The Ikano Bank AML fine: SEK 140 million for risk-assessment failures

On 17 June 2026 Sweden's Finansinspektionen issued the Ikano Bank AML fine of SEK 140 million, plus a remark, for failing to assess how its corporate products could fund crime. The regulator found gaps in the bank's general risk assessment and enhanced due diligence, not a single proven laundering case.

• Finansinspektionen fined Ikano Bank SEK 140 million, roughly 13 million euros at June 2026 rates, and issued a formal remark on 17 June 2026.
• The core failure was the general risk assessment, not a transaction: the bank never gauged how its corporate products could be misused for terrorist financing.
• Ikano also failed to apply enhanced due diligence to high-risk customers and did not absorb authority guidance on money laundering methods.
• The same risk-assessment defect underpinned FI's SEK 500 million Klarna penalty in 2024, making this a pattern, not an outlier.
• FI judged the breaches serious but not grave enough to threaten Ikano's banking licence.

What did Finansinspektionen find at Ikano Bank?

Finansinspektionen, Sweden's financial supervisor, sanctioned Ikano Bank AB under the Anti-Money Laundering and Counter-Terrorist Financing Act (2017:630). The decision, dated 17 June 2026, pairs a remark with an administrative fine of SEK 140 million. The regulator did not allege that laundering occurred; it found the controls that should prevent it were inadequate.

The findings cluster around the bank's general risk assessment. As FI put it, "Ikano has not conducted a separate, comprehensive and realistic assessment of how the products it offers to corporate clients could be misused for terrorist financing." The bank also failed to weigh risk factors tied to high-risk corporate customers, did not fold in authority guidance on money laundering methods, and did not apply enhanced due diligence where the risk demanded it.

Ikano Bank is a consumer finance lender founded in 1995 by IKEA founder Ingvar Kamprad and now wholly owned by Ingka Group, IKEA's largest retailer. It operates across eight European markets. That a mainstream retail bank, not a crypto venture or money services business, drew this Ikano Bank AML fine is the point: the supervisor is policing the foundations of a compliance programme, not exotic products.

How does the Ikano Bank AML fine compare to past Swedish penalties?

On a pure-krona basis the penalty is mid-tier for Sweden, but the reasoning is what carries weight. The Ikano Bank AML fine is far smaller than the headline cases of 2020, yet it echoes the most recent one almost exactly. FI is now repeating a single message: a weak general risk assessment is itself a sanctionable breach, regardless of whether dirty money moved.

The 2020 actions against Swedbank and SEB stemmed from Baltic exposure and historic transaction flows. The 2024 Klarna penalty and this Ikano case are different in kind. Both turn on the upstream document, the business-wide risk assessment, that is supposed to drive every downstream control. When that assessment is thin, FI now treats the whole programme as defective.

What does this mean for your AML obligations?

The decision maps to duties that exist in every EU member state under the AML directives and, from 2027, the single EU AML Regulation overseen by the new Authority for Anti-Money Laundering in Frankfurt. Treat the general risk assessment as the control FI audited first, because it did. The same duties echo the global FATF standard, so the lesson travels beyond Sweden.

Business-wide risk assessment. Produce a documented, product-by-product assessment that explains how each offering could be abused for money laundering and terrorist financing, and refresh it with the typologies regulators publish. A generic template that omits a product line is what sank Ikano.

Customer due diligence and enhanced due diligence. Under FATF Recommendation 10, higher-risk relationships require you to verify source of funds, source of wealth, purpose of the relationship, and beneficial ownership before and during the relationship, not as a one-time gate.

Beneficial ownership. EU rules treat ownership or control of 25 percent as the trigger for identifying the people behind a corporate customer. You cannot evidence that without resolving the ownership chain.

Ongoing monitoring and reporting. A risk assessment that misclassifies a customer also misfeeds transaction monitoring, sanctions and PEP screening, and the suspicious-activity reports that depend on accurate risk tiers.

Record-keeping. Retain the customer due diligence evidence and the rationale behind each risk rating, typically for five years, so a supervisor can reconstruct why a control fired or did not.

