TITLE: Denmark's Financial Supervisory Authority Issues Enforcement Actions Against Lunar Bank Following May 2026 Inspection
BODY:
On August 21, 2026, Denmark's Financial Supervisory Authority (FSA) published an inspection report on Lunar Bank A/S following a comprehensive examination conducted in May 2026. The FSA assessed the bank's principal risk areas using a risk-based approach.
Lunar Bank operates as a digital bank without physical branches, offering financial services to individuals and small businesses. The bank divested substantially all of its loan portfolio in 2024 and has since focused on generating revenue through interest margins between deposits and bond holdings, as well as transaction fees and service charges. The bank continues to operate at a loss, and uncertainty remains regarding the viability of its business model. The FSA identified multiple material deficiencies across governance, compliance, artificial intelligence (AI) management, data quality, and information technology (IT) risk management. High personnel turnover across the board, including the board, management, and broader organisation, has increased risks of errors, knowledge loss, and delayed task execution. The compliance function was understaffed throughout 2024 and 2025, preventing execution of planned work until consultant support was approved in the first quarter of 2026. The bank's ambitious AI and large language model (LLM) deployment lacks concrete, measurable monitoring frameworks and validation standards. Data quality governance is deficient across multiple areas, prompting the FSA to require a 0.4 percent increase in solvency requirements relative to risk-weighted exposures. IT risk management lacks coherence between central governance elements, documentation, operationalisation, and monitoring.
The FSA issued multiple formal orders requiring the bank to: establish sustainable earnings without incurring inappropriate risks; ensure adequate resources and robust management succession planning; strengthen compliance function capacity and oversight; implement comprehensive AI model risk governance and validation procedures; improve data quality management and reporting; and establish cohesive IT risk management with enhanced third-party oversight. The bank must address these deficiencies to maintain regulatory compliance.