of Correspondent Banking Flows through the Nordic-Baltic Region by share of Total, 2020 - July 2022

Citation: IMF Staff Country Reports 2023, 320; 10.5089/9798400252389.002.A001

• Download Figure
• Download figure as PowerPoint slide

F. Flows Between Financial Institutions

Methodological Note: The analysis presented below focuses on payments between financial institutions. This analysis does not incorporate the findings of the outlier detection analysis or economic fundamentals analysis. Payments between financial institutions seem to represent a low ML/TF risk in the region, given the maturity of the country’s financial sector and controls in place. Given this, the analysis presented is only for informational purposes and not part of recommendations generated as part of this report. Therefore, the analysis below is included for informational purposes

41. The Nordic-Baltic region’s cross-border payments between financial institutions²⁶ have been stable and balanced since mid-2017. As is the case with other similar economies, the region’s aggregate flows between financial institutions are considerably larger than retail payments.. Prior to mid-2017 inflows and in particular outflows were larger, driven by heightened flows between Nordic-Baltic and US financial institutions. Nordic-Baltic financial institutions’ monthly average outflows in 2015-July 2022 dropped by 82% from 2013-2014 levels.

View Full Size

Nordic-Baltic MT202 Inflows, Outflows, and Net Flows, 2013-July 2022

Citation: IMF Staff Country Reports 2023, 320; 10.5089/9798400252389.002.A001

• Download Figure
• Download figure as PowerPoint slide

42. The US is the largest outflows counterparty (21% of all outflows) and fourth largest counterparty for inflows (11% of all inflows). Nordic-Baltic flows between financial institutions are heavily concentrated in a small number of countries. The US, Sweden, United Kingdom, and Finland represent the majority of the region’s flows between financial institutions, representing 62% of outflows and 54% of inflows.

View Full Size

MT202 Inflows, Outflows, and Net Flows with the United States, 2013-July 2022 (USD Tr)

Citation: IMF Staff Country Reports 2023, 320; 10.5089/9798400252389.002.A001

• Download Figure
• Download figure as PowerPoint slide

View Full Size

Financial Institutions Outflows by Country, 2013-July 2022²⁷

Citation: IMF Staff Country Reports 2023, 320; 10.5089/9798400252389.002.A001

• Download Figure
• Download figure as PowerPoint slide

View Full Size

Financial Institutions Inflows by Country, 2013-July 2022

Citation: IMF Staff Country Reports 2023, 320; 10.5089/9798400252389.002.A001

• Download Figure
• Download figure as PowerPoint slide

A. Supervisory ML/TF Risk Assessment of Banks: Cross-Border ML/TF Risks

50. There has been clear investment in ML/TF risk assessment models across the region, several are still maturing, while others continue to have gaps. All countries have advanced in developing risk assessment models at the entity-level to guide risk based supervisory engagement. The models draw from and incorporate international and regional best practices in their design. In most countries, supervisors are well-versed with their risk models and assess and validate them on an ongoing basis to ensure that they remain fit for purpose. However, further work -notably, further refinements to methodologies and more detailed collection and integration of data) is required in order to ensure that robust ML/TF risk assessments underpin the supervisory approach for banks. Across the countries, this work ranges from the need for more investment and/or concentrated efforts to fine-tuning.

Overarching Formula for the Calculation of Residual Risk

51. All countries follow the standard approach to supervisory ML/TF risk assessment. This involves an assessment of inherent ML/TF risk the adequacy of the AML/CFT control environment. These two components are then combined to arrive at a residual risk score (e.g., low, medium, high). The inherent ML/TF risk factors generally fall into the headings of product/services; customer, geography, and delivery channel.

52. Inherent ML/TF risk is often not attributed sufficient weight in the calculation of the overall residual risk.. While consideration of the adequacy of the control environment is an important element of the ML/TF risk assessment, the inherent ML/TF risk should drive the risk assessment score. Equivalent or higher weightage to controls over inherent risks may lower entities with high inherent risks (but with more sophisticated internal control frameworks) to medium or low assessed residual risk levels, which in turn can impact the level of supervisory attention given to these entities. This is significant for the banking sector, which is commonly recognized as being exposed to high inherent risk levels but also often lead other types of supervised entities in quality of internal controls. Differences in quality of internal controls within the banking sector continues to be relevant to prioritize attention between entities of similar inherent risk exposures.

View Full Size

Supervisor Supervisory ML/TF Risk Assessment Model

Approaches in Residual Risk Determination Across the Region

Citation: IMF Staff Country Reports 2023, 320; 10.5089/9798400252389.002.A001

• Download Figure
• Download figure as PowerPoint slide

53. At an entity level, the risk assessment ratings for banks that present comparable levels of risk, seem to vary significantly (without adequate explanation) across the region. While certain variations can be justified, based on elements specific to the country operations, the broad ML/TF risk rating of banks, that are considered to present a high inherent risk (from medium-low to high) indicates that further re-examination of supervisory ML/TF risk assessments may be warranted

54. There is a risk that an over-reliance on the adequacy of control considerations could result in misleading residual ML/TF risk conclusions. Despite results indicating that an adequate control environment is in place, the inherent risk of money laundering can never be completely or even largely mitigated by a positive review of AML/CFT controls by supervisors. These control assessments are often limited in scope and depth and give supervisors an indication of the overall level of compliance and effectiveness from which to base their assessment. Overall, if a comprehensive and adequate inherent ML/TF risk assessment is conducted, supervisors should consider this to be the basis for the assessment with the control environment as a secondary consideration upon which to reassign a rating, on a marginal (e.g. medium-risk to medium-high risk, or medium risk to medium + risk)basis.

