The SEB AML penalty: NYDFS takes $33 million over Baltic KYC and monitoring gaps

The SEB AML penalty is a $33 million civil penalty that New York's Department of Financial Services announced on 15 October 2026 against Skandinaviska Enskilda Banken (SEB). The consent order finds that, between 2015 and 2019, SEB applied inadequate due diligence to high-risk correspondent banks, while its Baltic subsidiaries failed to vet non-resident clients and ran inadequate monitoring.

• DFS found violations of 3 NYCRR 116.2 (AML programme, including correspondent and RMA relationships) and 3 NYCRR 504.3 (transaction monitoring). SEB must pay within ten days of the order taking effect.
• The conduct sat in SEB Estonia, SEB Latvia and SEB Lithuania, not in New York. DFS reached it through the branch and through $275 billion of dollar clearing at two US banks.
• Internal audits found 42% of sampled Baltic files lacked beneficial ownership data, and a 2017 risk model did not raise scores when KYC data was missing.
• Estonia's monitoring system generated no new alerts for five weeks in 2017, and payments in Estonia and Latvia ran unscreened when the sanctions filter was down.
• The order imposes no monitor and no remediation plan. DFS credited SEB's cooperation and completed remediation.

What did NYDFS find at SEB?

DFS found that SEB failed to maintain an effective AML programme in its Baltic subsidiaries from 2015 to 2019. The failures were thin due diligence on non-resident accounts, simplified due diligence on high-risk correspondent banks, and a monitoring system that missed or mishandled alerts. The SEB AML penalty of $33 million resolves the matter.

The consent order says the Baltic subsidiaries knew about gaps in their non-resident due diligence but never gained "true insight into their customers' identities". The evidence comes largely from SEB's own audits. In 2015 the subsidiaries had not updated KYC data for 64% of legal entity clients. A 2016 audit found 3,000 inactive non-resident accounts at SEB Lithuania with no relevant KYC information at all.

In one audit sample, SEB Estonia onboarded half of its high-risk clients without the required approval from its Customer Adoption Committee. It screened beneficial owners against sanctions and PEP lists only twice a year, while regular customers were screened monthly. In some cases its systems held no record of who the ultimate beneficial owner was.

The DFS press release frames the case as a follow-up to the 2016 Panama Papers leak, which prompted reviews of licensees' links to Mossack Fonseca. The order's findings never mention the leak; they concern the Baltic programme itself.

Why can a New York regulator fine SEB for Baltic conduct?

DFS licenses SEB to run a New York branch, and it treats risk that reached New York through that branch or through dollar clearing as its business. The order notes that SEB did not clear US dollars through the branch. It instead traces how the Baltic risk was "imported" into New York.

About $300 million of transactions from the Baltic subsidiaries passed through the branch between 2006 and 2019, of which $2.5 million fell in 2015 to 2019. The larger exposure ran through correspondents. A New York clearing bank processed $144 billion of Baltic subsidiary transactions from 2015 to 2019, and a second cleared $131 billion from 2017 to 2019. SEB's Group-wide compliance rules bound both the Baltic units and the branch.

The correspondent side drew the sharpest findings. SEB applied only simplified due diligence, its lowest tier, to several high-risk respondent banks. The order anonymises them, but describes one bank implicated in a scandal involving hundreds of billions of dollars of suspicious transactions. It describes another that a US regulator named a primary money laundering concern in 2018. SEB processed more than $12 billion with that second bank from 2008 to 2018, including $1.8 billion in dollars from 2015 to 2018.

A further New York link ran through SWIFT. The branch shared a Relationship Management Application (RMA) key with the head office of a European bank implicated in that hundreds-of-billions scandal. Through it, the branch handled 669 transactions worth more than $300 million with that bank from 2008 to 2018, $120 million of them from 2015 to 2018.

SEB also offered downstreaming, letting other banks route payments through a correspondent account without full visibility of the originator. It stopped in dollars in 2016 at its US correspondents' direction, but continued in other currencies into 2018.

How does the SEB AML penalty compare with recent Baltic and AML cases?

The SEB AML penalty is the second New York action this year over a Swedish bank's Baltic operations. In July 2026 DFS took $50 million from Swedbank for withholding Baltic information. SEB's case differs in kind: it punishes the programme failures themselves, not a lack of candour.

The 2020 Swedish decision is on Finansinspektionen's sanctions page. The Swedbank figures come from our Swedbank NYDFS penalty analysis, and the OCC case from our American Express AML penalty report. New York's SEB AML penalty adds to the fines that, according to the order, Swedish, Estonian and Latvian supervisors issued over the same Baltic controls in 2019 and 2020.

What does the SEB AML penalty change for your obligations?

The SEB AML penalty shows what New York treats as programme failures: missing KYC data that does not raise risk scores, beneficial owners screened less often than customers, static correspondent reviews, unscreened payments when filters fail, and single-person SAR desks. Each maps to a rule DFS cited or a control the order says failed.

For customer identification and due diligence, 3 NYCRR 116.2 requires a programme that meets federal AML law, including a customer identification programme. DFS found SEB in breach for weak diligence on non-resident accounts. The most transferable finding is about scoring. SEB's 2017 model did not raise a client's risk score when key KYC data was missing, so a high-risk client could be rated low. Treat missing data as a risk factor, not a neutral one.

