Sweden

Ch. 2 s. 1 requires legal persons to keep reliable, up-to-date beneficial-owner information and document its basis, with earlier records kept for at least five years after a change. Ch. 2 s. 3 requires filing with Bolagsverket at company registration, or within four weeks of registration by another authority, and changes without delay; associations and foundations have four weeks after giving the information to an obliged entity (ss. 4-6).

Ch. 2 ss. 5-8 require an early warning of a significant incident as soon as possible and no later than 24 hours after becoming aware. The incident notification follows within 24 hours for trust service providers and 72 hours for other operators; a final report is due within one month of the notification. Under the Cybersecurity Ordinance (2025:1507) ss. 6 and 31, incident reports go to the CSIRT unit, which is Försvarets radioanstalt; the CSIRT passes the information to the supervisory authority (s. 33).

Ch. 5 s. 2 requires employers with 50 or more employees at the start of the calendar year to have internal reporting channels and procedures; s. 5 requires independent persons or units to receive and follow up reports. Private employers with 50-249 employees may share channels (s. 3).

IMY states that organisations must have a lawful ground for processing and must tell data subjects how their data is handled. Data subjects have rights of information, access, rectification, erasure, restriction, portability and objection, and a right not to be subject to solely automated decisions with significant effects.

IMY states that a personal data breach must be notified to it within 72 hours of the controller becoming aware, unless the breach is unlikely to risk individuals' rights and freedoms. Where the risk is high, affected individuals must also be informed without undue delay. A processor must notify the controller without undue delay.

Ch. 6 s. 1 requires internal control routines and guidelines, with model risk routines where risk-assessment or monitoring models are used. Ch. 6 s. 2 requires, where justified by size and nature, a senior manager responsible for compliance, a centrally responsible compliance officer and an independent review function.

Ch. 5 s. 3 requires records to be kept for five years from when the measures or transactions were carried out or the business relationship ended. Ch. 5 s. 4 allows extension where needed to prevent, detect or investigate money laundering or terrorist financing, up to a total of ten years.

Ch. 3 s. 1 bars establishing or maintaining a relationship without sufficient customer knowledge. Ch. 3 s. 4 applies due diligence when establishing a relationship and for occasional transactions of EUR 15,000 or more; ss. 7-8 cover identification and beneficial owner verification, s. 10 PEP checks and s. 13 ongoing monitoring.

Ch. 4 s. 3 requires a report to Polismyndigheten where there are reasonable grounds for suspicion, even if the transaction is not carried out. Ch. 4 s. 5 names the Police Authority as the financial intelligence unit; ch. 4 s. 9 prohibits tipping-off. The Finanspolisen page says reports are made without delay through goAML.

Ch. 6 ss. 4-5 require firms to provide reporting channels for whistleblowers, protect reporters from reprisals (s. 4 a) and protect the whistleblower's identity.

Ch. 3 s. 1 requires FI to intervene against anyone conducting MiCA-regulated activity without authorisation or registration. Firms operating before 30 December 2024 that needed authorisation under MiCA art. 63 could continue until 30 September 2025, or until a final decision if they applied by 1 October 2025.