Who was sanctioned, and for what?

The Board of Governors of the Federal Reserve System imposed 123.5 million USD on the Canadian parent company because it neglected risk management and oversight of its US retail business, so that a US subsidiary was used to launder hundreds of millions of dollars. TD must move the AML programme to the US and commission an independent review of the board and management; the sanctions of all authorities involved (DOJ, FinCEN, OCC) add up to around 3.09 billion USD.

Authority / court

Board of Governors of the Federal Reserve System

Area of law

Money laundering and terrorist financing · Internal controls

Legal basis

US-Anti-Geldwäschegesetze (laut Federal Reserve)

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Employees

10,000 or more

Liability of senior managers

Independent review of board and management ordered

Published

10 Oct 2024

Original amount 123,500,000 USD, converted at the ECB reference rate of 10 Oct 2024.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

From 2016 to 2025, the operator of the OTC Link ATS trading system lacked complete policies on systems security, access control and vulnerability management as required under Regulation SCI. Although the examiners of the U.S. Securities and Exchange Commission (SEC) had criticised the gaps in several examinations, drafts remained unfinished; the SEC issued a censure and imposed 575,000 USD.

Authority / court

U.S. Securities and Exchange Commission (SEC)

Area of law

Information security and cyber · Critical infrastructure

Legal basis

Regulation SCI, Rule 1001(a)(1)–(3)

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Repeat case

yes

Original amount 575,000 USD, converted at the ECB reference rate of 22 Sep 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

In 2023, a federal court found by way of summary judgment that the fuel card provider had charged its predominantly small business customers hidden or unauthorised fees and misrepresented savings; an appeals court upheld this in 2026. According to the FTC, the fees added up to hundreds of millions of dollars, and late fees were also charged despite punctual payment. Under the settlement resolving the administrative proceedings, FleetCor and CEO Ronald Clarke are paying 100 million USD for refunds; the order is not yet final.

Authority / court

Federal Trade Commission (FTC)

Area of law

Consumer protection and online retail · Misleading advertising and pricing

Legal basis

Section 5 FTC Act

Action

Disgorgement of profits

Status of proceedings

unknown

Sector

Financial services and insurance

Liability of senior managers

CEO Ronald Clarke is named in the press release as a party involved.

Published

17 Sep 2026

Original amount 100,000,000 USD, converted at the ECB reference rate of 17 Sep 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

As a so-called fund hotel, the company had its funds managed by other firms, but examined these delegation agreements only insufficiently, did not take the related decisions properly and did not monitor the funds’ returns in relation to risk closely enough. The Swedish financial supervisory authority Finansinspektionen (FI) issued a remark and imposed 2 million SEK; no damage to investors was established.

Authority / court

Finansinspektionen (FI)

Area of law

Capital markets and financial supervision · Organisational requirements

Legal basis

Schwedisches Fondsrecht – Regeln zur Delegation der Fondsverwaltung und deren Überwachung

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Mitigating circumstances

No established damage to investors; remedial measures already taken during the investigation.

Published

16 Sep 2026

Original amount 2,000,000 SEK, converted at the ECB reference rate of 16 Sep 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Following an on-site inspection, the Finantsinspektsioon (Estonian Financial Supervision Authority) issued an order requiring the payment institution Wallester to remedy, by 31 December, deficiencies in governance and control functions (separation of the lines of defence, internal rules), in safeguarding customer funds and in the staffing of its anti-money laundering and counter-terrorist financing function. Date = publication of the press release.

Authority / court

Finantsinspektsioon (Estnische Finanzaufsicht)

Area of law

Money laundering and terrorist financing · Internal controls

Legal basis

Aufsichtsrechtliche Anordnung (ettekirjutus) der Finantsinspektsioon

Action

Order

Status of proceedings

unknown

Sector

Financial services and insurance

Published

16 Sep 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

For seven months (October 2025 to May 2026), the bank continued to send a customer advertising via its app, although he had objected several times. The Italian data protection authority (Garante per la protezione dei dati personali) also found deficient systems for implementing objections and inaccurate information about the processing, and imposed 5,508,000 EUR (Provvedimento No. 613).

Authority / court

Garante per la protezione dei dati personali

Area of law

Data protection · Marketing and consent

Legal basis

Art. 5 Abs. 1 lit. a, Art. 12, 21, 24 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Published

11 Sep 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The financial institution did not deliver on time the data due every seven days to the Centralised Bank Account Register (CBAR). The Financial Intelligence Analysis Unit (FIAU) set a fine of 162,704 EUR, which was reduced by 40% to 97,622 EUR under a settlement pursuant to its 2026 settlement policy.

Authority / court

Financial Intelligence Analysis Unit (FIAU)

Area of law

Money laundering and terrorist financing

Legal basis

Reg. 4(2), 8, 9 CBAR Regulations (S.L. 373.03)

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Mitigating circumstances

Settlement with 40% reduction

Published

4 Sep 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

At the payment institution, the customer risk assessment had only been introduced after business had started, some customers remained unassessed, and customer profiles were based on transaction thresholds rather than on risk. The Financial Intelligence Analysis Unit (FIAU) set a fine of 266,833 EUR and a follow-up directive; under a settlement, the fine was reduced by 40% to 160,099 EUR.

Authority / court

Financial Intelligence Analysis Unit (FIAU)

Area of law

Money laundering and terrorist financing · Customer due diligence

Legal basis

Reg. 2(1), 5(5)(a)(ii), 7(1)(c), 7(2)(a), 21, 22 PMLFTR

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Mitigating circumstances

Settlement with 40% reduction; remediation demonstrated

Published

2 Sep 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

From 2004 to 2018, the three issuers of paper meal vouchers coordinated with retail chains how many vouchers would be accepted per purchase. The President of the Úřad pro ochranu hospodářské soutěže (Czech Office for the Protection of Competition, ÚOHS) dismissed the appeals against the recalculation of the fines: Pluxee 132.271 million, Edenred 101.94 million and Up 44.941 million CZK, a total of 279.152 million CZK.

Authority / court

Úřad pro ochranu hospodářské soutěže (ÚOHS)

Area of law

Competition law · Cartels and collusion

Legal basis

Tschechisches Wettbewerbsgesetz, Art. 101 AEUV (R0112/2025)

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Culpability

intentional

Published

17 Aug 2026

Original amount 279,152,000 CZK, converted at the ECB reference rate of 17 Aug 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Mainly between February and November 2022, the London branch processed 970 payments totalling around 19.7 million GBP that breached Russia and anti-corruption sanctions. The causes were overloaded alert handling after the wave of designations, delayed escalation and human error; the bank voluntarily disclosed most of the breaches and received a 20% reduction from HM Treasury's Office of Financial Sanctions Implementation (OFSI).

Authority / court

HM Treasury, Office of Financial Sanctions Implementation (OFSI)

Area of law

Sanctions and export control · Breaches of sanctions and embargoes

Legal basis

Russia (Sanctions) (EU Exit) Regulations 2019; Global Anti-Corruption Sanctions Regulations 2021; s. 146 Policing and Crime Act 2017

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Employees

10,000 or more

Mitigating circumstances

Predominantly voluntary disclosure and cooperation (20% reduction); exceptional burden caused by the 2022 sanctions packages taken into account

Published

2 Sep 2026

Original amount 4,732,830.58 GBP, converted at the ECB reference rate of 11 Aug 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The licensed money transmitter had no adequate policies for system updates and insufficient risk assessments under New York's cybersecurity regulation, as found by the New York State Department of Financial Services (NYDFS). The company has already remedied the deficiencies.

Authority / court

New York State Department of Financial Services (NYDFS)

Area of law

Information security and cyber · Security measures and risk management

Legal basis

23 NYCRR Part 500 (Cybersecurity Regulation)

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Mitigating circumstances

Because of its low turnover, the company was exempt from many Part 500 obligations; deficiencies already remedied.

Published

5 Aug 2026

Original amount 250,000 USD, converted at the ECB reference rate of 5 Aug 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The US Financial Crimes Enforcement Network (FinCEN) imposed 125 million USD on the broker-dealer – the highest BSA penalty against a broker-dealer to date. UBSFS admitted wilful infringements: the AML programme was inadequate, more than 50,000 foreign currency transfers totalling more than 10 billion USD were not adequately monitored and suspicious activity reports were not filed; it is already the second enforcement action after 2018.

Authority / court

Financial Crimes Enforcement Network (FinCEN)

Area of law

Money laundering and terrorist financing · Internal controls

Legal basis

Bank Secrecy Act (BSA)

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Employees

10,000 or more

Culpability

intentional

Repeat case

yes

Mitigating circumstances

Up to 15 million USD (remaining amount due by 31 May 2028) may be waived to the extent that UBSFS bears the costs of the independent review of its AML programme and implements its recommendations

Published

3 Aug 2026

Original amount 125,000,000 USD, converted at the ECB reference rate of 3 Aug 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Germany's Federal Financial Supervisory Authority (BaFin) imposed fines totalling 210,000 EUR on the cooperative bank: business relationships were not monitored on an ongoing basis or with enhanced scrutiny, additional information was not obtained and suspicious activity reports were not filed or were filed late. The function of the money laundering reporting officer had been outsourced to an external service provider with several clients.

Authority / court

Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin)

Area of law

Money laundering and terrorist financing · Customer due diligence

Legal basis

§ 56 Abs. 1 S. 1 Nr. 20, 36, 38 und 69 GwG; Bekanntmachung nach § 57 GwG

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Published

17 Sep 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The Baltimore-based US asset manager had not submitted voting rights notifications to the issuer and BaFin in time; the deadline is four trading days after reaching a notifiable threshold. BaFin imposed a fine of 187,500 EUR; the notice is final.

Authority / court

Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin)

Area of law

Capital markets and financial supervision · Disclosure and reporting obligations

Legal basis

§ 33 Abs. 1 Satz 1 WpHG

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Published

22 Jul 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

At the request of a third party and outside the scope of his duties, a bank employee retrieved account statements of a data subject (name, IBAN, transactions, balances). The Romanian data protection authority (ANSPDCP) found insufficient technical and organisational measures and imposed 26,172 lei (5,000 EUR); the bank has paid the fine. Date = publication of the press release; according to the authority, the investigation was concluded in the previous month.

Authority / court

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 32 Abs. 1, 2 und 4 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Published

2 Jul 2026

Original amount 26,172 RON, converted at the ECB reference rate of 2 Jul 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The credit rating agency did not submit up-to-date rating information to the European Securities and Markets Authority (ESMA), did not provide complete historical performance data to the central repository and lacked adequate procedures and internal control mechanisms. ESMA found negligent infringements and imposed fines totalling 2,145,000 EUR.