Calculation of Inherent Risk

55. There are some variations in the range of risk factors included in inherent risk assessment across models. While the risk factors of product/services, customer, geography, and delivery channel risks are assessed in nearly all cases, some models consider additional risk factors, such as risk appetite, elements of internal controls, and more as part of the inherent risk assessment (Figure 28). The inclusion of these additional risk factors may in some instances distort the inherent risk assessment, either through overlap between inherent risk and control considerations, the assignment of weightage disproportionate with risk relevance, or an overly simplistic consideration of any risk factors.

View Full Size

Inherent Risk Assessment Model

Inherent Risk Factors Assessed Across the Region

Citation: IMF Staff Country Reports 2023, 320; 10.5089/9798400252389.002.A001

The risk factors represented here are factors found across the various entity risk assessment models in the region, in proportion of their representation in risk model (i.e., product risk is considered in nearly all countries’ inherent risk calculation, while internal controls are only included in inherent risk assessments in two models). All the above represented factors are not present in each risk model.

• Download Figure
• Download figure as PowerPoint slide

Granularity in Inherent ML/TF Risk Assessment Factors

56. Across all risk factors, risk indicators often lack the necessary specificity for appropriate risk sensitivity of the relevant models:

• Product risk factors often do not include the full range of product/service offerings available in the financial sector or the scale of activity across product/service offerings.

• Customer risk indicators often lack disaggregation by relevant risk categories, for instance, number of domestic v. foreign politically exposed persons (PEPs), number of customers from high-risk jurisdictions, etc. Relatively few models measure the extent of exposure to high-risk industries (crypto assets, extractive industries, designated non-financial sectors, etc.).

• Geographic risk factors in some risk models do not account for average values and volumes of transactions to various country categories.

• Delivery channel related risks are covered marginally in several models and mainly measured in customer counts (e.g., number of customers onboarded remotely or through third parties).

View Full Size

Illustration of Key Inherent Risk Factors included in Models from the Region

The indicators and weightings used in this figure are illustrative and not meant to be an exhaustive list of considerations nor prescriptions for optimal weightages for risk factors.

Citation: IMF Staff Country Reports 2023, 320; 10.5089/9798400252389.002.A001

• Download Figure
• Download figure as PowerPoint slide

Product Risk Consideration and Assessment

57. In most instances, the models would benefit from the reassessment of weightages accorded to the inherent risk factors, particularly in the case of product/services risk. When assessing inherent risk, the analysis of product, customer and geography are the risk factors that should drive the determination. As figure 31 highlights, most countries accord an equal (or lower) weightage to product risk as compared to other risk factors, most commonly 20-25% (Figure 31). Based on discussions with the authorities and the outcomes of the various risk assessment calculations, it seems that product risk, in particular, should be the key driver of an entity’s inherent risk assessment, with higher risk products (e.g., correspondent banking) significantly driving up an entity’s risk exposure when compared to lower risk products (e.g., mortgages). A bank’s attractiveness for money laundering is often driven by the products offered, while its customer base and geographic spread of operations influence the significance of the risk. At the same time, while delivery risk is a worthwhile consideration, the emphasis placed on this factor would not equate with that of the other risk factors. In addition, the significance of delivery risk is diminishing among the typical inherent risk factors with improvements in remote onboarding measures and in the wake of an genenal industry wide move towards the provision of online services coupled with increased investments in digital ID systems.

View Full Size

Product Risk Weightage in Inherent Risk Assessment (Anonymized)

Citation: IMF Staff Country Reports 2023, 320; 10.5089/9798400252389.002.A001

• Download Figure
• Download figure as PowerPoint slide

58. Further, increased granularity in product risk indicators will also improve risk-sensitivity. In most instances, product risk ratings are based on a binary assessment of the types of products/services offered by the entity. Product risk indicators should measure volume of activity across the different product categories, to ensure that entities with extensive operations in higher risk products/services do not get an equivalent weightage as an entity with a much lower business in higher risk products.

Incorporation of “ Nature, Scale and Complexity”considerations

59. While some models included consideration, almost all risk models lack a formalized and comprehensive assessment of variables relate d to the ‘nature, scale, and com plexity’ of an entity. Many mature supervisory models include the assessment of factors related to the nature, scale and complexity of the entities comprising their supervisory population as part of their inherent risk assessment. Indicators of this risk type include business structure, complexity in operations, industry and materiality, and key financial indicators (including assets, turnover, deposits, flows, etc.), among others. A few of the risk assessment models in the region incorporate several elements of this risk type, including, for instance, complexity of structure (measured through the number of domestic branches) or the size of the entity. However, these models lack a comprehensive analysis of this risk type within the model. The assessment of ‘nature, scale and complexity risks’ measured through indicators as included above would be a useful addition to the inherent risk assessment. Further, the assessment of this risk type could include input from regional counterparts through established supervisory colleges, to allow consistent understanding of ML risks emanating from an entity’s size and scale of operations and other relevant considerations.

Internal Controls Assessment as Part of the ML/TF Risk Assessment Methodology

60. There is a wide degree of variance in list of control factors that are considered across the region. Internal controls assessment in the risk model involves expert judgement drawing from past supervisory engagements with the assessed entities. There is considerable divergence in the scope of the internal controls assessment in risk models across the region. A few countries include a comprehensive methodology for assessment of internal controls as part of entity risk assessment, with weightages assigned to various elements of the entity’s internal control frameworks and program as well as the effectiveness of key control measures. More commonly, countries ascribe a range of sources to inform the controls assessment (particularly the results of offsite and onsite inspections) but does not prescribe specific criteria or indicators to guide the assessment. While supervisory discretion is important in the qualitative assessment of controls (to avoid a checking the box exercise), the model should provide guidance on key elements to consider in an assessment of the entity’s controls framework as well as relative weightings for these elements to ensure systematic and consistent controls assessments.

