Compliance Radar

Who was sanctioned, and for what?

Fines, court rulings and incidents from Europe and North America: 718 cases from 32 jurisdictions, each with an official source and checked against that source before publication. Filter by country, area of law and sector. Click a chart to drill down one level.

EUEstonia Clear all filters
13cases from 1 jurisdiction
€426,000Total of monetary amounts (4 cases with an amount)
€200,000Largest single case: Svea Finance AS
€108,000Median per case with an amount

Click a bar to drill down one level.

by amountby number of cases

Where?

by authority
  1. Finantsinspektsioon (Estnische Finanzaufsicht) €426,000 100 % · 6 cases
  2. Andmekaitse Inspektsioon (AKI) — 0 % · 5 cases
  3. Konkurentsiamet (Estnische Wettbewerbsbehörde) — 0 % · 2 cases

What for?

by area of law

All areas of law

  1. Consumer protection and online retail €410,000 96 % · 4 cases
  2. Capital markets and financial supervision €16,000 4 % · 1 case
  3. Data protection — 0 % · 5 cases
  4. Competition law — 0 % · 2 cases
  5. Money laundering and terrorist financing — 0 % · 1 case

Who?

by sector

All sectors

  1. Financial services and insurance €426,000 100 % · 7 cases
  2. Healthcare — 0 % · 2 cases
  3. Other — 0 % · 2 cases
  4. Chemicals and pharmaceuticals — 0 % · 1 case
  5. Energy and utilities — 0 % · 1 case

When?

per quarter, by date of decision
Trend
PeriodCasesTotal
Q3 20230—
Q4 20230—
Q1 20240—
Q2 20240—
Q3 20241—
Q4 20242€10,000
Q1 20250—
Q2 20252€400,000
Q3 20252—
Q4 20254€16,000
Q1 20260—
Q2 20261—
Q3 20261—

13 cases

Newest firstHighest amounts
16 Sep 2026 Wallester ASFinancial supervisor orders Wallester to remedy governance and AML deficiencies EstoniaInternal controls Order

Following an on-site inspection, the Finantsinspektsioon (Estonian Financial Supervision Authority) issued an order requiring the payment institution Wallester to remedy, by 31 December, deficiencies in governance and control functions (separation of the lines of defence, internal rules), in safeguarding customer funds and in the staffing of its anti-money laundering and counter-terrorist financing function. Date = publication of the press release.

What organisations can take from it

Fast-growing payment service providers must let their compliance, AML and internal audit functions grow with them in terms of staffing and organisation.

Authority / court
Finantsinspektsioon (Estnische Finanzaufsicht)
Area of law
Money laundering and terrorist financing · Internal controls
Legal basis
Aufsichtsrechtliche Anordnung (ettekirjutus) der Finantsinspektsioon
Action
Order
Status of proceedings
unknown
Sector
Financial services and insurance
Published
16 Sep 2026
Sources

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Anonymous: we store only your text — no contact details and no IP address.

16 Apr 2026 Fullgevity OÜ (vormals OÜ Dr Mõttus Hambaravi)Fullgevity (dental clinic) must reorganise data processing in Invisalign treatment EstoniaData processors Order

The starting point was a complaint about incomplete disclosure of patient data; the clinic left several requests from the supervisory authority unanswered. The Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate, AKI) ordered it to revise its contracts with Align Technology (Invisalign) with regard to the GDPR roles (Art. 26/28 GDPR), to adapt the consent form and the privacy notices in accordance with Art. 7, 9, 13 and 14 GDPR and to publish them in Estonian; non-compliance is subject to a penalty payment of 1,000 EUR per item.

What organisations can take from it

Anyone passing patient data on to manufacturers or platforms must clarify roles, contracts and consents properly in advance – and respond to supervisory requests on time.

