Regulators and supervisors have come in for a heavy drubbing in the Financial Action Task Force's latest evaluation of Finland; the contrite FIN-FSA is promising to make amends.

The FATF's Finland Mutual Evaluation Report was published a few days ago. The phrase 'mutual evaluation' dates from the 1990s, when one FATF member-state would evaluate another's anti-money-laundering (AML) controls. Sparks used to fly when the French evaluated the British. Nowadays the world's AML standard-setter sends its own teams to gauge the compliance of various countries with its '40 recommendations,' but the old phrase has, for some reason, stuck.

When it comes to the "effectiveness and technical compliance ratings," the FATF gives Finland low marks in respect of supervision. Referring to recommendation 26, which gauges the regulation and supervision of financial institutions and which refers to Finland as 'largely compliant,' the FATF notes with disapproval that companies that provide certain financial services (e.g. non-consumer loans and financial leasing) are not subject to registration or licensing; banks are not required to "have meaningful mind and management located within Finland," a possible reference to the concept of 'substance' which is currently bedevilling the offshore world; and there are no specific fit-and-proper requirements for the managers and owners of insurance companies, local mutual insurance associations, a central securities depository (presumably Euroclear Finland) and a central counterparty (presumably a reference to the European Central Counterparty (EuroCCP) in Amsterdam, which functions as a buyer in relation to the seller in a Finnish securities trade, and as a seller in relation to the final buyer), as well as companies that provide financial services such as non-consumer loans and financial leasing.

On a more general note, the FATF starts off its evaluation with the observation: "Supervisors' understanding of ML/TF risks is not adequate for the majority of sectors under their supervision, and overall, the AML/CFT monitoring and supervision is not carried out on a risk-sensitive basis. The supervisors are significantly under-resourced given the breadth and depth of their AML/CFT responsibilities and associated workload.

Finland recently passed an AML/CFT Act which came into force in 2017, forcing financial institutions and gatekeepers (DNFBPs) to assess various risks and tackle money laundering in a risk-based way. It also imposed new requirements on financial firms to do with beneficial ownership and internal controls. However, the FATF has still spotted some significant shortcomings, regarding in particular the "transparency regime applicable to legal persons," supervision for DNFBPs and punishments for firms that fail to take preventive measures in general. The level of co-operation between the various AML supervisors, and between those supervisors and the financial intelligence unit (FIU) is inadequate in the FATF's eyes. The FIU is good at analysing things strategically, but the assessors do not believe that the regulators do enough with the results.

Financial institutions have a good understanding of their obligations as regards targeted financial sanctions (TFS) to do with proliferation financing (PF), but the FATF points out that "supervisors do not have legal powers to supervise the implementation of these obligations."

FIN-FSA, the Finnish Financial Supervisory Authority, is concentrating its supervisory efforts on the largest banks, neglecting other highly risky institutions such as hawalas. The FATF makes the rather shocking revelation that "there is no onging AML/CFT supervision of lower risk firms." The RSAA (one of Finland's six Regional State Administrative Agencies, but the FATF does not say which one) has concentrated its supervisory efforts on currency exchange businesses, which do not do much money laundering in Finland, but does not do much to regulate more risky sectors such as real estate. The FATF also leaves the reader in no doubt that FIN-FSA require bigger budgets and ought to be handing out stiffer penalties. The phrase "Finland should substantially increase the resources of all supervisory authorities" is probably the most quotable one in the entire report. It is aimed mainly at FIN-FSA and the RSAA.

FIN-FSA is therefore promising to intensify its risk-based anti-money-laundering supervision, inspect more firms and lower its boiling-point when it comes to handing out punishments. At the same time, it has promised to "increase its supervision resources," a phrase that suggests that it is thinking of keeping the same overall budget while "robbing Peter to pay Paul." On the other hand, it admits that its new policy of intensifying its risk-based AML supervision "will require a significant increase in personnel resources," so this may not be the case. It has promised to double the headcount of an unnamed unit - hopefully one that tackes money laundering - during the course of this year by adding ten more men. It also wants to "strengthen common European supervision," whatever that means.

Whenever firms or quangos are frightened and/or startled by criticism from their superiors, they are tempted to make rash promises in public about showing wrongdoers 'zero tolerance.' This is unfortunately the trap into which FIN-FSA has fallen. 'Zero tolerance' is always a bad idea in compliance and flies in the face of good risk management, which by its very nature consists of choosing between evils. Nevertheless, the regulator has made a statement that will probably come back to haunt it. In the words of director general Ms Anneli Tuominen: "Working in the financial sector requires trust, which in turn requires that operators have zero tolerance for the criminal exploitation of the financial sector.”

This year, FIN-FSA will introduce a new risk-based supervision model. The regulator has also revealed that the European Union, its country's liege lord and master, aims to increase the powers of the European Banking Authority (which is still moving its operations to Paris and is expected to close its premises in London on 31 May) in the interests of centralising anti-money-laundering supervision.

Ms Tuominen is also lending her voice to an ever-present chorus in Brussels in favour of greater centralisation throughout the EU: “The European Union has a clear need to establish a common anti-money laundering supervisor.”