On July 15, 2026, the New York State Department of Financial Services ("NYDFS" or the "department") entered into a consent order with Swedbank AB and Swedbank's New York Branch. The matter resolved a multi-year investigation arising out of the 2016 Panama Papers leak of law firm Mossack Fonseca’s records. Under the settlement, Swedbank agreed to pay a $50 million civil monetary penalty. It bears emphasis that the penalty was imposed for Swedbank's failure to cooperate fully and candidly with NYDFS's information requests, not for the underlying anti-money laundering ("AML") conduct at Swedbank's Baltic subsidiaries. Swedbank's own public statements confirm that the settlement addressed "failure to disclose information to the authority on two occasions" in 2016 and 2018, and the department's press release is titled around Swedbank "Withholding Information from Investigators" rather than around the Baltic AML conduct itself.
NYDFS's investigation began after the Panama Papers revealed that customers of Swedbank Estonia had used Mossack Fonseca as a registered agent and that individuals named in the leaked documents were customers of, or associated with, Swedbank's Baltic operations. Over the course of roughly two years, NYDFS issued two information requests to Swedbank seeking details about the bank's relationships with Mossack Fonseca and related banks, institutions and individuals. In response to the first request, the NYDFS found that Swedbank failed to report its exposure beyond the New York branch, failed to acknowledge the existence of European regulatory inquiries into its Baltic operations and withheld information about connections between Baltic-subsidiary customers and Mossack Fonseca.
In response to the follow-up request, NYDFS found that Swedbank created a false impression that it would meaningfully review its Baltic subsidiaries for responsive information before intentionally excluding those subsidiaries from its production to avoid revealing the bank's numerous connections to Mossack Fonseca and avoid disclosing adverse findings by European regulators. According to the department, Swedbank employees acknowledged that this information should have been included in the production. NYDFS's public statements indicate the consent order rests on New York Banking Law § 125(3), which imposes a reporting-accuracy and transparency duty on regulated institutions and their New York branches, together with the superintendent's authority under Banking Law § 37 to demand special reports and under Banking Law §§ 39 and 44 to impose penalties for violations.
The settlement is a pointed reminder that regulators evaluate whether an institution's compliance program prevented or detected misconduct, and how the institution behaves once regulators start asking questions. For clients across the financial services industry, the Swedbank consent order offers several practical lessons, discussed below.
Compliance Obligations
The consent order reinforces that New York law imposes an affirmative, ongoing duty of transparency on regulated institutions in their dealings with NYDFS, including in how they respond to information requests and examinations. This duty exists independently of, and in addition to, the substantive obligation to maintain an effective AML program, robust internal controls and accurate recordkeeping. By the department's account, Swedbank knew as early as 2016 that Baltic-subsidiary customers had used Mossack Fonseca as a registered agent and that Panama Papers-referenced individuals were linked to the Bank. Having this knowledge internally was not enough: the department found that Swedbank failed to ensure the knowledge reached those responsible for regulatory responses and failed to disclose it promptly once NYDFS made its inquiry. Gaps between internal knowledge held by compliance, legal and business units and what is ultimately communicated to a regulator can, in NYDFS's view, constitute a serious compliance failure in their own right—one the department treated as more consequential here because it found the gap to be knowing and intentional, particularly with respect to Swedbank's exclusion of its Baltic subsidiaries from its second production.
Best Practices
Cooperation with Investigators
For clients contacted by a regulator or already subject to an ongoing inquiry, the Swedbank matter underscores several best practices. First, engage counsel early, ideally before any response to a regulatory request is drafted and certainly before representations are made on the institution's behalf. When engaging counsel, ensure counsel is fully informed of all relevant facts across the corporate family. Counsel should independently test the completeness of business-unit information rather than relying solely on internal assurances, particularly where, as NYDFS found here, employees may already recognize that certain information should be disclosed but is not being surfaced. Second, issue a document preservation notice or litigation hold immediately upon learning of an inquiry, extending it to all relevant business units, affiliates and foreign subsidiaries rather than only the local branch named in the request; NYDFS's findings turned in significant part on Swedbank's failure to search, and later its decision to exclude, its Baltic subsidiaries. Third, treat every related regulatory inquiry, including those from foreign regulators, as potentially relevant to a domestic request. Swedbank's failure to disclose a related European inquiry was a central finding against the bank. Finally, if new information comes to light after a response has been submitted, supplement the record promptly. A delayed correction is far preferable to silence from a regulatory-risk standpoint, particularly shown here as the department found that Swedbank created a false impression about the scope of its planned review and then did not follow through.
Compliance Program Enhancements
In light of the issues identified in the consent order, financial services institutions, particularly those with cross-border operations or foreign subsidiaries, should consider a fresh review of their AML policies, procedures and training. Practical steps include:
- Confirming that escalation protocols require adverse findings from any regulator, anywhere in the corporate family, to be reported promptly to compliance and legal leadership rather than summarized or filtered at the local level, given the department's finding that Swedbank failed to disclose European regulatory inquiries into its Baltic operations.
- Auditing the process by which representations to regulators are prepared, so that draft responses are checked against what compliance and internal audit already know before being shared, since the department found that bank employees recognized information should have been included in Swedbank's production, but it was not.
- Integrating foreign subsidiaries into group-wide AML monitoring and recordkeeping systems rather than treating them as informationally separate, given that the department's core findings centered on Swedbank's Baltic subsidiaries in Latvia, Lithuania and Estonia.
Training for compliance officers, in-house counsel and business-unit leadership should specifically address the duty of candor owed to regulators under provisions such as Banking Law § 125(3), independent of the underlying AML obligations.
Regulatory Trends
The Swedbank consent order reflects a broader enforcement trend: NYDFS is willing to penalize process failures, such as incomplete or misleading responses to information requests, as severely as the underlying conduct that triggered the inquiry. In this instance, NYDFS did so without resolving the question of Swedbank's underlying AML exposure at all. Institutions with any New York touchpoint should expect responses to information requests to be scrutinized as closely as the conduct under investigation and should understand that a strong substantive compliance program will not offset a weak or incomplete regulatory response.
Summer Associate Rachel Dunnam contributed to this article. Rachel is not yet licensed to practice law.
