New York fines SEB $33 million over Baltic monitoring that went silent for five weeks

What happened

On 15 October 2026, the New York State Department of Financial Services (NYDFS) announced a $33 million penalty against Skandinaviska Enskilda Banken AB (SEB) and its New York Branch. The consent order finds that between 2015 and 2019 SEB failed to maintain an effective anti-money laundering (AML) program at its subsidiaries in Estonia, Latvia, and Lithuania, and that their transaction monitoring was inadequate. The NYDFS press release says the investigation grew out of its review of licensees’ links to the law firm at the centre of the 2016 Panama Papers leak.

Much of the order rests on SEB’s own audits. A 2015 audit found the Baltic subsidiaries had failed to update know your customer (KYC) information for 64% of legal entity clients. A risk scoring model introduced in 2017 did not raise a client’s score when key KYC data was missing, so a high-risk client could be rated low risk. SEB Estonia screened beneficial owner data against sanctions and politically exposed person (PEP) lists only twice a year.

Between 6 July and 10 August 2017, the monitoring system “did not create any new alerts for Estonia” because alert generation was started but never completed. A 2018 audit found Estonian staff closed PEP alerts as they came in, sometimes up to 100 per day. When the SafeWatch screening tool was unavailable in Estonia and Latvia, payments were processed without sanctions screening and reviewed afterwards.

Correspondent banking was the other weakness. SEB applied only simplified due diligence to several high-risk correspondent partners, and the order cites about $5.17 trillion processed for one European bank’s accounts between 2008 and 2018. NYDFS gave weight to SEB’s cooperation and remediation. SEB says the US Department of Justice closed its own review without taking action.

Why it matters

A monitoring system that produces no alerts for five weeks does not sound an alarm on its own. Someone has to notice that the queue is empty.

When missing data leaves a risk score unchanged, incomplete files can end up with lower ratings than complete ones. NYDFS links the 2017 model directly to high-risk clients being rated low risk and missing enhanced due diligence.

The conduct ended in 2019, and Swedish, Estonian, and Latvian regulators flagged deficiencies and issued fines in 2019 and 2020. A New York penalty still followed in 2026, because the Baltic business reached the US financial system. The order says one US dollar clearing bank processed $144 billion of transactions with SEB’s Baltic subsidiaries from 2015 to 2019.

Practitioner angle

• Track daily alert volume by scenario and by legal entity, and escalate automatically when a count drops to zero or falls sharply.
• Decide in advance whether payments may be released when the screening tool is down, who approves it, and how the backlog is reviewed afterwards.
• Test your customer risk model with blank KYC fields and confirm the score goes up.
• Base each annual correspondent review on current adverse information. The order criticises review forms for one high-risk bank that “remained virtually unchanged year-to-year.”

Add the zero-alert check to your daily monitoring dashboard this week.