Switzerland

Under Arts. 964j-l CO, companies importing or processing tin, tantalum, tungsten or gold from conflict-affected or high-risk areas, or whose products are suspected of using child labour, must identify risks, take measures, follow the OECD Due Diligence Guidance and have the due diligence reviewed externally. Arts. 964a-c separately require large public companies and financial institutions to report on environmental, labour, human rights and anti-corruption matters on a comply-or-explain basis.

Art. 19 FADP requires the controller to inform the data subject appropriately when collecting personal data, including where the data is not collected from the data subject. Art. 25 gives any person the right to ask whether personal data about them is processed; an FDPIC ruling of 29 January 2025 refers to a 30-day general response period in Art. 25 para. 7.

Art. 24 FADP requires the controller to notify the FDPIC as quickly as possible of a data security breach likely to lead to a high risk to the data subject's personality or fundamental rights. The processor must notify the controller as quickly as possible, and the controller informs data subjects where needed for their protection or if the FDPIC requests it.

Art. 3 requires the customer's identity to be verified on a document of evidentiary value when the business relationship is established. Art. 4 requires the beneficial owner to be identified with due diligence and Art. 5 requires repetition where doubt arises later. Art. 6 sets special duties of due diligence.

Circular 2026/1 requires banks and insurers to define responsibilities, identify and assess material climate and other nature-related financial risks using scenario analyses, integrate them into risk management and check that sustainability statements match their strategy. Category 1 and 2 banks must gradually integrate them into stress tests.

Circular 2018/3 requires an up-to-date inventory of outsourced functions (Rz 14-15.1), a documented risk analysis and provider selection before signing (Rz 16), written agreements giving the firm, its audit firm and FINMA inspection and audit rights (Rz 26-29, 32-35) and a named unit monitoring the provider. It has no explicit duty to notify FINMA of each outsourcing and does not mention cloud computing specifically; insurers need authorisation of outsourcing through the business plan (Rz 10).

Art. 1b BA and the Banking Ordinance allow an institution to accept public deposits of up to CHF 100 million, or collectively hold crypto-based assets, only with a FinTech licence from FINMA, provided the funds are not invested and bear no interest. Applicants must be a company limited by shares, partnership limited by shares or limited liability company with seat and business in Switzerland, and clients must be told that assets are not covered by deposit protection. Switzerland has no separate VASP register; FINMA tells crypto businesses to check individually whether authorisation or AMLA supervision applies.

Art. 10 AMLO-FINMA requires information on the client and the beneficiary to be transmitted with payment orders. FINMA Guidance 02/2019 says this applies technology-neutrally to blockchain services, and until a transmission system exists it restricts transfers to and from external wallets to proven own-customer wallets or verified third parties.