Measure the risk, then the controls

A clean inspection with a pointed finding

In March 2026, the Danish Financial Supervisory Authority carried out a money-laundering inspection of the Danish branch of Skandinaviska Enskilda Banken, the Swedish bank known as SEB. On 29 September 2026 it published the report: a set of orders to strengthen the branch's anti-money-laundering framework, spanning its risk assessment, its customer risk classifications, its due diligence, its screening of beneficial owners, and its investigation of unusual transactions. An inspection like this is worth reading less as a verdict on one bank than as a forecast. Where a regulator chooses to look, and what it chooses to flag, is the clearest signal available of where its enforcement attention is heading next, and the findings here point at the foundation of the whole AML program rather than at any single broken control.

The central finding is deceptively technical. The FSA concluded that the branch's risk assessment did not adequately reflect its inherent risk of being used for money laundering or terrorist financing, and it ordered the branch to redo that assessment so that, in the regulator's words, the assessment of the inherent risk is independent of any mitigating measures the branch may have taken. In plain terms, the branch had been measuring the risk that remained after its controls were applied and treating that as its picture of the risk it faced. The regulator wants the exposure measured first, on its own, before any credit is taken for the defenses built against it.

That distinction sounds academic until you follow it downstream. A risk assessment is the document on which a bank decides where to look hardest, how to classify its customers, and where to spend its monitoring effort. If the foundation understates the exposure, every layer built on top of it inherits the understatement. The rest of the FSA's findings, on customer risk ratings, enhanced due diligence for high-risk countries, beneficial-owner verification, and transaction investigation, read as exactly the kind of downstream consequences you would predict from a mismeasured base.

What the FSA ordered the branch to fix

The inspection cited roughly ten provisions of the Danish Anti-Money Laundering Act and translated them into concrete orders. On the risk assessment itself, the branch must rebuild it so that it adequately identifies and assesses inherent money-laundering and terrorist-financing risk, takes proper account of the EU supranational risk assessment, includes an explicit assessment of terrorist-financing risk across all relevant parameters, and properly weighs the risk factors tied to transactions with high-risk third countries. The assessment of inherent risk must stand independent of mitigating measures.

On the customers themselves, the FSA found that the branch's final risk classifications did not adequately reflect the actual risk in its relationships. The concern it names is specific and familiar to any compliance team: significant risk factors, such as transactions to high-risk third countries, politically exposed person status, industry risk, and prior cases involving money laundering, terrorist financing, or sanctions breaches, were not reliably reflected in the rating, so customers who carried those factors could sit in the medium-risk tier. The branch was ordered to ensure those factors flow into the final rating and to document its classification decisions, including any decision to downgrade a customer's risk level.

The remaining orders fill out the picture. The branch lacked procedures to detect when a customer changed its name or beneficial ownership, and had not taken adequate measures to verify beneficial owners' identities or to screen them for PEP and sanctions exposure on an ongoing basis. It did not obtain enough information about the purpose and intended nature of its business relationships, nor conduct adequate enhanced due diligence when customers transacted with countries on the European Commission's high-risk list. And it did not adequately investigate unexpected transactions, including their purpose and the origin of funds, or update its due diligence when monitoring revealed activity that did not match what it expected. Taken together, the orders touch risk assessment, customer risk ratings, know-your-customer and onboarding, customer and enhanced due diligence, sanctions and PEP screening, transaction monitoring, and recordkeeping.

How a measurement error becomes a control failure

The elegant thing about this case, if a regulatory finding can be elegant, is that most of it follows from one methodological mistake. Collapse inherent risk into residual risk at the top of the program, and three predictable failures appear underneath. The first is a systematic understatement of exposure, because the assessment never sees the full size of the risk before controls are credited against it. The second is a drift of customers toward the middle, because a rating model fed by an understated base has no reason to push borderline relationships upward. The third is a thinning of enhanced due diligence and investigation, because effort is allocated against a risk map that already looks tamer than reality.

The customer-rating finding is where this becomes concrete. When significant factors like PEP status, high-risk-country activity, or a prior sanctions case do not reliably move a customer out of the medium tier, the result is not a few misrated accounts. It is a structural bias in which the highest-risk relationships are the ones most likely to be hiding in plain sight, classified as ordinary. Medium risk is the comfortable default, and a classification process that lets serious factors wash out is a process that manufactures false comfort at scale.

A single thread runs through nearly every finding: transactions with high-risk third countries. The risk assessment did not weigh them properly, the customer ratings did not reflect them, the enhanced due diligence did not trigger on them, and the transaction investigation did not pursue them. That is not four separate gaps so much as one blind spot expressed at four layers. It is also the thread an examiner is most likely to pull, because high-risk-country activity is where the stakes are highest and where the supranational risk assessment the FSA cited is most pointed.