Authority / court

Europäische Wertpapier- und Marktaufsichtsbehörde (ESMA)

Area of law

Capital markets and financial supervision · Organisational requirements

Legal basis

Verordnung (EG) Nr. 1060/2009 (CRA-Verordnung), Art. 24, 36a, Anhang III

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Culpability

negligent

Repeat case

yes

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Because Paysera did not comply with the order to submit its 2024 annual financial statements by 30 September 2025, the Lietuvos bankas (Bank of Lithuania, financial supervisor) first imposed 20,000 EUR in November 2025 and then a daily fine of 1,000 EUR (rising to 2,000 and 3,000 EUR respectively). As the infringement was only remedied after 6 May 2026, the daily fine added up to 362,000 EUR. Source: archived copy of the press release.

Authority / court

Lietuvos bankas (Litauische Zentralbank, Finanzaufsicht)

Area of law

Capital markets and financial supervision · Disclosure and reporting obligations

Legal basis

Aufsichtsrechtliche Anordnung und Berichtspflichten nach litauischem E-Geld-Recht

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Repeat case

yes

Published

30 Jun 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

In stock option plans for employees of client companies (2018–2023), the bank did not fully inform the beneficiaries about costs, had initially not recorded the conflicts of interest in this business and assessed clients’ knowledge only with a yes/no question. The Autorité des services et marchés financiers (Belgian Financial Services and Markets Authority, FSMA) accepted a settlement of 1 million EUR with publication by name and commitments on cost information.

Authority / court

Autorité des services et marchés financiers (FSMA)

Area of law

Capital markets and financial supervision · Organisational requirements

Legal basis

Loi du 2 août 2002; Wohlverhaltensregeln (Loyalität, Kostentransparenz, bestmögliche Ausführung, Interessenkonflikte, Kundenkenntnis)

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Repeat case

yes

Mitigating circumstances

Remediation of all deficiencies (appropriateness test, conflicts policy, cost disclosure, waiver of CVA/KVA discounts).

Published

26 Jun 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Following an on-site inspection from February to April 2025, the Bank of Italy (Banca d'Italia) found deficiencies in customer due diligence, active cooperation (suspicious transaction reporting) and anti-money laundering controls, and imposed an administrative fine of 40,000 EUR. The duration of the deficiencies and the corrective measures initiated were taken into account.

Authority / court

Banca d'Italia

Area of law

Money laundering and terrorist financing · Customer due diligence

Legal basis

Art. 62 d.lgs. 231/2007; Verstöße gegen Art. 7, 16–19, 24, 25, 35, 36 d.lgs. 231/2007

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Mitigating circumstances

Corrective measures initiated

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The debt collection company posted personal data of alleged debtors on the internet, some of it particularly sensitive, in order to obtain information on their whereabouts and to warn third parties. The Swiss Federal Administrative Court (Bundesverwaltungsgericht, A-3891/2025) upheld the ruling of the Federal Data Protection and Information Commissioner (EDÖB) of 28 April 2025, according to which this constitutes an unjustified violation of privacy.

Authority / court

Bundesverwaltungsgericht (A-3891/2025) auf Verfügung des EDÖB vom 28.04.2025

Area of law

Data protection · Data subject rights and transparency

Legal basis

DSG Art. 6, Art. 19, Art. 31

Action

Order

Status of proceedings

final

Sector

Financial services and insurance

Published

20 Aug 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The UK Financial Conduct Authority (FCA) issued a public censure because the London branch opened and operated accounts for the wealth manager WealthTek, although its own register searches showed that it lacked permissions to hold client assets, and overlooked a restriction noted in the register; 16 monitoring alerts were not worked through over two years, and more than £314 million flowed through the accounts. In view of cooperation and a voluntary payment of £31.7 million to WealthTek clients, the FCA refrained from imposing a fine (otherwise £23.1 million after discount).

Authority / court

Financial Conduct Authority (FCA)

Area of law

Money laundering and terrorist financing · Customer due diligence

Legal basis

Section 205 FSMA (Public Censure) wegen Verstoßes gegen FCA Principle 2; Maßstab u. a. SYSC 6.1.1R, 6.3.1R, 6.3.3R und Regulations 18, 27, 28 MLR 2017

Action

Reprimand or warning

Status of proceedings

final

Sector

Financial services and insurance

Mitigating circumstances

Cooperation, acknowledgement of the deficiencies and a voluntary payment of £31,714,068 to those harmed

Published

25 Jun 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

For the period April 2022 to May 2023, the Swedish financial supervisory authority Finansinspektionen (FI) found that the bank’s general risk assessment did not realistically assess the terrorist financing risks of its corporate products and that no enhanced due diligence measures were taken for high-risk corporate customers. FI issued a remark and imposed 140 million SEK; the bank has brought an action before the administrative court.

Authority / court

Finansinspektionen (FI)

Area of law

Money laundering and terrorist financing · Customer due diligence

Legal basis

Penningtvättslagen (2017:630)

Action

Fine

Status of proceedings

under appeal

Sector

Financial services and insurance

Published

17 Jun 2026

Original amount 140,000,000 SEK, converted at the ECB reference rate of 17 Jun 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

For the period June 2023 to June 2024, the Cyprus Securities and Exchange Commission (CySEC) examined the investment firm’s organisational requirements, client information, appropriateness assessment and compliance with the restrictions on marketing CFDs to retail investors. The proceedings were concluded with a settlement of 100,000 EUR, which the company has already paid.

Authority / court

Cyprus Securities and Exchange Commission (CySEC)

Area of law

Capital markets and financial supervision · Organisational requirements

Legal basis

Art. 22(1), 25(1), 26(3) Gesetz über Wertpapierdienstleistungen 2017; Art. 42 VO (EU) 600/2014; CySEC-Richtlinie DI87-09; Art. 37(4) CySEC-Gesetz

Action

Other

Status of proceedings

final

Sector

Financial services and insurance

Published

24 Aug 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The bank failed to draw up insider lists in good time for two pieces of inside information (termination of the core banking project with Cognizant in 2021, merger talks with Liedon Säästöpankki in 2022), did not update them and omitted mandatory information. The Finanssivalvonta (Finnish Financial Supervisory Authority, FIN-FSA) imposed a total fine of 400,000 EUR; the decision was not appealed and is final.

Authority / court

Finanssivalvonta (FIN-FSA)

Area of law

Capital markets and financial supervision · Market abuse and insider dealing

Legal basis

Verordnung (EU) Nr. 596/2014 (MAR) Art. 18 Abs. 1, 3 und 4; Durchführungsverordnung (EU) 2016/347

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Mitigating circumstances

Measures to prevent recurrence and partial admission/cooperation had a mitigating effect.

Published

15 May 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Fraudsters in possession of customer data posed as customers at the bank's ‘Open24’ call centre, had account details changed and obtained further information because security protocols were not followed; those affected had to close accounts, and some suffered losses. Ireland's Data Protection Commission (DPC) imposed 250,000 EUR for inadequate security and 27,500 EUR for late breach notification (decision served in the week before the press release).

Authority / court

Data Protection Commission (DPC)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5 Abs. 1 lit. f, Art. 32 Abs. 1, Art. 33 Abs. 1 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Published

8 May 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

One of the insurer’s intermediaries was removed from the FSMA register in December 2023; owing to a human data entry error in the monitoring tool, P&V only noticed this after more than a month and concluded 34 contracts through him during that time. The Autorité des services et marchés financiers (Belgian Financial Services and Markets Authority, FSMA) accepted a settlement of 150,000 EUR; there had already been a settlement for the same amount in 2020.

Authority / court

Autorité des services et marchés financiers (FSMA)

Area of law

Capital markets and financial supervision · Organisational requirements

Legal basis

Loi du 4 avril 2014 relative aux assurances, Art. 259

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Repeat case

yes

Mitigating circumstances

IT adjustments to prevent recurrence.

Published

5 May 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Although the Information and Data Protection Commissioner (IDPC) had already ruled in favour of a complainant, an insurance company (name redacted) again had him called for marketing purposes via a third-party company; his number remained on call lists. The IDPC criticised the lack of safeguards and inadequate contracts with processors, ordered remedial action within 20 days and imposed two fines totalling 1,000 EUR.

Authority / court

Information and Data Protection Commissioner (IDPC)

Area of law

Data protection · Marketing and consent

Legal basis

Art. 5 Abs. 2, Art. 21 Abs. 2, Art. 24 Abs. 1, Art. 28 Abs. 3 i. V. m. Art. 58 Abs. 2 lit. b, d, i DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Repeat case

yes

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

In 2023, attackers exploited a zero-day vulnerability in MOVEit Transfer to steal files containing social security, driving licence, account and health data. The New York State Department of Financial Services (NYDFS) criticised inadequate retention settings, policies and controls as well as the late notification of the cybersecurity incidents to the supervisory authority.

Authority / court

New York State Department of Financial Services (NYDFS)

Area of law

Information security and cyber · Security measures and risk management

Legal basis

23 NYCRR Part 500 (Cybersecurity Regulation)

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Culpability

negligent

Published

30 Apr 2026

Original amount 2,250,000 USD, converted at the ECB reference rate of 29 Apr 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The operator of alternative trading systems passed on confidential order and trading information from its fixed income and equity platforms to unauthorised employees, lacked adequate safeguards and was initially not forthcoming with the regulator. Sanctions: administrative penalty of 600,000 CAD, 75,000 CAD in costs, a reprimand and an external review.

Authority / court

Capital Markets Tribunal (Ontario) auf Antrag der Ontario Securities Commission

Area of law

Capital markets and financial supervision · Organisational requirements

Legal basis

National Instrument 21-101, s. 5.10(1)-(3); Securities Act (Ontario) ss. 127(1), 127.1

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Mitigating circumstances

Cooperation, self-report, no prior record

Original amount 600,000 CAD, converted at the ECB reference rate of 15 Apr 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) imposed 693,742.50 CAD on the Edmonton money services business, which also exchanges virtual currencies, for five violations: repeated failure to file suspicious transaction reports, lack of written compliance policies, insufficient enhanced measures for high-risk transactions, lack of a risk assessment and incomplete records of occupation and transactions for crypto exchanges.

Authority / court

Financial Transactions and Reports Analysis Centre of Canada (FINTRAC)

Area of law

Money laundering and terrorist financing · Suspicious activity reports

Legal basis

Proceeds of Crime (Money Laundering) and Terrorist Financing Act, Part 1, und zugehörige Verordnungen

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Published

14 May 2026

Original amount 693,742.5 CAD, converted at the ECB reference rate of 27 Mar 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

After a new order management system was introduced in June 2024, CFD transactions with an underlying value of around 3.05 billion USD were not captured by automated trade surveillance. The bank identified the error in October 2024 but only remedied it in May 2025; the Financial Conduct Authority (FCA) imposed 338,000 GBP after a 30% cooperation discount.

Authority / court

Financial Conduct Authority (FCA)

Area of law

Capital markets and financial supervision · Organisational requirements

Legal basis

Art. 16 Abs. 2 UK MAR; SYSC 6.1.1R; FCA Principle 3

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Mitigating circumstances

Full cooperation (30% discount); CFD business discontinued in May 2025.

