Intesa Sanpaolo — XME Prestito
Intesa Sanpaolo S.p.A.
at 68% of the usury threshold
Data verified on unchanged since the sources
Worth it if you are already an Intesa customer and value the solidity of Italy's largest bank, with app-based loan management and insurance left optional.
Avoid it if the 7.20% nominal rate attracts you: it is a few-day promo, outside which the standard rate is 10.90% and the example APR 12.61%, with origination up to €750.
XME Prestito is the personal loan of Intesa Sanpaolo, Italy's largest bank. It is the textbook "teaser promo" case: the shopfront often shows a 7.20% nominal rate, but that is a flash online promotion lasting a few days. The standard nominal rate is 10.90% and the representative example (€12,000/84 months, effective 01/07/2026) has a 12.61% APR. Fees: 2% origination (min €100 – max €750) and €2 per-instalment collection. The ProteggiPrestito insurance is optional and not included in the APR.
Data & conditions
| Representative-example APR | 12.61% (€12,000 · 84 months) |
|---|---|
| Min advertised nominal rate | 7.2% |
| Usury threshold | 18.6% (Credito personale, 3° trim. 2026) — APR sits at 68% |
| Loan amount | €2,000 – €75,000 |
| Term | 24–120 months |
| Lender | Bank (direct lender) |
| Mandatory insurance | No |
| Insurance included in APR | No |
| Reported to credit bureaus (CRIF) | Yes |
| KYC | Full |
| Supported countries | EEA · 1+ countries |
| Regulator | Banca d'Italia / BCE |
| Segment | B2C |
| Funding / solidity | Gruppo Intesa Sanpaolo, prima banca italiana |
| MiCA / License status | Banca (Albo delle Banche, Banca d'Italia) |
Strengths
- Italy's largest bank: solidity, wide network, app/online management for customers
- Periodic online promos with a discounted nominal rate (7.20%) for short windows
- Insurance explicitly optional and outside the APR
- No notable sovereignty advantage documented.
Weaknesses
- The 7.20% is a few-day promo: outside the promo the standard nominal rate is 10.90% and the example APR 12.61%
- 2% origination (up to €750) + €2 per instalment: non-negligible fees
- The online loan is fullest mainly for existing customers
- Custodial: the platform holds your funds and can freeze or lose them.
- Full KYC required: verified identity, zero pseudonymity.
Verdict
Score 3.0/5, average profile. In its favour: italy's largest bank: solidity, wide network, app/online management for customers. The trade-off to weigh: the 7.20% is a few-day promo: outside the promo the standard nominal rate is 10.90% and the example APR 12.61%.
On the Sovereignty lens the score is 0.4/5 (weak): the strength is censorship resistance (1.5/5), while fund control (0.0/5) is the weak link.
Promp's editorial rating based on real fees and net annual cost. Promp reviews third-party products independently.
"Sovereignty" rating: score computed on privacy/anonymity (30%), fund control (20%), censorship resistance (20%), trustless/auditability (20%) and costs (10%). Same data, different weights.
Reputation
What happened to people who used Intesa Sanpaolo — XME Prestito, and what users say. External signals: they do not feed the promp.it rating.
Incidents & regulatory actions
Notable incidentsDocumented events with consequences still open. Each entry carries a source and a date.
-
Data breach Severe ● open
A bank employee accessed the banking data of 3,573 customers without cause for over two years: the Italian data protection authority issued a EUR 31.8 million fine (decision no. 208 of 26 March 2026), whose enforceability was later suspended on an interim basis by the Court of Turin
Between 21 February 2022 and 24 April 2024 an employee at one of the bank's branches consulted the banking information of 3,573 customers with no professional reason, in more than 6,600 separate accesses; politically exposed persons were among the profiles consulted. For over two years the bank's internal controls flagged nothing. The Italian data protection authority (Garante) found the technical and organisational measures inadequate overall — an operating model that let staff query the entire customer base with no restriction and no reinforced controls on the most exposed profiles — and also faulted the incomplete and late breach notification and the notice to affected customers, which came only after the authority's order of 5 November 2024. By decision no. 208 of 26 March 2026 the Garante imposed an administrative fine of EUR 31.8 million, among the largest ever issued in Italy and the largest in the banking sector. The bank challenged it: on 13 July 2026 the Court of Turin suspended the decision's enforceability on an interim basis, and the Garante accordingly removed the document from its website for the time being; the opposition proceedings are pending. The distinction matters: the fine is not final, the data breach is — the authority itself established it back in November 2024, when it ordered the bank to inform the customers involved.
↗ source -
Regulatory action Severe ● open
The data of some 2.4 million customers was profiled without an adequate legal basis to pick who would be moved to subsidiary Isybank: a EUR 17.6 million fine from the Italian data protection authority (decision no. 163 of 12 March 2026), now under a pending court challenge
Between 2023 and 2024 Intesa Sanpaolo selected which customers to move to its wholly owned subsidiary Isybank by combining preset criteria: age no higher than 65, regular use of digital channels over the past year, no investment products and financial resources below a given threshold. The Italian data protection authority (Garante) established that this profiling was carried out without an adequate legal basis and that customers could not reasonably have expected it: the notices were mostly filed in the archive section of the Intesa Sanpaolo app, in the middle of the summer holidays, with no prominent alert (push notification or SMS) signalling what was at stake. The move meant a unilateral change of contract: a new IBAN and digital-only banking, with no branch access. The proceeding began with numerous complaints from account holders. By decision no. 163 of 12 March 2026 the Garante fined Intesa Sanpaolo S.p.A. EUR 17,628,000. Isybank S.p.A., the subsidiary that received the accounts, was not separately sanctioned. The decision has been temporarily removed from the authority's website under art. 5 of legislative decree 150/2011 because the challenge against it is pending before the courts. The distinction matters: the fine is not final, but the unlawfulness of the processing was established by the authority.
↗ source
verified on
FAQ
Is XME Prestito's 7.20% nominal rate what I'll pay?
Almost always no: 7.20% is an online promotion lasting a few days. The standard rate is 10.90% nominal and the representative example has a 12.61% APR. Always check whether you're looking at the promo or the standard terms, and read the APR in your SECCI.
Sources
- Official service page Data verified on Jul 16, 2026