New payment

Hour shall mean an hour until which the payment order delivered on the Bank’s business day is considered as received (the countdown of the term of executing such payment order starts) on the same day and shall be executed within the number of the Bank’s business days specified in the ‘Day’ column, counting as of the day of delivery of the payment order. Payment order delivered after the specified hour on the Bank’s business day or on the day that is not the Bank’s business day shall be considered as received (the countdown of the term of executing such payment order starts) on the next Bank’s business day, but the funds will be debited immediately, thought it shall be executed within the number of the Bank’s business days specified in the ‘Day’ column, counting as of such next Bank’s business day (for example, should it be specified 14:00 in the ‘Hour’ column and T0 Day in the ‘Day’ column, a payment order delivered until 14:00 on the Bank’s business day shall be executed on the day of delivery of the payment order, while a payment order delivered after 14:00 or on a day that is not Bank’s business day shall be executed on the next Bank’s business day). The payment order submitted on the Bank's business day after the specified hour or on a day which is not a Bank's business day, if it has not been sent from the Bank yet, may be canceled by 4:00 on the next Bank's business day. The payment order submitted on the Bank's business day by 3:59 may be canceled before 4:00 on the same Bank business day.

Should nothing be specified in the ‘Hour’ column, payment order delivered at any time on the Bank’s business day shall be executed within the number of the Bank’s business days specified in the ‘Day’ column, counting as of the day of delivery of the payment order.

Day shall mean a number of the Bank's business days within which a payment order shall be executed. Countdown of the said term shall be started on the day of the receipt of a payment order, taking into account whether the payment order is delivered on the Bank's business day and/or until the set hour on the Bank's business day (see 'Hour' explanations provided hereinabove). For example, T0 - the payment order shall be executed on the same Bank's business day if delivered until time specified in the 'Hour' column.

Bank's business day:

• Credit transfers within "Swedbank", AB and Instant credit transfers – on each calendar day;
• Credit transfers SEPA to other banks incorporated in Lithuania (except Instant credit transfers) and [European payment]² – on a day that is neither Saturday, nor Sunday, Great Easter Friday, second Easter day, 1st of May, 25th and 26th of December, 1st of January;

¹ Instant credit transfer – the SEPA Instant credit of amount is less than EUR 15 000. Processed by EU valid instant payments schema rules. Currently Instant credit transfers are sent only to the banks registered in Lithuania that have joined Instant payments schema.

² EUR-denominated transfer to the EU Member State, Andorra, Iceland, United Kingdom, Liechtenstein, Monaco, Norway, San Marino, Switzerland and Vatican if terms are acceptable, in this case the Payee's bank SWIFT (BIC) must be indicated; the

Payee's bank account must be indicated in IBAN format, and the payment type is designated SHA.

³ Swedbank Group banks:

Swedbank (SWIFT code: SWEDSESS), Sweden, Stockholm

Swedbank (SWIFT code: SWEDFIHH), Finland

Swedbank (SWIFT code: SWEDNOKK), Norway

Swedbank AS (SWIFT code: HABAEE2X), Estonia

Swedbank AS (SWIFT code: HABALV22), Latvia

Explanations of OUR and SHA credit transfers

OUR. OUR type credit transfer means that when the funds are transferred to the Payee, the Payer (you) undertakes to pay all charges applicable by Swedbank, AB (hereinafter referred to as the Bank) and other banks' fees established for this type of credit transfer. Where your payment of such a charge to the Bank for effecting the payment order does not fully cover the charges stipulated by your Correspondent bank and the Payee's bank for effecting the payment order in question, you are expected to additionally cover the difference of the charges set by the Correspondent and Payee's banks.

SHA. SHA type credit transfer means that the Payer (you) covers the credit transfer-related fees charged by Swedbank, AB; fees of the other banks are to be covered by the Payee (meaning that the Payee may receive not a full amount , if agreed accordingly with his payment service provider).

