Summary

  • The RIPE NCC's rules already define the remedy path for the Svea abuse-contact surface: notification and documentation duties under ripe-667, closure evidence when a transferring party no longer exists, org-name changes only through LIR requests and RIPE NCC action, and abuse-mailbox corrections at the role-object level.
  • As of this writing, no authoritative registry evidence shows any of that remedy was applied after the 17 December 2025 Finansinspektionen sanction; third-party mirrors of the Svea surface still show the dissolved entity's name and contradictory timestamps.
  • The Finansinspektionen decision supplies an accountability standard by analogy: the supervisor rejected operator-asserted remediation as insufficient. No equivalent external verification mechanism exists for abuse contacts.

What the rules require

Start with the transfer rules. Under ripe-667, the RIPE NCC's document on transfers of Internet number resources and changes of a member's official legal name, a member must inform the RIPE NCC when resources are transferred — for example through merger, acquisition, bankruptcy, liquidation or insolvency — or when it changes its official legal name. Responsibility then splits: the RIPE NCC updates the registry, including all RIPE Database objects maintained by the RIPE NCC that are related to this transfer, while the transferring member must update all RIPE Database objects maintained by them. Svea Ekonomi AB merged into Svea Bank AB on 3 January 2022, a fact the Finansinspektionen decision itself records (see below), so the trigger conditions in ripe-667 were met nearly four years ago.

Documentation is the second half. Under the RIPE NCC's required-documents guidance for registry updates, if the transferring party no longer exists by the time the RIPE NCC is involved, the member must supply "an official document issued by a national authority confirming the closure of the transferring party", plus either a copy of an older signed agreement mentioning the transfer or, if that is unavailable, a signed confirmation by an authorised person of the receiving party. Such a document demonstrably exists in Svea's case: the Finansinspektionen decision of 17 December 2025 records that Svea Ekonomi AB merged into Svea Bank AB with all business inherited by the bank, and the bank's registration number 556158-7634 matches the reg-nr shown on the RIPE organisation object.

Naming is the third half. The RIPE Database Business Rules state that if an organisation object has a RIPE NCC maintainer present, only the RIPE NCC can change the org-name value, and only after an LIR submits a change request. A May 2024 RIPE Database Working Group statement concluded that names in the org-name attribute "should remain the legal name associated with the resource holder" and that changes require official proof of the legal change. Neither document addresses a person object that still carries a dissolved company's name — but the clean-up process for unreferenced data, running since 6 September 2016, shows the registry does eventually purge stale contact objects once they stop being referenced by operational objects for 90 days. An actively referenced abuse role is precisely the kind of object that process does not touch.

The abuse contact itself is governed separately. Under ripe-705, every aut-num must carry an abuse-c attribute referencing a role object with an abuse-mailbox attribute; the mailbox must be available without restriction via whois and APIs; and the RIPE NCC validates the abuse-mailbox at least annually. RIPE NCC guidance and the database query documentation make clear that changing the abuse contact email is done by editing the role object containing the abuse-mailbox attribute — not by renaming the organisation — and that any inetnum, inet6num or aut-num referencing the organisation is covered by that address.

What the record shows

Measured against those requirements, third-party mirror data of the Svea surface shows a system that exists on paper. Mirrors of AS211899 record organisation ORG-SBA155-RIPE with org-name Svea Bank AB, reg-nr 556158-7634 and abuse-c SEAR1-RIPE (as shown in the IPIP.NET whois mirror and the Sitezilla AS view). The same mirrors still show a person object JE4899-RIPE (Jorgen Edstrom) carrying the dissolved Svea Ekonomi AB name and address, and display a personal address on the svea.com domain as the AS211899 abuse contact. Mirrors contradict each other on the organisation's last-modified timestamp — one shows 2022-12-01T17:25:15Z, another 2026-05-13T06:37:38Z — and the RIPE Database search interface is the authoritative place where any post-sanction change would appear.

The 193.105.138.0/24 netblock, registered to Svea Billing Services AB, presents a separate anomaly: its abuse-c resolves to a mailbox on a Verizon domain in mirror data, with no public explanation located. That is exactly the kind of display the mandatory abuse-c and validated abuse-mailbox regime in ripe-705 exists to prevent.

The accountability standard already on the table

The Finansinspektionen decision concerned anti-money-laundering compliance only. Its announcement and decision document mention no registry, RIPE Database or abuse-contact obligations, and the investigation covered the period 30 April 2022 to 1 May 2023 for business directed at legal-person customers. The violations were judged not serious enough to withdraw authorisation or issue a warning.

What the decision does supply, by analogy only, is a proof standard. The supervisor examined the bank's own remediation cooperation and judged it "not more active than could be expected" — operator assertions were not accepted as evidence of remedy. In the abuse-contact field, no equivalent external verification mechanism exists at all. The RIPE NCC abuse-reports guidance describes the reporting path but does not evidence operational handling, and this briefing located no independent, non-operator source showing that any Svea abuse mailbox receives and acts on reports.

The compliance test is therefore concrete and cheap to check: JE4899-RIPE corrected or withdrawn via the member-side path; the displayed abuse contact satisfying the mandatory abuse-c and validated abuse-mailbox requirements rather than resolving to a personal address; closure documents on file for any transfer involving the dissolved party; and the 193.105.138.0/24 abuse-c explained or corrected. Any one of those appearing in the authoritative RIPE Database would move the surface from registered validity toward demonstrable remedy. None has.