Intesa Sanpaolo — XME Debit Card

Documented events with consequences still open. Each entry carries a source and a date.

1. Mar 26, 2026 Data breach Severe ● open

   A bank employee accessed the banking data of 3,573 customers without cause for over two years: the Italian data protection authority issued a EUR 31.8 million fine (decision no. 208 of 26 March 2026), whose enforceability was later suspended on an interim basis by the Court of Turin

   Between 21 February 2022 and 24 April 2024 an employee at one of the bank's branches consulted the banking information of 3,573 customers with no professional reason, in more than 6,600 separate accesses; politically exposed persons were among the profiles consulted. For over two years the bank's internal controls flagged nothing. The Italian data protection authority (Garante) found the technical and organisational measures inadequate overall — an operating model that let staff query the entire customer base with no restriction and no reinforced controls on the most exposed profiles — and also faulted the incomplete and late breach notification and the notice to affected customers, which came only after the authority's order of 5 November 2024. By decision no. 208 of 26 March 2026 the Garante imposed an administrative fine of EUR 31.8 million, among the largest ever issued in Italy and the largest in the banking sector. The bank challenged it: on 13 July 2026 the Court of Turin suspended the decision's enforceability on an interim basis, and the Garante accordingly removed the document from its website for the time being; the opposition proceedings are pending. The distinction matters: the fine is not final, the data breach is — the authority itself established it back in November 2024, when it ordered the bank to inform the customers involved.

   ↗ source
2. Mar 12, 2026 Regulatory action Severe ● open

   The data of some 2.4 million customers was profiled without an adequate legal basis to pick who would be moved to subsidiary Isybank: a EUR 17.6 million fine from the Italian data protection authority (decision no. 163 of 12 March 2026), now under a pending court challenge

   Between 2023 and 2024 Intesa Sanpaolo selected which customers to move to its wholly owned subsidiary Isybank by combining preset criteria: age no higher than 65, regular use of digital channels over the past year, no investment products and financial resources below a given threshold. The Italian data protection authority (Garante) established that this profiling was carried out without an adequate legal basis and that customers could not reasonably have expected it: the notices were mostly filed in the archive section of the Intesa Sanpaolo app, in the middle of the summer holidays, with no prominent alert (push notification or SMS) signalling what was at stake. The move meant a unilateral change of contract: a new IBAN and digital-only banking, with no branch access. The proceeding began with numerous complaints from account holders. By decision no. 163 of 12 March 2026 the Garante fined Intesa Sanpaolo S.p.A. EUR 17,628,000. Isybank S.p.A., the subsidiary that received the accounts, was not separately sanctioned. The decision has been temporarily removed from the authority's website under art. 5 of legislative decree 150/2011 because the challenge against it is pending before the courts. The distinction matters: the fine is not final, but the unlawfulness of the processing was established by the authority.

   ↗ source

verified on Sep 23, 2026

Weighted average across 1 public review platform (769,882 reviews in total), weighted by volume. This is not our rating: it is those platforms’ average.