Compliance Radar
Who was sanctioned, and for what?
Fines, court rulings and incidents from Europe, North America, Latin America, Asia-Pacific, Middle East and Africa: 2,207 cases from 44 jurisdictions, each with an official source and checked against that source before publication. Filter by country, area of law and sector. Click a chart to drill down one level.
Click a bar to drill down one level.
Where?
by regionAll jurisdictions
What for?
by action- Fine €159.1m 100 % · 12 cases
Who?
by sectorAll sectors
When?
per year, by date of decision| Period | Cases | Total |
|---|---|---|
| 2022 | 2 | €62.3m |
| 2023 | 1 | €75.3m |
| 2024 | 2 | €3.04m |
| 2025 | 6 | €17.9m |
| 2026 | 1 | €501,614 |
12 cases
22 Sep 2026 OTC Link LLCOTC Link: 575,000 USD – security policies never completed despite examination findings €501,614
From 2016 to 2025, the operator of the OTC Link ATS trading system lacked complete policies on systems security, access control and vulnerability management as required under Regulation SCI. Although the examiners of the U.S. Securities and Exchange Commission (SEC) had criticised the gaps in several examinations, drafts remained unfinished; the SEC issued a censure and imposed 575,000 USD.
Track supervisory examination findings with a deadline and a responsible person – points that remain open repeatedly become expensive.
- Authority / court
- U.S. Securities and Exchange Commission (SEC)
- Area of law
- Information security and cyber · Critical infrastructure
- Legal basis
- Regulation SCI, Rule 1001(a)(1)–(3)
- Action
- Fine
- Status of proceedings
- final
- Sector
- Financial services and insurance
- Repeat case
- yes
Original amount 575,000 USD, converted at the ECB reference rate of 22 Sep 2026.
- SEC Censures OTC Link LLC for Repeated Compliance Failures Related to Regulation SCI (22.09.2026) Press release of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
11 Dec 2025 Singapore Telecommunications Limited (Singtel)IMDA: SGD 1m against Singtel after hours-long fixed-line voice outage €660,197
On 8 October 2024 Singtel's fixed-line voice service failed for more than four hours for around 500,000 residential and corporate users; customer service lines of government agencies, healthcare organisations and banks as well as emergency call services were also affected. The cause was that the virtualised firewalls of the voice system and of a monitoring system shared the same hardware, so that an overload of the insufficiently filtered monitoring system also disrupted the voice system and the automatic failover did not work cleanly; according to the investigation, there was no cyber-attack. The Infocomm Media Development Authority (IMDA, Singapore's telecoms and media regulator) imposed a penalty of SGD 1 million under the Telecommunications Act because the incident had been within Singtel's control to prevent.
Critical services need separated components and reliably tested failover mechanisms – shared hardware can turn a fault in an ancillary system into an outage of the core service.
- Authority / court
- Infocomm Media Development Authority (IMDA)
- Area of law
- Information security and cyber · Critical infrastructure
- Legal basis
- Telecommunications Act
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Telecoms, IT and software
- Employees
- 10,000 or more
- Published
- 11 Dec 2025
Original amount 1,000,000 SGD, converted at the ECB reference rate of 11 Dec 2025.
- IMDA: IMDA Imposes Financial Penalty on Singtel for Fixed Voice Disruption (11.12.2025) Press release of an authority
Checked against the official source on 4 Oct 2026 · Direct link
Report an error
1 Dec 2025 One New Zealand Group Limited (One NZ)One NZ: 1.1 million NZD for breaches of the 111 emergency calling code €543,022
Following proceedings brought by the Commerce Commission (New Zealand's competition and consumer regulator), the High Court ordered One New Zealand Group Limited to pay a pecuniary penalty of 1,100,000 NZD; in addition, the company is paying 100,000 NZD towards the authority's costs, which is not included in the amount. One NZ admitted ten breaches of the 111 Contact Code between 2021 and 2023 concerning information duties, record-keeping and regular contact with customers. The Code is intended to ensure that vulnerable customers whose landline does not work in a power cut receive another way of calling 111 at no cost.