Original amount 338,000 GBP, converted at the ECB reference rate of 27 Mar 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Between September 2021 and August 2023, the asset manager failed to report a total of 2,867 transactions to the supervisory authority on time and in 2024 also submitted quarterly reports (FINREP) late. The Finanssivalvonta (Finnish Financial Supervisory Authority, FIN-FSA) imposed a total fine of 70,000 EUR; the admission had a mitigating effect.

Authority / court

Finanssivalvonta (FIN-FSA)

Area of law

Capital markets and financial supervision · Disclosure and reporting obligations

Legal basis

MiFIR (VO (EU) 600/2014) Art. 26 Abs. 1; IFR (VO (EU) 2019/2033) Art. 54 Abs. 1; FIN-FSA-Vorschriften 20/2013 (FINREP)

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Mitigating circumstances

Admission of the failures / cooperation.

Published

25 Mar 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The US Financial Crimes Enforcement Network (FinCEN) imposed 80 million USD on the broker-dealer, which admitted wilful BSA infringements: no effective AML programme, no due diligence on correspondent accounts of foreign financial institutions and failure to file suspicious activity reports in connection with securities fraud. Remedial measures that had been promised were not implemented for years.

Authority / court

Financial Crimes Enforcement Network (FinCEN)

Area of law

Money laundering and terrorist financing · Customer due diligence

Legal basis

Bank Secrecy Act (BSA)

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Culpability

intentional

Published

6 Mar 2026

Original amount 80,000,000 USD, converted at the ECB reference rate of 6 Mar 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Following the introduction of a new core banking system in April 2025, the bank was unable, until September 2025, to submit the mandatory weekly data deliveries to the Centralised Bank Account Register (CBAR) on time. The Financial Intelligence Analysis Unit (FIAU) imposed 69,000 EUR.

Authority / court

Financial Intelligence Analysis Unit (FIAU)

Area of law

Money laundering and terrorist financing

Legal basis

Reg. 4(2), 8 Centralised Bank Account Register Regulations (S.L. 373.03)

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Mitigating circumstances

The bank continuously attempted to upload reports

Published

6 Mar 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Following enforcement proceedings, the Swiss Financial Market Supervisory Authority (FINMA) found serious, systematic deficiencies in anti-money laundering due diligence, organisation and risk management; the bank enabled clients to circumvent official asset freezes and executed transactions for sanctioned persons. FINMA had withdrawn the bank's licence and ordered its liquidation; with the withdrawal of the appeal before the Federal Administrative Court, the orders took effect on 27 February 2026. The day before, FinCEN had proposed designating the bank as an institution of primary money laundering concern.

Authority / court

Eidgenössische Finanzmarktaufsicht (FINMA)

Area of law

Money laundering and terrorist financing · Internal controls

Legal basis

Schweizer Geldwäschereirecht und Bankenaufsichtsrecht (laut FINMA)

Action

Order

Status of proceedings

final

Sector

Financial services and insurance

Employees

50 to 249

Published

27 Feb 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

From 2017 to 2020, an Austrian bank specialising in private and investment banking had not adequately examined the ownership and control structure of an offshore holding client despite the lack of evidence on shareholders, trust arrangements and beneficial owners. The Austrian Federal Administrative Court (Bundesverwaltungsgericht, BVwG) confirmed the infringement but reduced the additional penalty imposed by the Financial Market Authority (Finanzmarktaufsicht, FMA) in its penalty decision of 17 December 2024 from 476,000 to 356,000 EUR (total penalty 436,000 EUR less FMA penalties already paid), because the FMA had taken the seriousness of the offence into account twice and the bank had cooperated, admitted its errors and terminated the client relationship; an appeal on points of law has been permitted.

Authority / court

Bundesverwaltungsgericht (BVwG); Straferkenntnis der Finanzmarktaufsicht (FMA) vom 17.12.2024

Area of law

Money laundering and terrorist financing · Customer due diligence

Legal basis

§ 9 Abs. 1 erster Satz i. V. m. § 6 Abs. 1 Z 2 FM-GwG; § 35 Abs. 1 und 3 i. V. m. § 34 Abs. 1 Z 2 und Abs. 2 FM-GwG; § 22 Abs. 9 FMABG (Zusatzstrafe)

Action

Fine

Status of proceedings

reduced

Sector

Financial services and insurance

Culpability

negligent

Mitigating circumstances

Reduction by the court because the wrongfulness of the offence had been counted twice, cooperation, admission of the facts and of guilt, and termination of the client relationship

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The Luxembourg trade repository lacked adequate compliance procedures and an appropriate organisational structure, failed to identify operational risks and did not adequately protect the confidentiality and integrity of the reported data. ESMA imposed fines totalling 1,374,000 EUR for negligent infringements under EMIR and SFTR; the case is under appeal.

Authority / court

Europäische Wertpapier- und Marktaufsichtsbehörde (ESMA)

Area of law

Capital markets and financial supervision · Organisational requirements

Legal basis

Verordnung (EU) Nr. 648/2012 (EMIR), Art. 65, 73, Anhang I; Verordnung (EU) 2015/2365 (SFTR), Art. 9

Action

Fine

Status of proceedings

under appeal

Sector

Financial services and insurance

Culpability

negligent

Repeat case

yes

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The Austrian Federal Administrative Court (Bundesverwaltungsgericht, BVwG) dismissed the appeal of a listed major Austrian bank and upheld the fine of 588,000 EUR (plus 58,800 EUR in procedural costs) imposed by the Financial Market Authority (Finanzmarktaufsicht, FMA) in its penalty decision of 19 November 2024. From 2017 to 2020, the bank had not adequately risk-classified three business relationships and had disregarded sector risks such as gambling and precious metals trading as well as cash intensity; an appeal on points of law has been permitted.

Authority / court

Bundesverwaltungsgericht (BVwG); Straferkenntnis der Finanzmarktaufsicht (FMA) vom 19.11.2024

Area of law

Money laundering and terrorist financing · Customer due diligence

Legal basis

§ 6 Abs. 5 i. V. m. § 34 Abs. 1 Z 2 und § 35 Abs. 1–3 FM-GwG

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Following a guilty plea to charges including conspiracy to operate an unlicensed money transmitting business and to violate the AML obligations of the Bank Secrecy Act, the peer-to-peer crypto platform was sentenced to a penalty of 4 million USD. 112.5 million USD would have been appropriate, but the US Department of Justice (DOJ) found an inability to pay; in December 2025, FinCEN had additionally imposed a civil penalty of 3.5 million USD.

Authority / court

U.S. Department of Justice

Area of law

Money laundering and terrorist financing · Internal controls

Legal basis

Travel Act; Verschwörung zum Betrieb eines nicht lizenzierten Geldtransfergeschäfts und zur Verletzung der AML-Pflichten des Bank Secrecy Act

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Culpability

intentional

Mitigating circumstances

Penalty limited from 112.5 million to 4 million USD because of proven inability to pay

Published

11 Feb 2026

Original amount 4,000,000 USD, converted at the ECB reference rate of 10 Feb 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Until March 2018, the payment institution had no systematic integrity risk analysis (SIRA) and therefore no systematic identification and analysis of integrity risks for its gatekeeper function. The Dutch central bank (De Nederlandsche Bank, DNB) imposed the fine in 2020; following objection and appeal proceedings, it was fixed at the reduced amount of 406,125 EUR by the decision of 28 January 2026 and was published in July 2026.

Authority / court

De Nederlandsche Bank (DNB)

Area of law

Money laundering and terrorist financing · Internal controls

Legal basis

Art. 3:10 Wet op het financieel toezicht (Wft); Art. 10 Besluit prudentiële regels Wft (Bpr)

Action

Fine

Status of proceedings

reduced

Sector

Financial services and insurance

Mitigating circumstances

Fine reduced in the objection and appeal proceedings

Published

21 Jul 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

An on-site inspection in 2023 revealed that the life insurer in some cases did not handle the mandatory money laundering risk assessment questionnaires in compliance with the rules, that the employees responsible lacked sufficiently precise instructions and that customer files contained many incorrect answers. The Commissariat aux Assurances (Luxembourg insurance supervisory authority, CAA) imposed 615,000 EUR.

Authority / court

Commissariat aux Assurances (CAA)

Area of law

Money laundering and terrorist financing · Customer due diligence

Legal basis

Loi modifiée du 12 novembre 2004 (LBC/FT), Art. 2-1, 8-4, 8-5; Règlement CAA 20/03

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Mitigating circumstances

Close cooperation with the CAA during and after the inspection; remediation plan for all deficiencies submitted promptly.

Published

1 Jul 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The mobile banking app of a bank (name not published) scanned the list of all installed applications on the Android and Huawei devices of 433,922 customers and stored it centrally – without a legal basis, without transparent information and without a data-minimising design. The Agencija za zaštitu osobnih podataka (Croatian Personal Data Protection Agency, AZOP) imposed 1.5 million EUR; the decision is not final (date = publication).

Authority / court

Agencija za zaštitu osobnih podataka (AZOP)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 5 Abs. 1 lit. a und c, Art. 6 Abs. 1, Art. 12, 13, 25 Abs. 2 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Published

18 Dec 2025

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The UK Financial Conduct Authority (FCA) imposed £44,078,500 (after a 30% discount) because, from October 2016 to July 2021, the building society had no effective systems to keep due diligence and risk assessments for personal customers up to date, and did not identify personal accounts used for business purposes. As a result, one customer received 24 fraudulent Covid furlough payments totalling £27.3 million.

Authority / court

Financial Conduct Authority (FCA)

Area of law

Money laundering and terrorist financing · Customer due diligence

Legal basis

FCA Principle 3; SYSC 6.1.1R und 6.3.1R

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Employees

10,000 or more

Mitigating circumstances

30% settlement discount

Published

12 Dec 2025

Original amount 44,078,500 GBP, converted at the ECB reference rate of 11 Dec 2025.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

With the help of an employee of its competitor I&G Insurance Brokers who later moved to ZP Libra, the broker unfairly concluded a brokerage agreement to the detriment of the competitor and used the competitor’s trade secrets to poach customers. The Комисия за защита на конкуренцията (Bulgarian Commission for the Protection of Competition, KZK) imposed 29,470 leva (1% of 2024 turnover, Art. 36(1) ZZK – Bulgarian Protection of Competition Act) and 14,735 leva (0.5%, Art. 37(1) ZZK); fines totalling 1,000 leva were also imposed on the employee.

Authority / court

Комисия за защита на конкуренцията (КЗК, Bulgarische Wettbewerbskommission)

Area of law

Competition law

Legal basis

Art. 36 Abs. 1, Art. 37 Abs. 1 ZZK

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Liability of senior managers

Fines on the employee involved (1,000 leva in total)

Published

16 Dec 2025

Original amount 44,205 BGN, converted at the ECB reference rate of 11 Dec 2025.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The lender did not submit its 2024 annual report, together with the audit report, the resolution on the appropriation of profits and the minutes of the shareholders’ meeting, to the financial supervisory authority on time. In misdemeanour proceedings, the Finantsinspektsioon (Estonian Financial Supervision Authority) imposed a fine of 16,000 EUR; the maximum is 1 million EUR or 10% of annual turnover. Date = publication.