Data Collection and Analysis

61. There were examples of good practices for the collection of data to inform the analysis of cross-border ML/TF threats in some countries. All countries undertake data collection through supervisory returns, which form the primary input for the risk model. However, the covered countries vary in the level of transactional data collected through supervisory returns, with some collecting disaggregated data across the various inherent risk factors. Good practices in data collection include, for instance, collection of input on cross-border payments, average and total values, disaggregated by geographic spread and customer type (high-risk customers/financial institutions and CASPs) as well as values of non-resident deposits disaggregated by geography and client type.

View Full Size

Cross-border Transactions Data Collected across the Region

Citation: IMF Staff Country Reports 2023, 320; 10.5089/9798400252389.002.A001

• Download Figure
• Download figure as PowerPoint slide

62. In the main, the level data and information collected to inform the sectoral and entity level assessments of banks lacks granularity. While all countries seek information across the classical inherent risk factors, in many countries the scope and specificity of information collected is limited. Common gaps include, for instance, lack of information sought on scale of business across various product offerings (to increase understanding of inherent product risk), exposure to higher risk industries and geographic regions, as well as volume of business conducted through third parties. Further, the type of data collected is also often unidimensional with emphasis on transaction/customer counts rather than the values/volumes of activity. This can present an incomplete understanding of risks impacting the accuracy of the results from the risk model.

63. Efforts need to be stepped up to incorporate transaction level data into supervisory returns and the analysis of this information should be feed into supervisory risk assessments. In general, the countries are moving towards increasing the type of data collected through supervisory returns as reflected in the most recent iterations of the returns. However, there should be greater inclusion of risk relevant data (as noted above) across all key risk factors. Further, covered countries collect relatively scant data on internal control factors. While internal controls assessments in the risk models are informed by supervisory activity and other external sources, there should be greater collection of controls data during the return to ensure consistent and updated review of the control’s environment at the time of the risk assessment.

Use of Data Analytics to Refine ML/TF Risk Assessment

64. Across the region, countries may explore broaden their data analytics toolkit to effectively harness expanded inherent risk data collected. In some instances, risk models are excel-based, which may have comparatively limited functionalities and prove inadequate to efficiently process larger volumes of data. In other cases, countries have automated models but could largely benefit from greater use of machine learning, big data mining and other data analytic tools to free up supervisory capacity and improve effectiveness of analysis. In several instances, countries are revamping their data collection tools and strategy, either on a standalone basis for the AML/CFT supervisory division, or in coordination with other workstreams within the supervisory body. Aligned with these initiatives, countries should improve their data toolkit to ensure fully leverage their expanded data collection. As with other elements of their risk model, authorities should assess any analytical solutions applied on an ongoing basis to ensure that they remain fit for purpose.

B. AML/CFT Supervision of Banks and Enhancing Effectiveness of Preventive Measures

Resourcing and Minimum Engagement Models

65. Increased priority for the AML/CFT supervisory function has generally been correlated with resource augmentation; however, in a few instances, available resources remain insufficient in proportion to supervisory population. All supervisors have seen increase in resource allocation in the recent years for the AML/CFT risk based supervisory functions. However, the adequacy of current supervisory resources is variable across the region: in a few instances, staffing levels seem too low to ensure sufficient supervisory presence commensurate with the size of supervisory population. Limitations in resourcing can impact effectiveness of supervisory engagement, with the de-prioritization of resourceintensive functions (including onsite inspections, or development of entity risk assessment models).

66. The development of minimum supervisory engagement models would facilitate a more effective risk-based supervisory approach. Several supervisors in the region have developed ‘minimum engagement models’ to guide depth and frequency of supervisory engagement based on assessed levels of entity risk. The minimum engagement model is intended to set out a minimum or ‘floor’ for frequency of supervisory activity for each identified risk category - supervisors can and should exceed the levels prescribed in the model whenever necessary to respond to newly identified risks or to improve compliance outcomes. An example of a minimum engagement model is included in Figure 33 below. In general, the model sets out the frequency of onsite inspections, offsite assessments, and data collection for each assessed entity risk category categories, with frequency of supervisory activities increasing in step with a move up risk-levels. The minimum engagement model should be sufficiently detailed and appropriately calibrated to ensure adequate risk-sensitive supervisory ‘presence’ in the sector to drive positive AML/CFT compliance outcomes.

View Full Size

Example of a Minimum Engagement Model

Citation: IMF Staff Country Reports 2023, 320; 10.5089/9798400252389.002.A001

• Download Figure
• Download figure as PowerPoint slide

Example of a minimum engagement model, FATF Risk-Based Supervision Guidance, 2021

67. There has been a significant increase in supervisory resources across almost all countries, however, an assessment of the adequacy of resourcing should be carried out (against a minimum engagement model). A regular assessment of supervisory resource adequacy will be key to’ ensure sufficient supervisory presence commensurate to risk levels. A minimum engagement model could be a critical measure of resource adequacy on an ongoing basis, responsive to changes in size and ML/TF risk levels of the supervisory population. As a rule of thumb, the AML/CFT supervisory division should have sufficient resources to systematically implement an appropriately calibrated minimum engagement model, with some flexibility to undertake responsive ad-hoc supervisory activities as needed.