Relevance to training and awareness

Consent and transparency for health data; cooperation with the supervisory authority

Authority / court
Andmekaitse Inspektsioon (AKI)
Area of law
Data protection · Data processors
Legal basis
§ 56 Abs. 1 IKS; Art. 58 Abs. 2 lit. d DSGVO i. V. m. Art. 5 Abs. 1 lit. a, 7, 9, 13, 14, 26, 28 DSGVO
Action
Order
Status of proceedings
unknown
Sector
Healthcare
Sources

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Anonymous: we store only your text — no contact details and no IP address.

10 Dec 2025 Invest in OÜLender Invest in OÜ pays 16,000 EUR for failing to submit annual accounts EstoniaDisclosure and reporting obligations €16,000

The lender did not submit its 2024 annual report, together with the audit report, the resolution on the appropriation of profits and the minutes of the shareholders’ meeting, to the financial supervisory authority on time. In misdemeanour proceedings, the Finantsinspektsioon (Estonian Financial Supervision Authority) imposed a fine of 16,000 EUR; the maximum is 1 million EUR or 10% of annual turnover. Date = publication.

What organisations can take from it

Even small supervised lenders need a reliable deadline calendar for mandatory supervisory reports.

Authority / court
Finantsinspektsioon (Estnische Finanzaufsicht)
Area of law
Capital markets and financial supervision · Disclosure and reporting obligations
Legal basis
§ 56 Abs. 3, § 96 Abs. 2 KAVS (Gesetz über Kreditgeber und -vermittler)
Action
Fine
Status of proceedings
unknown
Sector
Financial services and insurance
Published
10 Dec 2025
Sources

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Anonymous: we store only your text — no contact details and no IP address.

14 Oct 2025 AS Inbank FinanceOrder against Inbank Finance over deficiencies in creditworthiness assessment EstoniaConsumer protection and online retail Order

During an inspection, the Finantsinspektsioon (Estonian Financial Supervision Authority) found that Inbank Finance’s internal rules on assessing the creditworthiness of consumers did not fully comply with the law and that the assessment itself showed deficiencies. It issued an order requiring the company to remedy the deficiencies by mid-December. Date = publication.

What organisations can take from it

Creditworthiness assessments must be documented, rule-based and actually applied in day-to-day business.

Relevance to training and awareness

Responsible lending in sales

Authority / court
Finantsinspektsioon (Estnische Finanzaufsicht)
Area of law
Consumer protection and online retail
Legal basis
Gesetz über Kreditgeber und -vermittler (KAVS), verantwortungsvolle Kreditvergabe
Action
Order
Status of proceedings
unknown
Sector
Financial services and insurance
Published
14 Oct 2025
Sources

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Anonymous: we store only your text — no contact details and no IP address.

13 Oct 2025 Nura OÜNura OÜ must hand over scan files of their treatment to two patients EstoniaData subject rights and transparency Order

Despite access requests, two patients did not receive copies of their scan files at the end of treatment; the practice responded only sluggishly to enquiries and did not attend an appointment with the supervisory authority. The Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate, AKI) ordered disclosure under Art. 15(3) GDPR or a reasoned refusal and threatened a penalty payment of 2,000 EUR.

What organisations can take from it

Access requests concerning health data require a fixed procedure with deadlines – in small practices too.

Relevance to training and awareness

Handling access requests from patients

Authority / court
Andmekaitse Inspektsioon (AKI)
Area of law
Data protection · Data subject rights and transparency
Legal basis
§ 56 Abs. 1 IKS; Art. 58 Abs. 2 lit. c, Art. 12 Abs. 4, Art. 15 DSGVO
Action
Order
Status of proceedings
unknown
Sector
Healthcare
Sources

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Anonymous: we store only your text — no contact details and no IP address.

6 Oct 2025 Zu Disain OÜZu Disain must delete personal data collected from the land register by script EstoniaData protection Order

The company had used an automated script to carry out mass queries in the electronic land register and stored data of natural persons without demonstrating a legal basis; it did not respond to requests from the supervisory authority. The Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate, AKI) ordered erasure with proof or a statement of a legal basis with a balancing of interests; a penalty payment of 2,000 EUR was threatened.

What organisations can take from it

Publicly accessible register data remain personal data – automated scraping requires its own legal basis.