In case of credit transfer SEPA you (as a Payer) select the OUR transfer, Bank may refuse to carry out such credit transfer on its own discretion (the payment order shall be considered not received) or proceed with the credit transfer after changing it to the SHA transfer.

Hour shall mean an hour until which the payment order delivered on the Bank’s business day is considered as received (the countdown of the term of executing such payment order starts) on the same day and shall be executed within the number of the Bank’s business days specified in the ‘Day’ column, counting as of the day of delivery of the order. Payment order delivered after the specified hour on the Bank’s business day or on the day that is not the Bank’s business day shall be considered as received (the countdown of the term of executing such payment order starts) on the next Bank’s business day, but the funds will be debited immediately, thought it shall be executed within the number of the Bank’s business days specified in the ‘Day’ column, counting as of such next Bank’s business day (for example, should it be specified 14:00 in the ‘Hour’ column and T0 Day in the ‘Day’ column, a payment order delivered until 14:00 on the Bank’s business day shall be executed on the day of delivery of the order, while a payment order delivered after 14:00 or on a day that is not Bank’s business day shall be executed on the next Bank’s business day). The payment order submitted on the Bank's business day after the specified hour or on a day which is not a Bank's business day, if it has not been sent from the Bank yet, may be canceled by 4:00 on the next Bank's business day. The payment order submitted on the Bank's business day by 3:59 may be canceled before 4:00 on the same Bank business day.

Should nothing be specified in the ‘Hour’ column, payment order delivered at any time on the Bank’s business day shall be executed within the number of the Bank’s business days specified in the ‘Day’ column, counting as of the day of delivery of the payment order.

Day shall mean a number of the Bank's business days within which a payment order shall be executed. Countdown of the said term shall be started on the day of the receipt of a payment order, taking into account whether the payment order is delivered on the Bank's business day and/or until the set hour on the Bank's business day (see 'Hour' explanations provided hereinabove). For example, T0 - the payment order shall be executed on the same Bank's business day if delivered until time specified in the 'Hour' column.

Bank's business day:

• Credit transfers non SEPA within "Swedbank", AB – on each calendar day;
• Other credit transfers non SEPA – on a day when "Swedbank", AB intermediate bank and beneficiary's bank performs transactions under the respective credit transfers. "Swedbank", AB, performs such transactions on days that are neither Saturday, nor Sunday, nor other day-off or holiday defined by the legal acts of the Republic of Lithuania.

¹ To banks and payment service institutions in Lithuania and other countries, except for: Afghanistan, American Samoa, Anguilla, Aruba, Belarus, Belize, Bhutan, Bonaire, Sint Eustatius and Saba, British Virgin Islands, Brunei Darussalam, Burkina Faso, Burundi, Central African Republic, Chad, Comoros, Cook Islands, Democratic People's Republic of Korea (North Korea), Djibouti, East Timor (Timor Leste), El Salvador, Equatorial Guinea, Eritrea, Eswatini (Swaziland), Fiji, Gambia, Grenada, Guinea, Guinea-Bissau, Haiti, Islamic Republic of Iran, Iraq, Kiribati, Lesotho, Marshall Islands, Mauritania, Myanmar (Burma), Federated States of Micronesia, Montserrat, Nauru, Niger, Niue, Northern Mariana Islands, Palau, Papua New Guinea, Russia, Saint Helena, Saint Lucia, Saint Vincent and the Grenadines, Samoa, Sao Tome and Principe, Syria, Solomon Islands, Somalia, South Sudan, Suriname, Tonga, Turks and Caicos, Tuvalu, Vanuatu, Bolivarian Republic of Venezuela, Wallis and Futuna, Western Sahara.