Supervisory Strategy

68. AML/CFT supervisory strategies are either underdeveloped or not in place, and there were no examples of entity-level strategies for the highest ML/TF risk banks. In general, supervisors have developed inspection manuals/procedures and formulate inspection plans on a regular basis to guide active supervisory engagement. However, an overarching supervisory strategy for the banking sector is commonly lacking, and if available, in most instances insufficiently detailed. A sectoral/entity supervisory strategy can help concretely link supervisory activity with identified ML/TF risks in the banking sector, and thus improve the effectiveness of risk-based supervision. Based on an understanding of sectoral ML/TF risks, the supervisory strategy should set out the specific activities that supervisors will carry out to mitigate the risks, including details of onsite activity (e.g., full-scope inspections/areas of thematic focus/deep dive reviews), desk-based reviews, and other key supervisory activities such as outreach, guidance, and collaboration (both domestic and participation in supervisory colleges). For instance, a rise in volume of cross-border payments activity could prompt further focus on thematic reviews on related topics (including transaction monitoring, application of CDD and enhanced due diligence (EDD) measures, and correspondent banking activity) that could then be incorporated into banking sector or entity-specific strategies, or feedback from the FIU that suspicious transaction reports lack necessary granularity regarding the analysis of suspicious activity could lead to the incorporation of an STR focus in the banking sectoral strategy (e.g. thematic inspections, preparation of guidance, coordinating an industry feedback session with the FIU and banks).

69. As a good practice, all countries should consider developing specific strategies for the highest risk banks as a complement to sectoral supervisory strategies, in collaboration with the relevant counterparts in the region. Supervisory colleges can provide a good forum for the relevant supervisors to develop a consistent strategy to engage with financial institutions with cross-border operations. A region-wide supervisory strategy for specific high-risk institutions will allow supervisors to exploit synergies in activities across the concerned jurisdictions and could conserve resources. For instance, all supervisors of branches of a financial group could follow-up on key deficiencies identified following a full scope/thematic inspection of any branch. This follow-up could take the form of a deep dive into controls functions where gaps were identified or, as appropriate, the supervisors requiring the concerned entities to include the identified functions in their internal audit. Supervisors should ensure that such tailored focus is consistent with their domestic legal requirements for onsite supervisory activity.

Supervisory Engagement and Use of Data Analytics

70. Countries are actively carrying out supervision through onsite and offsite activities of banks in the region. Supervisory activity includes full-scope and targeted onsite inspections as well as desk-based reviews. Across the region, there is an increasing trend in the number of onsite inspections carried out. This is partly facilitated by general shift towards targeted or thematic inspections from repeated full-scope inspections which allows more frequent supervisory engagement. Despite the increase in onsite activity, further work is needed in risk-based prioritization of the activity undertaken: in a few instances, medium/medium-low risk entities get near equal supervisory attention as high-risk entities in terms of onsite activity.

71. While countries have noted im provements in ban k’s com pliance with preventive measures, there was consensus that banks (across the region) need to take further steps to ensure that AML/CFT systems and controls are effective which points to a need to also step-up AML/CFT supervisory activities. While improvements have been noted in banks across the region, the level of adequacy of control frameworks varied significantly. As such, supervisory activities need to continue to evolve further and adapt.

72. In the main, supervisory activity is guided by detailed manuals or procedures that map out the su pervisory process and set out criteria to guide the assessment of entities’ controls framework and application of key control measures. Countries have made significant progress to establish risk-based supervisory frameworks. In most instances, country-level materials, included clear criteria and guidance to ensure thorough and consistent engagement.

73. In most instance, further efforts are needed to intensify supervisory oversight in order to ensure that implementation of preventive measures are effective. Most supervisors pointed to a need for banks to further improve their preventive frameworks with several noting transaction monitoring systems as a particular area of focus. In order to do so, countries should consider steps to further intensify supervisory activities and adapt offsite and onsite tasks to pinpoint the highest risk areas, more deliberate selection and use of thematic inspections (discussed later in this report) would be a positive step.

Thematic AML/CFT Supervisory Inspections

74. Countries carry out thematic inspections across several key risk areas and controls. Thematic work includes correspondent banking, sanctions screening, risk assessment, transaction monitoring, internal controls systems, suspicious transaction reporting, internal audit, resources, customer due diligence and risk management processes for cash-in-store.

View Full Size

Topics Covered in Thematic Inspections

Citation: IMF Staff Country Reports 2023, 320; 10.5089/9798400252389.002.A001

• Download Figure
• Download figure as PowerPoint slide

75. There are positive examples of thematic work being directed to high-risk areas and key AML/CFT controls and responding to emerging threats. Some countries focus on high-risk products (correspondent banking) and key AML/CFT controls (ML/TF risk assessment and transaction monitoring). There are also examples of work being directed response to emerging threats (sanctions screening).

76. In many countries, it is unclear how a particular theme is selected. The general move from repeated full-scope inspections to targeted and thematic inspections in the region is welcome and consistent with the maturing of supervisory frameworks. Figure 34 sets out thematic focuses of recent reviews across the region. In all cases, the choice of themes should be appropriately risk sensitive, prioritizing the highest risk areas/topics for coverage. A granular understanding of risks facing the sector will help in the identification of the most critical areas for detailed reviews.