For enhanced due diligence, SEB's policy set annual reviews for high-risk clients, three years for regular risk and five for the lowest. The subsidiaries did not keep to it. SEB Latvia lowered clients out of enhanced review without the committee approval its procedures required, in every case it tested. Risk downgrades need the same control as onboarding approvals.

For correspondent banking, the order treats simplified diligence on high-risk respondents as a 116.2 breach. SEB made no site visits to the bank later named a primary money laundering concern, and its review forms for that bank "remained virtually unchanged year-to-year". SEB rated RMA and Loro account services as high risk in other forms, but that rating never reached the main assessment. Respondent reviews should move when the respondent's risk moves.

For PEP and sanctions screening, the gap was frequency and coverage. Screening beneficial owners twice a year while screening ordinary customers monthly inverts the risk logic. SEB Latvia screened at onboarding and on questionnaire updates, with no evidence of regular rescreening against PEP lists. Ongoing screening should cover ultimate beneficial owners at least as often as account holders.

For transaction monitoring, 3 NYCRR 504.3 requires end-to-end testing of data mapping and data input. It also requires documented protocols for how alerts are investigated and decided. SEB's failings line up with both: weak controls on data feeding the system, SEB Estonia's PEP alerts closed as they arrived, up to 100 a day, alerts closed on outdated standard forms that sometimes recorded investigations never carried out, and a backlog that recurred. Section 504.3 also requires a filtering programme to interdict prohibited transactions. SEB's 2018 auditors wrote that "[w]hen SafeWatch system is not available, payments are processed without screening against sanction lists". That applied in Estonia and Latvia; SEB reviewed those payments manually afterwards.

For SAR escalation, 3 NYCRR 116.2 expressly includes the duty to file SARs. Each subsidiary relied on a single employee to file them, with no quality control. Auditors could not tell whether SEB Latvia filed on time. Under 3 NYCRR 504.4, a regulated institution must submit an annual compliance finding by 15 April and keep the supporting records for five years. That certification is hard to sign over a monitoring system with this profile.

What remains uncertain after the SEB AML penalty?

The order settles New York's claims but leaves several questions open. It does not explain how DFS weighed seven years between the end of the conduct and the order, how it applied a 2017 rule to conduct from 2015, or what it expects from the clearing banks that processed the flows. Other authorities are not bound by it.

Timing is the first issue. Part 504 took effect on 1 January 2017, yet the findings period starts in 2015. The order cites 504.3 without saying which years that violation covers; the question does not arise for 116.2. Its most concrete monitoring failures, the five weeks without alerts in 2017 and the 2018 backlogs, fall after that date. Firms should not read the SEB AML penalty as a clean precedent on retroactive reach.

The clearing banks are the second issue. DFS records that USD Clearing Bank 1 processed $144 billion of Baltic transactions from 2015 to 2019, notwithstanding concerns it raised in 2016 about the customer base. The order names neither bank and says nothing about action against them. Any correspondent that documented concern without acting on it should take note.

Third, the order is narrow by design. It imposes no monitor and no remediation plan. It also binds no federal or other state agency, and DFS reserves the right to act on conduct SEB did not disclose. Legacy findings can resurface years later, so record retention and audit trails matter long after remediation ends.

How should compliance teams respond?

Test the controls behind the SEB AML penalty, starting with how your risk model treats missing data. Run a sample of high-risk files and check that a missing beneficial owner, source of funds or PEP declaration raises the score. Then confirm that every risk downgrade carries an approval record.

Next, align screening frequency with risk. Beneficial owners and high-risk clients should be rescreened at least as often as everyone else, and a correspondent banking due diligence review should never sit at the simplified tier for a respondent with adverse media or regulatory findings. Check what your sanctions filter does when it goes down: payments should queue, not pass. Finally, add a second reviewer to SAR decisions, and make sure your monitoring system alerts you when it stops alerting.

Much of SEB's trouble began with KYC files that were incomplete, stale or impossible to reconcile across three subsidiaries. Zyphe approaches this differently: identity documents are read from the NFC chip, verified once and held as a reusable credential, and beneficial ownership is resolved recursively across 240+ corporate registries. Identity data is encrypted and split across thousands of storage nodes, unlockable only with a key the user holds, so there is no central store of customer PII to leak. See how it fits your AML software stack and book a demo.

The bottom line

The SEB AML penalty is a case about legacy controls catching up with a bank years after it fixed them. New York reached conduct in three Baltic subsidiaries because the risk flowed through a licensed branch and through dollar clearing. For KYC and AML teams, the lessons are concrete. Missing data should raise risk scores. Beneficial owners deserve the most frequent screening, not the least. A monitoring or filtering system that fails silently is itself a finding.

Cited sources

• NYDFS press release: $33 million penalty with Skandinaviska Enskilda Banken AB, 15 October 2026
• NYDFS consent order, In the Matter of Skandinaviska Enskilda Banken AB (PDF)
• 3 NYCRR 116.2, anti-money laundering programmes (Cornell LII)
• 3 NYCRR 504.3, transaction monitoring and filtering programme requirements (Cornell LII)
• 3 NYCRR 504.4, annual compliance finding (Cornell LII)
• Finansinspektionen: SEB receives remark and administrative fine of SEK 1 billion, 25 June 2020