Nordic KYC & AML Data Guide

This guide looks at the official KYC and AML data available in Norway, Sweden, Denmark and Finland: who holds it, what it contains, how current it is and who can access it. The aim is to separate three questions that are often mixed together: what the law requires, what the registers actually contain, and what can be retrieved and monitored automatically.

Scope: Today's national rules still reflect the 4th and 5th EU Anti-Money Laundering Directives, with the directives applying in Norway through the EEA Agreement. The EU Anti-Money Laundering Regulation (Regulation (EU) 2024/1624) applies in EU Member States from 10 July 2027. This guide covers it where it changes the picture. Registry access and technical capabilities are described only where the responsible authority has documented them.

Executive summary

Denmark has the broadest combination of public company and legal ownership data in the Nordics. CVR brings together company data, signing rules, role history and legal owners holding 5% or more. The data is available programmatically free of charge (Erhvervsstyrelsen). Norway also has strong coverage: company data is available through a free open API with change endpoints (Brønnøysundregistrene). It is also the only Nordic market where a public authority provides shareholder data for every limited company, although the data is an annual snapshot as at 31 December (Skatteetaten).

The main gap is current legal ownership of unlisted companies in Sweden and Finland. Neither country has a central authority register for shareholders in unlisted companies. Instead, the company keeps its own share register (aktiebok or osakasluettelo). Building a current ownership chain therefore depends on documents from the customer or on commercial data.

Beneficial owner data is restricted in all four markets, and in each case the register holds information filed by the entity itself.

•         Denmark ended general public access on 1 September 2025.

•         Sweden introduced login and purpose requirements in February 2023 and a statutory access category regime on 1 July 2026.

•         Finland's UBO data has not been generally public; in 2026 PRH introduced a new Beneficial Ownership Information Service as the access channel.

•         Norway's register, opened in October 2024, has never been public.

The categories that differ most between the four markets are:

•         Legal shareholders and percentages. Denmark publishes owners from 5% in threshold bands, Norway provides an annual snapshot of shareholders, and Sweden and Finland have no central source.

•         UBO legal tests. The national formulations differ. Sweden presumes control above 25% of total votes. Denmark treats more than 25% as an indicator only. Norway and Finland apply ownership and voting criteria plus other control. EU Member States move to a harmonised 25% or more test on 10 July 2027. Norway is preparing corresponding changes, but the timing depends on incorporation of the EU AML package into the EEA Agreement.

•         UBO access mechanics. Norway offers API access for authorised user groups. Sweden offers API access through Bolagsverket for entitled users. Denmark offers MitID lookups or an API. Finland offers a web service with downloadable extracts and no documented direct API.

•         PEP data. All four now have an official definition of the functions that create PEP status. Norway introduced its own national list of qualifying positions and functions on 1 October 2026, to be applied by obliged entities no later than 1 January 2027. Only Denmark publishes an official list of named domestic PEPs.

•         Sanctions. Norway is outside the EU and implements sanctions through its own regulations, so timing can differ from the EU.

•         Regulatory timing. The EU AML Regulation applies in Sweden, Denmark and Finland from 10 July 2027. Norway is preparing parallel implementation, but the package was not yet part of the EEA Agreement at the time of writing.

Nordic KYC data at a glance

The ratings in the below table describe what an entity subject to AML rules can obtain from authoritative sources. They do not describe the legal duty itself. Strong = authoritative, current and available in a machine readable format. Partial = authoritative, but incomplete, based on a snapshot, paid, or limited in scope. Restricted = the data exists, but access depends on status, entitlement or purpose. Not generally available = no central authoritative source was identified. Each row is explained, with sources, in the country sections.

