Published 15 March 2023 at 10.22
Domestic. Swedbank receives a remark from the Financial Supervisory Authority, FI, for the bank's lack of internal control during a change in a system-critical IT system last year. The bank must also pay a sanction fee of SEK 850 million.
Share the article
TwittraShare
On April 28 and 29, 2022, a major IT incident occurred at Swedbank in connection with the bank made a change to a critical IT system.
Nearly a million customers had incorrect balances in their accounts, where it looked like money was missing, due to a large number of transactions being stopped in the systems .
The Financial Supervisory Authority's investigation shows that Swedbank made the change in the system without following its procedures for how such changes should be made. Swedbank also lacked appropriate control mechanisms that ensured that the bank followed the routines, according to the authority.
Swedbank has thereby violated central rules on internal control, states FI. According to the routines, for example, a risk and impact analysis would have been carried out and the timing of the change would have been particularly assessed based on, among other things, when salary payments are made.
– The bank deviated from its own routines. This contributed to a very large number of people having extensive problems managing their basic banking services. Close to a million customers received incorrect balances on their accounts and many were also unable to make payments. What happened shows that there can be serious consequences when routines are abandoned and internal control is not maintained, says FI's Acting Director General Susanna Grufman in a statement.
“The lack of internal control has had potential effects on the stability of the financial system. At the same time, it has not been a long-term or systematic violation and Swedbank has taken measures to strengthen internal control,” writes FI.
Swedbank therefore receives a remark and must pay a penalty fee of SEK 850 million.
FI assesses that the sanction does not endanger the bank's current operations or its customers. The bank is well capitalized, shows profitability and has a good liquidity coverage ratio.