Sweden

FI investigated AIFM Capital's conduct from 1 January 2021 to 13 September 2023 and found it did not follow its own rules for entering into delegation agreements and did not evaluate the delegated activities before signing. In monitoring delegated portfolio management it gave insufficient attention to whether unit-holders received an adequate return relative to the risk profile. The violations arose in its white-label fund hosting platform.

IMY found that Miljödata failed to implement adequate security measures for the personal data it processed after an August 2025 cyberattack in which data was published on the Darknet. The company says 2.2 million individuals were affected. IMY found inadequate checks when installing new software and no automated real-time intrusion monitoring.

The firm described its business well but its general risk assessment analysed threats and vulnerabilities weakly, so it could not properly perform customer risk assessments or tailor procedures. The board found the deficiencies not minor and present for 6 February 2025 to 6 February 2026, but only somewhat increasing the risk, with no mitigating or aggravating circumstances.

FI found that SSAB's consolidated financial statements for the 2022 financial year disclosed goodwill impairment in a way that fell short of the applicable requirements, and issued a caution (erinran). The page states no fine amount.

FI found that Ikano had not carried out a separate, comprehensive and realistic assessment of how its corporate-client products could be misused for terrorist financing, and had not considered authority information on money-laundering risks in the required manner. Ikano also did not apply the enhanced customer due diligence needed for high-risk customers. FI judged the violations not serious enough for withdrawal of authorisation or a warning.

The general risk assessment was very brief, with no product description, threat or vulnerability identification or justified risk levels, so the board treated the firm as having no adequate assessment from 1 March 2025 to 16 March 2026. A customer-risk template, produced after the period, had been reused for the firm's own assessment.

The general risk assessment was not tailored to the firm: its analysis of services, customer groups, industry, channel and geographic risks was generic and did not explain how conclusions were reached, so it could not support internal procedures. The board treated this as a breach that was not minor, covering 1 March 2025 to 13 March 2026, and found no mitigating or aggravating factors.

The board found the firm maintained business relationships without sufficient customer knowledge (a particularly serious breach), had a risk assessment that did not analyse misuse of its services, lacked a customer classification method and had too-general due diligence and monitoring routines. Some measures were taken only after the supervisory order. The breaches ran through the supervision period 1 September 2024 to 31 August 2025.

The board found business relationships were established without sufficient customer knowledge (a particularly serious breach), customer due diligence was usually done after the relationship began, and the risk assessment, customer classification and generic template routines were inadequate. Supervision period 1 September 2024 to 31 August 2025. The index marks the decision as appealed.

FI investigated Norion's customer due diligence for legal-entity customers. The bank did not take the measures needed to assess whether beneficial owners of medium- and high-risk customers were politically exposed persons, family members or known close colleagues, and did not apply enhanced due diligence, such as detailed information on business, finances or source of funds, to high-risk customers.

The board found the general risk assessment deficient in every area, leaving out the firm's cash handling, ignoring the distribution channels it actually uses and giving only very general guidance for customer risk profiles. Because of this the customer due diligence, monitoring, reporting and data-handling routines were also inadequate. The breaches were treated as serious and ran through 1 January 2025 to 20 March 2026, with turnover of about SEK 149 million in 2024.

Over the supervision period 1 August 2024 to 31 July 2025, the general risk assessment was too general, customer risk classification had no clear method, due diligence presumed some entities to be low risk, and monitoring routines did not explain how unusual transactions are detected. The board called the breaches serious and noted turnover of about SEK 14.6 million.

For the supervision year from 1 March 2024 the board found a general risk assessment that described services without analysing misuse risk, customer risk profiles without clear criteria, template-style due diligence, monitoring and record-keeping routines, and no workable internal control. It treated the breaches as serious and found no mitigating circumstances. The index marks the decision as appealed.

The risk assessment looked like a generic template with no concrete threats or tailoring, and it ignored the firm's heavy cash flows (about SEK 46 million received and 47 million paid out in cash over the period despite a stated plan to phase out cash). The sampled customer risk forms had no clear method and could not show that required checks were made, and the board also questioned that the AML officer who signed them was a customer of the firm in another business. The supervision period ran from 1 March 2024 to 9 September 2025 and the board cited the serious, long-lasting deficiencies and high cash volumes in setting the fee. The index marks the case as decided by a final court judgment (lagakraftvunnen dom); the judgment itself was not opened.

The firm used a generic template as its risk assessment, with no analysis of how its own services and customers could be misused; due diligence, monitoring, record-keeping and internal-control routines were unfilled standard forms. The board treated the deficiencies as serious through 1 April 2024 to 1 April 2025, with no mitigating circumstances.

The board described the general risk assessment as seriously deficient in its present form: risks were stated only generally, without threats, vulnerabilities or reasoning for the risk levels, and the business, customer and geographic descriptions were vague. Procedures mostly referred back to that assessment and the customer risk assessment method was flawed, so the sampled assessments could not be checked. The breaches were treated as serious and present for the whole period 1 September 2024 to 19 January 2026.

The risk assessment did not describe the firm's services, gave unexplained risk levels, included services the firm does not provide, and did not document mitigating measures; customer risk profiles and suspicious-activity routines were also inadequate. The board called the breaches serious and present throughout 1 September 2024 to 31 August 2025.

FI found that, in its 2021 consolidated financial statements, SBB reported some properties other than at fair value, treated two acquisitions as asset acquisitions instead of business combinations, overstated 2021 consolidated profit before tax by SEK 3.6 billion and omitted required disclosures. FI states the decision has been appealed to the administrative court.