² Swedbank Group banks:

Swedbank (SWIFT code: SWEDSESS), Sweden, Stockholm

Swedbank (SWIFT code: SWEDFIHH), Finland

Swedbank (SWIFT code: SWEDNOKK), Norway

Swedbank AS (SWIFT code: HABAEE2X), Estonia

Swedbank AS (SWIFT code: HABALV22), Latvia

³ OUR credit transfers non SEPA shall be available only in certain cases when credit transfer non SEPA is executed to the other state which is a non EU Member State, Iceland, Liechtenstein, Norway. If the credit transfer non SEPA is made in any currency to EU Member State, Iceland, Liechtenstein, Norway and you (as a Payer) select the OUR transfer, Bank may refuse to carry out such credit transfer on its own discretion (the payment order shall be considered not received) or proceed with the credit transfer after changing it to the SHA credit transfer.

Explanations of OUR and SHA payment transfers

OUR. OUR credit transfer means that when the funds are transferred to the Payee, the Payer (you) undertakes to pay all charges applicable by Swedbank, AB (hereinafter referred to as the Bank) and other banks' fees established for this type of credit transfers. Where your payment of such a charge to the Bank for effecting the payment order does not fully cover the charges stipulated by your Correspondent bank and the Payee's bank for effecting the payment order in question, you are expected to additionally cover the difference of the charges set by the Correspondent and Payee's banks.

Note: if a credit transfer is denominated in USD, other banks' fees can be additionally debited from the Payee's bank account.

SHA. This type credit transfer means that the Payer (you) covers the transfer-related fees charged by Swedbank, AB; fees of the other banks are to be covered by the Payee (meaning that the Payee may receive not a full amount, if agreed accordingly with his payment service provider).

Explanation of the return of credit transfers
In cases when return of the credit transfer is initiated by the beneficiary bank or bank correspondent (e.g. due compliance risk, inaccurate payment data, etc.), their fees can be deducted from the transfer amount or debited from the payer's (your) account.

¹ The fee is not applied when the payment order is submitted on a Bank business day after the specified hour, or on a Bank business day before 3:59, or on a day that is not a Bank business day, and such credit transfer is canceled by the payer in Swedbank Internet Bank until the next Bank business day 4:00.

² The fee applies regardless of whether the funds are returned to the payer. If the funds are credited to the beneficiary's account or the credit transfer is sent from the Bank, the funds may be returned to the payer only with the consent of the beneficiary.

³ International credit transfer - credit transfer non SEPA to banks incorporated in Lithuania, credit transfer SEPA to foreign banks and credit transfers non SEPA to foreign banks.

⁴ SEPA Member State - EU Member State, Andorra, Iceland, United Kingdom, Liechtenstein, Monaco, Norway, San Marino, Switzerland and Vatican.

You can cancel payments (including standing orders) in the "List of payments" section of the Internet Bank. In the "List of payment" you will find payment orders that you submitted after the specified bank hours or on bank non-business days, if such payments were not sent from the bank.

Note: in certain cases (subject to technical possibilities) payment orders to transfer euros to another bank in Lithuania submitted on bank business days between 16:00 and 16:30 may be performed and reach the beneficiary's bank on the same bank business day.

If you do not find the payment you want to cancel in the "List of payments", then you need to send the message "Payment order cancellation" in the Internet Bank. In this case, the cancellation of the payment will be subject to a commission fee according to the applicable bank services and operations fees, regardless of whether the funds will be refunded.

If the payment was sent to another bank, we will contact the beneficiary’s bank with a request for a refund. The funds will be refunded only with the consent of the beneficiary.

• You shouldn’t confirm transactions or logins to internet bank or app, which are not initiated by you under no circumstances.
• You shouldn’t ever disclose your personal data or data used for login to internet bank & app to other persons, including family members, friends or bank employees, unless you are calling to the bank.
• Do not write down, send by e-mail, SMS, etc. or otherwise save any confidential codes and passwords to unlock the screen of your computer or mobile phone. Create complex passwords, that are difficult to guess, memorise them and change them regularly. When creating PIN codes, be sure to make PIN codes in random number combination. Do not use combinations, such as 1111, 1234, dates of birth other personal details etc.
• Remember that your User ID number is as important as your personal code, thus pay a great deal of attention to its security.
• Keep in mind that after login you will have access to many services including external ones which do not require additional authentication.

