SEB’s $33 Million Settlement: What Went Wrong—and What to Check in Your Compliance Program
Amir Fadavi · 2026-10-28
On October 15, 2026, the New York Department of Financial Services announced a $33 million settlement with SEB and its New York branch. The consent order addressed AML deficiencies in SEB’s Baltic subsidiaries between 2015 and 2019, including inadequate customer and correspondent-bank due diligence and transaction monitoring.
NYDFS’s jurisdiction rested on SEB’s New York-licensed branch; the order also traced how the Baltic subsidiaries’ deficiencies exposed New York institutions through branch transactions and U.S. dollar clearing relationships. NYDFS acknowledged SEB’s cooperation and remediation.
The central lesson: policies, screening systems and internal audits provide protection only when their findings translate into effective controls.
What went wrong—and how it could have been prevented
1. Customer information was incomplete or outdated.
Files lacked beneficial ownership, source-of-funds and other material information. Required reviews were missed. Some due diligence accepted customer statements without corroboration or examination of actual activity.
Preventive controls: Make essential KYC fields mandatory, with validation that rejects placeholders and incomplete ownership records. Prevent account activation until required information is collected or an authorized, documented exception applies. Configure the client-management system to generate reviews at risk-based intervals, assign owners, and escalate overdue cases. Require reviewers to compare actual transactions with expected activity and document material discrepancies.
2. Risk ratings understated uncertainty, and approvals were bypassed.
Missing KYC information did not increase risk scores. The high-risk strategy focused too narrowly on non-residents. Staff onboarded high-risk clients and changed ratings without required approval.
Preventive controls: Configure missing material information to trigger a risk exception and prevent automatic low-risk classification. Include ownership, industry, geography and activity in scoring. Restrict onboarding and rating-change permissions: the system should hold the change until a separate authorized reviewer approves it, recording the rationale and supporting evidence.
3. Correspondent relationships received insufficient scrutiny.
SEB continued simplified diligence on certain high-risk banks despite adverse information. Relevant information held elsewhere within SEB did not reach the principal assessment. Downstreaming obscured underlying parties, while RMA messaging relationships also presented inadequately assessed risks.
Preventive controls: Consider a dedicated FI-client team—or designated specialists where scale does not justify a separate team—to maintain a consolidated view of each relationship. Link correspondent accounts, RMA authorizations and other services to one FI record. Route adverse-media and regulatory developments to its owner, with deadlines for reassessment and decisions on additional diligence, restrictions or exit.
4. Monitoring systems and investigations failed in operation.
Data feeds and scenarios were defective. One system generated no new alerts for more than a month. Staff closed alerts without adequate investigation, sometimes recording work that had not occurred. Backlogs recurred.
Preventive controls: Reconcile source transactions to monitoring inputs daily. Send failure notifications when processing jobs do not complete or alert volumes depart materially from expected levels. Require case-specific evidence before closure, sample closed cases for quality review, and track backlog age and risk—not just the number of cases closed.
5. Screening and reporting lacked effective safeguards.
Beneficial-owner and PEP screening was deficient. Payments proceeded during screening outages. Alert decisions lacked recorded reasons. Suspicious activity reporting was incomplete or delayed, and fragmented records prevented verification.
Preventive controls: Reconcile customer and related-party records to screening populations. Configure payments to remain on hold during screening outages unless an approved alternative completes screening before release. Require reasons for alert dispositions and maintain a case register linking referrals, investigations, reporting decisions, deadlines and filing confirmations.
6. Known weaknesses persisted.
Audits repeatedly identified deficiencies. Delegated reviews were inconsistent and lacked sufficient second-level controls.
Preventive controls: Give each finding an owner, deadline and measurable closure condition. Escalate overdue or recurring findings to management. Require someone independent of the remediation work to test operating results before closing the finding.
Check your own program
Use the table below to examine actual records and system behavior. These are practical controls derived from the findings; implementation should reflect your institution’s risks and applicable requirements.