Authority / court

Finantsinspektsioon (Estnische Finanzaufsicht)

Area of law

Capital markets and financial supervision · Disclosure and reporting obligations

Legal basis

§ 56 Abs. 3, § 96 Abs. 2 KAVS (Gesetz über Kreditgeber und -vermittler)

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Published

10 Dec 2025

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

In 2017/2018, the Chicago fund manager specialising in data centres took in capital from the Russian oligarch Suleiman Kerimov via nested structures and continued to manage this investment for four years after his designation in April 2018. The US Treasury's Office of Foreign Assets Control (OFAC) assessed the case as non-egregious and not voluntarily self-disclosed.

Authority / court

U.S. Department of the Treasury, Office of Foreign Assets Control (OFAC)

Area of law

Sanctions and export control · Breaches of sanctions and embargoes

Legal basis

Ukraine-/Russia-Related Sanctions Regulations (31 C.F.R. part 589); IEEPA

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Mitigating circumstances

No prior violations in five years; cooperation improved significantly only after initially insufficient engagement (including waiver of attorney-client privilege), hence only limited credit

Published

2 Dec 2025

Original amount 11,485,352 USD, converted at the ECB reference rate of 2 Dec 2025.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

When the website was accessed, eight non-exempt cookies were placed without any user action; after ‘Reject all’, three marketing cookies were nevertheless placed when switching to an affiliated domain, and after consent was withdrawn, cookies continued to be read. The Commission nationale de l’informatique et des libertés (French data protection authority, CNIL) imposed 1.5 million EUR for this and, in view of the rectification during the proceedings, refrained from issuing an order; it found an infringement of data minimisation in the recording of customer calls but did not sanction it.

Authority / court

Commission nationale de l'informatique et des libertés (CNIL), formation restreinte

Area of law

Data protection · Cookies and tracking

Legal basis

Art. 82 Loi Informatique et Libertés (Geldbuße); Verstoß gegen Art. 5 Abs. 1 lit. c DSGVO (Gesprächsaufzeichnungen) festgestellt, aber nicht sanktioniert

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Employees

10,000 or more

Mitigating circumstances

Corrections during the proceedings, cooperation.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The Swedish financial supervisory authority Finansinspektionen (FI) examined consumer loans granted by the lender over four weeks in summer 2024 and found at least around 30 cases in which consumers without the ability to repay received loans. FI issued a remark and imposed 20 million SEK.

Authority / court

Finansinspektionen (FI)

Area of law

Consumer protection and online retail

Legal basis

Konsumentkreditlagen (2010:1846), Kreditprüfung

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Published

11 Nov 2025

Original amount 20,000,000 SEK, converted at the ECB reference rate of 11 Nov 2025.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

In a settlement of 5 November 2025, the Central Bank of Ireland imposed a reprimand and 21,464,734 EUR (after a 30% discount on 30,663,906 EUR) for breaches of transaction monitoring obligations between April 2021 and March 2025: because of configuration errors in the monitoring system, more than 30 million transactions worth over 176 billion EUR – around 31% of all transactions – were not properly monitored over a period of twelve months. The subsequent review took almost three years and led to 2,708 suspicious transaction reports; the High Court confirmed the sanction on 12 January 2026, and it is the Central Bank's first enforcement action in the crypto sector.

Authority / court

Central Bank of Ireland

Area of law

Money laundering and terrorist financing · Internal controls

Legal basis

Criminal Justice (Money Laundering and Terrorist Financing) Act 2010

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Mitigating circumstances

30% settlement discount

Published

6 Nov 2025

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

By decision of 28 October 2025 (final since 7 November 2025), Germany's Federal Financial Supervisory Authority (BaFin) imposed a fine of 20,000 EUR because, from October 2022 to September 2023, the Landesbank operated data processing systems for money laundering prevention that were only partially adequate. Under the German Banking Act (KWG), the criteria by which monitoring identifies suspicious transactions must be documented, and the systems must be checked regularly by an independent auditor.

Authority / court

Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin)

Area of law

Money laundering and terrorist financing · Internal controls

Legal basis

§ 56 Abs. 2 Nr. 11b KWG (Betrieb angemessener Datenverarbeitungssysteme zur Geldwäscheprävention)

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Published

10 Dec 2025

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Following a technical change to the bank’s strong electronic identification service, a disruption lasting around one hour occurred in January 2023 during which customers logging in with Aktia credentials to services such as OmaKanta, OmaKela, unemployment funds, insurers and healthcare providers saw data of other persons; around 350 people were affected. The sanctions board of the Tietosuojavaltuutetun toimisto (Office of the Data Protection Ombudsman) criticised the deficient planning, implementation and testing of the change and imposed 865,000 EUR in addition to a reprimand.

Authority / court

Tietosuojavaltuutetun toimisto – seuraamuskollegio (Datenschutzbeauftragter, Sanktionsgremium)

Area of law

Data protection · Data breaches and data security

Legal basis

DSGVO Art. 5 Abs. 1 lit. f, Art. 25, Art. 32

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Published

28 Oct 2025

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

After the tax authority had refused the tax shelter certificates for a financed show and the insurer left cover open, the provider failed to inform investors of this material risk in good time by means of a prospectus supplement. The Autorité des services et marchés financiers (Belgian Financial Services and Markets Authority, FSMA) accepted a settlement of 75,000 EUR with publication by name.

Authority / court

Autorité des services et marchés financiers (FSMA)

Area of law

Capital markets and financial supervision · Disclosure and reporting obligations

Legal basis

Verordnung (EU) 2017/1129 Art. 23; Loi du 11 juillet 2018 (Loi Prospectus)

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Published

21 Oct 2025

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) imposed 176,960,190 CAD on the crypto payment service registered in British Columbia. In July 2024 alone, 1,068 suspicious transaction reports were not filed – including on transactions linked to child sexual abuse material, fraud, ransomware and sanctions evasion – as well as 1,518 reports of large virtual currency transactions; in addition, there were violations of a ministerial directive and a lack of policies and risk assessment. The company has appealed to the Federal Court.

Authority / court

Financial Transactions and Reports Analysis Centre of Canada (FINTRAC)

Area of law

Money laundering and terrorist financing · Suspicious activity reports

Legal basis

Proceeds of Crime (Money Laundering) and Terrorist Financing Act, Part 1, und zugehörige Verordnungen

Action

Fine

Status of proceedings

under appeal

Sector

Financial services and insurance

Published

22 Oct 2025

Original amount 176,960,190 CAD, converted at the ECB reference rate of 16 Oct 2025.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Between July 2023 and April 2024, the payment service provider, a substantial part of whose business is linked to the gambling sector, had gaps in its general risk assessment (including a missing assessment of its currency exchange service), in its customer risk assessment and in customer due diligence. The Swedish financial supervisory authority Finansinspektionen (FI) issued a remark and imposed 3 million SEK.

Authority / court

Finansinspektionen (FI)

Area of law

Money laundering and terrorist financing · Customer due diligence

Legal basis

Penningtvättslagen (2017:630)

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Published

15 Oct 2025

Original amount 3,000,000 SEK, converted at the ECB reference rate of 15 Oct 2025.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Attackers harvested driving licence numbers and dates of birth via inadequately secured online quoting tools and agent portals. According to the New York State Department of Financial Services (NYDFS), Farmers infringed the cybersecurity regulation and did not report the incident in time; the penalty is part of a package totalling $19 million against eight motor insurers.

Authority / court

New York State Department of Financial Services (NYDFS)

Area of law

Information security and cyber · Security measures and risk management

Legal basis

23 NYCRR Part 500 (Cybersecurity Regulation)

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Culpability

negligent

Published

14 Oct 2025

Original amount 2,775,000 USD, converted at the ECB reference rate of 14 Oct 2025.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Attackers extracted driver’s licence numbers in plain text via the motor insurer’s instant quote applications. Infinity discovered the anomalies on 9 February 2021 but only reported the cybersecurity event to the New York State Department of Financial Services (NYDFS) on 14 April 2021; the supervisor also criticised the lack of MFA and insecure development practices.

Authority / court

New York State Department of Financial Services (NYDFS)

Area of law

Information security and cyber · Incident reporting obligations

Legal basis

23 NYCRR § 500.17(a), § 500.12(a) u. a.

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Culpability

negligent

Original amount 2,250,000 USD, converted at the ECB reference rate of 14 Oct 2025.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

During an inspection, the Finantsinspektsioon (Estonian Financial Supervision Authority) found that Inbank Finance’s internal rules on assessing the creditworthiness of consumers did not fully comply with the law and that the assessment itself showed deficiencies. It issued an order requiring the company to remedy the deficiencies by mid-December. Date = publication.

Authority / court

Finantsinspektsioon (Estnische Finanzaufsicht)

Area of law

Consumer protection and online retail

Legal basis

Gesetz über Kreditgeber und -vermittler (KAVS), verantwortungsvolle Kreditvergabe

Action

Order

Status of proceedings

unknown

Sector

Financial services and insurance

Published

14 Oct 2025

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

By decision of 13 October 2025 (final since 30 October 2025), Germany's Federal Financial Supervisory Authority (BaFin) imposed a fine of 45 million EUR on J.P. Morgan SE because the institution had culpably breached its duty of supervision in the internal processes for filing money laundering suspicious activity reports; from 4 October 2021 to 30 September 2022, suspicious activity reports were systematically not filed on time. BaFin points out that, in the case of systematic infringements, the amount of the fine can be based on the institution's total turnover.

Authority / court

Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin)

Area of law

Money laundering and terrorist financing · Suspicious activity reports

Legal basis

§ 130 Abs. 1 OWiG (Aufsichtspflichtverletzung) i. V. m. Pflichten nach dem GwG (Verdachtsmeldungen); Bekanntmachung nach § 57 Abs. 1 GwG

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Employees

10,000 or more

Published

6 Nov 2025

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

For 2022 to 2024, the Cyprus Securities and Exchange Commission (CySEC) found that the investment firm had no adequate compliance procedures, did not define target markets for its financial instruments, did not act in the best interests of clients and did not inform clients in a fair, clear and not misleading manner. It imposed fines of 50,000, 30,000 and 20,000 EUR; a judicial review of the decision has been recorded.

Authority / court

Cyprus Securities and Exchange Commission (CySEC)

Area of law

Capital markets and financial supervision · Organisational requirements

Legal basis

Sec. 17(2), 17(3)(c), 22(1), 25(1), 25(3)(a) Gesetz über Wertpapierdienstleistungen 2017; Art. 22, 44 Delegierte VO (EU) 2017/565

Action

Fine

Status of proceedings

under appeal

Sector

Financial services and insurance

Published

17 Dec 2025

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The Commissariat aux Assurances (Luxembourg insurance supervisory authority, CAA) withdrew the broking firm’s licence (effective from 1 December 2025), among other things for using unregistered intermediaries, lacking internal expertise, insufficiently protected confidential data, economically unexplained payment flows with affiliated companies, incomplete or false information provided to the supervisory authority and deficient customer information.

