New York regulators just fined Swedbank $50 million, and the violation at the center of the case was not the underlying misconduct from a decade ago, it was the bank’s failure to tell investigators about it when asked. The penalty closes out New York’s Panama Papers-era probe into Swedbank and sets a marker for how much concealment now costs on its own.
What happened
The New York State Department of Financial Services announced on July 16 that Swedbank agreed to pay $50 million to resolve an investigation into its compliance with New York banking law and its failure to fully cooperate with information requests made in 2016 and 2018. DFS found that Swedbank excluded its Baltic subsidiaries from its responses, leaving investigators unaware of customer relationships tied to Mossack Fonseca, the law firm at the center of the 2016 Panama Papers leak, and of adverse findings from European regulators. Acting Superintendent Kaitlin Asrow said financial institutions “have a legal obligation to comply with New York’s laws and regulations designed to protect the integrity of the financial system.” The settlement closes all DFS investigations into Swedbank’s historical shortcomings.
Why it matters
The case follows the same enforcement logic New York regulators applied to Block’s $45 million Cash App settlement: the penalty is not just about the original gap in controls, it is about what the institution did or did not disclose once regulators started asking questions. That distinction raises the stakes for every compliance team fielding a regulatory information request, since an incomplete or misleading response can now generate a larger, separate liability from the conduct that triggered the inquiry in the first place.
The original insight
Swedbank’s case shows concealment has become its own enforcement category, independent of whether the underlying activity was ultimately provable. DFS’s order centers on two specific instances, in 2016 and 2018, where Swedbank had the information and chose not to produce it. For compliance leaders, the lesson is that once a regulator opens an inquiry, the completeness of the response itself becomes a second, separately punishable event.
