Switzerland
3 regulators · 9 laws & regulations · 8 obligations · 10 enforcement actions
Switzerland concentrates financial supervision in FINMA, an integrated regulator covering banks, insurers, securities firms, fund managers and financial market infrastructure.
Regulatory pulse · 90 days
Laws & Regulations Enforcement NewsOverview
Switzerland concentrates financial supervision in FINMA, an integrated regulator covering banks, insurers, securities firms, fund managers and financial market infrastructure. The Swiss National Bank retains monetary policy and systemic oversight. The regulatory architecture was substantially restructured by the Financial Services Act and Financial Institutions Act, which harmonised conduct and licensing across sectors. Anti-money-laundering obligations sit under the Anti-Money Laundering Act, with the Money Laundering Reporting Office Switzerland as the financial intelligence unit; Switzerland's self-regulatory organisation model for certain intermediaries is distinctive. The revised Federal Act on Data Protection, closely aligned with but separate from the GDPR, governs privacy. Switzerland has developed a comparatively clear distributed-ledger framework through targeted amendments across multiple statutes.
Who regulates what
View all 3 regulators →Key laws & regulations
All Laws & Regulations →| Law or regulation | Type | Year | Regulator | Source |
|---|---|---|---|---|
| FINMA Circular 2026/1 Nature-related financial risks | Circular | 2026 | — | official |
| Federal Act of 26 September 2025 on the Transparency of Legal Persons and the Identification of Beneficial Owners (TLPA) | Act | 2025 | — | official |
| FINMA Circular 2023/1 Operational risks and resilience - banks | Circular | 2023 | — | official |
| Federal Act of 25 September 2020 on Data Protection (Data Protection Act, FADP) | Act | 2020 | — | official |
| FINMA Guidance 02/2019 - Payments on the blockchain status not recorded | Guideline | 2019 | — | official |
| No instruments match these filters. | ||||
Recent enforcement
Open tracker →| Date | Entity | Regulator | Action | Source |
|---|---|---|---|---|
| Sep 2026 | Julius Bär | Business Restriction Disgorgement / Restitution | official | |
| Jun 2026 | Swiss Fund Management AG in liquidation and BZ Berater Zentrum AG | Licence Action Prohibition Order | official | |
| Jun 2026 | Wendelspiess Partners AG (in liquidation) and two responsible individuals | Licence Action Prohibition Order | official | |
| Apr 2026 | Cream della Cream Switzerland GmbH and Philipp Plein International AG | Remedial Direction | official | |
| Feb 2026 | MBaer Merchant Bank AG | Licence Action | official |
Industry compliance
Essential obligations
All obligations →| Obligation | Timing | Regulator | Source | Detail |
|---|---|---|---|---|
| Due diligence and reporting on conflict minerals and child labour | Ongoing | — | source | |
Under Arts. 964j-l CO, companies importing or processing tin, tantalum, tungsten or gold from conflict-affected or high-risk areas, or whose products are suspected of using child labour, must identify risks, take measures, follow the OECD Due Diligence Guidance and have the due diligence reviewed externally. Arts. 964a-c separately require large public companies and financial institutions to report on environmental, labour, human rights and anti-corruption matters on a comply-or-explain basis. |
||||
| Information to data subjects and right of access | Ongoing; access requests answered within 30 days (Art. 25 para. 7) | — | source | |
Art. 19 FADP requires the controller to inform the data subject appropriately when collecting personal data, including where the data is not collected from the data subject. Art. 25 gives any person the right to ask whether personal data about them is processed; an FDPIC ruling of 29 January 2025 refers to a 30-day general response period in Art. 25 para. 7. |
||||
| Notifying the FDPIC of a data security breach | As quickly as possible | — | source | |
Art. 24 FADP requires the controller to notify the FDPIC as quickly as possible of a data security breach likely to lead to a high risk to the data subject's personality or fundamental rights. The processor must notify the controller as quickly as possible, and the controller informs data subjects where needed for their protection or if the FDPIC requests it. |
||||
| Customer due diligence: identification, beneficial owner and special clarifications | At onboarding + ongoing (repeat where doubt arises) | — | source | |
Art. 3 requires the customer's identity to be verified on a document of evidentiary value when the business relationship is established. Art. 4 requires the beneficial owner to be identified with due diligence and Art. 5 requires repetition where doubt arises later. Art. 6 sets special duties of due diligence. |
||||
| Management of climate- and nature-related financial risks | Climate risks from 1 Jan 2026 (Categories 1-2) or 1 Jan 2027 (Categories 3-5); full implementation by 1 Jan 2028 | — | official | |
Circular 2026/1 requires banks and insurers to define responsibilities, identify and assess material climate and other nature-related financial risks using scenario analyses, integrate them into risk management and check that sustainability statements match their strategy. Category 1 and 2 banks must gradually integrate them into stress tests. |
||||
| Outsourcing of significant functions: inventory, oversight and audit rights | Before signing and ongoing | — | official | |
Circular 2018/3 requires an up-to-date inventory of outsourced functions (Rz 14-15.1), a documented risk analysis and provider selection before signing (Rz 16), written agreements giving the firm, its audit firm and FINMA inspection and audit rights (Rz 26-29, 32-35) and a named unit monitoring the provider. It has no explicit duty to notify FINMA of each outsourcing and does not mention cloud computing specifically; insurers need authorisation of outsourcing through the business plan (Rz 10). |
||||
| No obligations match these filters. | ||||