Providers moving customers from copper to new landline technology must actively follow up and fully document vulnerable customers' ability to make emergency calls during power cuts.
Duties to vulnerable customers regarding emergency calls during power cuts: inform, follow up, document
- Authority / court
- High Court of New Zealand (Verfahren der Commerce Commission)
- Area of law
- Information security and cyber · Critical infrastructure
- Legal basis
- Telecommunications Act 2001 (Neuseeland), s 156B; 111 Contact Code
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Telecoms, IT and software
- Mitigating circumstances
- According to the Commerce Commission, One NZ remedied the breaches as soon as it recognised their scale and cooperated fully with the investigation; the breaches were admitted.
- Published
- 1 Dec 2025
Original amount 1,100,000 NZD, converted at the ECB reference rate of 1 Dec 2025.
- Commerce Commission – One NZ ordered to pay $1.1 million for breaching 111 obligations (01.12.2025) Press release of an authority
- Commerce Commission, Case register – One New Zealand Group Limited (PRJ0047020) Enforcement database of an authority
Checked against the official source on 3 Oct 2026 · Direct link
Report an error
17 Oct 2025 Odido Netherlands B.V.Netherlands: 1.52 million EUR against Odido – interception system without security plan and staff screening €1.52m
In inspections in 2021/22, the RDI (Rijksinspectie Digitale Infrastructuur, the Dutch Authority for Digital Infrastructure) found that the mobile operator had no mandatory security plan for its system for lawful interception of telecommunications, that employees with access had not been adequately screened (missing job descriptions, confidentiality declarations, certificates of conduct), that unauthorised persons had access to interception data and that suppliers could access the system digitally. The RDI imposed 1,518,750 EUR; Odido has since renewed the system.
Treat the security plan, staff screening and strictly limited supplier access for highly sensitive systems as the core of the obligation, not a formality.
Access rights, staff screening and supplier access for sensitive systems
- Authority / court
- Rijksinspectie Digitale Infrastructuur (RDI)
- Area of law
- Information security and cyber · Critical infrastructure
- Legal basis
- Telecommunicatiewet Art. 15.4; Besluit beveiliging gegevens telecommunicatie (Bbgt) Art. 2, 3, 4
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Telecoms, IT and software
- Mitigating circumstances
- System renewed, risk of unauthorised access eliminated.
- Published
- 17 Oct 2025
- RDI legt Odido boete op van ruim 1,5 miljoen vanwege onvoldoende beveiligd aftapsysteem Press release of an authority
- Beschikking tot oplegging bestuurlijke boete Odido (Publieksversie) Decision of an authority
Checked against the official source on 28 Sep 2026 · Direct link
Report an error
3 Jul 2025 Telenor Norge ASTelenor Norge: 50 million NOK after four disruptions to emergency numbers in autumn 2024 €4.21m
The Nasjonal kommunikasjonsmyndighet (Nkom, Norwegian Communications Authority) imposed an administrative penalty (overtredelsesgebyr) of 50,000,000 NOK on Telenor Norge because, on four occasions in autumn 2024 (29 August, 16 September, 17/18 October, 13 November), emergency calls over its network failed entirely or intermittently or were misrouted. The inspection found 22 breaches of ekomloven (Electronic Communications Act), sikkerhetsloven (National Security Act) and several regulations, including inadequate risk assessments, planned work not carried out securely, insufficient redundancy, inadequate auditing of a subcontractor and late notification of the authority. In its final decision Nkom maintained the amount announced in February 2025; the deadline for an administrative appeal ran until 8 September 2025.
Operators that carry emergency call services must safeguard planned network changes with a risk analysis and working redundancy, audit their suppliers and report disruptions on time.