The EU and EEA framework behind the data

Today's national rules implement the 4th and 5th AML Directives. The EU AML Regulation (Regulation (EU) 2024/1624, AMLR) applies in EU Member States from 10 July 2027. The 6th AML Directive (Directive (EU) 2024/1640, AMLD6) governs registers and access to them. Some of its register access articles had earlier deadlines of 10 July 2025 and 10 July 2026, which is why Sweden and Denmark have already changed beneficial owner access (Swedish Government bill Prop. 2025/26:129).

The CJEU judgment of 22 November 2022 ended unconditional public access to beneficial owner data. In joined cases C‑37/20 and C‑601/20 (WM and Sovim), the Court of Justice invalidated the rule that this information must always be available to the general public. AMLD6 replaces it with access for authorities, for obliged entities performing customer due diligence, and for persons with a verified legitimate interest, including journalists and civil society organisations.

AMLR changes both the legal test and the register content. AMLR Article 52 defines an ownership interest as 25% or more of the shares, voting rights or other ownership interest, rather than today's more than 25%. Indirect holdings are calculated by multiplying through each chain and adding the results across chains. Control by other means remains a separate route. Under AMLR Article 62, beneficial ownership information includes the beneficial owner's residential address, and under Article 63 legal entities must report changes to the central register within 28 calendar days. The Swedish government expects some residential addresses to be withheld in individual cases on confidentiality grounds (Prop. 2025/26:129).

AMLR also continues the official list of PEP functions. Under the current Directive, each Member State lists the exact functions that qualify as prominent public functions, and the Commission publishes a consolidated list. That list was published in the Official Journal as C/2023/724 on 10 November 2023, alongside the Commission's list of functions in EU institutions (C/2023/611). It lists positions, not the names of people holding them. AMLR Article 43 carries this forward.

Norway is an EEA state, not an EU member, so EU dates do not apply automatically. AMLR is marked as relevant to the EEA and under assessment for incorporation into the EEA Agreement (Government EEA memo). The Ministry of Finance consulted on a proposal for a new Norwegian AML Act in early 2026 (Norges Bank consultation response). How Norway will relate to AMLA, an EU agency, has not been settled.

The EU interconnection of beneficial owner registers is still pending. It was due by March 2021. In February 2026 the Swedish government stated that technical work was continuing and that access through the interconnection will follow defined by the EU user categories (Prop. 2025/26:129).

The High-Value Datasets Regulation (EU) 2023/138 strengthens the EU open company data framework. It requires basic company data to be available free of charge in machine readable form. Sweden launched its free company data API under this framework on 3 February 2025 (Bolagsverket). Free access to CVR data in Denmark and PRH open data in Finland predates the regulation.

Norway

Norway combines strong open company data with an annual, public shareholder dataset and an available only through API beneficial ownership register for authorised users. It is outside the EU, so sanctions and the 2027 AML package follow a Norwegian timetable.

Company registry

Brønnøysundregistrene runs the Central Coordinating Register for Legal Entities (Enhetsregisteret), which covers every entity and assigns the nine digit organisation number. It also runs the Register of Business Enterprises (Foretaksregisteret), which records roles, signing authority (signatur) and procuration (prokura).

Company and role data is free through the Enhetsregisteret open data API under the Norwegian Licence for Open Government Data. The API has update endpoints for entities, subordinate entities and roles. Role data including national identity numbers is available only through an authorised endpoint secured with Maskinporten.

New Acts for both registers took effect on 1 January 2026. Board members, deputy board members and general managers must now confirm that they accept the role in which they are registered (Brønnøysundregistrene).

Legal ownership and shareholders

The Norwegian Tax Administration's Shareholder Register (Aksjonærregisteret) covers shareholders in every Norwegian limited company, and anyone can request its data (Skatteetaten). It is built from each company's annual return and shows shareholders as at 31 December. Data is ordered per company through Skatteetaten's service. Data for income year 2025 became available on 18 May 2026. Immediately before the next annual release, the latest available ownership information can therefore be approaching 17 months old.

Brønnøysundregistrene itself holds no shareholder data; the company's own share register is the current source (Brønnøysundregistrene).

