Norway (EEA/EFTA, non-EU) runs AML/CFT under the Hvitvaskingsloven (Money Laundering Act), supervised by Finanstilsynet with Økokrim as FIU/economic-crime prosecutor.
Law made at European Economic Area level that applies in Norway is covered once, on the European Economic Area page. This page covers Norway’s own layer: implementation, national authorities, national options and local enforcement.
Norway: frontline North Sea/Barents Sea transit state for Russian shadow-fleet tankers; voluntary, case-by-case EU sanctions alignment (not automatic, documented exceptions per challenge review) creates scope/timing divergence from direct EU application and further divergence from OFAC's unilateral 155-tanker Jan 2025 designation; risk trajectory worsening.
Norway (EEA/EFTA, non-EU): outside AMLR (Reg 2024/1624) direct application, outside 6AMLD transposition obligation, and outside AMLA (Reg 2024/1620) direct/indirect supervisory perimeter pending EEA Joint Committee incorporation. FATF status corrected: Compliant/Largely Compliant on 37/40 Recommendations, Partially Compliant on 3 (2023 follow-up), not a single overall 'largely compliant' label. BO registry (reelle rettighetshavere) operative but Okokrim reports persistent complex-structure verification challenges and no finalized BO-driven asset-recovery cases to date.
Enabler Jurisdictions is not yet covered for this jurisdiction in this report.
Conflict Finance is not yet covered for this jurisdiction in this report.
Norway's digital-asset regulatory architecture reached a structural milestone this cycle with the 30 June 2026 expiry of the extended VASP transitional-registration period, which had previously allowed crypto-asset service providers to operate under national registration pending full MiCA authorisation. Finanstilsynet granted MiCA Article 63 CASP authorisation to two Norwegian exchanges during this window: TÝR Markets AS on 18 May 2026, becoming the first crypto-native Norwegian exchange to hold a full CASP licence, and NBX (Norwegian Block Exchange AS) on 30 June 2026, the same date the transitional deadline closed. Both authorisations are corroborated by independent trade-press coverage in addition to the underlying legal-tracker source describing the extension of the transition deadline itself, giving this development Confirmed-level standing.
The architecture-over-incident reading here is that Norway's crypto sector has now fully entered the harmonised MiCA supervisory perimeter, directly applicable via EEA incorporation of Regulation (EU) 2023/1114, rather than continuing to operate under a temporary bridging arrangement. This is a meaningful transition point: firms that previously operated under transitional national registration now face full CASP-level authorisation requirements, and any firm that did not secure authorisation before the 30 June 2026 deadline is, in principle, no longer able to lawfully provide crypto-asset services in Norway under the old transitional basis. The enablement dimension is notable too — the orderly completion of this transition, with two firms authorised on schedule, suggests Norwegian authorities and industry coordinated effectively around the deadline, in contrast to jurisdictions where transitional deadlines produce compliance gaps or enforcement backlogs.
From a three-pillar perspective, this development sits primarily in the CDD/authorisation space rather than generating AML/CFT or CPF signal directly, though MiCA authorisation itself carries embedded governance and fit-and-proper requirements that have downstream AML relevance for any newly authorised CASP's obligations under Norway's separately-tracked AML regime.
Watch for whether additional Norwegian crypto-asset service providers complete MiCA authorisation in the months following the 30 June 2026 deadline, which would confirm whether NBX and TÝR Markets represent the vanguard of a broader authorisation wave or an early-moving pair. The precise EEA Joint Committee incorporation date and decision number for MiCA's application to Norway remains unconfirmed and is worth tracking, as is any indication of enforcement action against providers that operated past the transitional deadline without securing full authorisation.
Compliance Technology & Active Defence is not yet covered for this jurisdiction in this report.
Norway's core anti-money-laundering statute, the Hvitvaskingsloven (2018), was amended twice during 2026. The Act of 6 February 2026 No. 2 amended Section 4, with that amendment entering into force on 1 August 2026, while the Act of 19 June 2026 No. 40 amended Sections 48-49, which had not yet entered into force as at this cycle. Both amendments rest on a secondary legal-tracker aggregator source rather than the primary Lovdata or Storting parliamentary text, which was not directly retrieved this cycle, so the finding is held at Probable rather than Confirmed confidence. A consolidated, AMLR/6AMLD-aligned replacement Act is reportedly under development via a domestic working group, which submitted an implementation report in January 2026, with the Ministry of Finance since consulting on proposals for the new Act.
The architecture point worth foregrounding: Norway, as an EEA/EFTA member rather than an EU member state, sits outside the direct application of the AML Regulation (AMLR), outside the transposition obligation for the sixth AML Directive (6AMLD), and outside the supervisory perimeter of the new Anti-Money Laundering Authority (AMLA), pending EEA Joint Committee incorporation of the EU AML Package. This is a structural gap between EU and EEA/EFTA AML architecture that persists independently of Norway's own domestic legislative activity, and the timing of EEA incorporation is itself uncertain, historically lagging EU entry into force by a material margin.