Mark each row Effective / Gap / Not tested / N/A, with supporting evidence. A policy alone is not evidence of effectiveness.
| What went wrong — order paragraphs | Actionable preventive control | Your program: status / evidence |
|---|---|---|
| Missing or inaccurate KYC, including inactive accounts (¶¶12–15) | Make essential fields mandatory; reject placeholders; flag missing ownership information; require outstanding checks before reactivation. | ___ / ___ |
| Required diligence reviews were missed (¶¶11, 14–17) | Generate reviews automatically at policy-defined intervals; assign owners and escalate overdue cases. | ___ / ___ |
| Customer statements and actual activity were insufficiently examined (¶¶13, 16–17) | Require reviewers to attach corroborating evidence appropriate to risk and explain material deviations from expected activity. | ___ / ___ |
| Delegated EDD lacked oversight and consistent standards (¶¶12, 17) | Use common review templates, require second-level review of high-risk cases, and compare sample decisions across teams. | ___ / ___ |
| Onboarding and risk changes bypassed approvals; EDD termination controls were weak (¶¶13, 20–21) | Restrict system permissions; require a separate authorized approver before activation, rating changes or removal from EDD. | ___ / ___ |
| Risk strategy overlooked foreign-owned resident entities and other risks (¶18) | Add ownership geography, industry and activity to scoring; test resident companies with foreign owners against the rules. | ___ / ___ |
| Missing KYC did not increase assessed risk (¶19) | Trigger an exception for missing material data and prevent automatic low-risk classification until resolved. | ___ / ___ |
| PEP screening was irregular or undocumented (¶¶21–22) | Schedule risk-based rescreening; retain execution logs; give manual reviewers written search and escalation instructions. | ___ / ___ |
| UBO screening was incomplete and less frequent than customer screening (¶13) | Feed beneficial-owner records into screening and reconcile record counts; investigate missing parties and unjustified frequency differences. | ___ / ___ |
| Customers outside specialist teams lacked coverage; strategies remained unimplemented (¶¶24–26) | Reconcile high-risk customer lists across business units; assign every relationship an owner; track partner concerns to completed actions. | ___ / ___ |
| High-risk correspondent banks received simplified diligence despite adverse information (¶¶30, 36–44) | Assign FI specialists; route adverse developments into mandatory reassessment tasks with deadlines and documented decisions. | ___ / ___ |
| FI assessments omitted information held elsewhere (¶43) | Maintain one FI assessment linking customer-base, country, product, industry and compliance information from relevant teams. | ___ / ___ |
| RMA relationships were inadequately assessed (¶¶34–35, 41–44, 63) | Reconcile active RMA authorizations to approved FI records; flag unmatched authorizations for review and restriction where warranted. | ___ / ___ |
| Downstreaming obscured parties and continued outside USD (¶¶9, 31–32, 45–49) | Identify underlying banks and payment routes; analyze flows across currencies; restrict activity where transparency is insufficient. | ___ / ___ |
| Monitoring feeds and scenario logic were deficient (¶¶51–52) | Reconcile daily input totals, investigate rejected records, and test scenarios with transactions expected to generate alerts. | ___ / ___ |
| Monitoring stopped generating alerts (¶54) | Notify Compliance and IT of failed jobs or unexplained zero-alert periods; reconcile and reprocess affected transactions after recovery. | ___ / ___ |
| Alerts were closed without adequate investigation or accurate records (¶52) | Require case-specific findings and evidence before closure; sample high-volume closures and repeated narratives for quality review. | ___ / ___ |
| Alert backlogs recurred (¶53) | Report aging and risk weekly, set escalation thresholds, and compare incoming workload with available investigation capacity. | ___ / ___ |
| Screening decisions lacked reasons and documented QA (¶56) | Require a reason, supporting evidence and decision-maker identity for each disposition; independently sample the results. | ___ / ___ |
| Screening omitted customers or transactions; payments proceeded during outages (¶¶57–58) | Reconcile screening coverage and configure payment holds that cannot be released without completed screening or an approved screened alternative. | ___ / ___ |
| Internal restriction lists contained stale information (¶58) | Assign list owners and review dates; require documented approval for changes without removing applicable legal restrictions. | ___ / ___ |
| Referrals, investigations and SAR filings were incomplete, delayed or unreconciled (¶59) | Use a case register with deadline alerts; reconcile referrals to decisions and filings to submission confirmations. | ___ / ___ |
| One employee investigated and filed SARs without quality checks (¶60) | Assign a separate qualified reviewer and backup filer; record review without delaying required submissions. | ___ / ___ |
| Known deficiencies persisted (¶¶10–17, 51, 53, 61) | Set evidence-based closure conditions, escalate repeat findings, and independently retest controls before closure. | ___ / ___ |
Source: NYDFS consent order concerning SEB.
Use this enforcement action to examine your own program before similar weaknesses become the subject of regulatory scrutiny. Assessing whether compliance controls work—and identifying what needs to change—is what Sanctrust specializes in. If you would like help checking your exposure to these issues, contact us.