Planned work on critical networks: risk analysis, a working fallback and notifying the regulator within 30 minutes
- Authority / court
- Nasjonal kommunikasjonsmyndighet (Nkom)
- Area of law
- Information security and cyber · Critical infrastructure
- Legal basis
- ekomloven (lov 4. juli 2003 nr. 83), sikkerhetsloven (lov 1. juni 2018 nr. 24), ekomforskriften, nummerforskriften, klassifiseringsforskriften, virksomhetssikkerhetsforskriften
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Telecoms, IT and software
- Employees
- 1,000 to 9,999
- Published
- 3 Jul 2025
Original amount 50,000,000 NOK, converted at the ECB reference rate of 3 Jul 2025.
- Nkom – Opprettholder millionbot mot Telenor (03.07.2025) Press release of an authority
- Nkom – Tilsynsrapporten mot Telenor er klar: Varsler bot på 50 millioner kroner (27.02.2025) Press release of an authority
- Nkom – Tilsynsrapport Telenor, offentlig sammendrag av sikkerhetsgradert tilsynsrapport (foreløpig), 27.02.2025 Decision of an authority
- Brønnøysundregistrene, Enhetsregisteret – Telenor Norge AS (org.nr. 976967631), antall ansatte Official register or notice
Checked against the official source on 28 Sep 2026 · Direct link
Report an error
20 Mar 2025 The London Metal Exchange (LME)London Metal Exchange: 9.2 million GBP – controls and escalation failed in nickel turmoil €11m
When the nickel price rose to over 100,000 USD within just over an hour on 8 March 2022, only junior staff were on duty during Asian trading hours, and they had not been trained to recognise a disorderly market; they did not escalate and even switched off price bands. The Financial Conduct Authority (FCA) imposed a fine on the recognised investment exchange for the first time: 9.2 million GBP after a 30% discount.
Critical infrastructure needs trained staff around the clock and clear escalation paths – including at night and at off-peak times.
Escalation of unusual market conditions; training of shift staff
Missing or inadequate training played a role in the decision.
- Authority / court
- Financial Conduct Authority (FCA)
- Area of law
- Information security and cyber · Critical infrastructure
- Legal basis
- FCA REC 2.5.1 (Recognition Requirements); Art. 18 RTS 7 (MiFID II)
- Action
- Fine
- Status of proceedings
- final
- Sector
- Financial services and insurance
- Mitigating circumstances
- Early settlement (30% discount); improvements since March 2022.
Original amount 9,200,000 GBP, converted at the ECB reference rate of 20 Mar 2025.
- FCA: First FCA enforcement action and fine against Recognised Investment Exchange (20.03.2025) Press release of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
7 Jan 2025 City of Boardman (Oregon)City of Boardman: 8,770 USD – water system's risk assessment was an empty template €8,438
The U.S. Environmental Protection Agency (EPA, Region 10) imposed a civil penalty of 8,770 USD by consent agreement and final order on the City of Boardman (Oregon), whose drinking water system serves around 4,490 people. According to the EPA, the city had not prepared the risk and resilience assessment and emergency response plan required by the Safe Drinking Water Act on time and had not complied with a 2022 EPA order: at an inspection in April 2024 the assessment was an empty template, and the emergency response plan dated from 2005 and contained no cybersecurity section. The city admitted jurisdiction without admitting or denying the factual allegations and waived its right to appeal. The authority allegedly made the findings set out here; this account is not based on a final judgment.
Mandatory assessments of physical and cyber security must be substantively prepared and kept up to date – a template that has merely been certified does not meet the obligation.
Actually prepare the risk and resilience assessment, including cybersecurity, and keep the emergency response plan current
- Authority / court
- U.S. Environmental Protection Agency (EPA), Region 10
- Area of law
- Information security and cyber · Critical infrastructure
- Legal basis
- Safe Drinking Water Act Section 1433(a) und (b) (42 U.S.C. § 300i-2) sowie Section 1414(g)(3)(A); Strafe nach Section 1414(g)(3)(B) (42 U.S.C. § 300g-3(g)(3)(B))
- Action
- Fine
- Status of proceedings
- final
- Sector
- Energy and utilities
- Repeat case
- yes
- Published
- 7 Jan 2025
Original amount 8,770 USD, converted at the ECB reference rate of 7 Jan 2025.