Against this backdrop, Finanstilsynet identified serious AML deficiencies at Svenska Handelsbanken AB NUF, the Norwegian branch of a Swedish bank, in a 2026 inspection. The findings covered failures in risk assessment, internal controls, staff training, and inadequately calibrated transaction-monitoring systems. This is a bank-specific rather than systemic finding, and it rests on secondary press coverage rather than the underlying Finanstilsynet report itself, which was not independently retrieved this cycle — the finding is accordingly held at Probable confidence with a T4 source tier. Separately, Norway's FATF mutual evaluation follow-up status remains Compliant or Largely Compliant on 37 of 40 Recommendations and Partially Compliant on 3, a standing position carried forward with no plenary change this cycle.
The consolidated AMLR/6AMLD-aligned replacement Act is expected around 2027, per the domestic working group's timeline, and the EEA Joint Committee's incorporation decision on the EU AML Package overall is similarly expected around 2027, though both dates carry meaningful uncertainty. Watch for whether the Handelsbanken Norway finding produces a formal sanction or remediation order, and for primary-source confirmation of the two 2026 Hvitvaskingsloven amendments via Lovdata, which would allow this cycle's Probable-confidence findings to be upgraded.
Commercial Activity is not yet covered for this jurisdiction in this report.
MLROs at Norwegian-branch or Norway-exposed institutions should note that transaction-monitoring calibration and staff training were both cited as deficient in a bank-specific finding, and that Section 4 of the AML Act changed effective 1 August 2026, with further sections pending.
Compliance functions with Norwegian obligations should track both the 1 August 2026 in-force amendment and the pending Sections 48-49 amendment, and monitor the Ministry of Finance's consultation on a wholesale AML Act replacement expected around 2027.
Legal counsel advising cross-border obliged entities should note the structural gap between EU AML Package application and Norway's EEA/EFTA status, with incorporation timing uncertain and historically lagging EU entry into force.
Boards overseeing Nordic digital-asset exposure should note that the transitional VASP registration period has closed and full MiCA authorisation is now the operative standard for Norwegian crypto-asset service providers.
Technology functions integrating with Norwegian crypto infrastructure should treat MiCA Article 63 CASP authorisation as the now-operative compliance baseline, with the prior transitional national-registration regime closed as of 30 June 2026.
Risk functions should treat the Handelsbanken finding as an institution-specific rather than systemic signal, while tracking the broader structural exposure created by Norway's position outside the AMLR/6AMLD/AMLA perimeter.
No material change for this persona this cycle
Internal audit functions should note that the cited deficiencies covered risk assessment, internal controls, staff training and transaction-monitoring calibration, indicating a broad control-framework review may be warranted for comparably-structured institutions.
Finanstilsynet identified serious AML control failures at Handelsbanken's Norwegian branch, and the Hvitvaskingsloven was amended twice in 2026.
Norway's AML statute changed twice in 2026 and a consolidated AMLR/6AMLD-aligned replacement is under consultation.
Norway remains outside the AMLR/6AMLD/AMLA perimeter pending EEA Joint Committee incorporation.
Norwegian crypto-asset licensing completed its transition to full MiCA CASP authorisation with two exchanges now licensed.
NBX and TÝR Markets became the first fully MiCA-authorised Norwegian crypto exchanges.
A bank-specific AML control failure was identified at Handelsbanken's Norwegian branch, alongside a structural AML architecture gap for Norway relative to the EU.
No material change for this persona this cycle.
Finanstilsynet's supervisory finding at Handelsbanken Norway cited control-testing gaps in transaction-monitoring calibration.
Illustrative only: as the AMLA Regulation (Reg (EU) 2024/1620) builds out its direct and indirect supervision perimeter for cross-border obliged entities within the EU, one structural question for EEA/EFTA states like Norway is how and when the AMLR (Reg (EU) 2024/1624) and 6AMLD's harmonised standard would extend to them via EEA Joint Committee incorporation. A scenario worth orienting on: if incorporation lags materially behind EU entry into force, Norwegian-domiciled entities with cross-border EU exposure could face a period of regulatory asymmetry relative to EU-domiciled peers, potentially incentivising forum selection by obliged entities seeking the more settled supervisory regime. This is illustrative orientation only, not a prediction of Norway's actual incorporation timeline or a statement of observed fact.
Illustrative scenario for analytical orientation only. Not compliance advice, not a prediction, and not a statement of observed fact.
| Tracker | Status | Note |
|---|---|---|
| T1 · Russian Sanctions-Evasion Architecture | stable | No material NO-specific Russian sanctions-evasion development surfaced this cycle. |
| T2 · EU AML Package / AMLA | watch | Norway remains outside AMLR direct application, outside 6AMLD transposition obligation, and outside the AMLA supervisory perimeter pending EEA Joint Committee incorporation; a domestic AMLR/6AMLD-aligned replacement act is under consultation. |
| T3 · FATF Grey List | stable | Norway is not on the FATF grey list. Cambodia's governor warned of renewed grey-list exposure this cycle. |
| T4 · Beneficial-Ownership Register Status | no_change | No BO-register development for Norway located this cycle. |
| T5 · Crypto / VASP Regulatory Framework | material_change | MiCA CASP authorisation regime went fully live for Norway with the 30 June 2026 expiry of the extended VASP transition period; NBX and TÝR Markets became the first fully-authorised Norwegian CASPs. |
| T6 · Sanctions Regime Divergence | stable | No NO-specific EU/US/UK autonomous-listing divergence signal located this cycle. |