Short answer
Six entries in the available Latvijas Banka sanctions register are especially relevant. Artex SIA, AHOI SIA and SIA VIAL were sanctioned for customer-due-diligence weaknesses; HELP SIA received both a fine and a compliance order addressing due diligence for several similar consecutive transactions; Reģionālā investīciju banka AS was fined for AML/terrorist-financing violations and internal-control shortcomings; and Paysera LT was warned about controls connected with payment services through Latvian agents.
Together they point to a control chain: assess institutional risk, translate it into written internal procedures, conduct event-sensitive customer due diligence, monitor transactions, oversee agents and train staff. But the available documents are public-register summaries, not full reasoned decisions. They disclose the sanctioned party, date, breach category and sanction—sometimes a specific remedial requirement—but usually not the underlying customer files, transaction facts or proportionality analysis. Any lesson must stay within that evidentiary limit.
The HELP entry offers the clearest concrete transaction-pattern trigger in the collection.
The six most relevant register entries
The monetary amounts should not be read as a tariff for particular defects. The summaries do not expose all aggravating, mitigating, duration, turnover, cooperation or remediation factors that could explain the different outcomes.
HELP SIA: the most specific due-diligence trigger
The is the most operationally specific. On 16 November 2022, Latvijas Banka recorded a EUR 3,000 fine and a compliance order for customer-due-diligence deficiencies.
The order required compliance with Section 11(1)(2)(c) of the AML/CFT/proliferation-financing law, paragraph 18 of Latvijas Banka Regulation No 176 and paragraph 5.1.2 of chapter 5 of the firm's internal-control-system document when several similar consecutive transactions are completed. It also required internal-control procedures to be improved.
Obligation to comply [..] during customer due diligence, when several similar consecutive transactions are completed, obligation to improve internal control procedures.
—
The important compliance lesson is not that one universal number of transactions automatically triggers enhanced due diligence. The register does not say that. It shows that transaction patterns must activate the firm's own risk-based procedures and legally required CDD controls. Repetition and similarity cannot be assessed as isolated transactions merely because each transaction, viewed alone, appears ordinary.
Artex SIA: weakness across the control lifecycle
The records a EUR 500 fine on 18 May 2022. Its breach label spans deficiencies in risk assessment, the internal-control-system document, customer due diligence, customer-transaction supervision and employee training.
deficiencies in risk assessment and in the ICS document, in customer due diligence, in the supervision of customer transactions, and in employee training
—
This is broader than an isolated missing identity document. The listed areas run from design through execution and assurance. An enterprise risk assessment should shape the written ICS; the ICS should direct customer onboarding and event-driven review; monitoring should test actual activity; and training should equip personnel to respond. If these layers are disconnected, a formally documented policy can coexist with ineffective operations.
The summary does not disclose which customers, transactions or training records failed. It supports a lifecycle lesson, not a reconstructed case narrative.
AHOI and VIAL: concise CDD findings with different sanctions
The 29 June 2022 AHOI SIA entry records a warning for deficiencies in risk assessment and CDD. The 27 September 2022 SIA VIAL entry records a EUR 2,500 fine for CDD deficiencies. Both are concise register labels.
They confirm that CDD is not merely onboarding identification. Because AHOI couples due diligence with risk assessment, an institution should be able to show how customer risk is determined and how the rating controls verification depth, beneficial-owner work, source-of-funds or wealth inquiries where relevant, monitoring sensitivity, and review frequency.
The summaries do not permit a reliable claim about why one party received a warning and the other a fine. The difference could reflect facts not published in the register entry. A compliance benchmark should therefore focus on control expectations, not assume sanction equivalence.
Reģionālā investīciju banka: system-level shortcomings
The record a EUR 259,867 fine on 12 December 2023 for violations of regulatory AML/terrorist-financing requirements and shortcomings in the internal-control system.
The label is system-level, but the indexed register summary does not enumerate the affected customer categories, governance decisions or monitoring scenarios. It supports the proposition that internal-control effectiveness is itself an enforcement object. It does not support guessing which particular controls failed.
For governance, the practical question is whether the institution can demonstrate a closed loop: board-approved risk appetite, risk assessment, operational policies, monitoring results, escalation, management information, independent testing, and tracked remediation. A control should have an owner, evidence of operation, an exception route and a way to test effectiveness.
Paysera LT: agent-based services remain within the control perimeter
The records a warning on 25 June 2025 for internal-control deficiencies and violations of AML/CFT/proliferation-financing requirements connected with payment services in Latvia through agents.
The summary makes the distribution channel material. Using agents does not make the regulated control obligation disappear. An agent-control framework should cover appointment due diligence, role and territory limits, training, access rights, transaction-monitoring integration, escalation, quality testing, record availability and termination.
Again, the register does not provide the specific agent files or control failures. The defensible lesson is the scope of responsibility, not an invented account of what individual agents did.
What institutions should test
The entries support a focused internal audit programme:
- Does the enterprise risk assessment reflect customer, product, geography, channel and transaction risks?
- Do written ICS procedures translate those risks into concrete CDD and monitoring steps?
- Do similar consecutive transactions trigger aggregation and review rather than isolated treatment?
- Can the institution evidence beneficial-owner verification, purpose, expected activity and ongoing updates?
- Do monitoring alerts lead to documented investigation, escalation and disposition?
- Are agents subject to the same effective data, monitoring and governance perimeter?
- Is training role-specific, tested and refreshed after control changes?
- Are findings assigned, time-bound, independently validated and reported to management?
The audit should test actual cases, not only policy wording. The HELP entry is especially useful for scenario testing because it connects a transaction pattern to due-diligence action and procedure remediation.
What the register cannot establish
Every selected Legalcode record is expressly labelled PUBLIC_REGISTER_SUMMARY and Full decision available: No. The summaries cannot establish the regulator's full evidentiary record, the institution's submissions, all legal provisions applied, the penalty methodology, or whether particular weaknesses were isolated or systemic beyond the published wording.
That limit matters when comparing institutions. It is appropriate to say that the register identifies a CDD deficiency. It is not appropriate to state the hidden cause, duration or customer impact unless a separate official document supports it.
MCP source-quality finding
The production MCP now exposes the 31 LV_BANK_SANCTIONS items as structured agency decisions and accurately identifies these six records as register summaries without full decisions. Sanction type, amount, outcome, legal basis and remedies are available where the register supplies them, confirming that the earlier defects in closed issue #308 have been materially repaired.
One new response defect was found. When adaptive minimum-should-match retrieval was used for an agency_decision query, the diagnostic message incorrectly said “Case-law BM25.” This source-family mislabel is now tracked in .
Conclusion
The sanctions summaries identify recurring failures in risk assessment, written internal controls, customer due diligence, transaction monitoring, agent oversight and training. HELP gives the clearest operational example: similar consecutive transactions must activate applicable CDD and internal procedures. Artex shows how weaknesses can span the entire control lifecycle; Paysera confirms that agent-based services remain inside the regulated perimeter. Because the records are summaries rather than full decisions, they are best used as control-testing signals, not as substitutes for complete enforcement reasoning.
Sources
This article provides general legal information, not advice for a specific matter. Laws, facts and procedural deadlines may change the result. Follow the linked primary sources and obtain local advice before acting.