Authority / court

Commissariat aux Assurances (CAA)

Area of law

Capital markets and financial supervision · Organisational requirements

Legal basis

Loi modifiée du 7 décembre 2015 sur le secteur des assurances, Art. 303 Abs. 3 lit. c

Action

Other

Status of proceedings

unknown

Sector

Financial services and insurance

Published

29 May 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

After an update of the PSD2 interface for third-party providers in July 2023, the confidentiality of 57 IBAN accounts of bank customers was not ensured. The banking supervisor, Banka Slovenije (Bank of Slovenia), issued a reprimand to the bank and to the responsible IT development director for breaching the obligation to protect confidential data (final).

Authority / court

Banka Slovenije

Area of law

Information security and cyber · Security measures and risk management

Legal basis

Art. 146, Art. 396 Abs. 1 Nr. 18 ZBan-3 (slowenisches Bankengesetz)

Action

Reprimand or warning

Status of proceedings

final

Sector

Financial services and insurance

Liability of senior managers

Reprimand also issued to the responsible Director of IT Development (Dejan Pust).

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

From June 2021 to October 2024, the company, which raises tax shelter funds through public offerings, kept a public offering on its website with an information note from 2020 without publishing an updated note and filing it with the Autorité des services et marchés financiers (Belgian Financial Services and Markets Authority, FSMA); several dozen investors with an investment volume of under 5 million EUR were affected. The FSMA accepted a settlement of 10,000 EUR.

Authority / court

Autorité des services et marchés financiers (FSMA)

Area of law

Capital markets and financial supervision · Disclosure and reporting obligations

Legal basis

Loi du 11 juillet 2018 (Loi Prospectus), Art. 10, 11

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Published

16 Sep 2025

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

After a new login function was introduced in the S-mobiili app in April 2022, a vulnerability in the identification service made it possible until August 2022 to access online banking and services requiring strong authentication using other customers’ credentials; misuse caused financial losses. The bank had introduced the function without sufficient risk analysis and testing; the sanctions board of the Tietosuojavaltuutetun toimisto (Office of the Data Protection Ombudsman) imposed 1.8 million EUR in addition to a reprimand, with a previous reprimand acting as an aggravating factor.

Authority / court

Tietosuojavaltuutetun toimisto – seuraamuskollegio (Datenschutzbeauftragter, Sanktionsgremium)

Area of law

Data protection · Data breaches and data security

Legal basis

DSGVO Art. 5 Abs. 1 lit. f, Art. 25 Abs. 1, Art. 32 Abs. 1 und 2

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Repeat case

yes

Mitigating circumstances

The fine imposed by the financial supervisory authority (7.67 million EUR) for the same facts was taken into account (fine around one third of the amount that would otherwise have been imposed); according to the bank, it compensated customers for direct losses.

Published

10 Sep 2025

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Paysera acquired 100% of the shares in UAB ‘Finansinės paslaugos „Contis“’ before the assessment period had expired and without a non-objection from the supervisory authority; in April 2025, the Lietuvos bankas (Bank of Lithuania, financial supervisor) objected to the acquisition owing to a lack of documents on reputation, financial soundness and money laundering risks. In addition, the annual financial statements and other reports were not approved and submitted on time. Fine of 400,000 EUR and obligation to remedy by 30 September 2025. Source: archived copy of the press release.

Authority / court

Lietuvos bankas (Litauische Zentralbank, Finanzaufsicht)

Area of law

Capital markets and financial supervision · Organisational requirements

Legal basis

Elektroninių pinigų ir elektroninių pinigų įstaigų įstatymas (Inhaberkontrolle, Berichtspflichten)

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Published

5 Sep 2025

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

For the period November 2020 to May 2025, the Cyprus Securities and Exchange Commission (CySEC) investigated the investment firm’s handling of conflicts of interest and its general conduct of business and information obligations towards clients. The proceedings ended with a settlement of 70,000 EUR, which the company has paid.

Authority / court

Cyprus Securities and Exchange Commission (CySEC)

Area of law

Capital markets and financial supervision · Organisational requirements

Legal basis

Art. 24(1), 25(1) Gesetz über Wertpapierdienstleistungen 2017; Art. 37(4) CySEC-Gesetz

Action

Other

Status of proceedings

final

Sector

Financial services and insurance

Published

17 Nov 2025

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

By decision of 22 August 2025, Germany's Federal Financial Supervisory Authority (BaFin) imposed a fine of 3.3 million EUR because the bank systematically filed suspicious activity reports late from June 2023 to March 2025; in February 2025, a penalty payment of 500,000 EUR had already been imposed for failure to comply with a 2023 order concerning Iran-related transactions (total 3.8 million EUR). In addition, in July 2025 BaFin ordered comprehensive remediation of the deficiencies in money laundering prevention, with an action plan and reporting obligations.

Authority / court

Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin)

Area of law

Money laundering and terrorist financing · Suspicious activity reports

Legal basis

Bußgeld: § 56 Abs. 1 S. 1 Nr. 69, Abs. 3 GwG; Anordnung: § 51 Abs. 2 GwG, § 44 Abs. 1 KWG; Zwangsgeld: § 14 VwVG i. V. m. § 17 FinDAG; Bekanntmachung nach § 57 Abs. 1 GwG

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Repeat case

yes

Published

16 Sep 2025

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Between 2011 and 2014, the bank did not take all the necessary organisational precautions, with the result that bribes flowed to Petrobras executives through several account relationships (around 71 million USD in attempted or completed aggravated money laundering). Fine of 3.5 million CHF; because of a settlement of 16 million CHF with Petrobras, the Office of the Attorney General of Switzerland (Bundesanwaltschaft, OAG) waived a compensation claim. A former asset manager was separately given a suspended prison sentence.

Authority / court

Bundesanwaltschaft

Area of law

Money laundering and terrorist financing · Internal controls

Legal basis

Art. 102 Abs. 2 StGB i. V. m. Art. 305bis Abs. 1 und 2 StGB

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Mitigating circumstances

Time elapsed since the offence, organisational corrective measures after the affair became known; no compensation claim because of the payment of 16 million CHF to Petrobras.

Liability of senior managers

A former asset manager was separately given a suspended prison sentence of six months for aggravated money laundering (offences committed at another Swiss bank).

Published

22 Aug 2025

Original amount 3,500,000 CHF, converted at the ECB reference rate of 22 Aug 2025.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Between October 2014 and July 2015, around 174 million CHF from predicate offences in the 1MDB complex passed through the bank in 43 transfers, even though negative information about the Petrosaudi managers involved was publicly available. The Office of the Attorney General of Switzerland (Bundesanwaltschaft) convicted the bank by summary penalty order and imposed 3 million CHF; a compensation claim was waived because the 1MDB fund is being compensated as a private claimant.

Authority / court

Bundesanwaltschaft

Area of law

Money laundering and terrorist financing · Customer due diligence

Legal basis

Art. 102 Abs. 2 StGB i. V. m. Art. 305bis Abs. 1 und 2 StGB

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Mitigating circumstances

Time elapsed since the offence, very good cooperation in the proceedings, compensation of the private claimant (1MDB).

Published

22 Aug 2025

Original amount 3,000,000 CHF, converted at the ECB reference rate of 22 Aug 2025.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

An employee of the dental insurance service provider disclosed his login credentials via a phishing e-mail; the mailbox containing over 100,000 e-mails with health and social security data was accessible. Healthplex had known about the incident since November 2021 but only reported it to the New York State Department of Financial Services (NYDFS) in April 2022 instead of within 72 hours; in addition, there was no MFA for web access and no data retention and deletion policy.

Authority / court

New York State Department of Financial Services (NYDFS)

Area of law

Information security and cyber · Incident reporting obligations

Legal basis

23 NYCRR § 500.17(a), § 500.12(b), § 500.13, § 500.17(b)

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Culpability

negligent

Original amount 2,000,000 USD, converted at the ECB reference rate of 14 Aug 2025.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

A school employee gained access to her school’s official e-mail account and sent forged documents on the basis of which the credit association concluded 17 loans in 2023/2024 without the knowledge of the data subjects. The Romanian data protection authority (ANSPDCP) criticised the insufficient identity verification for remote applications and imposed 15,141.6 lei (3,000 EUR). Date = publication of the press release; according to the authority, the investigation was concluded in June 2025.

Authority / court

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 32 Abs. 2 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Published

12 Aug 2025

Original amount 15,141.6 RON, converted at the ECB reference rate of 12 Aug 2025.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The New York State Department of Financial Services (NYDFS) imposed a penalty of 26.5 million USD on the crypto trust company because Paxos did not maintain an effective BSA/AML programme before 2023: KYC checks and risk ratings were inadequate, and transaction monitoring and suspicious activity reporting procedures had gaps, including in connection with the business relationship with Binance, contrary to a 2020 agreement. In addition, Paxos must invest at least 22 million USD in its compliance programme.

Authority / court

New York State Department of Financial Services (NYDFS)

Area of law

Money laundering and terrorist financing · Customer due diligence

Legal basis

New York Banking Law §§ 39, 44; AML-Vorschriften des NYDFS und Bank Secrecy Act

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Published

7 Aug 2025

Original amount 26,500,000 USD, converted at the ECB reference rate of 7 Aug 2025.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

From 2017 to 2022, the Indian subsidiary Liberty General Insurance paid around 1.47 million USD to employees of six state-owned banks so that they would refer bank customers to its insurance products; the payments were booked as marketing expenses and routed through third parties. The DOJ declined to prosecute; Liberty Mutual is disgorging 4,699,088 USD in profits.

Authority / court

U.S. Department of Justice (Fraud Section; USAO District of Massachusetts)

Area of law

Bribery and corruption · Bribery of public officials

Legal basis

FCPA, 15 U.S.C. § 78dd-2; Corporate Enforcement and Voluntary Self-Disclosure Policy (Declination)

Action

Disgorgement of profits

Status of proceedings

final

Sector

Financial services and insurance

Employees

10,000 or more

Culpability

intentional

Mitigating circumstances

Voluntary self-disclosure (March 2024), full cooperation, root cause analysis, termination of those involved, improved controls including rules on messaging apps.

Published

7 Aug 2025

Original amount 4,699,088 USD, converted at the ECB reference rate of 7 Aug 2025.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The instalment payment provider created customer profiles without a contract for persons who signed in via retailer checkouts, refused former customers the closure of their accounts and continued to send them transactional e-mails with advertising content. The Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate, AKI) ordered transparent information, valid consent, erasure options under Art. 17 GDPR and the separation of transactional and advertising e-mails; a penalty payment of 5,000 EUR is threatened for each item not fulfilled.