77. A regional look-across of thematic inspections indicates some divergence in scope of thematic inspections. Predominantly, thematic inspections in the region have a focus on control functions such as risk assessment, transaction monitoring, or suspicious transactions reporting. More rarely, the scope of a thematic is significantly wide (e.g., assessment of internal controls frameworks) resembling full-scope inspections in breadth and resource-needs. Such broad thematic inspections may not realize the intended gains of risk-specificity and improved frequency in supervisory engagements. In a few instances, thematic inspections focus on specific higher-risk products (e.g., correspondent banking), where supervisors assess a range of preventive controls in relation to identified higher-risk products. This approach of centering thematic activity on particular products, customers, or higher-risk jurisdictions could be very beneficial in directly correlating supervisory activity with identified risks.

Development of Geographic Risk Understanding to Better Target Supervisory Activities

78. As noted in the financial flow analysis above, in nearly all cases, countries rely on external lists of high-ris k juris dictions to inform the assessment of entities’ geogra phic ris k. Most supervisory risk models across the region measure geographic risk with reference to external list, most commonly, the FATF and EU Commission’s list of high-risk jurisdictions. While these lists are useful, sole reliance on such lists misses the country-specificity for a comprehensive supervisory risk assessment. In step with enhanced collection of cross-border transactions data to enhance the accuracy of both the sectoral and entity-level supervisory risk assessment of banks, all supervisors should consider developing tailored lists of higher-risk jurisdictions taking into account the respective country-specific factors. Key information on geographic risk could be obtained through more detailed supervisory returns.

79. Countries may explore expanding thematic inspections to themes outside systems and controls, and products. In line with the development of a supervisory high-risk country assessment, this information could then drive the scope of a thematic inspection. For example, following analysis of information gathered as part of the supervisory risk assessment, supervisors could first identify a high-risk country with notable transaction levels (this could be particularly informative for countries that utilize financial flows analysis, akin to those described in this report). With the country as the main determining feature, the analysis could then be evaluated against product risk and customer. This could then inform the supervisory activities. For banks that were identified in this analysis, supervisors could then inspect the systems and controls that are in place, related to that country, for relevant topics such as, a sample of high-risk customer due diligence files (including PEPs), transaction monitoring typologies, and STRs.

C. AML/CFT Supervisory Cooperation and Information Sharing

AML/CFT Supervisory Colleges for Banks

80. In response to various AML/CFT-related banking scandals in Europe and the lack of cooperation between international AML/CFT supervisors, European authorities are taking steps to develop structures to facilitate information sharing and coordination. The formal framework for AML/CFT supervisory colleges has been a key initiative. The underlying objective is to provide member countries’ AML/CFT and prudential supervisors with a dedicated forum to share relevant information, while converging the work of FIU

81. s as well, along with the exploration of further synergies. The first AML/CFT colleges for banks were formally set up in 2020. These information-sharing meetings are also complemented by EBA’s European reporting System for material CFT/AML weaknesses, EuReCA, which servers as a central database for AML/CFT. EBA uses this information from EuReCA to inform its view of ML/TF risks affecting the EU financial sector and shares it with competent authorities as appropriate, to support them at all stages of the supervisory process and, in particular, should specific ML/TF risks or trends emerge.

82. While information can be successfully passed between supervisors on a bilateral/informal basis, the structured European Banking Authority (EBA) framework for AML/CFT supervisory colleges is a welcome move. The colleges include EU AML/CFT supervisors and while prudential supervisors, third country AML/CFT and/or prudential supervisors, and FIUs are observers. For an AML/CFT college to be required, under the EBA framework, the relevant institutions must operate on a cross-border basis in at least three EU Member States. In each AML/CFT college, the lead supervisor is the permanent member responsible for the AML/CFT supervision of the institution’s head office or parent entity and is also responsible for establishing and maintaining the college, including the meeting organization. The EBA, through its participation in selected AML/CFT colleges, adopts a monitoring role and shares relevant information as necessary, and provides technical assistance to supervisors providing best practices across other colleges and identifies EU-wide risks and trends based on the colleges’ discussions.

View Full Size

AML Colleges Participation and EBA Monitoring Approaches and Selection Criteria⁴²

Citation: IMF Staff Country Reports 2023, 320; 10.5089/9798400252389.002.A001

• Download Figure
• Download figure as PowerPoint slide

83. Due to the high level of connectivity among banks in the region, most Nordic Baltic countries are well connected and jointly involved across several AML/CFT and prudential colleges, in line with the EBA Guidlines.⁴³ Most countries in the region show strong levels of involvement and participation. This degree of involvement is often tied to the level of activities by foreign banks on each country. Therefore, countries in the region with low numbers of foreign institutions, or where their domestic banks are usually limited to their domestic market, tend to have lower participation levels. In addition to ML/TF risks, participants often discuss other tangential issues, including reputational risk, and the assessment of the business model for banks, including profitability and sustainability.

84. As noted by the EBA, although the work of the colleges has been welcomed, further operationalization efforts are required, along with a shift to a more predictive and preventive nature, instead of a d escri ptive “after the fact” approach.⁴⁴ The EBA keeps track of the colleges’ performance and publishes the results in specific reports. The competent authorities across the EU have shown commitment to implement the colleges framework, through the allocation of resources, and positive exchanges of information. Nevertheless, relevant pieces of information are still being produced on a request-only basis and not proactively, hampering preventive risk mitigation or the identification of emerging threats and vulnerabilities. Although the countries in the region consider them useful, the EU reviews request a shift from a purely descriptive reactive mode to a proactive mode. Countries should strive to use colleges for the early detection of threats, patterns, or suspicious transactions.

85. Implementation across Europe is still at nascent stage, with many colleges having held its first meeting only in 2021. There are challenges in the implementation of international legal cooperation, slowing down the participation of key stakeholders (e.g., non-EU countries and their information sharing frameworks).

