- Argentina
- Australia
- Austria
- Bangladesh
- Belgium
- Brazil
- Bulgaria
- Cambodia
- Canada
- Chile
- China
- Colombia
- Croatia
- Cyprus
- Czech Republic
- Denmark
- Egypt
- Estonia
- Eswatini
- Ethiopia
- Finland
- France
- Germany
- Greece
- Haiti
- Hong Kong
- Hungary
- India
- Iraq
- Ireland
- Indonesia
- Italy
- Japan
- Jordan
- Kazakhstan
- Kenya
- Kosovo
- Kuwait
- Latvia
- Lithuania
- Luxembourg
- Malaysia
- Malta
- Mauritius
- Mexico
- Micronesia
- Moldova
- Mongolia
- Montenegro
- Morocco
- Mozambique
- Myanmar
- Namibia
- Nauru
- Nepal
- Nigeria
- Nicaragua
- Niue
- Norway
- Netherlands
- New Zealand
- Oman
- Pakistan
- Palau
- Palestine
- Panama
- Papua New Guinea
- Paraguay
- Peru
- Puerto Rico
- Philippines
- Portugal
- Poland
- Qatar
- Republic of Congo
- Romania
- Russia
- Rwanda
- Samoa
- San Marino
- Senegal
- Serbia
- Seychelles
- Sierra Leone
- Singapore
- Slovakia
- Slovenia
- Somalia
- South Africa
- South Korea
- South Sudan
- Spain
- Sri Lanka
- St Kitts and Nevis
- St Maarten
- St Lucia
- Sweden
- Switzerland `
- Syria
- Taiwan
- Tajikistan
- Tanzania
- Thailand
- Timor Leste
- Togo
- Tonga
- Trinidad and Tobago
- Turkey
- Turks and Caicos
- Turkmenistan
- Tunisia
- Tuvalu
- UAE
- Uganda
- Ukraine
- UK
- USA
- Vietnam
SWEDEN KYC, KYB AND AML
Scale Identity Verification and KYC Operations in Sweden
Verify Swedish customers and businesses through Sweden's notified eIDs, NFC, QES, identity documents, biometrics and KYB. Cut manual review, keep consistent audit evidence and run one connected workflow designed to support penningtvättslagen today and AMLR from 10 July 2027.
Operational Performance for Sweden KYC
Our Numbers Speak Volumes
82.55%
First-pass
verification rate
< 10 sec
Median
verification time
5+
Swedish ID methods
supported
Sweden IDV/KYC Challenges
The eID Everyone Uses Is a Bank Product
BankID needs a Swedish personnummer and a relationship with an issuing bank, so new arrivals, samordningsnummer holders and cross-border customers cannot reach the route most Swedish onboarding is built around. Sverige-id will give folkbokförda residents without Swedish citizenship a route that needs no bank relationship. Under 1 kap. 8-9 §§ of Lag (2026:1358) it does not reach samordningsnummer holders, so the document and chip routes still carry them.
Swedish Names Lose Their Accents in the Chip
The machine-readable zone holds no å, ä or ö, so a customer recorded as Öberg or Änggård reaches screening under a different spelling to the one on file.
The Ownership Register Is No Longer an Open Lookup
Bolagsverket closed the registret över verkliga huvudmän in February 2023, and since 1 July 2026 SFS 2026:316 puts access on a legitimate-interest test. Open search is gone; 3 kap. 5 § lagen (2017:631) makes you report mismatches.
Address Is a Register Lookup, Not a Document
Swedish onboarding reads the population register through SPAR rather than collecting utility bills, so customers outside folkbokföring have no register address and fall straight into manual review.
Regulatory Update
What AMLR Changes for Identity Verification in Sweden
The EU Anti-Money Laundering Regulation (EU) 2024/1624 applies directly in Sweden from 10 July 2027, with no transposition period. It sets the due diligence rules penningtvättslagen operates under. AMLA, the new EU-level supervisor, is established in Frankfurt.
