Finland's Financial Supervisory Authority publishes decision appendix on EUR 7.67 million penalty and public warning for S-Bank

Finland's Financial Supervisory Authority (FIN-FSA) supplemented its earlier announcement by publishing a decision appendix to its enforcement action against S-Bank Plc, imposing a combined penalty payment of EUR 7,670,000 for omissions in operational risk management and issuing a public warning for failures related to strong customer authentication and payer consent when executing payment transactions. The deficiencies were linked to a programming error in the bank’s IT system between 20 April 2022 and 5 August 2022. The operational risk management shortcomings covered information system security and effective incident management procedures, as well as inadequate policies and processes to identify, assess and manage operational risks in these areas and insufficient preparedness for outsourcing-related risks. The issues were identified through an FIN-FSA inspection carried out in 2022–2023 and through a separate programming error investigation; FIN-FSA also noted that supervision of ICT, cyber and outsourcing risks remains an operational priority in 2025. The penalty amount, payable to the State, reflected an overall assessment including the nature, extent and duration of the omissions and the bank’s previous omissions, with remediation measures and cooperation treated as mitigating factors. The decision is not yet legally binding, and S-Bank may appeal to the Helsinki Administrative Court within 30 days of receiving notice of the decision.