86. The EBA recognized six actions to be followed by supervisors and college participants based on the identified best practices: finalizing structural elements of colleges including cooperation agreements and terms of participation; enhance discussions during these meetings; foster ongoing exchange within colleges; apply risk-based approach; identify areas for common approach or joint action; enhance supervisory convergence in AML/CFT colleges.

87. The commitment from the Nordic-Baltic countries to establish and participate in AML/CFT colleges is clear, and steps to enhance the effectiveness of these relationships are welcome. Countries are actively cooperating and sharing information within the EBA AML/CFT supervisory college model, however, bridging the gap between useful discussions and coordinated supervisory efforts will require more work. Supervisors may explore leveraging the colleges to develop cross-border supervisory strategies to engage with high-risk institutions (as noted above) and undertake coordinated onsite activity. This can allow targeted follow-up on significant gaps in the entities’ controls framework: While there are some instances of follow-up with other countries regarding deficiencies identified during supervisory engagements this could be further deepened and mainstreamed. For example, when a lead supervisor identifies a weakness in an AML/CFT preventive framework that could have broader ramifications across the group, these discussions should be brought to the attention of college members and countries should proactively follow-up with members of the group to understand the level of action that has been taken to determine whether this deficiency exists elsewhere. If, in line with the countries’ risk-based approach, it is decided that it is not a priority to look further into this aspect through offsite/onsite activities, host supervisors should challenge firms to include testing on this deficiency as part of their regular second and/or third line of defense activities.

Cross-Border AML/CFT Working Groups

88. The environment for information sharing appears proactive, where information can be shared in an efficient and flexible manner. In addition to the entity specific fora’s for information exchange, there are two main initiatives that enhance collaboration between supervisors and other entities on a cross-national, more general AML/CFT basis. These initiatives include the Nordic-Baltic Stability Group and the Nordic Baltic AML/CFT Working Group

89. Domestic Cooperation between AML/CFT supervisors, prudential supervisors and FIUs on domestic cooperation, most countries show strong frameworks that allow for the exchange of extensive information between AML and prudential supervisors, and between other agencies (including FIUS). In several instances, both the AML and the prudential supervision functions are performed by the same authority, leading to strong cooperation efforts and a high frequency of interactions. On cooperation between the public and private sector, some Nordic Baltic countries also show strong initiatives in most instances, through the extensive use of public-private partnerships (PPPs). Through these fora, the representatives of banks and supervisors discuss together points on preventive measures, thematic risks, supervision, improvements to AML/CFT controls and procedures, and the quality of STR filings. Countries are encouraged to further strengthen this area for an effective and holistic joint work on tackling ML/TF.

90. Several of the international banking scandals concerning AML/CFT breaches pointed to the need for more effective mechanisms for information-sharing among impacted banks. At national and regional levels, there is a need to balance the proactive sharing of information related to customer information (including beneficial ownership), among banks, that may be relevant for the prevention of ML/TF with data protection requirements.⁴⁵ While this “private-private” information sharing is an important mechanism to exchange details, generally, on ML/TF risks/typologies, countries are exploring the boundaries of what can be shared, for example customer-level data (see Box 5). However, it must first be ensured (through banks implementing effective AML/CFT preventive frameworks that are subject to active supervision) that the information banks are collecting is accurate and the analysis reliable, as sharing inaccurate information would be counter-productive.

91. The incorporation of AML/CFT supervisory concerns/considerations in prudential assessments of banks has deepened in recent years. Bank for International Settlements (BIS) considers that AML/CFT supervision in the banking sector aims to ensure compliance by banks with requirements for countering ML and/or FT and to assess banks’ ML/FT risks and processes and internal control systems set up in order to mitigate those risks and to undertake supervisory actions on the basis of such assessments. As AML/CFT supervisors have specialized expertise and knowledge of AML/CFT-related issues, the assessment of banks’ ML/FT risk should be carried out by AML/CFT supervisors in the context of their ongoing AML/CFT supervision and considered in prudential supervision. AML/CFT supervisors should conversely consider in their assessment the knowledge and insights of the prudential supervisors, in particular on the overall risk management, internal controls and governance of the supervised entities.

View Full Size

Cooperation Between Prudential and AML/CFT Supervisors

Citation: IMF Staff Country Reports 2023, 320; 10.5089/9798400252389.002.A001

• Download Figure
• Download figure as PowerPoint slide

92. It is important for AML/CFT supervisors to continue to have strong channels of communication with prudential supervisors. The BIS guidelines point at deficiencies that can have bidirectional consequences in either AML/CFT or prudential supervision. As an example, an improperly vetted member of the board could introduce weaknesses in the AML/CFT framework of a bank. Conversely, AML/CFT cases may affect the bank’s reputation and its ability to fulfill prudential needs and capital adequacy requirements. Supervisors are expected to adopt practices from applicable FATF Recommendations and the Committee’s principles and guidelines. These include the roles and powers of supervisors (including their powers to impose sanctions) and information exchange, to appropriately consider ML/FT risks.

93. Information exchange between both functions is key, with the establishment of official channels to facilitate and structure ongoing dialogue, at both jurisdictional and international levels. This ongoing dialogue may include but it is not limited to authorization procedures, licensing, application, fit and proper tests, ongoing supervision, assessment of the governance, risk management and internal control systems, profitability drivers, operational risks, AML requirements and risk assessment, AML history, and enforcement actions. The BIS points as examples of these channels the bilateral and multilateral exchanges, with or without memorandum of understanding, between prudential colleges and their AML/CFT counterparts.

