Norway

Section 2 A-6 requires undertakings that regularly employ at least five people to have written internal whistleblowing routines, prepared with employees and their representatives. Smaller undertakings need them if conditions indicate a need. Section 2 A-4 prohibits retaliation and section 2 A-3 requires the employer to see that reports are adequately investigated.

Organisations obliged to register must submit a form with beneficial-owner information, including where there are none. The Register Centre says registration must be made within 14 days of registration in a public register or of a change, and that it imposes daily fines for missed duties.

Section 8 requires providers of essential services, and section 11 digital service providers, to report incidents that significantly affect service delivery to the body designated by the King, without undue delay. NSM's guidance says providers of essential societal services must report significant incidents within 24 hours, and lists banking among the covered sectors.

Section 7 requires a risk assessment. Section 8 requires written, risk-based routines set at top management level, and its fifth paragraph requires a person in management with special responsibility for following them up. Section 35 requires internal control, and its second paragraph says the AML officer (hvitvaskingsansvarlig) can never be the same person as the compliance officer. Section 36 covers training (as applied in Finanstilsynet decisions).

Section 9 requires risk-based customer measures and section 11 says they are in principle completed before the relationship starts. Section 12 second paragraph requires identity to be obtained and confirmed in person against valid ID. Sections 13 and 14 cover ownership and control structure and beneficial owners, section 12 fourth paragraph and section 13 fourth paragraph cover politically exposed persons, section 17 enhanced measures and section 24 ongoing follow-up.

Section 2-4 requires a licence to issue e-money. Section 13-18 requires funds from customers to be safeguarded by the end of the business day after receipt. Section 13-19 requires conversion into e-money without undue delay and section 13-20 requires redemption at par on request. Applications must include an AML risk assessment and procedures (AML Act sections 7 and 8).

Section 2-10 of the Financial Institutions Act licence covers the payment services in section 1-5; narrower licences exist for small money remittance and account information services. Section 13-6 requires adequate own funds and section 3-4 sets starting capital of EUR 20,000, 50,000 or 125,000 depending on services. Section 13-18 requires customer funds to be segregated or insured by the end of the business day after receipt.

About 1,200 large listed companies must follow the sustainability reporting rules in the Accounting Act from financial year 2024; small non-complex financial companies, insurers and parents of large groups report from financial year 2025. Finanstilsynet's control page says it checks issuers with Norway as home state under the Securities Trading Act section 19-1 and can decide that a matter be corrected, more information given or the reporting redone.