Summary

  • Control of prevention and detection on the Svea abuse-contact surface is split between Svea's own frozen registry objects and a sponsoring-LIR layer that was actively maintained as recently as 1 July 2026.
  • The registry's enforcement ladder under ripe-705 mandates annual abuse-mailbox validation, but no published validation report, tracked complaint outcome or compliance action exists for the Svea attributes.
  • The only accountability that demonstrably fired was Finansinspektionen's 17 December 2025 remark and SEK 170 million AML sanction against Svea Bank AB — supervision that attached to the operator through a different failure channel, not to the abuse-contact question.

The starting fact is a corporate event: Svea Ekonomi AB was merged into Svea Bank AB on 3 January 2022. What the RIPE Database inherited is visible in third-party mirrors of the registry record. The autonomous system AS211899 (as-name SVEA) is registered to ORG-SBA155-RIPE — Svea Bank AB, registration number 556158-7634 — with sponsoring organisation ORG-TA44-RIPE (Tele2/SWIPNET). It was created on 2021-02-02 and the aut-num record shows a last-modified of 2022-05-13T06:38:36Z.

The organisation object carries the abuse handle: abuse-c SEAR1-RIPE. Its person-level history is the crux. Person object JE4899-RIPE (Jorgen Edstrom) still lists the address "Svea Ekonomi AB" — a company that legally ceased to exist in January 2022 — with a last-modified of 2022-04-11. The legacy address block 193.105.138.0/24 (SVEA-EKONOMI-SE) routes abuse reports to a third-party mailbox, with a last-modified of 2021-02-02. Meanwhile the SWIP-RIPE role object (Swipnet Staff), which sits on the sponsor side of the chain, carries a sponsor-side abuse-mailbox under the tele2.com domain and was last modified on 2026-07-01 — the freshest timestamp in the entire chain, and the only one outside Svea.

Mirrors are not the authoritative registry, and they disagree: one shows ORG-SBA155-RIPE last modified 2022-12-01T17:25:15Z, another 2026-05-13T06:37:38Z. The live mailbox value behind SEAR1-RIPE could not be verified from a primary source in this research; several secondary retrieval attempts against the RIPE REST interface and RIPEstat also failed to surface it. That gap is itself part of the finding. Some mirrors render the computed abuse contact for AS211899 as an individual address in the svea.com domain, diverging from the registered role handle.

The mechanism that should govern this surface is fully documented on paper. Policy proposal 2017-02, accepted 1 June 2018 and implemented 10 October 2019, produced ripe-705, which requires an abuse-c referencing a role object with a single abuse-mailbox attribute, mandates annual validation via automated checks — syntax, domain, mail-server configuration, with no email sent — and defines follow-up with the responsible or sponsoring LIR, escalating in the worst case to LIR closure or de-registration of resources. RIPE NCC guidance is explicit about the boundary: the NCC ensures contacts are valid and up to date, but it cannot compel an operator to reply. The database documentation adds the operational caveat that a valid, registered contact does not prove anyone reads it.

What the public record does not show is any outcome. As prior BTW reporting established, there is no published validation report, no tracked complaint outcome, no arbitration request and no compliance action certifying whether any Svea abuse-mailbox attribute was ever validated as correct or incorrect. "Not publicly observed" must be kept distinct from "not enforced" — but the asymmetry is real: the enforcement ladder is exhaustively documented, and for this specific resource holder its public event log is empty.

The one accountability that demonstrably fired came from outside the registry system. Finansinspektionen decided on 16 December 2025 and announced on 17 December 2025 a formal remark (anmärkning) and a SEK 170,000,000 administrative fine against Svea Bank AB. The decision document (FI dnr 23-13249, under chapter 15 §7 of the Banking and Financing Business Act) cites breaches of core anti-money-laundering rules — beneficial-owner identification and enhanced due diligence for high-risk customers — over an investigation period of 30 April 2022 to 1 May 2023. The investigation-closure page confirms the sanction from a second primary source, and the sanctions register entry completes the record.

This sanction matters here for what it is, and for what it is not. It is independent, non-operator supervision that demonstrably attached to Svea Bank AB. It is not validation of the abuse-contact failure: it concerns a different channel — money-laundering controls — and the fine's cap was set against 2024 group turnover of roughly SEK 6,271 million (maximum roughly SEK 627 million). The contrast it creates is the article's central point. When Swedish supervisors found a control failure at Svea, they produced a dated, quantified, published decision.

When the registry's own validation machinery encountered the same organisation's frozen abuse-contact surface, the public record produces silence.