Who was sanctioned, and for what?

The provider of web-based systems for sickness reporting, rehabilitation and occupational safety incidents was hacked in August 2025; the stolen personal data appeared on the dark web shortly afterwards. The Swedish data protection authority (Integritetsskyddsmyndigheten, IMY) found that, despite the high need for protection, there were no adequate security measures and no automatic real-time monitoring for attacks, assessed this as negligent and imposed 1,800,000 SEK.

Authority / court

Integritetsskyddsmyndigheten (IMY)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 32 Abs. 1 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Culpability

negligent

Published

22 Sep 2026

Original amount 1,800,000 SEK, converted at the ECB reference rate of 22 Sep 2026.

Checked against the official source on 25 Sep 2026 · Direct link

As a so-called fund hotel, the company had its funds managed by other firms, but examined these delegation agreements only insufficiently, did not take the related decisions properly and did not monitor the funds’ returns in relation to risk closely enough. The Swedish financial supervisory authority Finansinspektionen (FI) issued a remark and imposed 2 million SEK; no damage to investors was established.

Authority / court

Finansinspektionen (FI)

Area of law

Capital markets and financial supervision · Organisational requirements

Legal basis

Schwedisches Fondsrecht – Regeln zur Delegation der Fondsverwaltung und deren Überwachung

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Mitigating circumstances

No established damage to investors; remedial measures already taken during the investigation.

Published

16 Sep 2026

Original amount 2,000,000 SEK, converted at the ECB reference rate of 16 Sep 2026.

Checked against the official source on 25 Sep 2026 · Direct link

For the period April 2022 to May 2023, the Swedish financial supervisory authority Finansinspektionen (FI) found that the bank’s general risk assessment did not realistically assess the terrorist financing risks of its corporate products and that no enhanced due diligence measures were taken for high-risk corporate customers. FI issued a remark and imposed 140 million SEK; the bank has brought an action before the administrative court.

Authority / court

Finansinspektionen (FI)

Area of law

Money laundering and terrorist financing · Customer due diligence

Legal basis

Penningtvättslagen (2017:630)

Action

Fine

Status of proceedings

under appeal

Sector

Financial services and insurance

Published

17 Jun 2026

Original amount 140,000,000 SEK, converted at the ECB reference rate of 17 Jun 2026.

Checked against the official source on 25 Sep 2026 · Direct link

The security services provider used cameras in vehicles through which personal data was processed without any legal basis for doing so. The Swedish data protection authority (Integritetsskyddsmyndigheten, IMY) issued a reprimand under Art. 58 GDPR; no fine was imposed.

Authority / court

Integritetsskyddsmyndigheten (IMY)

Area of law

Data protection · Video surveillance

Legal basis

DSGVO Art. 6 Abs. 1

Action

Reprimand or warning

Status of proceedings

final

Sector

Defence and security

Checked against the official source on 25 Sep 2026 · Direct link

Finansinspektionen (FI, Swedish Financial Supervisory Authority) imposed an administrative fine of 1,500,000 SEK on The Goldman Sachs Group, Inc. because six crossings of the 5% threshold for shares and voting rights in Lundin Mining Corporation, Samhällsbyggnadsbolaget i Norden AB and Scandic Hotels Group AB were notified between 1 and 104 trading days late; a further transaction (Lundin Mining, 27 March 2025) was closed without sanction. FI took into account that a professional market participant had committed breaches in several issuers and saw no grounds for waiving the fine.

Authority / court

Finansinspektionen (FI)

Area of law

Capital markets and financial supervision · Disclosure and reporting obligations

Legal basis

6 kap. 3 a § första stycket 4 lagen (1991:980) om handel med finansiella instrument (Flaggningspflicht)

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Employees

10,000 or more

Published

10 Apr 2026

Original amount 1,500,000 SEK, converted at the ECB reference rate of 8 Apr 2026.

Checked against the official source on 28 Sep 2026 · Direct link

The Konkurrensverket (Swedish Competition Authority) found that Mavera AB abuses its dominant position by applying, since 1 January 2021, exclusivity clauses in contracts with companies providing insurance medical advice that prohibit advising competing businesses. The authority imposed a competition damages fee (konkurrensskadeavgift) of 14,300,000 SEK and ordered the company to stop applying the clauses and to inform its contractual partners within six weeks; the order is backed by a conditional fine (vite) of 30,000,000 SEK. Mavera has appealed to the Patent- och marknadsdomstolen (Patent and Market Court). The decision is not final.

Authority / court

Konkurrensverket

Area of law

Competition law · Abuse of market power

Legal basis

2 kap. 7 § konkurrenslagen (2008:579); Art. 102 AEUV; 3 kap. 1 § och 3 kap. 5 § första stycket 1 KL

Action

Fine

Status of proceedings

under appeal

Sector

Financial services and insurance

Published

19 Mar 2026

Original amount 14,300,000 SEK, converted at the ECB reference rate of 19 Mar 2026.