It is worth being clear about what this case is and is not. The FSA did not find that money laundering occurred. What it found was a control environment in which money laundering could go undetected, and it set out, in writing, the specific deficiencies it expects fixed. That written record is the useful part. An inspection report is a regulator telling the market, in detail, which questions it is now asking, and the themes it names here, honest inherent-risk measurement, country-risk treatment, and beneficial-owner screening, are the themes every peer should expect to meet in its own next examination.

One blind spot, six places it surfaced

Each order maps to a layer of the AML program. Read top to bottom, they trace a single understated base through to the point where a suspicious transaction would have been missed.

The pitfalls worth checking before an inspection does

The first and most portable lesson is the inherent-versus-residual discipline. Many risk assessments quietly bake in the controls they are supposed to be independent of, scoring a business line or a customer segment as lower risk because the firm believes its monitoring is strong. That is the exact move the FSA ordered reversed. Inherent risk should be scored as if no controls existed, and the strength of controls should be assessed and documented separately as what reduces inherent risk to residual. When the two are blended, a firm loses the ability to see where its exposure is genuinely concentrated, and it loses the audit trail that shows a regulator how it reasoned.

The second is the tyranny of the medium tier. A classification model should be stress-tested with a simple question: which single factors, present on their own, are powerful enough to lift a customer out of medium, and are they actually doing so in production? If PEP status, high-risk-country activity, or a prior sanctions case can be present and the customer still rates medium, the model is not reflecting risk, it is diluting it. The fix is both a design question, about how factors combine, and a documentation question, about recording why any downgrade was justified.

The third is treating high-risk-country exposure as a cross-cutting control, not a single checkbox. In this case the same blind spot appeared in the risk assessment, the ratings, the due diligence, and the monitoring. A firm that only patches one layer, say by adding an EDD trigger, while leaving the risk assessment and the ratings untouched, will find the exposure resurfacing at the layers it did not fix. Country risk is most reliably handled as a thread checked at every layer, with the EU supranational assessment and the Commission's high-risk list wired into each.

The fourth is the lifecycle problem. Due diligence done well at onboarding decays if the firm cannot detect when a customer's name, ownership, or transaction pattern changes. Beneficial owners become PEPs or sanctioned persons after onboarding, not only before it. A program that screens once and does not re-screen as structures change is, over time, screening against a snapshot that no longer describes the customer.

None of these require waiting for an inspection. Each is a question a firm can put to its own framework now, and each maps directly to a layer in the finding map above.

The risk-based approach, tested the hard way

The methodological failure the FSA identified is not unique to one branch or one country. The enforcement record is full of cases in which a flawed risk assessment or risk-rating methodology was the hinge on which much larger failures turned. These three, all brought by the UK's FCA, show the same fault line, and the penalties attached to them are a reminder of what the Danish orders are meant to prevent.

The pattern across all three, and the reason this SEB inspection belongs in their company, is that each began where this one begins: with a risk assessment or rating methodology that did not reflect the real exposure. Each of those penalties was preceded, years earlier, by supervisory attention to exactly this kind of foundational weakness. The Danish FSA is naming the same fault at the stage before it compounds into billions moved and nine-figure outcomes.

What an inspection forecasts

The most useful way to read an inspection like this is as a forecast. A regulator has finite examination capacity, and where it spends that capacity is a deliberate signal of its priorities. The Danish FSA carries around 85 AML-tagged matters in the RegLabs record, a steady cadence of inspections that collectively map the control areas it considers most exposed. When the same themes surface across those reports, honest inherent-risk measurement, country risk, beneficial ownership, they stop being one bank's problem and become a published agenda. The firms that read that agenda early are the ones that walk into their own examinations having already closed the gaps.

The regional backdrop sharpens the point. The Nordic region spent the past decade absorbing the aftermath of the Baltic money-laundering scandals, and Danish supervision in particular has been rebuilt around the lesson that controls which look adequate on paper can fail catastrophically against determined cross-border flows. An inspection that drills into whether inherent risk is measured honestly, and whether high-risk-country exposure is reflected at every layer, is a direct descendant of that experience, and a preview of the standard every bank operating in the region will be held to.

Globally, the risk-based approach is the common denominator of modern AML regimes, from the EU's framework to the FATF standards that sit behind it. Its great strength, directing effort to where risk is greatest, is also its single point of failure: if the assessment of risk is wrong, the entire allocation of effort is wrong with it. That is why regulators from London to Copenhagen keep returning to the same questions about methodology, inherent versus residual scoring, and the honest treatment of country risk. A risk assessment is not a compliance artifact to be filed. It is the control that decides how every other control is aimed, and this inspection is a reminder that regulators now read it that way.