Relevance to training and awareness

Public registers are no licence for data collection

Authority / court
Andmekaitse Inspektsioon (AKI)
Area of law
Data protection
Legal basis
§ 56 Abs. 1 IKS; Art. 58 Abs. 2 lit. d, Art. 5 Abs. 1 lit. a, Art. 6 Abs. 1 DSGVO
Action
Order
Status of proceedings
unknown
Sector
Other
Sources

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Anonymous: we store only your text — no contact details and no IP address.

25 Jul 2025 Tamro Eesti OÜTamro Eesti: order against unfair payment terms for food supplements EstoniaAbuse of market power Order

In consignment agreements, the pharmaceutical wholesaler had made payment to suppliers of food supplements dependent on subsequent resale (payment period over 30 days) and had reserved the right to hold suppliers liable for spoiled goods. The Konkurentsiamet (Estonian Competition Authority) found infringements of the act on unfair trading practices in the food supply chain and ordered amended contractual terms.

What organisations can take from it

Purchasing terms in the food sector – including for food supplements – must comply with the 30-day payment period and the prohibition on shifting risk.

Authority / court
Konkurentsiamet (Estnische Wettbewerbsbehörde)
Area of law
Competition law · Abuse of market power
Legal basis
§ 4 Abs. 1 und 2, § 5 Abs. 2, § 7 Abs. 1 PTEKS (UTP-Richtlinie (EU) 2019/633)
Action
Order
Status of proceedings
unknown
Sector
Chemicals and pharmaceuticals
Sources

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Anonymous: we store only your text — no contact details and no IP address.

23 Jul 2025 ESTO ASData protection authority requires ESTO AS to stop creating accounts for non-customers EstoniaData subject rights and transparency Order

The instalment payment provider created customer profiles without a contract for persons who signed in via retailer checkouts, refused former customers the closure of their accounts and continued to send them transactional e-mails with advertising content. The Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate, AKI) ordered transparent information, valid consent, erasure options under Art. 17 GDPR and the separation of transactional and advertising e-mails; a penalty payment of 5,000 EUR is threatened for each item not fulfilled.

What organisations can take from it

Customer accounts must not be created for non-customers ‘on the side’ – and erasure must work once the contract has ended.

Authority / court
Andmekaitse Inspektsioon (AKI)
Area of law
Data protection · Data subject rights and transparency
Legal basis
§ 56 Abs. 1, § 58 Abs. 1 IKS; Art. 58 Abs. 2 lit. d, Art. 4 Nr. 11, 5, 6, 7, 12–14, 17 DSGVO
Action
Order
Status of proceedings
unknown
Sector
Financial services and insurance
Sources

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Anonymous: we store only your text — no contact details and no IP address.

11 Jun 2025 Svea Finance AS200,000 EUR fine against Svea Finance over deficient creditworthiness assessment EstoniaConsumer protection and online retail €200,000

Between December 2023 and February 2024, Svea Finance’s internal rules on consumer lending did not comply with the law (50,000 EUR), and the company concluded credit agreements without assessing all prescribed creditworthiness components (150,000 EUR). Fines totalling 200,000 EUR for two misdemeanours. Date = publication.

What organisations can take from it

Creditworthiness assessments must cover all factors prescribed by law – gaps in internal policies are sanctioned separately.

Relevance to training and awareness

Responsible lending

Authority / court
Finantsinspektsioon (Estnische Finanzaufsicht)
Area of law
Consumer protection and online retail
Legal basis
§ 98 Abs. 2 und § 99 Abs. 2 KAVS
Action
Fine
Status of proceedings
unknown
Sector
Financial services and insurance
Published
11 Jun 2025
Sources

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Anonymous: we store only your text — no contact details and no IP address.

30 Apr 2025 Bondora ASBondora must pay 200,000 EUR for breaching responsible lending rules EstoniaConsumer protection and online retail €200,000

From 6 December 2023 to 24 February 2024, Bondora concluded consumer credit agreements without assessing all criteria provided for by law and satisfying itself of the borrowers’ ability to repay. In misdemeanour proceedings, the Finantsinspektsioon (Estonian Financial Supervision Authority) imposed 200,000 EUR. Date = publication.