We will also automatically block access to Internet Bank if incorrect login data (User ID or code from the PIN code generator) is entered 5 times in a row.

You can unblock it by calling us at +370 5 268 4422 (workdays only 8:00 to 18:00). In case of a repeated block, you will have to visit the bank’s branch. You should book a visit in advance. Have you discovered any unauthorised transactions on your account performed prior to the blocking of Internet Bank access? Review your account statement and submit the information to us.

The login session is terminated when no activity happens for 5 minutes. You will be asked to re-enter your login details. Time limits are used for security reasons, to prevent Internet Bank access if a user forgets to log off from his/her account after finishing using the Internet Bank.

Once you finish Internet Bank session, log off (by clicking 'Logoff') and close the browser.

The login session is terminated when no activity happens for 5 minutes. You will be asked to re-enter your login details. Time limits are used for security reasons, to prevent Internet Bank access if a user forgets to log off from his/her account after finishing using the Internet Bank.

Once you finish Internet Bank session, log off (by clicking 'Logoff') and close the browser.

Address of the Internet Bank website

On the computer:

By clicking on the lock sign you should see the correct Swedbank certificate:

On the smart device:

Before entering your login data, make sure that the website domain is “swedbank.lt”.

• Make sure you are using antivirus software that automatically updates the threat library at least once a day.
• Use the firewall, that does not allow to log in to your computer remotely.
• Make sure your Operational System and browser are up-to-date.
• Turn on automatic updates of your software. If automatic updates are not possible you should check for then on a regular basis.
• Set your browser to block the pop-ups.

Information on the ways to secure your device and to safely use other Internet services is available on the following website:

https://www.esaugumas.lt/lt

• Download applications only from trusted sources such as the App Store, Google Play or Windows Phone Apps – Microsoft store.
• Do not allow other persons to use your phone or tablet were Swedbank App is installed.
• Do not reveal the screen lock codes to other persons and do not allow to unlock your phone with other persons’ biometric data.
• Use antivirus software.
• Always adhere to the requirements or security alerts of the manufacturer of your phone device.

What are safe browsers?

We encourage you to update your browser and operating system version as soon as update is released. These updates can be set up automatically for better security and experience in our digital channels. We officially support these browser versions:

• Google Chrome 85 and later;
• Microsoft Edge 85 and later;
• Mozilla Firefox 80 and later;
• Safari 14 and later.

What else should you know about security?

• Do not share your personal authentication means. If you want to give your family members or your employees rights to manage funds on your accounts, please, request the Bank to grant them respective rights. They will be able to use company’s accounts on behalf of their own and by using their own personal authentication means. You can revoke these rights at any time. It is also possible to order a supplementary card linked to your account for a family member to use. Sharing the same authentication mean between the employees or family members is strictly forbidden.
• Remember, that security of all your data (User ID, PIN codes, mobile phone number provided to the bank, personal number, etc.) is the key for protecting an access to your money.
• If you’re using a public computer, avoid entering personal information as there might be malware that records your details.
• Do not keep User ID number together with authentication means and their confidential codes.
• Never send authentication data by email.
• Never disclose your login information, unless you are initiating the call with the bank. No one has the right to request you to provide your personal number and authentication mean by phone. If you receive a call from a person stating he is an employee of the bank, end the conversation immediately.
• Your Smart-ID or PIN code generator PINs should not coincide with any part of your phone number or the sequence of numbers.
• Always compare control number and read “see what you sign” if available.
• By entering PIN2 of Smart-ID you are usually confirming a payment or an agreement. Be extra careful when doing it.
• You will get an SMS when new Smart ID account is created. Contact bank immediately if it wasn’t you who created Smart ID.