The government has proposed a new, continuously updated shareholder register. In its 2027 budget proposal, the government proposes NOK 100 million in 2027 to start a project, run jointly by Skatteetaten and Brønnøysundregistrene, for a register at Brønnøysund fed automatically from companies' digital share registers. According to the government's announcement, the project is to be completed by the end of 2030 within a total cost frame of NOK 1,510 million (regjeringen.no). The proposal is subject to the Storting's budget decision. Wider access, for example for the press and financial institutions, is described only as a longer term possibility.

Beneficial ownership

Legal definition. Under section 14 of the AML Act and the regulation to the Register of Beneficial Owners Act, a beneficial owner is a natural person who directly or indirectly:

•         owns more than 25% of the ownership interests;

•         can vote for more than 25% of the votes, where voting rights differ from ownership;

•         can appoint or remove more than half of the board members or equivalent; or

•         otherwise exercises control.

What the register gives you. The Register of Beneficial Owners opened on 1 October 2024, with a final filing deadline of 31 July 2025. It was redesigned after the 2022 CJEU judgment and is not public. By law, access is granted to authorities, obliged entities, media, civil society organisations and higher education institutions (regjeringen.no).

Access is provided through APIs authenticated with Maskinporten (Brønnøysundregistrene API documentation). Obliged entities can:

•         retrieve a registered entity's beneficial owner information by organisation number;

•         see national identity or D-numbers;

•         see discrepancy information and its date; and

•         follow the change log.

Obliged entities cannot search the register by person or download the full register; those functions are reserved for specified public authorities. System vendors can be given delegated access by an entitled customer. The register holds the entity's own filing; it is not an independent determination of who the beneficial owner is.

Individuals

The National Population Register (Folkeregisteret) is kept by Skatteetaten. Access depends on the entitlement package granted (Skatteetaten):

•         Private businesses can apply for access to non-confidential data.

•         Packages for private businesses differ in whether the national identity number is included. Confidential data is released only to bodies with their own statutory authority; for financial institutions this is the Financial Institutions Act (Skatteetaten handbook).

•         All use must stay within the user's purpose and legal basis, and Skatteetaten logs every lookup.

Electronic identity

BankID is the dominant scheme for authentication and signing.

PEP and sanctions

Norway now has an official list of PEP positions and functions. The Ministry of Finance adopted a regulation on positions and functions conferring PEP status on 1 October 2026. Key points:

•         The regulation entered into force immediately, but obliged entities must apply it no later than 1 January 2027.

•         It lists 64 categories of positions, including named state enterprises and international organisations.

•         Temporary holders count only if the appointment lasts at least 12 months.

•         Other EEA states' official function lists are to be treated as exhaustive for those countries.

•         The ministry has said the list will need reassessment when the EU AML Regulation's PEP definition is implemented (regjeringen.no).

No official list of named Norwegian PEPs was identified.

Sanctions. Norway is not an EU member, so EU restrictive measures do not apply in Norway as EU law. Norway implements UN sanctions and the EU measures it decides to join through Norwegian regulations under the Sanctions Act (regjeringen.no). Implementation timing can therefore differ from the EU. For example, the EU's Russia package of 23 April 2026 was implemented by later amendments to the Norwegian Russia regulation (regjeringen.no).

Ongoing monitoring

Pending changes

•         The proposed continuously updated shareholder register (2027 budget proposal).

•         Application of the PEP functions regulation by 1 January 2027.

•         EEA incorporation of AMLR, AMLD6 and the AMLA Regulation, with the government aiming for parallel implementation.

Sweden

Sweden has strong company data, paid change notifications and a restricted beneficial owner API, but no central source for legal shareholders of unlisted companies.