Authority / court

Andmekaitse Inspektsioon (AKI)

Area of law

Data protection · Data subject rights and transparency

Legal basis

§ 56 Abs. 1, § 58 Abs. 1 IKS; Art. 58 Abs. 2 lit. d, Art. 4 Nr. 11, 5, 6, 7, 12–14, 17 DSGVO

Action

Order

Status of proceedings

unknown

Sector

Financial services and insurance

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Following an on-site inspection in 2024, the Commissariat aux Assurances (Luxembourg insurance supervisory authority, CAA) withdrew the broker’s licence (effective 15 September 2025): there was no effective management by approved managers, unlicensed ‘introducers’ were de facto selling insurance, and the broker’s licence, together with its sub-intermediary network, was improperly made available to third parties.

Authority / court

Commissariat aux Assurances (CAA)

Area of law

Capital markets and financial supervision · Organisational requirements

Legal basis

Loi modifiée du 7 décembre 2015 sur le secteur des assurances, Art. 273, 274, 283, 286, 303

Action

Other

Status of proceedings

unknown

Sector

Financial services and insurance

Published

16 Sep 2025

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

A fraudster impersonated a customer by e-mail and, between 2021 and 2023, obtained information and documents on three policies from the life insurer’s case handlers without his identity being verified. Although the customer alerted the company to the false e-mail address in September 2024, Poste Vita only notified the breach to the supervisory authority in January 2025.

Authority / court

Garante per la protezione dei dati personali

Area of law

Information security and cyber · Incident reporting obligations

Legal basis

Art. 5 Abs. 1 lit. a und f, Art. 33 Abs. 1 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Culpability

negligent

Mitigating circumstances

Immediate blocking of further communication, internal investigation, criminal complaint and stricter identity verification.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

In a coordinated multistate proceeding brought by six states – the New York State Department of Financial Services (NYDFS) with the supervisory authorities of CA, MN, NE, TX and MA – the money transmitter must pay 4.2 million USD. An examination (July 2022 to September 2023) found, among other things, a lack of independent AML reviews at an appropriate frequency, late suspicious activity reports, data quality problems in transaction monitoring and unremedied earlier findings; Wise does not admit any legal infringements and must conduct a lookback.

Authority / court

New York State Department of Financial Services (NYDFS) mit den Aufsichtsbehörden von CA, MN, NE, TX und MA

Area of law

Money laundering and terrorist financing · Suspicious activity reports

Legal basis

Bundes- und einzelstaatliches Recht zu Geldtransfer und BSA/AML (u. a. 31 CFR 1022.320)

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Mitigating circumstances

Remedial measures already initiated and lookback

Published

9 Jul 2025

Original amount 4,200,000 USD, converted at the ECB reference rate of 9 Jul 2025.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The reinsurer breached the principle of specialisation in reinsurance business, its approved manager was not effectively present on site and had insufficient powers, the governance system including oversight of outsourced functions was inadequate, and orders from a 2019 inspection had not been implemented or only partially. The Commissariat aux Assurances (Luxembourg insurance supervisory authority, CAA) imposed the statutory maximum of 250,000 EUR; the company cooperated.

Authority / court

Commissariat aux Assurances (CAA)

Area of law

Capital markets and financial supervision · Organisational requirements

Legal basis

Loi modifiée du 7 décembre 2015 sur le secteur des assurances, Art. 49, 71, 81, 274, 303

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Mitigating circumstances

Cooperation with the CAA during and after the inspection.

Published

8 Aug 2025

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The UK Financial Conduct Authority (FCA) imposed £21,091,300 (after a 30% discount) because, from 2018 to 2020, Monzo onboarded customers on the basis of sparse and sometimes obviously implausible information – such as well-known London landmarks given as addresses. Despite a requirement not to take on any more high-risk customers, the bank opened more than 34,000 such accounts up to 2022.

Authority / court

Financial Conduct Authority (FCA)

Area of law

Money laundering and terrorist financing · Customer due diligence

Legal basis

FCA Principle 3 (PRIN 3); s. 55L FSMA (Verstoß gegen Auflage)

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Mitigating circumstances

30% settlement discount

Published

8 Jul 2025

Original amount 21,091,300 GBP, converted at the ECB reference rate of 7 Jul 2025.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Following an anonymous tip-off about a USB stick containing data on more than one million vehicle owners (name, OIB, address, registration number, insurance data), the Croatian data protection authority (Agencija za zaštitu osobnih podataka, AZOP) found that the data originated from the database of the Insurance Bureau, which had not laid down appropriate protective measures or deletion periods. Because of its public tasks, the fine was capped at 101,000 EUR (date of publication; exact date of the decision not stated).

Authority / court

Agencija za zaštitu osobnih podataka (AZOP)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5 Abs. 1 lit. e, Art. 32 Abs. 2 und 4 DSGVO; Art. 44 kroatisches DSGVO-Durchführungsgesetz

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Mitigating circumstances

Cap due to public tasks (Art. 44 of the Implementing Act).

Published

2 Jul 2025

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Between 2014 and 2021, the credit union solicited cash from persons without an account and accepted 2,329 cash deposits totalling 8.75 million EUR without the required anti-money laundering checks; the board had known about the risk since 2015, and there was no self-reporting. The Central Bank of Ireland imposed a reprimand and 36,273 EUR (after a 30% discount on 51,819 EUR).

Authority / court

Central Bank of Ireland

Area of law

Money laundering and terrorist financing · Customer due diligence

Legal basis

Criminal Justice (Money Laundering and Terrorist Financing) Act 2010; Credit Union Act 1997

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Mitigating circumstances

30% settlement discount

Liability of senior managers

The board had known about the risks since 2015 without taking remedial action

Published

2 Jul 2025

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

An on-site inspection from February to May 2024 revealed deficiencies in organisation and internal controls relating to customer profiling, due diligence obligations and active cooperation (suspicious transaction reports). The Bank of Italy (Banca d'Italia) imposed an administrative fine of 60,000 EUR, taking into account the corrective measures taken.

Authority / court

Banca d'Italia

Area of law

Money laundering and terrorist financing · Internal controls

Legal basis

Art. 62 d.lgs. 231/2007; Verstöße gegen Art. 7, 16–20, 24, 25, 35, 36 d.lgs. 231/2007

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Mitigating circumstances

Corrective measures taken

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The financial institution did not take into account its customers’ significant cash exposure in its customer risk assessment, so that almost all customers were rated low risk – even with cash deposits of over 100,000 EUR. The Financial Intelligence Analysis Unit (FIAU) imposed 243,537 EUR and a follow-up directive; the fine was open to appeal at the time of publication.

Authority / court

Financial Intelligence Analysis Unit (FIAU)

Area of law

Money laundering and terrorist financing · Customer due diligence

Legal basis

Reg. 5(5)(a)(ii), 7(1)(c), 7(1)(d), 7(2)(a), 21 PMLFTR

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Published

23 Jun 2025

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Between 2010 and 2013, an asset manager at the bank validated 54 transfers through which bribes of around 4.1 million USD connected with SBM Offshore's charter contracts with Petrobras were concealed. The bank had not classified high-risk accounts as such and had inadequately monitored transfers; the Office of the Attorney General of Switzerland (Bundesanwaltschaft) imposed a fine of 2 million CHF, and the former employee received a suspended prison sentence.

Authority / court

Bundesanwaltschaft

Area of law

Money laundering and terrorist financing · Internal controls

Legal basis

Art. 102 Abs. 2 StGB i. V. m. Art. 305bis und Art. 322septies StGB

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Mitigating circumstances

Time elapsed since the offence, very good cooperation, organisational corrective measures after the Petrobras affair became known.

Liability of senior managers

Former asset manager: suspended prison sentence of six months (probation period of two years).

Published

17 Jun 2025

Original amount 2,000,000 CHF, converted at the ECB reference rate of 17 Jun 2025.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Between December 2023 and February 2024, Svea Finance’s internal rules on consumer lending did not comply with the law (50,000 EUR), and the company concluded credit agreements without assessing all prescribed creditworthiness components (150,000 EUR). Fines totalling 200,000 EUR for two misdemeanours. Date = publication.

Authority / court

Finantsinspektsioon (Estnische Finanzaufsicht)

Area of law

Consumer protection and online retail

Legal basis

§ 98 Abs. 2 und § 99 Abs. 2 KAVS

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Published

11 Jun 2025

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

A person who was not (or no longer) a customer received a letter from CaixaBank about an update to its privacy statement, announcing that she would be contacted about her advertising preferences. The Spanish data protection authority (Agencia Española de Protección de Datos, AEPD) considered the continued storage of her data to be an infringement of the principle of storage limitation and imposed 200,000 EUR; the bank's request for reconsideration was dismissed as inadmissible.

Authority / court

Agencia Española de Protección de Datos (AEPD)

Area of law

Data protection · Marketing and consent

Legal basis

Art. 5 Abs. 1 lit. e DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Employees

10,000 or more

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

During an inspection in 2024, the Finanssivalvonta (Finnish Financial Supervisory Authority, FIN-FSA) found that the crypto trading platform had not identified and verified its customers when establishing permanent business relationships. Taking the company’s financial situation into account, it imposed 500,000 EUR; LocalBitcoins has appealed to the Helsinki Administrative Court.

Authority / court

Finanssivalvonta (FIN-FSA)

Area of law

Money laundering and terrorist financing · Customer due diligence

Legal basis

Finnisches Geldwäschegesetz – Identifizierung und Verifizierung von Kunden

Action

Fine

Status of proceedings

under appeal

Sector

Financial services and insurance

Published

3 Jun 2025

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

From 6 December 2023 to 24 February 2024, Bondora concluded consumer credit agreements without assessing all criteria provided for by law and satisfying itself of the borrowers’ ability to repay. In misdemeanour proceedings, the Finantsinspektsioon (Estonian Financial Supervision Authority) imposed 200,000 EUR. Date = publication.

Authority / court

Finantsinspektsioon (Estnische Finanzaufsicht)

Area of law

Consumer protection and online retail

Legal basis

§ 99 Abs. 2 KAVS

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Published

30 Apr 2025

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Since 2008, Iberinform had obtained data on sole traders through a supply contract with Camerdata and used it to enrich its own files for commercial information services. The Spanish data protection authority (Agencia Española de Protección de Datos, AEPD) found no legal basis for this and no information of the data subjects, and imposed 360,000 EUR for each (720,000 EUR in total) as well as an order to bring the processing into compliance; the request for reconsideration (recurso de reposición) was rejected.

Authority / court

Agencia Española de Protección de Datos (AEPD)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 6 Abs. 1, Art. 14 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The New York State Department of Financial Services (NYDFS) imposed 40 million USD on the operator of Cash App for serious gaps in its BSA/AML programme, including insufficient customer due diligence, a lack of risk-based controls and untimely transaction monitoring. Rapid growth in 2019/2020 led to a considerable backlog of alerts; an independent monitor is being appointed.