Timeline
- End of 2026 EU Digital Identity Wallet issuance target
- 1 December 2026 Sverige-id, the state e-legitimation under Lag (2026:1358), issued by Polismyndigheten at assurance level high
- 10 July 2027 AMLR applies, no transposition
- December 2027 (derived) Private relying parties using strong user authentication, micro and small enterprises excluded, must accept EU wallets on user request. eIDAS 2.0 Article 5f(2).
- 2028 AMLA direct supervision begins
eIDAS Becomes an Explicit Route
Article 22(6) gives two equal means. Chapter 3 Section 7 of penningtvättslagen points to eIDAS, so BankID and Freja stay usable, and documents with reliable independent sources under Article 22(6)(a) stay valid. Record the route you use.
The Ownership Test Tightens
AMLR keeps the ownership limb at 25% or more under Article 52, the line penningtvättslagen already applies, and Articles 51 to 54 add a control test that can bite below any percentage. Article 52(2) lets the Commission cut the line to at most 15% for higher-risk categories.
Existing Customers Get Re-Checked
AMLR expects existing customer records to be brought up to standard on a risk basis, not just new onboarding. Continuous monitoring keeps back-book files current between reviews.
Accountability Stays With You
Chapter 3 Section 21 of penningtvättslagen already makes you answerable for due diligence others carry out, and AMLR Article 18 holds that line for outsourcing from 2027.
FOR FINANSINSPEKTIONEN-SUPERVISED BUSINESSES
Streamline Finansinspektionen-Supervised Onboarding in Sweden
Connect identity verification, QES, Penny Drop and compliance evidence in one configurable workflow for businesses operating within Finansinspektionen's supervisory remit. Reduce customer drop-off and manual handovers while giving compliance teams a consistent, review-ready record of every decision.
1. Verify the customer
Verify identity using the configured route, such as Sweden's notified eIDs, NFC chip reading or document and biometric checks.
2. Complete qualified signing
Apply and validate the QES within the same journey, keeping the signed document, verification result and supporting evidence together.
3. Confirm the payment account (optional)
Optional, where your risk policy calls for it: Penny Drop confirms the payment account belongs to the customer. Swedish law sets no payment-account identification route. The register route in Chapter 3 Section 5 of FFFS 2017:11 closes with a confirmation to the folkbokföring address or a certified copy of an identity document.
Shufti's IDV/KYC Solutions for Sweden
KYC Solutions
Onboarding designed to support penningtvättslagen for Swedish customers, with age and address checked in the same flow as identity, in seconds.
Explore MoreIdentity Verification
Shufti confirms every customer is real and present, not a spoofed or synthetic identity. Biometric face matching and liveness detection run against 10,000+ actively processed document types.
.Face Verification
Face verification binds the live person to the document. iBeta confirmed Level 3 PAD conformance to ISO/IEC 30107-3 for the Shufti SDK on 24 April 2026.
.Age Verification
Selfie-based age estimation combined with a document verification fallback where required for regulated sectors, including operators licensed by Spelinspektionen under the Swedish Gambling Act.
.Address Verification
Shufti verifies Swedish address-bearing documents, including utility invoices, telecom bills and bank statements from major Swedish issuers. Proof-of-address checks remain common in regulated onboarding.
.Document Verification
Verification of the Swedish passport, national identity card and driving licence, with NFC chip reading where the document carries a chip and Swedish-language OCR. AMLR Article 22(6)(a) permits it.
.KYB Solutions
Shufti checks a business as deeply as the people behind it, supporting risk-based CDD under penningtvättslagen. Shufti checks registry records, beneficial ownership, and VAT details in real time, then screens UBOs against 4,000+ global watchlists for sanctions and adverse media exposure.
Explore MoreBusiness Verification
Automated validation of Bolagsverket data, the organisationsnummer, the Swedish VAT number and F-tax approval. Reduces manual registry lookups and delays.
.Enhanced Due Diligence (EDD)
Structured risk profiling for complex ownership chains, cross-border entities and high-risk sectors, designed to support the risk-based obligations in penningtvättslagen.