Checked against the official source on 28 Sep 2026 · Direct link

Finansinspektionen (FI, Swedish Financial Supervisory Authority) issued the occupational pension provider Alecta a warning and the statutory maximum administrative fine of 50,000,000 SEK. For investments of around 26.5 billion SEK in Heimstaden Bostad AB between October 2019 and August 2023, Alecta had – with the exception of one investment occasion – not sufficiently identified the risk of loss arising from the articles of association and shareholder agreements, nor ensured that it could manage that risk; the assets were therefore not invested in the way that best served the beneficiaries' interests. FI classified the breaches as serious but refrained from revoking the licence in view of the measures taken.

Authority / court

Finansinspektionen (FI)

Area of law

Capital markets and financial supervision · Organisational requirements

Legal basis

6 kap. 20 § försäkringsrörelselagen (2010:2043) in der Fassung vor dem 1.1.2016; 6 kap. 1–3 §§ lagen (2019:742) om tjänstepensionsföretag; 15 kap. 1, 2 och 16 §§ LTF

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Repeat case

no

Mitigating circumstances

Alecta replaced several senior executives, made staffing changes in asset management and strengthened its board; FI therefore considered a warning rather than licence revocation sufficient.

Published

18 Mar 2026

Original amount 50,000,000 SEK, converted at the ECB reference rate of 17 Mar 2026.

Checked against the official source on 28 Sep 2026 · Direct link

The provider of management software and an app for sports clubs suffered a data exfiltration by an external attacker in January 2025. The Swedish Authority for Privacy Protection (IMY) found that no appropriate technical and organisational security measures were in place before and at the time of the incident, even though the data processed related predominantly to children and also included health information (allergies, disabilities), and imposed 6 million SEK; in setting the amount it took into account the 2024 group turnover of the Lime group (around 685.7 million SEK).

Authority / court

Integritetsskyddsmyndigheten (IMY)

Area of law

Data protection · Data breaches and data security

Legal basis

DSGVO Art. 32 Abs. 1

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Mitigating circumstances

Prompt and comprehensive information of the clubs and data subjects after the incident; support for around 1,700 clubs in filing their notifications within 72 hours.

Published

26 Jan 2026

Original amount 6,000,000 SEK, converted at the ECB reference rate of 26 Jan 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Finansinspektionen (FI, Swedish Financial Supervisory Authority) issued Svea Bank a remark (anmärkning) and an administrative fine of 170,000,000 SEK. In the review period from 30 April 2022 to 1 May 2023 (business with legal entities), the general risk assessments were incomplete, customers were not risk-assessed as required, beneficial owners were not sufficiently identified, and enhanced due diligence on high-risk customers was omitted, insufficient or late in a large proportion of the cases reviewed. An earlier FI sanction of June 2022 for credit assessment failings was treated as only a minor aggravating factor because it concerned different obligations.

Authority / court

Finansinspektionen (FI)

Area of law

Money laundering and terrorist financing · Customer due diligence

Legal basis

Lag (2017:630) om åtgärder mot penningtvätt och finansiering av terrorism, u. a. 2 kap. 1–3 §§, 3 kap. 12 och 16 §§; 15 kap. 1 och 7 §§ lagen (2004:297) om bank- och finansieringsrörelse

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Repeat case

yes

Mitigating circumstances

The bank pointed to its cooperation and remediation; FI did not treat this as mitigating. No damage was known to FI; in an overall assessment FI did not classify the breaches as serious and therefore refrained from a warning or licence revocation.

Published

17 Dec 2025

Original amount 170,000,000 SEK, converted at the ECB reference rate of 16 Dec 2025.

Checked against the official source on 28 Sep 2026 · Direct link

The Konsumentombudsmannen (KO, Swedish Consumer Ombudsman) issued H&M with a prohibition order (föreläggande) because, when advertising price reductions, the company had stated a higher price than the lowest price applied in the previous 30 days, in breach of the Price Information Act (prisinformationslagen). The prohibition is backed by a conditional fine (vite) of 2,000,000 SEK; KO reduced it from 3 million SEK because the breach was limited and H&M had taken countermeasures. An earlier supervisory case from 2023 on long sale periods had been closed in March 2024 after the company stated, among other things, that it was working continuously to comply with the rules.

Authority / court

Konsumentombudsmannen (KO) / Konsumentverket

Area of law

Consumer protection and online retail · Misleading advertising and pricing

Legal basis

Prisinformationslagen (Angabe des niedrigsten Preises der letzten 30 Tage bei Preisermäßigungen)

Action

Order

Status of proceedings

unknown

Sector

Retail and e-commerce

Mitigating circumstances

Limited breach and countermeasures taken: conditional fine reduced from 3 million to 2 million SEK.