Company registry

Bolagsverket keeps the Companies Register (aktiebolagsregistret) and the Trade Register (handelsregistret); the identifier is the ten digit organisation number. There are two API tiers:

•         Free API. Bolagsverket's API for high-value datasets is free and needs no agreement. It covers organisation name, legal form, addresses, business description, deregistration, ongoing liquidation or restructuring, and digitally filed annual reports. Industry codes (SNI) come from Statistics Sweden through the same API (SCB).

•         Paid API. Board members and richer company information are available through Bolagsverket's paid company information API. Signing rules (firmateckning) are registered and appear in register extracts.

Company-name lookup. Bolagsverket’s company-information API requires an organisation number and does not currently support lookup by company name. If a process starts with only a company name, a separate source is needed to resolve the organisation number first. SCB’s företagsregister API is one authoritative option for this.

Change notifications. In 2026 Bolagsverket added change notifications to the company information API (Bolagsverket). A notification identifies the company and the type of change, among other things, after which the updated company information can be retrieved. The service is part of the paid API environment, not a free public push service.

Legal ownership and shareholders

No central authority register of shareholders in unlisted Swedish limited companies was identified. The share register (aktiebok) is kept by the company itself. Current ownership and ownership percentages are therefore not generally available from an authoritative register for private companies.

Beneficial ownership

Legal definition. Under Act 2017:631 on the registration of beneficial owners, a beneficial owner is a natural person who ultimately owns or controls the legal person. Unless the circumstances indicate otherwise, a person is presumed to be the beneficial owner if they:

•         control more than 25% of the total votes through shares, participation or membership;

•         have the right to appoint or remove more than half of the board or equivalent; or

•         can exercise such control through an agreement with owners or members, the articles of association or similar documents.

The statutory presumption is framed around votes and control, not around ownership of more than 25% of the capital as such.

What the register gives you. The register records name, citizenship, country of residence, personal identity or coordination number (or date of birth), and the nature and extent of the interest. If there is no beneficial owner, that fact is recorded instead (Prop. 2025/26:129). The entries are the entity's own filings.

Access timeline. After the 2022 CJEU judgment, Bolagsverket required users from 16 February 2023 to log in and state what the data would be used for (Bolagsverket press release). On 1 July 2026, amendments implementing AMLD6 introduced statutory access categories (Bolagsverket; Prop. 2025/26:129):

1.       Specified authorities and supervisory bodies receive immediate and unrestricted access.

2.       Obliged entities performing customer due diligence may receive data electronically.

3.       Persons with a legitimate interest, including media and civil society organisations, receive a certificate valid for three years. It covers name, birth month and year, country of residence, citizenship and the nature and extent of the interest. Some groups may also receive five years of history and control structure descriptions.

Machine access for entitled users is live. Bolagsverket provides beneficial owner information through its company information API to authorities and obliged entities (Bolagsverket). Key conditions:

•         Access is restricted and requires the relevant entitlement.

•         Direct integration requires an agreement with a supplementary agreement for beneficial owner data (Bolagsverket agreement).

•         Intermediaries that pass the information on to entitled recipients can also connect.

•         This is not public API access.

Bolagsverket has announced an online service for applying for access, for smaller organisations and individual users, for autumn 2026.

Individuals

Population registration is kept by Skatteverket. Private sector access to population data is conditional and limited to permitted purposes. Personal identity numbers appear in register data such as the beneficial owner register, but their use by obliged entities is subject to data protection rules.

Electronic identity

BankID dominates authentication and signing, and Freja eID is the main alternative. The state eID, Sverige-id, is scheduled to launch on 1 December 2026. It will be issued by the Police at the highest assurance level of the Swedish trust framework and used through an app (Polisen). The governing Act 2026:1358 on state e-identification was issued on 18 June 2026 and enters into force on 1 December 2026.

PEP and sanctions

The PEP definition is in the AML Act (2017:630). Sweden's official list of qualifying functions forms part of the EU's consolidated list of prominent public functions (C/2023/724). No official list of named Swedish PEPs was identified. EU restrictive measures apply directly.