.AML Screening
Shufti screens customers and transactions in 240+ countries and territories, flagging sanctions, PEP, and adverse media matches as they happen. Ongoing monitoring surfaces suspicious activity in time to meet local reporting obligations.
Explore More
AI Compliance Copilot
Helps compliance teams review verification and AML data, investigate alerts, and understand the reasoning behind risk signals. It brings relevant case information together to support faster, more consistent compliance decisions.
.
Transaction Monitoring
Ongoing transaction monitoring calibrated to Swedish payment flows flags anomalies against AML rules, supporting the controls Finansinspektionen expects and goAML reporting.
.Supported Verification Methods for Sweden
Every Verification Route Sweden Uses, in One Platform
Shufti supports the full range of remote verification routes used in Sweden, from the EUDI Wallet and the notified eIDs to document and biometric checks. Each method below shows what is live today and what is ready for the 2027 rollout. Sweden codifies no attended video identification regime, so remote verification runs through electronic identification means, chip reading, and document and biometric checks.
EUDI Wallet
Wallet-ready · from 2027AMLR Article 22(6)(b) points to eIDAS identification at substantial or high. DIGG plans an e-legitimation and test environment in December 2026 and a certified EU wallet by 2029. Shufti accepts wallets as they go live.
Notified eID
Live · eIDAS SubstantialSweden's notified scheme is Swedish eID (Svensk e-legitimation), and its notified means are BankID and Freja eID Plus, both at eIDAS assurance level substantial. Shufti verifies them via Mobile BankID and the Freja app. Sverige-id opens for applications on 1 December 2026.
Docless Database eIDV
LiveA database check against Swedish government, telecom, credit and utility data confirms identity in seconds for low-risk onboarding, with no document upload. Shufti confirms sources at scoping and escalates as risk rises.
NFC Chip Verification
LiveShufti reads the facial image from the contactless chip in the Swedish passport and national identity card. This is the high-assurance capture route where an eID is not available.
Document and Face Biometric
LivePermitted by AMLR Article 22(6)(a). Document authentication of the Swedish passport, national identity card and driving licence, paired with liveness at iBeta-confirmed PAD Level 3.
Qualified Electronic Signature
LiveShufti runs eIDAS-qualified signing powered by Evrotrust, an EU qualified trust service provider, producing PAdES-LTV signatures. Sweden is one of the ten notified eIDs supported for the signing flow, so the signing identity check runs through the Swedish eID.
Independent Validation
Shufti's Recognition Across Independent Evaluations

Ranked Exceptional in the Liminal Index 2026 for age estimation
View Report
Differentiated by Gartner on document diversity and country coverage
Read more
Certified at iBeta Level 3 PAD with 0% APCER
Read Blog
Broadest global reach in the 2025 KuppingerCole Extended IDV report
Download Report
Ranked Top 5 in the DHS RIVR 2025 for identity validation
Read Blog
Top Vendor for Product Execution in the Liminal Index for KYC 2026
View Report
Ranked Exceptional for age verification by Liminal Index 2026
View Report
Recognised as a Leader in G2 Fall 2026 reports
Read MoreEvidence-Ready Checks Across People & Businesses
Verifications with robust evidentiary support
Individual Documents We Verify
Shufti verifies 22+ Swedish document types.
View All Supported DocumentsSwedish Passport
Biometric travel document from Polismyndigheten under passlagen (1978:302). Its chip stores the facial image, so Shufti reads it over NFC at onboarding.
Swedish National Identity Card
Card issued by Polismyndigheten under förordning (2005:661). Its contactless chip meets the EU secure identity card rules, so Shufti reads and matches it.
Swedish Driving Licence
Photocard from Transportstyrelsen, named as an acceptable identity document in FFFS 2017:11. It has no chip, so Shufti checks the document and the face.
Personal Identity Number (Personnummer)
Lifelong identifier Skatteverket assigns to everyone in the population register. Shufti uses it to reconcile identity and address data across registers.