Authority / court

New York State Department of Financial Services (NYDFS)

Area of law

Money laundering and terrorist financing · Customer due diligence

Legal basis

BSA/AML-, Geldtransfer- und Virtual-Currency-Vorschriften des NYDFS

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Employees

10,000 or more

Mitigating circumstances

Cooperation and remedial measures already initiated

Published

10 Apr 2025

Original amount 40,000,000 USD, converted at the ECB reference rate of 10 Apr 2025.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

During an on-site examination in 2023, the Financial Intelligence Analysis Unit (FIAU) found deficiencies at the crypto service provider in its business risk assessment (including product risks), customer risk assessment, customer profiles, ongoing monitoring, suspicious transaction reporting and record-keeping. It imposed 1,054,269 EUR and a follow-up directive; the fine was open to appeal at the time of publication.

Authority / court

Financial Intelligence Analysis Unit (FIAU)

Area of law

Money laundering and terrorist financing · Internal controls

Legal basis

Reg. 5(1), 5(4), 5(5), 7, 11, 15(3), 21 PMLFTR; FIAU Implementing Procedures

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Published

3 Apr 2025

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The investigation covering 2021 to 2022 concerned compliance organisation, product governance, record-keeping obligations, safeguarding of client funds, client information, suitability and appropriateness assessments and the CFD restrictions for retail investors. Following board resolutions of 17 and 31 March 2025, the Cyprus Securities and Exchange Commission (CySEC) concluded a settlement of 225,000 EUR, which has been paid.

Authority / court

Cyprus Securities and Exchange Commission (CySEC)

Area of law

Capital markets and financial supervision · Organisational requirements

Legal basis

Art. 17, 22(1), 25, 26(3)(a) Gesetz über Wertpapierdienstleistungen 2017; Art. 42 VO (EU) 600/2014; Art. 37(4) CySEC-Gesetz

Action

Other

Status of proceedings

final

Sector

Financial services and insurance

Published

11 Nov 2025

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

When the nickel price rose to over 100,000 USD within just over an hour on 8 March 2022, only junior staff were on duty during Asian trading hours, and they had not been trained to recognise a disorderly market; they did not escalate and even switched off price bands. The Financial Conduct Authority (FCA) imposed a fine on the recognised investment exchange for the first time: 9.2 million GBP after a 30% discount.

Authority / court

Financial Conduct Authority (FCA)

Area of law

Information security and cyber · Critical infrastructure

Legal basis

FCA REC 2.5.1 (Recognition Requirements); Art. 18 RTS 7 (MiFID II)

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Mitigating circumstances

Early settlement (30% discount); improvements since March 2022.

Original amount 9,200,000 GBP, converted at the ECB reference rate of 20 Mar 2025.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The housing finance corporation retained data of a former customer in its loan system beyond the permissible retention period because deletion there is only possible manually, record by record. The Επίτροπος Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Commissioner for Personal Data Protection) imposed 10,000 EUR and ordered erasure within 10 days as well as technical and organisational corrections within six months.

Authority / court

Επίτροπος Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Commissioner for Personal Data Protection)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 5 Abs. 1 lit. d und e, Art. 24 Abs. 1 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

During a follow-up inspection, Banka Slovenije (Bank of Slovenia) found that the company had not remedied the anti-money laundering deficiencies it had been ordered to address in 2023; some infringements are considered serious. It limited transactions to 1,000 EUR per customer per day, ordered monthly reports and set a deadline of 30 June 2025.

Authority / court

Banka Slovenije

Area of law

Money laundering and terrorist financing · Internal controls

Legal basis

Art. 164 ZPPDFT-2, Art. 280 ZBan-3, Art. 42.a ZBS-1

Action

Order

Status of proceedings

final

Sector

Financial services and insurance

Repeat case

yes

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

In 2010, the company's legal predecessor did not take all necessary and reasonable organisational precautions to prevent a relationship manager from committing aggravated money laundering with assets derived from bribery offences in Greece. The Office of the Attorney General of Switzerland (Bundesanwaltschaft) concluded the proceedings with a summary penalty order of 1 million CHF.

Authority / court

Bundesanwaltschaft

Area of law

Money laundering and terrorist financing · Internal controls

Legal basis

Art. 102 Abs. 2 StGB i. V. m. Art. 305bis StGB

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Published

27 Feb 2025

Original amount 1,000,000 CHF, converted at the ECB reference rate of 27 Feb 2025.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

An insurance agent who was himself involved in an accident received, on request, the roadside assistance file from the insurer, including data of the other party to the accident, and subsequently contacted that person. The Επίτροπος Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Commissioner for Personal Data Protection) issued a reprimand because there was no legal basis for the disclosure and internal procedures did not cover this case, and ordered a procedure for data requests from agents and employees.

Authority / court

Επίτροπος Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Commissioner for Personal Data Protection)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5 Abs. 1 lit. a und f, Art. 6 Abs. 1, Art. 32 Abs. 1 DSGVO

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Financial services and insurance

Mitigating circumstances

The company implemented the order

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

From December 2023 to September 2024, Cembra answered 9 of 13 access requests after the 30-day deadline had expired, and responded to all 13 people only with standard letters instead of the data actually processed about them. The Swiss Federal Data Protection and Information Commissioner (Eidgenössischer Datenschutz- und Öffentlichkeitsbeauftragter, EDÖB) required the bank to provide the data subsequently.

Authority / court

Eidgenössischer Datenschutz- und Öffentlichkeitsbeauftragter (EDÖB)

Area of law

Data protection · Data subject rights and transparency

Legal basis

DSG Art. 25 Abs. 2 lit. b, Art. 25 Abs. 7

Action

Order

Status of proceedings

final

Sector

Financial services and insurance

Published

1 Jul 2025

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

When changing data flows for 1099-K tax forms, insufficiently trained teams bypassed security processes; criminals with compromised credentials were able to retrieve forms containing social security numbers. According to the New York State Department of Financial Services (NYDFS), qualified personnel, training, access policies as well as MFA, CAPTCHA and rate limiting were lacking.

Authority / court

New York State Department of Financial Services (NYDFS)

Area of law

Information security and cyber · Security measures and risk management

Legal basis

23 NYCRR Part 500 (Cybersecurity Regulation)

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Employees

10,000 or more

Culpability

negligent

Mitigating circumstances

PayPal has since remedied the deficiencies.

Published

23 Jan 2025

Original amount 2,000,000 USD, converted at the ECB reference rate of 23 Jan 2025.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Employees identified weaknesses in investment models that could affect client returns by March 2019 at the latest, but Two Sigma only acted in August 2023; there were no policies, and one employee made unauthorised changes to more than a dozen models. In addition, separation agreements required employees to declare that they had not filed any complaint with authorities. The U.S. Securities and Exchange Commission (SEC) imposed 90 million USD; Two Sigma had already repaid 165 million USD to clients.

Authority / court

U.S. Securities and Exchange Commission (SEC)

Area of law

Capital markets and financial supervision · Organisational requirements

Legal basis

Investment Advisers Act of 1940 (Antifraud, Compliance Rule 206(4)-7); Exchange Act Rule 21F-17(a)

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Culpability

intentional

Mitigating circumstances

Voluntary repayment of 165 million USD to affected funds and accounts.

Original amount 90,000,000 USD, converted at the ECB reference rate of 16 Jan 2025.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

From December 2020 to May 2023, staff on the agency CMO bond desk sold mortgage-backed bonds worth around 3 billion USD using misleading metrics; the broker-dealer’s supervisory procedures contained no requirements for the structuring and sale of these bonds. BMO paid 19,417,908 USD in disgorgement, 2,241,507 USD in interest and a civil penalty of 19 million USD.

Authority / court

U.S. Securities and Exchange Commission (SEC)

Area of law

Capital markets and financial supervision · Organisational requirements

Legal basis

Securities Exchange Act of 1934, Section 15(b)(4)(E) (Failure to supervise)

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Employees

10,000 or more

Original amount 40,659,415 USD, converted at the ECB reference rate of 13 Jan 2025.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

An IRIS transfer made by mobile number via the bank’s app ended up with an uninvolved customer instead of the intended recipient because the number had been assigned incorrectly. By Decision 3/2025, the Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority) imposed 100,000 EUR for inaccurate data, insufficient security, lack of data protection by design and failure to notify the data breach, as well as 20,000 EUR for breach of the right of access.

Authority / court

Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5 Abs. 1 lit. d und f, Art. 15, 25, 32, 33, 34 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

From January to September 2015, the broker had no effective systems against financial crime and was therefore exposed to the risk of facilitating fraudulent trading and money laundering in connection with cum-ex trades. Following proceedings before the Upper Tribunal, the UK Financial Conduct Authority (FCA) set the fine at £288,962.53 instead of the £744,745 originally intended.

Authority / court

Financial Conduct Authority (FCA)

Area of law

Money laundering and terrorist financing · Internal controls

Legal basis

FCA Principles 2 und 3 (PRIN 2, PRIN 3)

Action

Fine

Status of proceedings

reduced

Sector

Financial services and insurance

Mitigating circumstances

Reduction by the Upper Tribunal

Published

10 Jan 2025

Original amount 288,962.53 GBP, converted at the ECB reference rate of 9 Jan 2025.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Following 47 complaints, the Commission nationale pour la protection des données (Luxembourg data protection authority, CNPD) found that a Luxembourg credit institution (pseudonymised in the decision as ‘Société A’) had not responded to data subjects’ requests on time; the CNPD did not accept the reference to the COVID-19 pandemic. It issued a reprimand (rappel à l’ordre) and imposed 175,000 EUR.

Authority / court

Commission nationale pour la protection des données (CNPD) – formation restreinte

Area of law

Data protection · Data subject rights and transparency

Legal basis

DSGVO Art. 12 Abs. 3 und 4

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

A courier of the insurer delivered an employee’s dismissal letter unsealed to his parents’ home and, when the father refused to accept it, left it there, so that third parties could read its contents. The Επίτροπος Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Commissioner for Personal Data Protection) issued a reprimand for breaches of lawfulness, confidentiality and accountability and ordered the delivery procedure for dismissal letters to be revised within one month.

Authority / court

Επίτροπος Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Commissioner for Personal Data Protection)

Area of law

Data protection · Employee data

Legal basis

Art. 5 Abs. 1 lit. a und f, Art. 6, Art. 24 Abs. 1 DSGVO

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Financial services and insurance

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

On the loan comparison portals lainaparkki.fi and rahoitu.fi, application data (including income, housing costs, marital status, children) could be accessed by anyone who knew the personal customer link; the links were targeted by phishing and data reached third parties. The sanctions board of the Tietosuojavaltuutetun toimisto (Office of the Data Protection Ombudsman) imposed 950,000 EUR and ordered the data subjects to be notified.