Ongoing monitoring

Pending changes

•         Launch of Sverige-id on 1 December 2026.

•         Bolagsverket's online service for access applications, announced for autumn 2026.

•         AMLR application from 10 July 2027, including the 25% or more test.

Denmark

Denmark offers the deepest public company and legal ownership data in the Nordics, plus the region's only official list of named domestic PEPs. Beneficial owner data left public view on 1 September 2025 but remains available to entitled users through login and an API.

Company registry

The Danish Business Authority (Erhvervsstyrelsen) runs CVR, the Central Business Register, with an eight digit CVR number and P-numbers for production units. CVR holds status, address, legal form, industry code, management, board, signing rule (tegningsregel) and change history.

CVR services that do not involve manual handling, including direct system access, are free (European e-Justice Portal). Direct system access is an Elasticsearch interface that returns current and historical data (Erhvervsstyrelsen). Erhvervsstyrelsen registers information as filed and does not check its accuracy.

Legal ownership and shareholders

Danish company ownership data is public for legal owners holding 5% or more of the capital or voting rights. These owners are registered in the public Register of Owners and shown in CVR (virk.dk). Holdings are not published as exact percentages. A change must be registered when a holding crosses 5, 10, 15, 20, 25, 50, 90 or 100%, or one-third or two-thirds (Folketing answer from the Minister). CVR therefore shows the band a holding falls in, not its precise size.

Beneficial ownership

Legal definition. Erhvervsstyrelsen's guidance treats holding more than 25% of the ownership interests or voting rights as an indication, a starting point rather than a fixed legal test. The decisive question is the person's actual overall control or influence, through ownership, voting rights or other means. A person below 25% can therefore still be a beneficial owner through other control.

The rules follow a cascade model: if a company has no beneficial owners or cannot identify them, this must be registered, and members of the executive management are registered in their place (Folketing answer; virk.dk).

What the register gives you. From 1 September 2025, CVR stopped publishing beneficial owners to the general public (Erhvervsstyrelsen). Access is limited to competent authorities, obliged entities and persons with a legitimate interest, through two routes:

•         single lookups on cvr.dk after MitID login and a declaration that the access conditions are met; and

•         an direct API for retrieving beneficial owner data into the user's own systems.

Erhvervsstyrelsen may check afterwards whether access conditions are met, normally no earlier than 12 months after access is granted. Beneficial owners can request a list of the legitimate interest users who have accessed their data (Consolidated CVR Act, LBK nr. 246 of 5 February 2026). As in the other markets, the register holds the company's own filing.

Individuals

The Civil Registration System (CPR) holds identity and address data. Access for private parties is restricted. CPR numbers of persons registered in CVR are not disclosed to private parties (European e-Justice Portal).

Electronic identity

Under the Act on MitID and NemLog-in, MitID provides identification and authentication. Digital signing is a separate NemLog-in service, and business user administration (MitID Erhverv) is also part of NemLog-in. Private service providers connect to MitID through a broker.

PEP and sanctions

Finanstilsynet publishes a list of named domestic PEPs. It includes name, position and date of birth. Bodies employing PEPs must report them, and the list is revised within two working days of a report. Former PEPs remain on a separate list for up to 12 months (Executive Order no. 658 of 30 May 2023). The list does not cover family members, close associates or foreign PEPs, so screening still needs other sources.

Denmark's official list of qualifying functions forms part of the EU's consolidated list (C/2023/724). EU restrictive measures apply directly.

Ongoing monitoring

No registry generated change alert for CVR was identified. Machine readable access to current data supports monitoring through regular queries.

Pending changes

•         AMLR application from 10 July 2027, including the 25% or more ownership test.

Finland

Finland has free open company data and historical beneficial owner information for authorised users, but no central shareholder register for unlisted companies and no documented direct UBO API. In 2026 PRH introduced a new Beneficial Ownership Information Service as the access channel for authorised users.