Coordination Number (Samordningsnummer)
Identifier Skatteverket issues to people not in the population register. Shufti records its identity level, because that level governs how much it carries.
Entity Identity
Certificate of Registration (Registreringsbevis)
Extract from Bolagsverket confirming the registered name, organisationsnummer, address and signatory powers. Shufti verifies it as the KYB anchor record.
Articles of Association (Bolagsordning)
Constitutional document filed with Bolagsverket covering the company name, objects, share capital and financial year. Shufti reconciles it with ownership.
Annual Reports
Financial statements filed with Bolagsverket showing turnover, results, assets and liabilities. Shufti uses them to size a business for due diligence.
Tax Identity
Swedish Corporate Identification Number (Organisationsnummer)
Ten-digit identifier assigned under lagen (1974:174), the last digit a check digit. Shufti validates it and matches it to the Bolagsverket record.
VAT Registration Number
Swedish VAT number built from the country code, the organisationsnummer and a trailing 01. Shufti checks it against VIES and confirms F-tax approval.
Ownership & Control (UBO)
UBO Register Entry from Bolagsverket
Entry in the registret över verkliga huvudmän under lagen (2017:631), naming anyone holding 25% or more. AMLR applies the same test from 10 July 2027.
Articles of Association and Shareholder Register
Company records mapping shareholdings and control to named people. Shufti reconciles them with the register and flags a mismatch so it can be reported.
Languages We Cover
Swedish Latin-Script Document Handling
Swedish adds å, ä and ö to the Latin alphabet. Shufti covers 150+ languages and keeps the accented forms intact, with quality gates so poor captures never reach a decision.
Name Matching With Swedish Characters And Diacritics
The machine-readable zone stores names without accents, so matching reconciles the stripped and accented spellings and preserves both values in the audit trail for later review.
Evidence Consistency Across KYC and KYB Steps
Document checks, face verification and screening outputs sit in one case record, so a Finansinspektionen or Finanspolisen request is answered from one pack.
Governance & Controls
Audit-Ready Decisions, Lower Operational Drag
Fewer avoidable re-submissions
Capture tuned to Swedish document designs, plus NFC reading of the passport and identity card, cuts avoidable re-submissions.
Cleaner audit trails
Structured logs aligned to Chapter 5 of penningtvättslagen and to Finanspolisen reporting keep every decision audit-ready.
Better name matching outcomes
Matching handles å, ä and ö plus the accent-stripped chip spelling, so false positives on Swedish names stay low in screening.
One workflow, one back office
KYC, KYB and AML screening are consolidated in one operational case view, so one back office team works on every customer file.
National ID-first flow design
Flows lead with BankID and Freja for residents, then fall back to the Swedish passport, identity card and foreign documents.
Continuous Compliance
Compliance that does not stop at onboarding
AMLR treats customer due diligence as a continuing obligation. Perpetual monitoring keeps the customer picture current between reviews, so risk is caught when it appears, not at the next annual check.
Surface Changes as it happens
DetectPerpetual monitoring flags risk when it appears, not at the next annual review. Behavioural biometrics, background fraud signals, and ongoing sanctions and PEP screening watch every active relationship.
Step up when the signal fires
VerifyWhen a signal fires, re-verification confirms the person or the ownership change using the same live methods above, so a flag turns into a resolved decision.
Keep the file audit-ready
ComplyEvery check and decision is logged to the Chapter 5 standard in penningtvättslagen, so the file is organised and retrievable for supervisory review.
Perpetual KYC
pKYCKeeps individual customer risk current with behavioural biometrics, background fraud signals and ongoing AML screening, so back-book records stay standard-ready.
Perpetual KYB
pKYBMonitors the registret över verkliga huvudmän and the Bolagsverket company record for shareholding and control changes, so a shift past the 25% or more threshold is caught between reviews.
Built To Fit Sweden's Compliance Landscape
Finansinspektionen (FI)
Sweden's financial supervisory authority over banks, payment institutions, investment firms, insurers and crypto-asset providers for AML. Shufti evidences due diligence steps and holds the audit trail FI reviews.
