The Anti-Money Laundering Act for bookkeeping and accounting – the County Administrative Board’s administrative fine

Following supervision of Aho Redovisning AB, on 8 September this year the Swedish County Administrative Board (Länsstyrelsen) decided to impose an administrative fine of SEK 50,000. This followed serious deficiencies in the company’s risk assessment and consequent failures to comply with the Anti-Money Laundering Act. The case underlines the importance for obliged entities within the anti-money laundering framework to maintain a risk assessment for their business that accurately reflects the services actually provided (neither more nor less). The decision has been appealed.

Requirements for a general risk assessment in the advisory sector

Accounting and audit firms form part of the advisory sector and are subject to the anti-money laundering framework. Given the risk that the advisory sector may be exploited for money laundering and terrorist financing, obliged entities are required by law to carry out a general risk assessment to prevent misuse of their operations. The general risk assessment must address how the company’s activities could be used for money laundering or terrorist financing and the likelihood of that occurring. The risk assessment must take into account:

• the services and products offered,
• the customer base and distribution channels,
• the geographical risk factors, and
• other factors relevant to the business.

Under Chapter 2, Section 2, second paragraph of the Anti-Money Laundering Act, the assessment must be documented. Its scope should be proportionate to the size and nature of the obliged entity and the risks of money laundering or terrorist financing. It must be designed so that it can underpin the firm’s policies and internal controls, which requires tailoring to the firm’s specific business. A thorough and accurate risk assessment is therefore not merely an administrative legal obligation; it is the foundation for the entire firm’s anti-money laundering work.

What deficiencies were identified in relation to bookkeeping, accounting, audit and tax advisory services?

The County Administrative Board found the company’s risk assessment deficient on multiple points. Among other things, the company stated it provided tax advisory services even though it did not in fact do so. Further, the company had not performed an analysis and reasoned assessment of the risks associated with certain customers. It also lacked sufficient analysis and a reasoned assessment of the risks arising from the company’s geographical location. Taken together, these shortcomings meant the firm’s actual exposure to money laundering and terrorist financing could not be properly assessed.

The County Administrative Board also noted that an overall (composite) assessment was missing. The general assessment must include a composite risk assessment addressing how each risk factor interacts with the others. A risk factor may be low in isolation yet increase when assessed in combination with other factors.

Finally, the County Administrative Board concluded that the company lacked a proper understanding of its own risk assessment, and that the assessment contained incorrect information. This illustrates the risk of treating risk assessments as a box-ticking exercise, when they should instead be operationally useful and fulfil their intended function by being understood by the firm itself.

The County Administrative Board’s assessment and sanction against the accounting firm

The County Administrative Board considered the deficiencies to constitute a serious breach of the anti-money laundering framework. Because the risk assessment must underpin customer due diligence, policies and reporting obligations, an inadequate assessment increases the risk of the firm being misused. The County Administrative Board therefore imposed an administrative fine of SEK 50,000. In setting the amount, it considered both the seriousness of the breaches and the company’s financial position.

What can we learn from the decision against the accounting and audit firm?

The decision sends a clear message to the entire advisory sector: the risk assessment is not a mere formality, but a substantive element of regulatory compliance. Firms engaged in bookkeeping, accounting, audit, legal advisory services or financial planning must be able to demonstrate that their risk analysis is accurate, tailored to the business and operationally usable.

Key takeaways

• Integrate the risk assessment into business operations. It should be actively used as a practical tool. Staff should be familiar with its content and understand why certain customers or services present higher risk.
• Ensure the risk analysis reflects the business. List only the services actually provided by the firm. Incorrectly included risks can distort the analysis.
• Analyse the interaction between risk factors. A low risk in itself may become high in combination with other factors. Assess risks both individually and in combination.
• Document everything. The County Administrative Board requires risk assessments, customer due diligence and policies to be documented and kept up to date. Documentation is central to evidencing compliance.

By working systematically with the risk assessment, a firm not only achieves compliance but also strengthens operational confidence. A clear, well-constructed risk analysis reduces the risk of sanctions, builds client trust and supports fair competition in the market.

How Morling Consulting can support during County Administrative Board supervision

This review highlights the challenges of understanding and meeting the requirements set by anti-money laundering frameworks. At Morling Consulting, our lawyers specialising in anti-money laundering help businesses to build effective systems for risk assessment and customer due diligence. We provide legal solutions enabling firms to meet anti-money laundering requirements while continuing to operate with confidence and assurance.