Finanstilsynet faults savings bank's cash AML controls across the line

Finanstilsynet has published an inspection report on Marker og Eidsberg SparebankFinanstilsynet (ref. 26/3661, 7 October 2026) finding several deficiencies in the bank's compliance with the anti-money-laundering rules for cash handlingFinanstilsynet. The inspection, scoped to cash risk, comprised a meeting on 28 May 2026 and builds on a preliminary report of 18 August 2026 with board comments of 9 September 2026. The bank is asked to send a copy of the report to its auditor.

The risk assessment identified cash as a high-inherent-risk areaFinanstilsynet — anonymous, hard to trace, widely used in criminal environments — but assessed terrorism-financing risk inadequatelyFinanstilsynet: it referred throughout to money-laundering risk, leaving the reader to enter the underlying risk matrix to find the terrorism-financing exposure, and the matrix itself described inherent cash risk without an independent terrorism-financing assessment although the two do not necessarily coincideFinanstilsynet. Customer-group analysis was insufficiently business-specific: it was hard to derive which customer groups used which cash products (ATMs, minibanks, Kontant i butikk, cashier services) and what the actual risk against them was. The matrix was incompletely filled in — including the modus column — and the bank repeatedly overstated the effect of its own controls, for example treating a risk-classification model it admitted was weak as risk-reducing, leaving residual risk understatedFinanstilsynet.

Routines for hvitvaskingsloven §§ 24 second paragraph, 25 and 26 gave staff too little operational guidance, particularly on alarms: the threshold for a new MF report after persistent suspicion was vaguely described («forhold som avdekker nye opplysninger i saken» without saying what counts as new), no guidance told staff when an alarm triggers event-based customer measures under § 24 second paragraph — so alarms risked assessment under § 25 only — and «store kontanttransaksjoner» was exemplified without saying what staff should treat as large or which assessments decide further investigation.

Risk classification rested mainly on customers' self-declared expected cash use in KYC forms rather than actual cash behaviourFinanstilsynet, with weakly reasoned thresholds and combination-risk weighting that rarely lifted cash-active customers to enhanced control — even though the bank's own assessment called cash high-risk. Electronic monitoring was too generic to catch the structuring, money-mule, rapid-onward-transfer and ATM/KIB-integration typologies the bank had itself identifiedFinanstilsynet; dedicated in-flag (i-flagg) rules for personal-market customers had been deactivatedFinanstilsynet, and business-market monitoring largely reused personal-market rules with higher thresholds.

Samples of 20 customer files showed enhanced measures and ongoing follow-up failing in practiceFinanstilsynet: plausibility of explanations unassessed, deviations between declared and actual cash use left without updated measures or new risk ratings, and source-of-funds documentation missing for enhanced-measure customers. Investigation and reporting to Økokrim showed material weaknessesFinanstilsynet: explanations accepted without plausibility assessment, updates of customer data substituting for investigations, and — most pointedly — persistent suspicious activity continuing for over a year after an MF report without a new report or a documented assessmentFinanstilsynet, including one customer generating over 50 cash alarms after a January 2025 reportFinanstilsynet. A prior report does not exempt the bank from assessing fresh reporting when activity continues, changes character or grows.Finanstilsynet

Legal basis: hvitvaskingsloven §§ 7–9 (risk assessment, routines, risk-adapted measures), 24 (ongoing follow-up), 25–26 (investigation and Økokrim reporting) and 38 (electronic monitoring), cf. hvitvaskingsforskriften § 7-3 and Finanstilsynet rundskriv 4/2022.