Company registry

The Finnish Patent and Registration Office (PRH) keeps the Trade Register. The Business Information System (YTJ) is run jointly with the Tax Administration, and the identifier is the Business ID (Y-tunnus). Trade Register information is public, except beneficial owner data (PRH).

There are three layers of access:

•         Free open data. PRH open data provides basic company details from YTJ, information on registered Trade Register filings since 7 November 2014, and data from digital financial statements, updated once a day. Sole traders are excluded (PRH).

•         Free Virre services. The Virre Information Service offers basic company details and electronic Trade Register extracts free of charge. Board members, the managing director and representation rights recorded in the Trade Register appear in those extracts, and Virre can also show a named person's roles across companies.

•         Paid services. Documents such as financial statements, translated extracts and articles of association are paid. Frequent or high volume users can become Virre contract clients or use PRH's contractual interfaces.

The free open data API should not be assumed to contain all the role and representation data shown in extracts.

Legal ownership and shareholders

No central authority register of shareholders in unlisted Finnish limited companies was identified. The shareholder register (osakasluettelo) is kept by the company itself, so current ownership and percentages are not generally available from an authoritative register.

Beneficial ownership

Legal definition. Under the AML Act (444/2017), beneficial owners include natural persons who directly or indirectly own more than 25% of the shares or hold more than 25% of the votes, or who otherwise exercise control. PRH states that holding exactly 25% does not meet the numerical criterion; the threshold is 25.01% (PRH). This changes when AMLR's 25% or more test applies from 10 July 2027.

What the register gives you. Filings include name, Finnish personal identity code or date of birth, citizenship, country and municipality of residence, and the basis and extent of ownership or control (PRH). Listed companies and mutual real estate companies are not required to file. PRH sent reminder letters in 2026 to companies whose data is missing, which signals coverage gaps (PRH). The entries are the entities' own filings. Banks and other financial firms must notify PRH if a customer's information differs from the register (PRH).

Access was already restricted; what changed in 2026 is the channel. Finnish beneficial owner data has not been generally public. Data other than a company's own extract and a beneficial owner's own data is released only for a purpose under the AML Act (PRH). In 2026 PRH opened a new Beneficial Ownership Information Service for authorised users, including:

•         members of the Finnish Bar Association and auditors in PRH's auditor register;

•         persons authorised by banks and financial firms supervised by FIN-FSA, through Suomi.fi mandates;

•         persons authorised by AML supervisory authorities; and

•         real estate agents authorised by a registered brokerage.

The service provides company and person extracts, including previously valid beneficial owner data, as PDF and CSV files (PRH). Data is paid for users other than authorities. PRH has not documented a direct API for obliged entities.

Individuals

The Population Information System is kept by the Digital and Population Data Services Agency (DVV). Access for private parties is restricted and limited to stated purposes.

Electronic identity

Finnish online banking credentials and mobile certificates are used for strong authentication, including through Suomi.fi e-Identification, which PRH uses for its beneficial owner service (PRH). Suomi.fi mandates let a person prove that they may act on behalf of a company.

PEP and sanctions

The PEP definition is in the AML Act. Finland's official list of qualifying functions forms part of the EU's consolidated list (C/2023/724). No official list of named Finnish PEPs was identified. EU restrictive measures apply directly.

Ongoing monitoring

Pending changes

•         AMLR application from 10 July 2027, including the 25% or more test.

What this means for automated KYC

Company identification can be automated from authoritative sources in all four markets. Ownership and UBO determination are less straightforward. In every market there are cases where the official registers are not enough on their own, so registry data has to be combined with customer evidence and human assessment. The table below shows what the official data can support and where input from the customer or a reviewer is still needed.

A UBO register entry is evidence, not an independent legal determination. Every Nordic register stores information filed by the entity itself. Denmark's register authority, for example, registers information as filed and does not check its accuracy (European e-Justice Portal). The obliged entity remains responsible for understanding the ownership and control structure and for taking reasonable measures to verify the beneficial owner. A register entry that does not match the ownership chain should be treated as a discrepancy, not as confirmation. In Norway, discrepancy notes are visible to obliged entities through the register API.