What organisations can take from it

Automated credit decisions do not release lenders from the full statutory creditworthiness assessment.

Relevance to training and awareness

Responsible lending

Authority / court
Finantsinspektsioon (Estnische Finanzaufsicht)
Area of law
Consumer protection and online retail
Legal basis
§ 99 Abs. 2 KAVS
Action
Fine
Status of proceedings
unknown
Sector
Financial services and insurance
Published
30 Apr 2025
Sources

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Anonymous: we store only your text — no contact details and no IP address.

3 Dec 2024 Salva Kindlustuse ASSalva Kindlustus: 10,000 EUR for motor insurance advertising without mandatory notice EstoniaMisleading advertising and pricing €10,000

Through Europark Estonia, the insurer placed advertising for motor third-party liability insurance that lacked the statutory notice referring to the insurance terms, and incorrectly stated on policies that the contracts had been concluded through a registered insurance agent. Fine of 10,000 EUR. Date = publication.

What organisations can take from it

Anyone using distribution partners for advertising and concluding contracts must itself check their mandatory disclosures and registration.

Relevance to training and awareness

Mandatory disclosures in financial advertising; management of distribution partners

Authority / court
Finantsinspektsioon (Estnische Finanzaufsicht)
Area of law
Consumer protection and online retail · Misleading advertising and pricing
Legal basis
§ 254 Abs. 2 KindlTS (Versicherungstätigkeitsgesetz); Werbegesetz
Action
Fine
Status of proceedings
unknown
Sector
Financial services and insurance
Published
3 Dec 2024
Sources

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Anonymous: we store only your text — no contact details and no IP address.

7 Oct 2024 Eesti Keskkonnateenused ASEesti Keskkonnateenused must reduce excessive charges for moving waste containers EstoniaAbuse of market power Order

In 17 municipalities and towns with organised waste collection (16 price lists), the waste management company charged 8.33 to 20 EUR net per occasion for manually fetching containers over distances of 10 to 30 metres. The Konkurentsiamet (Estonian Competition Authority) considered this an abuse of a dominant position through excessively high prices and ordered the prices to be reduced to cost plus a reasonable profit by 31 October 2024.

What organisations can take from it

Companies with exclusive waste collection rights in an area must also price additional services on a cost basis.

Authority / court
Konkurentsiamet (Estnische Wettbewerbsbehörde)
Area of law
Competition law · Abuse of market power
Legal basis
§ 16 Nr. 1, § 61¹ KonkS; § 28 Abs. 1 KorS
Action
Order
Status of proceedings
unknown
Sector
Energy and utilities
Sources

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Anonymous: we store only your text — no contact details and no IP address.

30 Sep 2024 AS WasaWellness hotel Wasa must suspend video surveillance in treatment area EstoniaVideo surveillance Order

Following a tip-off that at the Wasa Resort Spa filming was also taking place in the treatment area and for monitoring work discipline, and that cameras captured the neighbouring property, the Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate, AKI) ordered the hotel to suspend video surveillance until a sound balancing of interests had been submitted, to stop recording the neighbouring property and to correct the camera information on the website. The hotel had repeatedly let the supervisory authority’s deadlines lapse.

What organisations can take from it

Cameras require a documented balancing of interests for each location – performance monitoring of employees is not a permissible purpose.

Relevance to training and awareness

Video surveillance of employees and guests

Authority / court
Andmekaitse Inspektsioon (AKI)
Area of law
Data protection · Video surveillance
Legal basis
§ 56 Abs. 1, § 58 Abs. 1 IKS; Art. 58 Abs. 2 lit. d und f, Art. 5 Abs. 1, Art. 6 Abs. 1 DSGVO
Action
Order
Status of proceedings
unknown
Sector
Other
Sources

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Anonymous: we store only your text — no contact details and no IP address.

Ready for training that sticks?

Try it free for 14 days — from 1 user, no credit card, ends automatically.

Start free trial