Stockholm fintech runs on BankID, Swish, and the Klarna lesson.

Compliance-first procurement. Every vendor diligence pack includes a Schrems II transfer-impact assessment, an SCC + DPA mapping, ISO 27001 / SOC 2 receipts, and increasingly a model card with bias-testing summary. After IMY's 2024 enforcement record (SEK 60.6M total, anchored by Apoteket SEK 37M and Apohem SEK 8M for Meta-Pixel data leakage), even marketing-stack pixels are a board-level risk topic.

The signal: a vendor without an EU sub-processor list and a signed DPA gets deprioritised at the next renewal, regardless of product quality.

FI as the gatekeeper. Finansinspektionen supervises all banks, payment institutions, e-money institutions, investment firms, insurance carriers, and now MiCA crypto-asset service providers — FI granted its first MiCA authorisation in October 2025 after a roughly six-month review window.

FI's Innovation Centre formally collaborates with Findec (SweFinTech), the Riksbank, and PTS, which means regulator dialogue is a baked-in part of go-to-market for any Swedish-domiciled fintech. PSD2 passporting — and PSD3 from 2026 — means a Swedish EMI or PI licence travels across all 27 EU member states without re-authorisation. This is why Stockholm consistently punches above its population in licensed-counterparty share.

The Klarna watershed read honestly. The 2024 OpenAI deployment was the case study every Swedish fintech CEO read. The 2025 partial reversal is the case study they actually buy on. CEO Siemiatkowski admitted on the Q1 2025 earnings call that cost-driven optimisation produced lower quality, and Klarna started rehiring human agents under a freelance-shift model from SEK 400/hour while AI handles tier-1.

The reference architecture is now hybrid by design: route deterministic tier-1 to AI, route empathy and edge cases to humans, never claim 100% containment, measure CSAT not just throughput.

Schrems II data residency. The EU-US Data Privacy Framework adequacy decision of 10 July 2023 made transfers to certified US vendors viable again — but the diligence overhead remains. Every transfer needs a TIA, every sub-processor is mapped, and EU- or Nordic-region hosting is the default ask for any LLM inference path. The practical effect: vendors that ship US-only inference get filtered at procurement; vendors that ship EU-resident inference with documented sub-processors get signed.

Bilingual disclosure is non-negotiable. EF EPI ranks Sweden #8 globally in English proficiency, and most Swedish fintech operates English-default internally. But formal regulated documents — KIIDs, PRIIPs KIDs, FI-mandated disclosures, T&C addenda — need a Swedish-language fallback for end-customer disclosure. The bilingual split is structural: English for the sales motion, Swedish for the regulatory artefact. Both surfaces need to be citable by AI engines, and right now they are not.

DORA full application since 17 January 2025. ICT risk governance, incident reporting on a four-hour initial and 72-hour intermediate clock, mandatory third-party register, threat-led penetration testing for significant entities, and ESA-level oversight of critical ICT third-party providers since H2 2025.

Penalties run up to 2% of annual worldwide turnover for in-scope entities and 1% of average daily worldwide turnover for designated critical ICT providers. Every AI vendor sold into a Swedish fintech now sits inside DORA's third-party register — not maybe, definitely.

EU AI Act high-risk obligations. Creditworthiness evaluation of natural persons and life/health insurance risk assessment and pricing are both classified Annex III high-risk. Articles 9-17 provider obligations apply, plus Article 26 deployer obligations and an Article 27 Fundamental Rights Impact Assessment before first deployment.

The headline date is 2 August 2026; the 7 May 2026 EU political agreement introduced staggered deadlines with a 16-month postponement for new or substantially modified high-risk credit and insurance systems. Penalties under Article 99: EUR 15M or 3% of global annual turnover, whichever is higher. Fraud-detection AI is explicitly carved out — important for the Stripe Radar / Featurespace / Sift layer.

PSD3 + PSR. Provisional agreement 27 November 2025, entry into force expected late Q1 / early Q2 2026, 21-month transition. The EMI category merges into payment institutions; IBAN-name verification becomes mandatory; behavioural transaction monitoring requirements expand; SCA carve-outs broaden in narrow places and tighten elsewhere. Every Swedish PSP's roadmap for 2026-2027 turns on these dates. Marketing claims that ignore the transition window age badly inside a year.

MiCA + FI. Live in Sweden since December 2024; FI is competent authority and granted its first authorisation in October 2025. Passporting works the same way as PSD2 — one Swedish MiCA authorisation travels across EU27. Crypto-asset service providers selling into Sweden now sit under FI's full supervisory regime, which materially changes the marketing posture compared to the pre-MiCA Nordic crypto landscape.

MiFID II + IDD + Solvency II. Record-keeping, best-execution evidence, product-governance and suitability-assessment obligations apply to every AI used in advisory or sales motions.

IDD broker remuneration disclosure adds another layer for insurance distribution — Areza's Foundation content templates handle the disclosure surface natively. GDPR + IMY sits on top of everything: Schrems II TIAs on every US sub-processor, Meta-pixel marketing-stack architecture as a documented board-level risk.

Lagom procurement. Long evaluation, multi-stakeholder sign-off (compliance + risk + product + engineering all opt-in), written diligence preferred over enthusiasm, US-style scarcity tactics treated as a red flag.

After sign-off, execution is unusually clean — scope creep is rare and retention is high. Pricing transparency matters: Swedish buyers explicitly de-prioritise vendors who hide pricing behind a request-a-demo wall, especially when the procurement gate includes a compliance officer with DORA budget pressure.