- EPA Region 10 – Consent Agreement, In the Matter of City of Boardman, Docket No. SDWA-10-2025-0022 (eingereicht 07.01.2025) Decision of an authority
- EPA Region 10 – Final Order, City of Boardman, Docket No. SDWA-10-2025-0022 (07.01.2025) Decision of an authority
- EPA Administrative Enforcement Dockets – SDWA-10-2025-0022 (Status Closed, Payment Received) Enforcement database of an authority
Checked against the official source on 3 Oct 2026 · Direct link
Report an error
1 Oct 2024 a US swap trading platformSwap trading platform: 875,000 USD because emergency and security tests were not brought before the board €789,284
A US swap trading platform did not fully inform its board of the results of emergency, technology risk and penetration tests, did not regularly test its business continuity and disaster recovery capabilities and had no adequate risk management. It also failed to produce documents requested during an examination on time despite extensions of deadlines; the Commodity Futures Trading Commission (CFTC) imposed 875,000 USD.
Contingency plans only count if they are tested regularly and the results are noted by the entire governing body.
- Authority / court
- Commodity Futures Trading Commission (CFTC)
- Area of law
- Information security and cyber · Critical infrastructure
- Legal basis
- Commodity Exchange Act; CFTC-Regeln zu System Safeguards für Swap Execution Facilities
- Action
- Fine
- Status of proceedings
- final
- Sector
- Financial services and insurance
Original amount 875,000 USD, converted at the ECB reference rate of 1 Oct 2024.
- CFTC, Pressemitteilungen (Übersicht) (Entscheidung 2024) Press release of an authority
Checked against the official source on 28 Sep 2026 · Version 3 · Company name anonymised since 1 Oct 2026 · Direct link
Report an error
21 May 2024 a Dutch telecommunications providerNetherlands: 2.25 million EUR against a telecommunications provider over inadequately secured interception system €2.25m
According to the Dutch Authority for Digital Infrastructure (RDI), a Dutch telecommunications provider did not take the necessary measures from October 2021 to December 2022 to protect data from lawful interception of telecommunications against unauthorised persons: the security plan was inadequate, staff with access had not been sufficiently screened (missing job descriptions, confidentiality declarations, certificates of conduct), and logical and physical access controls were deficient. No actual unauthorised access was found; the fine amounts to 2.25 million EUR.
Treat interfaces for access by authorities as high-risk systems; document access controls and staff screening completely.
Access control and staff screening for interception interfaces
- Authority / court
- Rijksinspectie Digitale Infrastructuur (RDI)
- Area of law
- Information security and cyber · Critical infrastructure
- Legal basis
- Telecommunicatiewet Art. 15.4; Besluit beveiliging gegevens telecommunicatie (Bbgt) Art. 2, 3, 4, 8
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Telecoms, IT and software
- Mitigating circumstances
- Deficiencies remedied after they were identified; no actual unauthorised access found.
- Published
- 22 Oct 2024
- RDI, Nachrichten (Übersicht) (Entscheidung 2024) Press release of an authority
Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 21 May 2026 · Direct link
Report an error
14 Mar 2023 a Swedish major bankMajor bank: 850 million SEK – unapproved IT change led to wrong balances and blocked payments €75.3m
Finansinspektionen (Swedish Financial Supervisory Authority) issued a Swedish major bank with a remark (anmärkning) and an administrative fine of 850,000,000 SEK because on 28 April 2022 the bank made a change to a business-critical IT system – to implement new EU sanctions – without following its internal change management process: without approval by the Change Advisory Board, without a risk assessment and without a rollback plan. The resulting error stopped around 1.7 million transactions to about 1.1 million accounts, showed incorrect balances for almost 960,000 customers and prevented around 160,000 customers from making payments; because none of the bank's controls had detected that the process was bypassed, the supervisor found the internal control of this systemically important bank to be inadequate. It treated an earlier sanction from 2020 (oversight of anti-money laundering measures in subsidiary banks) as aggravating and, in the bank's favour, the fact that the breach was neither long-lasting nor systematic.