Published

17 Nov 2025

Checked against the official source on 28 Sep 2026 · Direct link

The Swedish financial supervisory authority Finansinspektionen (FI) examined consumer loans granted by the lender over four weeks in summer 2024 and found at least around 30 cases in which consumers without the ability to repay received loans. FI issued a remark and imposed 20 million SEK.

Authority / court

Finansinspektionen (FI)

Area of law

Consumer protection and online retail

Legal basis

Konsumentkreditlagen (2010:1846), Kreditprüfung

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Published

11 Nov 2025

Original amount 20,000,000 SEK, converted at the ECB reference rate of 11 Nov 2025.

Checked against the official source on 25 Sep 2026 · Direct link

The Naturvårdsverket (Swedish Environmental Protection Agency) imposed a penalty of 142,757,565 SEK on the airline Braathens International Airways because it had not surrendered emission allowances for 99,707 tonnes of CO2 equivalent from 2024 by the deadline of 30 September 2025. The inflation-adjusted penalty amounts to 129.69 EUR per tonne (12,930,939 EUR) and does not release the company from the obligation to surrender allowances; the company had been declared bankrupt on 30 September 2025. A separate penalty was imposed on its sister company Braathens Regional Airways AB.

Authority / court

Naturvårdsverket

Area of law

Environment and sustainability · Emissions and permits

Legal basis

10 kap. 5 § förordningen (2020:1180) om vissa utsläpp av växthusgaser; 16 § 3 lagen om vissa utsläpp av växthusgaser; Art. 12 Abs. 3 Richtlinie 2003/87/EG (EU-Emissionshandel)

Action

Fine

Status of proceedings

unknown

Sector

Transport, logistics and shipping

Mitigating circumstances

None: EU rules allow no exception from the surrender obligation regardless of the company's financial situation.

Published

10 Nov 2025

Original amount 142,757,565 SEK, converted at the ECB reference rate of 6 Nov 2025.

Checked against the official source on 28 Sep 2026 · Direct link

Between July 2023 and April 2024, the payment service provider, a substantial part of whose business is linked to the gambling sector, had gaps in its general risk assessment (including a missing assessment of its currency exchange service), in its customer risk assessment and in customer due diligence. The Swedish financial supervisory authority Finansinspektionen (FI) issued a remark and imposed 3 million SEK.

Authority / court

Finansinspektionen (FI)

Area of law

Money laundering and terrorist financing · Customer due diligence

Legal basis

Penningtvättslagen (2017:630)

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Published

15 Oct 2025

Original amount 3,000,000 SEK, converted at the ECB reference rate of 15 Oct 2025.

Checked against the official source on 25 Sep 2026 · Direct link

The shipping company processed results of on-board breath alcohol tests that could be attributed to a complainant employed as a captain. The Swedish Authority for Privacy Protection (IMY) regarded this as processing without a legal basis and as unlawful processing of health data and imposed 75,000 SEK.

Authority / court

Integritetsskyddsmyndigheten (IMY)

Area of law

Data protection · Employee data

Legal basis

DSGVO Art. 6, Art. 9

Action

Fine

Status of proceedings

unknown

Sector

Transport, logistics and shipping

Published

18 Jun 2025

Original amount 75,000 SEK, converted at the ECB reference rate of 18 Jun 2025.

Checked against the official source on 25 Sep 2026 · Direct link

Spelinspektionen (Swedish Gambling Authority) issued the gambling operator Spooniker Ltd (licensed for sites including unibet.se, mariacasino.se and bingo.se) a warning and an administrative fine of 10,000,000 SEK. A follow-up review covering May 2023 to April 2024 again found that, for the five new customers with the highest deposits, the company had not established the source of funds sufficiently or in good time; several of these customers were able to keep depositing even though the deposits could not plausibly have been financed from their known annual taxable income. The authority considered the breaches serious and repeated (earlier decision of 17 November 2022); the Förvaltningsrätten (Administrative Court) in Linköping dismissed the appeal on 2 July 2026, and the judgment is final.

Authority / court

Spelinspektionen

Area of law

Money laundering and terrorist financing · Customer due diligence

Legal basis

3 kap. 1, 13 och 16 §§ samt 4 kap. 1 och 2 §§ lagen (2017:630) om åtgärder mot penningtvätt och finansiering av terrorism; 18 kap. 17–19 §§ spellagen (2018:1138)

Action

Fine

Status of proceedings

final

Sector

Other

Repeat case

yes

Published

6 May 2025

Original amount 10,000,000 SEK, converted at the ECB reference rate of 5 May 2025.