PEP screening involves two separate questions: which positions qualify, and who actually holds those positions. All four markets now have an official answer to the first question. Norway has its regulation of 1 October 2026, while Sweden, Denmark and Finland are covered by the EU's consolidated list of functions. Denmark is the only one of the four that also publishes an official list of named domestic PEPs. Elsewhere, a PEP match comes from the screening provider and should be traceable back to the underlying official function.

The same distinction matters for monitoring. In Norway, update endpoints in the open API make changes to company and role data directly detectable. Sweden provides change notifications through its paid API. Denmark and Finland support monitoring through regular checks of current register data. Ownership and UBO changes in Sweden and Finland may still only come to light when the customer submits a new declaration, provides a document, or an entitled user checks the register again.

Key differences across the Nordics

Seven differences change how a KYC process has to be built:

1.       Legal ownership source. Denmark has a public register of owners from 5%, and Norway an annual public snapshot of all shareholders. Sweden and Finland have no central source identified, so ownership evidence must come from the customer.

2.       Ownership precision. Danish holdings are registered in threshold bands, and Norwegian data shows holdings as at 31 December. Neither gives a current, exact percentage for automated threshold tests.

3.       UBO legal test. Norway applies ownership and voting criteria, a right to appoint or remove more than half the board and other control. Sweden presumes control above 25% of total votes, a right to appoint or remove more than half the board or equivalent control by agreement. Denmark treats more than 25% as an indicator, with actual overall control decisive. Finland applies more than 25% of shares or votes, or other control, and exactly 25% does not qualify. Sweden, Denmark and Finland move to AMLR's 25% or more test on 10 July 2027; Norway's timing depends on EEA incorporation.

4.       UBO access route. Norway offers APIs via Maskinporten for authorised groups. Sweden offers an API through Bolagsverket for entitled users under agreement. Denmark offers MitID lookups with a declaration, or an API. Finland offers a paid web service with PDF and CSV extracts via Suomi.fi mandates. Each needs separate onboarding.

5.       PEP data. All four have official lists of qualifying functions. Only Denmark publishes official named domestic PEPs.

6.       Sanctions. Norway screens against Norwegian regulations that implement UN sanctions and the EU measures Norway joins, with timing that can differ from the EU. Sweden, Denmark and Finland apply EU restrictive measures directly.

7.       Company change detection. Norway has open update endpoints, and Sweden paid change notifications. Denmark and Finland rely on regular queries of current data; Finland's open dataset updates daily.

Glossary of local terms

Registers are the starting point, not the whole KYC record.

Where authoritative registry data exists, it can be retrieved directly and used to pre-populate the information held on the entity. The entity can then confirm that information, correct anything that has changed and provide the details that no authoritative register contains. That confirmation becomes part of the evidence trail alongside the original registry data and any supporting documents.

In practice, a robust KYC process therefore combines authoritative external data with information confirmed directly by the entity. Where the two differ, the discrepancy should be reviewed rather than one source simply overriding the other.

About IQON

IQON is a Nordic KYC and AML platform. It connects registry, identity and screening data with KYC workflows, ongoing monitoring and compliance evidence.

IQON integrates directly with government sources in Norway, Sweden and Denmark. Where direct access is not available or practical, it uses selected regional data partners and adds direct connections where they improve coverage or reliability.

IQON uses authoritative registry data to pre-populate the KYC record, then asks the customer to confirm or supplement it. If the customer’s declaration differs from the registry data, the discrepancy can be routed for review and retained as part of the compliance evidence.

Sources

All sources were consulted for the 9 October 2026 edition. Primary sources are used throughout; the only press release distribution page used is Bolagsverket's own release on the 2023 access change.

