Finland FI

FIN-FSA's updated sanctions risk assessment, published 12 February 2026, identifies payment service providers as the sector with the most room for improvement in complying with sanctions regulations and national freezing orders. This is a Confirmed, primary-source finding from Finland's own financial supervisor, notable for being a proactive self-identification of a supervisory weak point rather than a finding surfaced through external enforcement or scandal. The obligation basis sits within the AML/CFT Act (444/2017), Chapter 3, section 10, which governs screening obligations for obliged entities including payment companies.

Read through the sanctions-architecture lens, this finding is significant less for what it says about any specific evasion pattern and more for what it signals about supervisory prioritisation: FIN-FSA has flagged payment service providers, rather than banks or other obliged-entity categories, as the sector requiring the most improvement. This distinguishes Finland's current sanctions-compliance posture from a pattern where enforcement volume concentrates on banking-sector screening; here the regulator itself is directing attention toward a non-bank obliged-entity category. No enforcement action against a specific payment service provider was identified this cycle; the finding remains at the risk-assessment and supervisory-priority stage rather than having yet produced a named enforcement outcome.

Outlook

Whether FIN-FSA's February 2026 sanctions risk assessment translates into concrete supervisory action, guidance, or enforcement against specific payment service providers is the item to watch. Given that this is a self-identified regulatory priority rather than an externally-forced finding, FIN-FSA is well positioned to follow through with targeted supervisory engagement in the payment-services sector over the coming cycles.

Finland's national virtual-currency provider regime has been fully repealed and replaced by the European Markets in Crypto-Assets Regulation, with FIN-FSA confirming that the national transition period for virtual-currency providers ended 30 June 2025. This is a Confirmed, Tier-1 finding directly from Finland's financial supervisor: national legislation has been repealed and replaced, meaning MiCA CASP authorisation is now the sole basis on which a crypto-asset service provider may lawfully operate in Finland.

The transition carries a specific and material supervisory-gap signal. Legacy Finnish virtual-currency registrants who filed a complete MiCA application by the 31 October 2024 deadline could continue operating under national law until 30 June 2025 or a FIN-FSA authorisation decision, whichever came first. Only seven companies met this filing deadline. This is a Probable finding, reported in secondary coverage of the FIN-FSA transition announcement, but it corroborates the crypto monitor's own independent finding of the same seven-filer figure, giving the number cross-source support even though the underlying evidence tier for the figure itself remains secondary. The obligation architecture here runs through MiCA (Regulation (EU) 2023/1114), Article 63, governing the transitional and ongoing authorisation requirements for crypto-asset service providers, with VASP counterparties as the relevant customer typology this cycle.

The financial-integrity reading of this transition centres on the supervisory-continuity question: a shift from a comparatively larger, nationally-registered population to a much smaller MiCA-authorised population creates a period in which the population of entities under active Finnish AML/CFT supervision may be significantly smaller than it was under the prior regime, at least until authorisation decisions for the seven filers, and any subsequent new applicants, are resolved.

Outlook

The outstanding question is how many of the seven legacy filers have since received full MiCA CASP authorisation from FIN-FSA, and what happened to any that did not. Until this is resolved, the effective AML/CFT supervisory perimeter for crypto-asset activity in Finland cannot be precisely characterised. This is the single most concrete open item for the D5 domain heading into the next cycle.