The firm's two-page general risk assessment, dated 1 February 2023 with no sign of later review, only named its sectors and gave no detail on services, customers, channels or geography, and identified no concrete money-laundering methods or risk levels. The board judged the deficiencies particularly serious because they prevented adequate procedures and customer risk assessments, and found them present for 1 September 2024 to 11 November 2025. The county board's index marks the decision as appealed.

For 1 September 2024 to 1 September 2025 the board found an inadequate general risk assessment, no clear customer risk method, due diligence procedures that largely restated the law, no explanation of how deviations are detected, and missing data-handling rules. It treated the deficiencies as serious and ongoing, and noted missing identity documents for some customers.

The company had no documented general risk assessment for 1 August 2024 to 31 July 2025 (described as an especially serious breach), and its routines for due diligence, monitoring, record-keeping and internal control were missing or deficient, including no adequately designated compliance officer.

After a January 2025 cyber attack, data on more than 2.1 million people, mostly children and young people, was published on the Darknet. IMY found technical and organisational security gaps: the company knew of weaknesses long before the attack without fixing them adequately, lacked routines to detect flaws in its security measures and had no real-time intrusion detection.

Only the general risk assessment was reviewed: it identified risks for each service but did not analyse them in enough depth, did not properly analyse customer, geographic, transaction and distribution-channel factors, and did not justify its risk levels or overall conclusion. The board called this a serious breach covering at least 1 February 2024 to 1 February 2025.

The risk assessment did not describe services or analyse customer, geographic and distribution risks, and customer risk profiles had no criteria; routines on due diligence, suspicious-activity reporting and data retention were insufficient. The board called the breaches serious, lasting the whole period 1 September 2024 to 31 August 2025. The index marks the decision as appealed.

FI opened an investigation in January 2025, found several breaches of central provisions of the Payment Services Act, and found that the authorisation application contained inaccurate information that influenced the decision to grant it. FI judged a warning insufficient and withdrew the authorisation with immediate effect.

The company produced no documented general risk assessment and no routines for customer due diligence, monitoring, reporting, personal data or internal control, so the board concluded it had none during the supervision year. It called the breaches serious, long-lasting and within the firm's control. The index marks the decision as appealed.

In its advice on investments linked to deposit insurance, the firm in several cases gave deficient information on costs and fees and on the benefits and costs of switching between investment assets, and did not document switching advice as required. FI considered the consumer-protection breaches worth intervention but not serious enough to withdraw authorisation or issue a warning.

FI found that Svea Bank had not assessed money laundering and terrorist financing risks for some of its products, did not take customer risk factors into account, and did not properly establish beneficial owners or the purpose and nature of business relationships. Enhanced due diligence on high-risk customers was missing, insufficient or late in a high share of reviewed cases. FI judged the breaches not serious enough for withdrawal of authorisation or a warning.

FI reviewed investment advice given to retail customers through tied agents on warrants and autocalls. It found violations of rules on the content of the suitability report and the presentation of costs and fees, and a failure to document that customers had the knowledge and experience for recommended investments and to document the analysis of benefits and costs of switches between instruments.

For 2 June 2023 to 5 June 2024 the board found a risk assessment that underrated heavy cash use and omitted customer, channel and location risks, no method for customer risk profiles, and no enhanced checks on three recurring customers pledging high-value items (one pledged about SEK 777,000 in eight months). It called the breaches particularly serious. The county board's index marks the decision as appealed.

The general risk assessment did not analyse how vulnerabilities combine to raise risk, gave brief likelihood reasoning, and did not address geographic risks or how reports to the Financial Intelligence Unit were considered. The deficiencies ran through 1 January 2024 to 17 June 2025, so the assessment could not support internal routines.

The auction house had a general risk assessment but it set risk levels without explaining them and applied controls before analysing inherent risk, so it could not support its other AML procedures. The board found the deficiencies not insignificant and present from 1 April 2024 to 11 September 2025.

The company had no general risk assessment during 1 July 2024 to 2 September 2025, which the board called a particularly serious deficiency; the assessment submitted on 2 October 2025 was superficial and could not support its routines or customer risk assessments. The county board's index marks the decision as appealed.

For loans granted in four weeks of 2024 (SEK 10,000 to 125,000), poor coordination between the application form and the creditworthiness assessment led Avida to pay out loans to at least 34 consumers who, on its own calculation model, could not afford them. FI otherwise found the assessment process thorough and chose a remark with a fine rather than withdrawal of authorisation or a warning.

The general risk assessment dated 28 November 2022 had not been reviewed annually, did not reflect rules in force from 1 July 2024, ignored the firm's legal services and copied risks from the national assessment without tailored analysis. The board called it a serious breach covering 1 April 2023 to 1 October 2024. The county board's index marks the decision as appealed.

The general risk assessment was very brief and described the business only superficially, with no analysis of concrete threats and vulnerabilities, so it could not support the firm's procedures. The board called this a serious breach lasting 1 July 2024 to 4 September 2025. The county board's index marks the decision as appealed.

FI found that Zimpler's risk assessment did not evaluate how one of its services could be used for money laundering or terrorist financing, that it did not assess the risk linked to many customers at onboarding, and that it did not always request information on the purpose and nature of the business relationship where required.

Fined together with Apoteket AB in the same decision on the transfer of personal data to Meta through Meta Pixel; IMY found that the companies lacked appropriate technical and organisational measures to ensure adequate security.

After enabling a new sub-feature of Meta Pixel on its websites, the company transferred more personal data to Meta than intended over an extended period, including sensitive data on purchases of over-the-counter medicines and health products. It lacked procedures to detect the problem and stopped the transfers only after external parties informed it.

FI examined compliance from 1 April 2021 to 31 March 2022 and found significant deficiencies in the general risk assessment, which did not assess how products and services could be misused for money laundering or terrorist financing, and missing procedures covering all situations where due diligence applies to customers using the invoice product.