Authority / court

Tietosuojavaltuutetun toimisto – seuraamuskollegio (Datenschutzbeauftragter, Sanktionsgremium)

Area of law

Data protection · Data breaches and data security

Legal basis

DSGVO Art. 5 Abs. 1 lit. f, Art. 25, Art. 32

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Published

20 Dec 2024

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The Swiss Financial Market Supervisory Authority (FINMA) found serious breaches of risk management obligations and of the requirement to guarantee irreproachable business conduct: the financial group monitored its distribution chain inadequately and in some cases worked with dubious, unregulated distributors that sold products in countries not intended for them without authorisation. FINMA ordered governance requirements, the termination of these relationships, the appointment of an audit agent and the confiscation of 9.3 million CHF in profits; the ruling was not yet final at the time of publication.

Authority / court

Eidgenössische Finanzmarktaufsicht (FINMA)

Area of law

Capital markets and financial supervision · Organisational requirements

Legal basis

Finanzmarktaufsichtsgesetz (FINMAG)

Action

Disgorgement of profits

Status of proceedings

unknown

Sector

Financial services and insurance

Mitigating circumstances

Good cooperation in the proceedings; Leonteq had already strengthened compliance and distribution controls of its own accord and terminated relationships with suspicious distributors

Original amount 9,300,000 CHF, converted at the ECB reference rate of 12 Dec 2024.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Through Europark Estonia, the insurer placed advertising for motor third-party liability insurance that lacked the statutory notice referring to the insurance terms, and incorrectly stated on policies that the contracts had been concluded through a registered insurance agent. Fine of 10,000 EUR. Date = publication.

Authority / court

Finantsinspektsioon (Estnische Finanzaufsicht)

Area of law

Consumer protection and online retail · Misleading advertising and pricing

Legal basis

§ 254 Abs. 2 KindlTS (Versicherungstätigkeitsgesetz); Werbegesetz

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Published

3 Dec 2024

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

From June 2020 to February 2022, a trader on the metals and commodities desk was able to book over 400 fictitious trades and circumvent three key internal controls in order to conceal losses; the bank was partly aware of the weaknesses but did not remedy them in time. Unwinding the positions cost around 57.8 million USD; the Financial Conduct Authority (FCA) imposed 13 million GBP on the bank and banned the trader Travis Klein.

Authority / court

Financial Conduct Authority (FCA)

Area of law

Capital markets and financial supervision · Organisational requirements

Legal basis

FCA Principles for Businesses, Principle 3 (Systeme und Kontrollen); s. 206 Financial Services and Markets Act 2000

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Employees

10,000 or more

Liability of senior managers

Prohibition order imposed on the trader; no fine imposed on him on grounds of serious financial hardship.

Original amount 13,031,400 GBP, converted at the ECB reference rate of 26 Nov 2024.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

From September 2023 to May 2024, the asset management company used transactions worth several billion forints to create false signals about the trading volume of 4iG shares (‘painting the tape’). The Magyar Nemzeti Bank (Central Bank of Hungary, MNB) prohibited any repetition, imposed 250 million HUF and filed a criminal complaint.

Authority / court

Magyar Nemzeti Bank (MNB)

Area of law

Capital markets and financial supervision · Market abuse and insider dealing

Legal basis

Art. 12, 15 MAR (Marktmanipulation), Beschluss H-PJ-III-B-26/2024

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Culpability

intentional

Published

22 Nov 2024

Original amount 250,000,000 HUF, converted at the ECB reference rate of 22 Nov 2024.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

From 2020 to 2022, Invesco told clients that 70 to 94 per cent of the parent company's assets under management were ‘ESG integrated’, but counted passive ETFs that did not take ESG into account and had no written definition of ESG integration. The U.S. Securities and Exchange Commission (SEC) imposed 17.5 million USD, a censure and a cease-and-desist order.

Authority / court

U.S. Securities and Exchange Commission (SEC)

Area of law

Environment and sustainability · Misleading environmental and sustainability claims

Legal basis

Investment Advisers Act of 1940

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Culpability

intentional

Published

8 Nov 2024

Original amount 17,500,000 USD, converted at the ECB reference rate of 8 Nov 2024.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

From 2018 to mid-2023, the bank had no adequate policies for impairments and provisions under IFRS 9 and the EBA guidelines on credit risk. Banka Slovenije (Bank of Slovenia) imposed 90,000 EUR on the bank and 2,500 EUR each on the chair of the management board and a board member.

Authority / court

Banka Slovenije

Area of law

Capital markets and financial supervision · Organisational requirements

Legal basis

Art. 171, Art. 396 Abs. 1 Nr. 19 ZBan-3

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Liability of senior managers

Fines of 2,500 EUR each on the chair of the management board, Marko Rozman, and the board member Barbara Cerovšek Zupančič.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The swap trading platform did not fully inform its board of the results of emergency, technology risk and penetration tests, did not regularly test its business continuity and disaster recovery capabilities and had no adequate risk management. It also failed to produce documents requested during an examination on time despite extensions of deadlines; the Commodity Futures Trading Commission (CFTC) imposed 875,000 USD.

Authority / court

Commodity Futures Trading Commission (CFTC)

Area of law

Information security and cyber · Critical infrastructure

Legal basis

Commodity Exchange Act; CFTC-Regeln zu System Safeguards für Swap Execution Facilities

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Original amount 875,000 USD, converted at the ECB reference rate of 1 Oct 2024.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The asset manager had twelve job applicants sign NDAs that prohibited voluntary reports to authorities, and, in a settlement agreement, required a former employee who had announced a report to the SEC to confirm that he had not initiated any investigation and to withdraw statements already made. The U.S. Securities and Exchange Commission (SEC) took cooperation and remediation into account and imposed 500,000 US dollars.

Authority / court

U.S. Securities and Exchange Commission

Area of law

Whistleblower protection · Retaliation against whistleblowers

Legal basis

Securities Exchange Act of 1934, Rule 21F-17(a); Investment Advisers Act Section 203(e)

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Employees

50 to 249

Mitigating circumstances

Cooperation with the SEC and prompt remedial measures

Published

26 Sep 2024

Original amount 500,000 USD, converted at the ECB reference rate of 26 Sep 2024.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Between May 2019 and September 2023, TransUnion had senior employees waive potential awards for reports to authorities in 29 severance, separation and incentive agreements; three consulting agreements prohibited voluntary disclosures to authorities. As part of a sweep against seven listed companies, TransUnion paid 312,000 US dollars to the U.S. Securities and Exchange Commission (SEC); the contract templates were amended.

Authority / court

U.S. Securities and Exchange Commission

Area of law

Whistleblower protection · Retaliation against whistleblowers

Legal basis

Securities Exchange Act of 1934, Rule 21F-17(a)

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Mitigating circumstances

Amendment of the templates after contact by the SEC, information provided to those affected, and cooperation

Published

9 Sep 2024

Original amount 312,000 USD, converted at the ECB reference rate of 9 Sep 2024.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

From May 2021 to February 2024, the three New Jersey firms had eleven retail clients sign confidentiality agreements in connection with settlement payments that permitted reports to the SEC only at the SEC's initiative; in some cases, clients had to confirm that they had never contacted and would never contact authorities. Penalties imposed by the U.S. Securities and Exchange Commission (SEC): 160,000 (NPA Asset Management), 70,000 (Nationwide Planning) and 10,000 US dollars (Blue Point).

Authority / court

U.S. Securities and Exchange Commission

Area of law

Whistleblower protection · Retaliation against whistleblowers

Legal basis

Securities Exchange Act of 1934, Rule 21F-17(a)

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Published

4 Sep 2024

Original amount 240,000 USD, converted at the ECB reference rate of 4 Sep 2024.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

In 2022, an employee of a processor accidentally sent customer documents containing PESEL numbers, identity document, income and credit data to another financial institution; the envelope was returned opened. Despite a notice from the authority, the bank did not notify the data subjects because the recipient was ‘trustworthy’; Poland’s data protection authority (UODO) imposed 4,053,173 PLN and ordered the notification.

Authority / court

Prezes Urzędu Ochrony Danych Osobowych (UODO)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 34 Abs. 1 und 2 DSGVO (DKN.5131.1.2024)

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Published

9 Sep 2024

Original amount 4,053,173 PLN, converted at the ECB reference rate of 20 Aug 2024.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The Swiss Financial Market Supervisory Authority (FINMA) found that, for two politically exposed persons, the bank insufficiently clarified the origin and purpose of assets – transactions of more than 300 million USD from a Lebanese state institution between 2002 and 2015 – and only reported them to the reporting office in September 2020. It ordered a review of all PEP relationships, a ban on new PEP relationships until the review is completed and the appointment of an audit agent; the decision was not final at the time of publication (date of the announcement used as decision date).

Authority / court

Eidgenössische Finanzmarktaufsicht (FINMA)

Area of law

Money laundering and terrorist financing · Customer due diligence

Legal basis

Schweizer Geldwäschereirecht (laut FINMA)

Action

Order

Status of proceedings

unknown

Sector

Financial services and insurance

Published

18 Jun 2024

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

In April 2021, a third party alerted ICE to a vulnerability in its VPN; ICE found malicious code that had been inserted but did not inform the legal and compliance officers of its exchange and clearing subsidiaries for days. As a result, the subsidiaries, including the New York Stock Exchange, did not immediately report the incident to the U.S. Securities and Exchange Commission (SEC) as required under Regulation SCI; ICE paid 10 million USD.

Authority / court

U.S. Securities and Exchange Commission (SEC)

Area of law

Information security and cyber · Incident reporting obligations

Legal basis

Regulation Systems Compliance and Integrity (Regulation SCI), Meldepflichten

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Employees

10,000 or more

Repeat case

yes

Original amount 10,000,000 USD, converted at the ECB reference rate of 22 May 2024.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

By final decision of 24 April 2024, Germany's Federal Financial Supervisory Authority (BaFin) imposed a fine of 9.2 million EUR on the neobank because it had systematically filed money laundering suspicious activity reports late in 2022.

Authority / court

Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin)

Area of law

Money laundering and terrorist financing · Suspicious activity reports

Legal basis

§ 56 Abs. 1 Nr. 69, Abs. 3 GwG (verspätete Verdachtsmeldungen, § 43 Abs. 1 GwG); Bekanntmachung nach § 57 GwG

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Published

21 May 2024

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The Swiss Financial Market Supervisory Authority (FINMA) found serious infringements of anti-money laundering rules in PEP relationships: insufficient clarification of the origin of assets, failure to report to the reporting office despite unexplained transaction purposes and a serious breach of the duty to provide information, because a critical internal audit report was not handed over. It confiscated 3.9 million CHF in profits, imposed a capital surcharge of 19 million CHF and a two-year ban on new PEP and high-risk relationships (date of the announcement used as decision date).

Authority / court

Eidgenössische Finanzmarktaufsicht (FINMA)

Area of law

Money laundering and terrorist financing · Suspicious activity reports

Legal basis

Schweizer Geldwäschereirecht; Gewinneinziehung und Auskunftspflicht nach Finanzmarktaufsichtsrecht (laut FINMA)

Action

Disgorgement of profits

Status of proceedings

unknown

Sector

Financial services and insurance

Published

25 Mar 2024

Original amount 3,900,000 CHF, converted at the ECB reference rate of 25 Mar 2024.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report