Swedish Financial Intelligence Unit (Finanspolisen)
Sweden's FIU inside Polismyndigheten, taking reports under Chapter 4 Section 3 of penningtvättslagen via goAML. Shufti keeps evidence audit-ready.
Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY)
Sweden's data protection authority, enforcing the GDPR and the Swedish data protection act (2018:218). Shufti supports data minimisation and EU hosting.
Swedish Companies Registration Office (Bolagsverket)
Keeps the company registers and the registret över verkliga huvudmän under lagen (2017:631), where access has been restricted to a legitimate-interest basis since 1 July 2026. Shufti captures UBO data, screens controlling persons and flags any mismatch so it can be reported.
Swedish Tax Agency (Skatteverket)
Runs the population register, assigns the personnummer and samordningsnummer, and operates SPAR. Shufti structures KYB evidence around these identifiers.
Swedish Economic Crime Authority (Ekobrottsmyndigheten)
Prosecution authority investigating money laundering, accounting fraud, tax offences and financial market crime. Shufti supports risk-based re-verification at the moment of suspicion with investigation-grade evidence.
AMLA (EU Anti-Money Laundering Authority)
The new EU-level supervisor has been established in Frankfurt since July 2025. It begins direct supervision of selected high-risk cross-border entities from 2028 and shapes the technical standards under AMLR.
Deployment Option
Cloud in EU and Swedish regions, including Stockholm, or on-premise, hosts Swedish customer data in-region and supports GDPR accountability.
Regulatory Alignment
Aligned with the due diligence, beneficial ownership and record-keeping duties in penningtvättslagen, with GDPR and the Swedish data protection act (2018:218), and with AMLR from July 2027.
Retention Controls
Chapter 5 Section 3 of penningtvättslagen sets a five-year retention period, counted from the transaction or the end of the relationship. Chapter 5 Section 4 allows longer where it is needed, capped at ten years in total.
Encryption & Security
Encryption in transit and at rest, with access controls and audit logging, supports Article 32 GDPR and Swedish data protection duties, under ISO 27001 certification.
Scope of Our Role
Shufti acts as a data processor and provides verification technology, not legal advice. Responsibility for customer due diligence and for the choice of verification method remains with the obliged entity.
Biometric Processing
The lawful basis is set by the controller. Biometric data used for unique identification engages Article 9 GDPR, and human review is available in the workflow.
AI Act Position
Under the AI Act as amended by Regulation (EU) 2026/1744, Article 50 transparency duties apply from 2 August 2026 and Annex III high-risk duties from 2 December 2027.
Data and Privacy Controls in Sweden
Sweden AML Sources That Strengthen Decisions
We screen against 215+ sanction regimes, 4,000+ watchlists, 100,000+ adverse-media sources, and 6M+ PEPs across Sweden and globally. A few of them are:
Swedish Financial Supervisory Authority (Finansinspektionen)
Swedish Financial Intelligence Unit (Finanspolisen), Swedish Police Authority
Swedish Economic Crime Authority (Ekobrotts
Swedish Companies Registration Office (Bolagsverket)
County Administrative Boards (Länsstyrelserna)
Swedish Gambling Authority (Spelinspektionen)
Swedish Prosecution Authority (Åklagar
Swedish Tax Agency (Skatteverket)
Sveriges Riksbank
Act on Measures against Money Laundering and Terrorist Financing (2017:630)
Financial Action Task Force (FATF)
European Union Consolidated Financial Sanctions List (EU Sanctions Map)
European Banking Authority (EBA)
Anti-Money Laundering Authority (AMLA)
United Nations Security Council Consolidated Sanctions List
SEE SHUFTI IN YOUR SWEDEN WORKFLOW
Turn Sweden Verification Requirements into a Smoother Customer Journey
Share your customer types, risk rules and current onboarding process. A Shufti specialist will show you how to connect identity verification, KYB, QES, Penny Drop and ongoing monitoring, reducing operational hand-offs while keeping decision evidence organised for compliance review.
