Compliance Radar
Who was sanctioned, and for what?
Fines, court rulings and incidents from Europe, North America, Latin America, Asia-Pacific, Middle East and Africa: 2,207 cases from 44 jurisdictions, each with an official source and checked against that source before publication. Filter by country, area of law and sector. Click a chart to drill down one level.
Click a bar to drill down one level.
Where?
by regionAll jurisdictions
What for?
by topicWho?
by companyWhen?
per year, by date of decision| Period | Cases | Total |
|---|---|---|
| 2024 | 2 | €3.85m |
| 2025 | 2 | €1.75m |
| 2026 | 2 | €725,086 |
6 cases
16 Jul 2026 TeamViewer SETeamViewer: cyberattack not disclosed as inside information without delay €240,000
Germany's Federal Financial Supervisory Authority (Bundesanstalt für Finanzdienstleistungsaufsicht, BaFin) imposed a fine of 240,000 EUR on the software company because it had not disclosed the information about a cyberattack it had suffered as inside information without delay. The fine notice is final.
Put serious IT security incidents immediately before the ad hoc disclosure committee as well – the incident response process must take capital market disclosure into account.
Recognising security incidents as potential inside information and reporting them to the ad hoc disclosure committee
- Authority / court
- Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin)
- Area of law
- Capital markets and financial supervision · Disclosure and reporting obligations
- Legal basis
- Art. 17 Abs. 1 UAbs. 1 MAR (EU) Nr. 596/2014
- Action
- Fine
- Status of proceedings
- final
- Sector
- Telecoms, IT and software
- Published
- 20 Jul 2026
- TeamViewer SE: BaFin setzt Geldbuße fest Decision of an authority
- Bekanntmachung der BaFin zur TeamViewer SE (Maßnahmenansicht mit Rechtskraftvermerk) Official register or notice
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
28 Apr 2026 Canva Pty Ltd; Canva Operations Pty Limited; Canva Trading Pty Ltd; Fusion Books Pty LtdCanva group: AUD 792,000 in penalties for late annual financial reports €485,086
Four Australian companies of the Canva group did not lodge their financial reports for the 2024 financial year with ASIC by the due date of 30 April 2025; the consolidated report followed only on 27 March 2026. ASIC issued an infringement notice of allegedly AUD 198,000 to each company (AUD 792,000 in total); the notices were paid, which is not an admission of guilt.
Even fast-growing technology groups must monitor the reporting deadlines of every single group company.
Lodgement deadlines for the financial reports of all group companies
- Authority / court
- Australian Securities and Investments Commission (ASIC)
- Area of law
- Capital markets and financial supervision · Disclosure and reporting obligations
- Legal basis
- s 319(1) Corporations Act 2001 (Cth); Bußgeldbescheide nach s 1317DAM
- Action
- Fine
- Status of proceedings
- final
- Sector
- Telecoms, IT and software
- Published
- 6 May 2026
Original amount 792,000 AUD, converted at the ECB reference rate of 28 Apr 2026.
- ASIC 26-090MR: Canva Group pays $792,000 in infringement notices for failing to lodge financial reports on time Press release of an authority
- ASIC Infringement Notice B00442525 an Canva Pty Ltd (28 April 2026) Decision of an authority
- ASIC Infringement Notice B00442527 an Fusion Books Pty Ltd (28 April 2026) Decision of an authority
- ASIC Infringement Notices Register Official register or notice
Checked against the official source on 3 Oct 2026 · Direct link
Report an error
24 Jul 2025 The Open Network FoundationVARA: fine and cease-and-desist order against The Open Network Foundation (marketing) Fine
According to VARA's enforcement list, The Open Network Foundation breached the VARA Marketing Regulations. The list records a cease-and-desist order, a fine of an undisclosed amount and a public statement as the measures taken.
Foundations in the crypto sector are also subject to Dubai's marketing rules for virtual assets when they promote their offering there.