Recent EU Developments on a Single AML/CFT Supervisor

94. The EU Anti-Money Laundering Authority (AMLA) represents a positive development for better coordination on risk-based AML/CFT supervision, at EU level, but it remains premature to comment on the effectiveness of this initiative and bilateral country efforts will need to continue. As noted at Box 6 below, one of the benefits of the AMLA will be the ability to tackle cross-border AML/CFT supervision of the highest risk-banks in a consistent and coordinated manner. However, with direct supervision expected to commence in 2026, countries will need to continue to establish solutions to address gaps in cross-border supervision until then and for those firms that do not meet the threshold of “high risk” by the definition of the AMLA countries, these efforts will have to continue thereafter.

D. Crypto Assets and Crypto Asset Service Providers

Trends in level of CA activity and ML/TF risks

95. Inherent features of crypto assets can make them susceptible to criminal misuse. Features such as heightened anonymity and limited traceability⁴⁹, coupled with the low-cost global reach make crypto assets vulnerable to abuse by illicit actors. Options for limited intermediation, regulatory arbitrage and the possibility of widespread peer-to-peer transactions also weaken the traditional AML/CFT controls. The FATF in 2021 noted a mainstreaming of criminal activity using crypto assets.¹

96. The CASP population is concentrated in two countries in the region. The CASP sector is generally nascent in the region (fewer than 10 registered CASPs in 4 out of the 8 countries). Two countries have sizeable CASP populations as of April 2023 (Figure 37) -one a notable outlier with around 300 registered CASPs. Countries with a small CASP population, some mild increasing trends in size and volume of activity. The region also sees concentration in the sector, where relatively a small number of CASPs account for the majority of the market share.

View Full Size

CASP Populations in the Region (Anonymized)

Citation: IMF Staff Country Reports 2023, 320; 10.5089/9798400252389.002.A001

• Download Figure
• Download figure as PowerPoint slide

97. Early trends of regulatory arbitrage are clear in the region. In the two countries with large CASP populations, strengthening of market entry controls has led to the decline in the size of the sector. Based on the data provided by countries, the tightening of market entry controls in one jurisdiction has been correlated with an ‘inflow’ (in terms of increased registrations) of CASPs to another country in the region with weaker market entry controls. Further, in several countries, CASPs have been de-risked by the banking sector, with many CASPs (particularly in the countries with larger sectors) primarily serviced by payment service providers.

98. All countries have a good appreciation of the ML/TF risks associated with the crypto asset sector. Across the countries, recent National Risk Assessments include a discussion of ML risks associated with CASPs, which are informed by EU and FATF assessments. In the main, the sector is considered medium-high - high-risk, due to anonymity, low traceability, and easy cross-border reach of crypto assets as well as immature regulatory frameworks for crypto asset service providers. For countries with a small CASP population, the small size of the sector is considered a risk-limiting factor.

99. All countries have amended their domestic legal frameworks to regulate CASPs. Recent amendments set out definitions for crypto assets and crypto asset services providers. CASPs are designated as reporting entities and required to comply with AML/CFT preventive controls. However, in some instances, the legal frameworks are not fully aligned with FATF recommendations on crypto assets.

Market Entry Controls

100. Countries overwhelmingly opt for registration regimes for CASPs. Seven out of the eight covered countries have registration regimes, with one country opting for a licensing framework for CASPs. Within registration regimes, there is considerable variation in levels on market entry controls. On one end, a few countries have light-touch registration frameworks comprising mainly a notification obligation without options for assessment or rejection of registration applications. Others have more extensive registration requirements, with detailed assessment by the regulators of registration applications, covering, among others, the adequacy of AML/CFT controls. However, countries are increasingly moving towards more elaborate frameworks for market entry, with fit and proper testing now included even in most light-touch registration frameworks. These trends are welcome and, in general, countries should aim to have registration frameworks of sufficient strength to avoid inflows of non-compliant CASPs as counterparts strengthen entry controls.

101. Many countries expressed a view that regional regulations can aid a move towards greater harmonization in market entry. The MiCA regulations include specific provisions on market entry controls for covered crypto-asset service providers, requiring all entities that seek to provide covered services to seek authorization in their home jurisdiction. The application for authorization requires detailed information including the description of the entities’ internal controls policies and procedures to mitigate ML/TF risks. The authorization process also envisages fit and proper testing for management and beneficial owners of CASPs. The Regulations also require competent authorities to withdraw authorizations of entities that do not have effective systems and procedures to detect and mitigate risks of money laundering in line with relevant EU Directives.² Harmonized authorization mechanisms once implemented can significantly reduce regulatory arbitrage and inflows of non-compliant CASPs.

102. All countries should continue efforts to detect and sanction unauthorized CASP activity. Given the borderless and transient nature of CASP activity, unregistered CASPs can easily undermine the market entry regime in the absence of proactive measures to identify and sanction unauthorized CASP activity. In all countries, regulators are taking steps to identify unauthorized CASPs, usually in collaboration with other competent authorities (e.g., law enforcement agencies). Regulators are increasingly using a wider range of tools to identify illicit CASP activity, using open-source information and information from other reporting entities to identify illicit actors as well as blockchain analysis tools.