Frequently Asked Questions
Which identity documents can be used for KYC in Sweden?
Chapter 3 Section 2 of FFFS 2017:11 names the Swedish driving licence, the Swedish passport, an identity card issued by a Swedish authority and a Swedish certified identity card. Where a customer holds none of these, it takes a foreign passport or ID carrying a photograph and citizenship, issued by a competent authority.
How does Shufti support Finansinspektionen-supervised businesses in Sweden?
Shufti connects identity verification, KYB, AML screening, QES, account verification and decision evidence in one configurable workflow. Businesses within Finansinspektionen's supervisory remit cut manual hand-offs, standardise compliance records and prepare clearer evidence for internal audit and supervisory review.
What documents are required for KYB in Sweden?
Typically a registreringsbevis from Bolagsverket, the organisationsnummer, the Swedish VAT number and beneficial ownership details from the registret över verkliga huvudmän. Shufti verifies these in real time and screens the UBOs behind them against sanctions and PEP lists.
How are Swedish name variants and diacritics handled in screening?
Swedish adds å, ä and ö, and the machine-readable zone stores names without them, so one person can appear two ways. Matching reconciles both spellings and keeps them in the audit trail.
How long must AML records be retained in Sweden?
Five years. Chapter 5 Section 3 of penningtvättslagen counts from the transaction or the end of the relationship; Chapter 5 Section 4 permits up to ten years where needed, and sets no deletion duty. From 10 July 2027 AMLR Article 77 keeps five years and requires deletion at the end.
Is EU-region data hosting available for Swedish customer data?
Yes. Shufti offers EU-based cloud regions, including Stockholm, so Swedish data is hosted in-region. Onward access from outside the EEA runs on EU standard contractual clauses. On-premise is available.
What changes for Sweden under AMLR from July 2027?
AMLR applies directly, so no Swedish transposition law is needed for the core obligations. It makes eIDAS-recognised electronic identification and qualified trust services the primary routes for remote verification, keeps document plus biometric checks as a lawful fallback, and sets the beneficial ownership test at 25% or more.
Can BankID and Freja be used for remote KYC in Sweden?
Yes. Both are notified under Sweden's eIDAS scheme at assurance level substantial, BankID since December 2024 and Freja eID Plus since February 2022, and Chapter 3 Section 7 of penningtvättslagen permits eIDAS electronic identification means for remote identity checks.
How is a customer verified remotely in Sweden without an eID?
Chapter 3 Section 5 of FFFS 2017:11 sets out a register route. A firm collects the name, address and personnummer, checks them against external registers or equivalent documentation, then closes the loop with a confirmation to the registered or an equivalent reliable address, or with a certified copy of an identity document.
When will the EU Digital Identity Wallet be usable for onboarding in Sweden?
Under eIDAS 2.0, member states target wallet availability from the end of 2026, and private relying parties in scope must accept wallets after that. DIGG plans a first version of the Swedish state wallet in December 2026 and a certification-ready EU wallet from 2028. Shufti is built to accept wallet-based verification as it goes live.
Let’s Build Trust Into Your Business
1B+Verifications Processed
240+Regions Actively Processed
99.7%Accuracy Rate
Samer Al Tamimi
CEO of Safwa Bank
“We take our client’s privacy very seriously and always look for new innovative solutions to ensure a safe banking experience. Working with Shufti feels like a breath of fresh air, as their 100% in-house tech keeps our customer’s data free from vulnerabilities and fully safe and protected.”
Trusted. Compliant. Certified
Explore Shufti For Your Business
Get a personalised demo from our experts.
PROVEN PLAYBOOKS
Explore Practical KYC & AML Resources
10 July, 2026
Identity Verification in Europe: eIDAS 2.0 & EUDI Wallet
A practitioner's guide to verifying identity in Europe, covering eIDAS 2.0, the EUDI Wallet, docless eIDV and how to choose an eID provider for onboarding in the EU.
Product Guide