Governance. The board must be able to show the risk assessment actually steers procedures, screening thresholds, and monitoring rules. The boundary between these duties is exactly what our primer on the difference between KYC and AML sets out.

What is still uncertain after the Ikano Bank AML fine?

Several questions stay open. FI judged the breaches not grave enough that "there is cause to consider withdrawing the bank's authorisation," but it did not publish the review period, so the exposure window is unclear. Whether Ikano appeals to the administrative court, as Swedish banks sometimes do, will set how final the SEK 140 million figure is.

The deeper risk is interpretive. The Ikano Bank AML fine signals that a regulator can penalise a paperwork defect, an inadequate risk assessment, with no proven laundering and no customer harm. That lowers the evidentiary bar for enforcement and raises the cost of weak documentation across the sector. Corporate and small-business banking, where products are bespoke and harder to risk-rate than retail accounts, looks most exposed. Firms relying on a single annual assessment, rather than a living one that absorbs new typologies, carry the same latent defect FI just punished.

There is also a calibration question. The penalty sits well below the 2020 cases, yet the conduct, a structural control gap rather than a laundering scandal, is arguably less grave, so it is hard to read a clear tariff from the number alone. As supervision converges under the EU framework, firms cannot assume a Swedish-sized fine will be the ceiling elsewhere for the same defect. The safer planning assumption is that any regulator in the bloc could now treat a thin risk assessment as a standalone, fineable breach.

Why do general risk assessments keep failing?

The general risk assessment fails because it is treated as an artefact, not an engine. The Ikano Bank AML fine is the latest proof of that habit. Teams write it once, file it, and let it drift while products and customers change underneath. FI's repeated findings, Klarna in 2024 and now Ikano, show the same root cause: the document does not reflect the live book of business or current criminal methods.

Two structural problems recur. First, data fragmentation: customer information sits in onboarding tools, monitoring systems, and case files that do not reconcile, so no one can produce a coherent product-level risk picture on demand. Second, stale inputs: regulators publish new typologies faster than most banks re-paper their assessments. A control architecture that minimises and centralises verified identity data makes both problems smaller, because the evidence behind each risk rating is consistent and retrievable. The 2026 broker-dealer cases we covered in Canaccord's record FinCEN penalty point the same way.

How should compliance teams respond?

Start with the document FI starts with. Re-open your business-wide risk assessment and test whether it covers every product, names the terrorist-financing angle for corporate offerings, and cites the latest national and supervisory typologies. Confirm enhanced due diligence is evidenced for higher-risk customers with source of funds and beneficial ownership on file, and that the assessment demonstrably drives your screening and monitoring rules. Keep an exportable audit trail that a supervisor can follow without a workshop.

Strong identity data makes that audit trail credible. Zyphe verifies customers through NFC chip reads to ICAO 9303 and eIDAS standards with two-step liveness and no image upload, shards personal data across a decentralised network so no single node holds a complete record, and produces a reusable, exportable credential with per-region data residency. That gives compliance teams clean, consistent evidence behind every risk rating, as our how it works overview explains. To see how it fits your CDD and EDD workflow, book a demo.

The bottom line

The Ikano case confirms a shift in how Swedish supervision works. Finansinspektionen will fine a bank for an inadequate risk assessment alone, without a proven laundering event, and it will do so to a mainstream retail lender, not just a high-risk niche. The lesson for any KYC or AML team is that the business-wide risk assessment is no longer back-office paperwork; it is the first thing a regulator reads and the easiest place to lose. Treat it as a living control, evidenced by clean and retrievable identity data, and the rest of the programme has somewhere solid to stand.

Cited sources

• Finansinspektionen: Ikano Bank receives a remark and an administrative fine (17 June 2026)
• Finansinspektionen: Klarna receives a remark and an administrative fine (2024)
• Finansinspektionen: SEB receives a remark and administrative fine of SEK 1 billion (2020)
• Finansinspektionen: Swedbank receives a warning and an administrative fine of SEK 4 billion (2020)