When shopping online, be prudent with your personal and financial data. Properly assess the threats, which you may encounter on the internet. We recommend to ensure protection of personal devices and always follow these safety tips:

• Shop in reliable shops only. It is always safe to buy goods and services in well-known Lithuanian and foreign e-shops with a good reputation. Take a critical approach to unknown sellers and try to find out more information about their activity. Study public internet feedback about a specific online shop. Find out whether the website presents detailed contact data of its administrator (address, phone, email, etc.), and make sure it does not contain various errors in their links (additional words or letters, strange symbols), popup windows, advertisings, a great number of links instead of informative content.
• Be cautious about discounts. You have found a high-quality product offered at a particularly low price? Before making a payment order, be sure that the company that offers the product really exists and is trustworthy. Be careful about advertisements in social networks. They may lead you to a fake online shop.
• Safe shopping by card. When shopping in foreign e-shops, the most common way of payment is by card. In this case you will have to indicate the details of your payment card. If an online shop participates in international security programmes, special logos such as “MasterCard SecureCode”, and “Verified by Visa” for Visa cards are used in this shop. You may be redirected to internet bank to confirm payment transaction by logging in. Learn more about “Safe online shopping” programme here. Before making payment in online shop, please evaluate safety of such online shop and study public internet feedback about its activity.
• Safe payment via electronic banking system. When shopping in Lithuanian online shops, usually you will be redirected to Swedbank internet bank account. You will recognise it from the Swedbank logo and internet bank address: https://www.swedbank.lt/banklink confirms that payment is made directly through the bank system. After you enter your login details, the website will automatically display the generated payment form.
• Third party providers. As of 14/09/2019, when you shop online, you might be offered to use payment initiation service, offered by payment institution (PISP), other than the bank, to pay for goods or services. If you choose to initiate payment from your account, kept with the bank, you might be asked to fill in the payment order form in the PISP’s environment, and give your consent to transfer data, necessary for performance of payment transaction, and later to confirm payment order with the Swedbank internet bank authentication mean. If you have noticed any transaction in the account statement, not authorised by you, inform us immediately by calling 1884 (for private clients) or 1633 (for business clients).

It is important for us at Swedbank that our customers can feel safe and secure when managing their monetary affairs with our electronic channels. Therefore, we seek to ensure the highest security level in IT systems. Despite this, an error may slip by. If you have found a security flaw, we would like to hear more about it to be able to correct the problem as soon as possible.

How do you report?

Send an email to us in your local language at responsible-disclosure@swedbank.com. Optionally, you can use our public PGP key to protect the information you send over. Make sure to have included the following information:

• Detailed description of the vulnerability containing such info as URL and type of vulnerability;
• The necessary information that we need in order to reproduce the problem;
• If applicable, a screenshot of the vulnerability you have found;
• Contact information, name and surname, email, phone number, and your public PGP key (if you have one).

This personal data submitted by you will be processed by Swedbank in order to inform you about the analysis of IT security flaws noticed by you and their correction, and, if necessary, to contact you regarding the revision of the information submitted by you. More information about Swedbank’s data processing procedure is available in the Swedbank Principles of Processing Personal Data.

What can you report?

You can report security flaws that you have found in any of our services. Examples of security flaws are cross-site scripting, flaws in encryption or flaws with security implications in logic controls. The reporting service is not designated for other logical errors, errors in texts, questions about our services, questions about the security of our services or similar.

What can you expect from Swedbank?

We will confirm that we have received your description, continuously keep you updated while we process the issue, and inform you when the issue is fixed. Claims for compensation as a condition for sending in a vulnerability are not accepted.

What is required from you?

It is important for both us and our clients that you follow good practice, i.e. that:

• You do not use the vulnerability to access or attempt to access information that does not belong to you;
• You do not use the vulnerability to remove or modify information;
• You do not affect the availability of our services;
• You give us an opportunity to fix the reported vulnerability before going public with it.

Can you file a report anonymously?

Yes, but then we cannot respond back and keep you updated on the status.

PGP key

Use this PGP key if you want to send us an encrypted e-mail. But using it is not required.

Key ID: 0x0AD6CCAF

Control code: 2D14 4030 6D4B 68C3 F286 3AC6 333B E8E4 0AD6 CCAF