EU and EEA

•         Regulation (EU) 2024/1624 (AML Regulation), including Articles 43, 52, 62 and 63: EUR-Lex

•         Prominent public functions at national level, international organisations and EU institutions (C/2023/724): EUR-Lex

•         Prominent public functions in EU institutions and bodies (C/2023/611): EUR-Lex

•         Joined cases C‑37/20 and C‑601/20, WM and Sovim: Court of Justice of the EU

•         Prop. 2025/26:129, disclosure of data from the register of beneficial owners (AMLD6 access rules, BORIS): Swedish Government

•         EEA memo on Regulation (EU) 2024/1624: Norwegian Government

•         Norges Bank response on Norwegian implementation of the EU AML package: Norges Bank

Norway: company and ownership data

•         Enhetsregisteret open data API documentation: Brønnøysundregistrene

•         Central Coordinating Register for Legal Entities dataset and licence: data.norge.no

•         New register Acts from 1 January 2026: Brønnøysundregistrene

•         The Shareholder Register: Brønnøysundregistrene

•         Aksjonærregisteret: Skatteetaten

•         2027 budget: proposed continuously updated shareholder register: Norwegian Government

Norway: beneficial ownership, individuals, eID, PEP and sanctions

•         AML Act section 14: Lovdata

•         Regulation to the Register of Beneficial Owners Act: Norwegian Government

•         Register of Beneficial Owners opened, 1 October 2024: Norwegian Government

•         Register of Beneficial Owners API: endpoints and access by scope: Brønnøysundregistrene

•         Folkeregisteret entitlement packages: Skatteetaten

•         Folkeregister handbook, disclosure of confidential data: Skatteetaten

•         Agreement on personal BankID: BankID

•         Regulation on positions and functions conferring PEP status (1 October 2026): Ministry of Finance

•         Announcement of the PEP regulation: Ministry of Finance

•         Financial sanctions: guidance on freezing provisions: Norwegian Government

•         New Russia sanctions implemented in Norwegian law: Ministry of Foreign Affairs

Sweden

•         API for high-value datasets: Bolagsverket

•         Launch of free high-value datasets, 3 February 2025: Bolagsverket

•         High-value datasets: basic company information: Statistics Sweden

•         New information and change notifications in the company information API: Bolagsverket

•         Act 2017:631 on the registration of beneficial owners: Riksdagen

•         Obtaining beneficial owner information (access categories and options): Bolagsverket

•         Agreement for company information via API: Bolagsverket

•         First step in implementing the new EU AML framework (July 2026): Bolagsverket

•         Purpose declaration required for beneficial owner searches (February 2023): Bolagsverket press release

•         Act 2026:1358 on state e-identification: Riksdagen

•         Sverige-id: Swedish Police Authority

Denmark

•         Getting started with CVR Elasticsearch: Erhvervsstyrelsen

•         Business registers in Denmark: European e-Justice Portal

•         The Public Register of Owners: virk.dk

•         Minister's answer on owner registration thresholds and beneficial owners: Folketinget

•         Guidance on beneficial owners: Erhvervsstyrelsen

•         Access to beneficial owner information restricted from 1 September 2025: Erhvervsstyrelsen

•         Consolidated CVR Act (LBK nr. 246 of 5 February 2026): Retsinformation

•         Act on MitID and NemLog-in: Retsinformation

•         Executive Order on reporting and publication of domestic PEPs (no. 658 of 30 May 2023): Retsinformation

Finland

•         Trade Register extracts and information services: PRH

•         Virre Information Service: PRH

•         PRH open data: YTJ

•         Registered filings added to open data: PRH

•         FAQ for companies on beneficial owner filings: PRH

•         Beneficial owner extract and authorised users: PRH

•         Financial sector access to the Beneficial Ownership Information Service (August 2026): PRH

•         Download your company's beneficial owner extract (February 2026): PRH

•         Reminder letters on missing beneficial owner data (July 2026): PRH