Checked against the official source on 28 Sep 2026 · Direct link

Following a complaint – one of several complaints about cookie banners lodged with European data protection authorities – the Swedish Authority for Privacy Protection (IMY) found that the betting operator did not make withdrawing consent as easy as giving it and, through the misleading design of the banner (choice of colours, contrast, rejection only as a link), made informed, freely given consent more difficult. IMY issued a reprimand; ATG had since changed the banner.

Authority / court

Integritetsskyddsmyndigheten (IMY)

Area of law

Data protection · Cookies and tracking

Legal basis

DSGVO Art. 6, Art. 7 Abs. 3

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Other

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The landlord monitored a multi-family building in Malmö around the clock with cameras at entrances, lifts, flat doors, in the stairwell, the basement and the refuse room, without any legal basis for doing so; the signs did not name the controller. The Swedish Authority for Privacy Protection (IMY) imposed 200,000 SEK and ordered the landlord to stop the surveillance except in the garage and to supplement the signs.

Authority / court

Integritetsskyddsmyndigheten (IMY)

Area of law

Data protection · Video surveillance

Legal basis

DSGVO Art. 6 Abs. 1, Art. 13

Action

Fine

Status of proceedings

unknown

Sector

Construction and real estate

Published

12 Dec 2024

Original amount 200,000 SEK, converted at the ECB reference rate of 11 Dec 2024.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

Finansinspektionen (FI, Swedish Financial Supervisory Authority) issued Klarna a remark and an administrative fine of 500,000,000 SEK for breaches of the anti-money laundering act between 1 April 2021 and 31 March 2022. The general risk assessment lacked, among other things, assessments of how products and services could be misused for money laundering or terrorist financing; for the invoice product (faktura) there were no procedures capturing all situations requiring due diligence, and there was no procedure for model risk management. The maximum was based on the group's 2023 turnover of 24.64 billion SEK; the bank itself had a turnover of 19.65 billion SEK.

Authority / court

Finansinspektionen (FI)

Area of law

Money laundering and terrorist financing · Internal controls

Legal basis

2 kap. 1 och 8 §§ samt 6 kap. 1 § andra stycket lagen (2017:630) om åtgärder mot penningtvätt och finansiering av terrorism; 15 kap. 1 och 7 §§ lagen (2004:297) om bank- och finansieringsrörelse

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Repeat case

no

Mitigating circumstances

FI did not treat cooperation, remediation or the proceedings' length of just over two and a half years as mitigating.

Published

11 Dec 2024

Original amount 500,000,000 SEK, converted at the ECB reference rate of 10 Dec 2024.

Checked against the official source on 28 Sep 2026 · Direct link

Finansinspektionen (FI, Swedish Financial Supervisory Authority) imposed an administrative fine of 1,300,000 SEK on Carnegie Investment Bank by way of a sanction order (sanktionsföreläggande) for market manipulation. On 2 August 2024, Carnegie placed a client buy order for 100,000 shares in Vertiseit AB which, in concert with another party, was executed against a sell order of the same quantity and price placed almost simultaneously (98,202 shares at 43.70 SEK, 87% of daily turnover). The trade was likely to give false or misleading signals as to the supply of, demand for or price of the share.

Authority / court

Finansinspektionen (FI)

Area of law

Capital markets and financial supervision · Market abuse and insider dealing

Legal basis

Art. 12 Abs. 1 lit. a Ziff. i und Art. 15 Verordnung (EU) Nr. 596/2014 (MAR); 5 kap. 1 § 2 samt 6 och 19 §§ lagen (2016:1306) med kompletterande bestämmelser till EU:s marknadsmissbruksförordning

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Published

20 Dec 2024

Original amount 1,300,000 SEK, converted at the ECB reference rate of 26 Nov 2024.

Checked against the official source on 28 Sep 2026 · Direct link

The Integritetsskyddsmyndigheten (IMY, Swedish data protection authority) fined the pharmacy chain 37,000,000 SEK because, between 19 January 2020 and 25 April 2022, the company had not taken appropriate technical and organisational measures when using the Meta Pixel analytics tool on its website. Through the activated advanced matching function, contact details including personal identity numbers in hashed form, together with details of purchased, partly sensitive products, reached Meta when purchases were made; according to the incident report, an estimated 500,001 to 1,000,000 people were affected. The pharmacy chain learned of this through a tip-off from an outside party; the fine was based on its 2023 annual turnover of 23.27 billion SEK.

Authority / court

Integritetsskyddsmyndigheten (IMY)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 32 Abs. 1 DSGVO; Art. 58 Abs. 2 und Art. 83 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Mitigating circumstances

In assessing seriousness, IMY took into account that the data went in hashed form to a single recipient and that security measures were already in place; it treated notification, cooperation and subsequent remediation as neutral.

Original amount 37,000,000 SEK, converted at the ECB reference rate of 29 Aug 2024.

Checked against the official source on 28 Sep 2026 · Company name anonymised since 29 Aug 2026 · Direct link