Even urgent changes to critical IT systems prompted by regulation must go through the regular change process, and controls must detect when individuals bypass it.
Change management: no change to critical IT systems without approval, risk assessment and a rollback plan
- Authority / court
- Finansinspektionen (FI)
- Area of law
- Information security and cyber · Critical infrastructure
- Legal basis
- 6 kap. 2 § lagen (2004:297) om bank- och finansieringsrörelse (LBF) i. V. m. 2 kap. 1 § första stycket 5 FFFS 2014:1; Anmärkning nach 15 kap. 1 § LBF, Sanktionsavgift nach 15 kap. 7 § LBF
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Financial services and insurance
- Employees
- 10,000 or more
- Repeat case
- yes
- Mitigating circumstances
- Not a long-lasting or systematic breach; the bank has taken, and announced further, measures to strengthen internal control.
- Published
- 15 Mar 2023
Original amount 850,000,000 SEK, converted at the ECB reference rate of 14 Mar 2023.
- Finansinspektionen, Sanktionen (Übersicht) (Entscheidung 2023) Decision of an authority
Checked against the official source on 28 Sep 2026 · Company name anonymised since 14 Mar 2025 · Direct link
Report an error
20 Dec 2022 a British bankBritish bank: 48.65 million GBP – IT migration disrupted banking services for millions of customers €55.6m
Following the migration to a new IT platform in April 2018, customers were able to carry out banking transactions in branches, by telephone and online only to a limited extent for months; all branches and a large proportion of the 5.2 million customers were affected. The Financial Conduct Authority (FCA) and the Prudential Regulation Authority (PRA) accused the bank of deficient planning, governance and management of outsourcing risk and imposed a total of 48.65 million GBP (FCA 29.75 million, PRA 18.9 million).
Major IT migrations at providers of critical services need robust governance, testing and contingency plans – including for the critical service provider.
- Authority / court
- Financial Conduct Authority (FCA) und Prudential Regulation Authority (PRA)
- Area of law
- Information security and cyber · Critical infrastructure
- Legal basis
- FCA- und PRA-Anforderungen an operationelles Risikomanagement, Governance und Auslagerung
- Action
- Fine
- Status of proceedings
- final
- Sector
- Financial services and insurance
- Mitigating circumstances
- 30% discount for settlement; 32.7 million GBP in compensation already paid to customers.
Original amount 48,650,000 GBP, converted at the ECB reference rate of 20 Dec 2022.
- FCA, Final Notices (Übersicht) (Entscheidung 2022) Press release of an authority
Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 20 Dec 2024 · Direct link
Report an error
29 Sep 2022 a US futures exchangeUS futures exchange: 6.5 million USD – without adequate security testing €6.7m
From 2017 to 2021, the New York futures exchange failed to comply with key system safeguards obligations: no controls testing, inadequate internal and external penetration testing, deficient technology risk assessments without involvement of the board and late notification of a security-relevant system change. In addition, there were reporting violations and a false statement to the Commodity Futures Trading Commission (CFTC); owing to cooperation, the penalty was reduced to 6.5 million USD.
Exchanges and other market infrastructures must not only carry out security tests but also demonstrably bring their results before the governing body.
- Authority / court
- Commodity Futures Trading Commission (CFTC)
- Area of law
- Information security and cyber · Critical infrastructure
- Legal basis
- Commodity Exchange Act; CFTC-Regeln zu System Safeguards für Designated Contract Markets
- Action
- Fine
- Status of proceedings
- final
- Sector
- Financial services and insurance
- Mitigating circumstances
- Substantial cooperation and remediation; penalty reduced accordingly.
Original amount 6,500,000 USD, converted at the ECB reference rate of 29 Sep 2022.
- CFTC, Pressemitteilungen (Übersicht) (Entscheidung 2022) Press release of an authority
Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 29 Sep 2024 · Direct link