Rules for marketing virtual assets
- Authority / court
- Virtual Assets Regulatory Authority (VARA), Dubai
- Area of law
- Capital markets and financial supervision
- Legal basis
- VARA Marketing Regulations
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Telecoms, IT and software
- VARA: Enforcement Actions – Liste der Geldbußen (Eintrag The Open Network Foundation, 2025/07/24) Enforcement database of an authority
Checked against the official source on 3 Oct 2026 · Direct link
Report an error
14 May 2025 SAP SESAP: failure to publish notice on the 2022 annual financial report €1.75m
SAP had not published an announcement stating from when and at which internet address the 2022 annual financial report was publicly available in addition to the company register (Hinweisbekanntmachung). BaFin imposed a fine of 1.75 million EUR; the notice is final.
Even seemingly formal disclosure steps such as the notice announcement need a fixed place in the financial calendar – the range of fines extends up to five per cent of total turnover.
- Authority / court
- Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin)
- Area of law
- Capital markets and financial supervision · Disclosure and reporting obligations
- Legal basis
- § 114 Abs. 1 Satz 2 WpHG
- Action
- Fine
- Status of proceedings
- final
- Sector
- Telecoms, IT and software
- Published
- 27 May 2025
- SAP SE: BaFin setzt Geldbuße fest Decision of an authority
- Bekanntmachung der BaFin zur SAP SE (Maßnahmenansicht mit Rechtskraftvermerk) Official register or notice
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
22 Oct 2024 Unisys Corp.SEC: $4 million against Unisys for downplaying cyber incidents after SolarWinds €3.7m
In mandatory disclosures, Unisys presented cyber risks as hypothetical, although it had suffered two intrusions with data exfiltration connected with the SolarWinds compromise. On the same day, the US Securities and Exchange Commission (SEC) also imposed penalties on Avaya ($1 million), Check Point ($995,000) and Mimecast ($990,000).
Do not describe cyber incidents that have occurred as a mere risk in investor information – disclosure processes must involve IT security.
- Authority / court
- U.S. Securities and Exchange Commission (SEC)
- Area of law
- Capital markets and financial supervision · Disclosure and reporting obligations
- Legal basis
- Securities Act of 1933, Securities Exchange Act of 1934 (inkl. Disclosure Controls)
- Action
- Fine
- Status of proceedings
- final
- Sector
- Telecoms, IT and software
- Culpability
- negligent
- Mitigating circumstances
- Cooperation in the proceedings and improvement of cybersecurity controls.
- Published
- 22 Oct 2024
Original amount 4,000,000 USD, converted at the ECB reference rate of 22 Oct 2024.
- SEC Charges Four Companies With Misleading Cyber Disclosures Press release of an authority
Checked against the official source on 28 Sep 2026 · Version 2 · Direct link
Report an error
19 Jul 2024 a French drone manufacturerDrone manufacturer: misleading half-yearly report ahead of a takeover bid €150,000
In its 2018 half-yearly report, the drone manufacturer disseminated misleading information on the absence of impairment indicators for the drone division, on goodwill and on earnings. Sanction imposed on the company: 150,000 EUR.
Impairment tests for loss-making divisions are particularly sensitive in a takeover context.
Accurate financial reporting in connection with takeover plans
- Authority / court
- Autorité des marchés financiers (AMF), Commission des sanctions
- Area of law
- Capital markets and financial supervision · Market abuse and insider dealing
- Legal basis
- Art. 12 Abs. 1 lit. c, Art. 15 MAR; Art. 8 und 14 MAR
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Telecoms, IT and software
- Liability of senior managers
- Measures against individuals are not reported here.
- AMF, Entscheidungen der Commission des sanctions (Übersicht) (Entscheidung 2024) Decision of an authority
Checked against the official source on 28 Sep 2026 · Version 6 · Company name anonymised since 19 Jul 2026 · Direct link