View Full Size

Country-Level Good Practices: Toolkit for Identification of Illicit CASP Activity

Several countries in the region proactively take steps to identify CASP activity, through a range of tools as set out below:

Citation: IMF Staff Country Reports 2023, 320; 10.5089/9798400252389.002.A001

• Download Figure
• Download figure as PowerPoint slide

Incorporating VA-Specific Considerations into the Risk Assessment Model

103. The application of the supervisory entity risk assessment model to the CASP sector is nascent in the region. In most instances, countries have not begun systematic entity level risk assessments for the CASP sector. However, countries with more elaborate registration regimes gain an insight into the risks associated with each CASP during the registration process. This has, in one instance, formed the basis for a temporary risk classification to guide preliminary supervisory activity, pending the development of a formal risk assessment model for the sector. For the countries that have commenced CASP risk assessments, most use their standard risk assessment model for the financial sector without CASP-specific tailoring, with only one country having developed a separate risk assessment model for the CASP sector.

104. Countries should incorporate CASP specific variables and tailor weightages to effectively capture risk relevant characteristics of the CASP sector. Sectoral/entity-level risk assessments are necessary for the risk-based prioritization of supervisory activity and therefore key to systematic supervisory engagement. As in the case of the banking sector (as discussed above), entity risk assessments for CASPs should consider the classical inherent risk factors as well as AML/CFT controls framework. In inherent risk assessment, classic risk factors such as product, customer and geographic risks will continue to be key determinants of risk levels. However, the risk model should include indicators specific to the CASP sector: for instance, indicators on types of CASP services provided and volume of activity in each service offered would be key determinants of risk, given the wide variance in the ML risks associated with different types of CASP activity (e.g., fiat-CA or CA-CA exchanges v. custodial wallets). Further, some delivery channel related risk indicators may be less relevant to differences in risk-levels between CASPs: for instance, since virtual onboarding is a common characteristic across CASP business models, the risk-sensitivity of indicators related to volume of activity from remotely onboarded customers may be blunted. Countries could consider lesser weightage to delivery channel related risks due to reduced sensitivity.

105. Countries should also prioritize the collection of granular, risk-relevant information from the CASP sector through regular returns. Data collection is also relatively underdeveloped for the CASP sector: some countries have not yet commenced regular data collection for the sector while others collect little or no CASP specific information. However, in a very welcome move, many countries are revising their returns to seek CASP specific information and aim to formalize data collection in the sector in the near term. Questions on the scale of operations across the classical inherent risk factors (product, customer, geography, delivery channel) as well on the entities’ AML/CFT control frameworks will be relevant for CASPs. In addition, the returns should also collect risk-relevant information specific to VA/CASPs, including input on the range of CASP services offered, types of virtual currencies used in the CASPs’ transactions, any anonymity enhancing services provided, among others. Figure 39 highlights good practices in the region on data collection, setting out key input sought from the sector in recent iterations of supervisory returns.

View Full Size

Information on Scale of Activity and on CASP Specific Characteristics

Citation: IMF Staff Country Reports 2023, 320; 10.5089/9798400252389.002.A001

• Download Figure
• Download figure as PowerPoint slide

Next Steps in Establishing an Effective Supervisory Model

106. In the main, countries have taken steps towards active supervision in the sector but need further capacity enhancements (particularly through the development of sector-specific risk tools). Supervisory engagement in the CASP sector has increased in 2021 - 2022, however, supervision is not fully risk-based in the absence of systematic entity-level risk assessments. While the small size of the sector (in most countries) can limit resourcing needs, in the main, capacity investments have not been commensurate with the countries’ assessment of ML/TF risks associated with crypto asset activity. The authorities should ensure active supervisory engagement in the sector in line with assessed risk levels. As discussed above, subjecting CASPs to a minimum engagement model can help ensure risk-sensitive engagement while assessing resource adequacy on an ongoing basis. This is key especially for the countries with sizeable CASP sectors.

107. Countries should consider the formulation of specific supervisory strategies for the sector. A tailored strategy can help match the nature of supervisory activity to the specific risks in the sector and guide supervisors in choosing the appropriate supervisory activities for types of identified risks. For instance, if specific risks are identified related to limited customer identification of non-resident client base, or related to provision of nested services, the strategy could include focus on horizontal thematic inspections on topics such as customer due diligence/enhanced due diligence measures applied for nonresident customers and mitigation measures in relation to nested accounts etc.

108. Supervisors should invest in specialized skills and tools to appropriately supervise the CASP sector. CASP supervision may require upskilling by supervisors as well as investment in specialized tools, including blockchain analytic tools. Countries should also engage suitable external consultants particularly for onsite inspections of CASPs to assess and challenge adequacy of solutions undertaken by CASPs.

Cooperation and Information Sharing

109. Acute data gaps hamper risk assessment and active supervision in the CASP sector. CASP supervisors operate with markedly insufficient data on the scale of CASP activity in their jurisdiction, which affects their understanding of potential risks of misuse of crypto assets by illicit actors. While granular data collection through supervisory returns could address some of the gaps, cross-border reach of CASP services as well as relative ease to operate without authorization (when compared to other financial institutions) impacts the comprehensiveness of returns data collected. Close collaboration and information sharing with foreign supervisors could be in addressing some persistent data gaps. For instance, information from foreign counterparts on the application/regulatory history of any CASP can aid home supervisors in assessing CASP authorization applications and can be valuable information to aid detection of unauthorized CASP activity.

110. Regional cooperation and information exchange can enhance domestic risk assessment and risk based supervisory engagement. Countries should move from a domestic, fragmented approach to data collection to a collaborative, cross-border approach to data sharing to inform risk assessments. However, countries indicate preliminary hurdles to supervisory information exchange, including lack of information on CASP authorizations by foreign counterparts. Countries should actively leverage regional platforms to build networks for information sharing on CASP activity. For instance, a regional network allowing supervisors to exchange information on CASP authorizations and rejections as well as to share data on CA activity could address persisting data gaps across the region and allow more effective regional cooperation.