Compliance in Switzerland: Issues and Legal Obligations
Compliance refers to all the processes, policies and controls put in place by a company to ensure that it complies with the laws, regulations and ethical standards applicable to its activities. In Switzerland, compliance requirements have been considerably strengthened in recent years, particularly in the areas of anti-money laundering (AMLA/LBA), data protection (FADP/LPD 2023), competition law and anti-corruption. PBM Avocats advises companies in Geneva and Lausanne.
The Main Areas of Compliance in Switzerland
| Domain | Law / Regulator | Risks in Case of Non-Compliance |
|---|---|---|
| Anti-Money Laundering (AML) | AMLA/LBA / FINMA | FINMA sanctions, criminal prosecution, licence withdrawal |
| Data protection | FADP/LPD 2023 / FDPIC | Fines up to CHF 250,000, reputational damage |
| Competition law | CartA/LCart / COMCO | Up to 10% of Swiss turnover, personal liability |
| Anti-corruption | SCC art. 322ter et seq. | Custodial sentence, exclusion from public procurement |
| Corporate due diligence | CopA (art. 964j et seq. CO) | CSR reporting obligations (large companies) |
The Anti-Money Laundering Act (AMLA/LBA) in Companies
The AMLA imposes strict anti-money laundering obligations on financial intermediaries:
- Identification of the contracting party: verify the client's identity (KYC — Know Your Customer)
- Identification of the beneficial owner: determine who actually controls the funds (UBO — Ultimate Beneficial Owner)
- Clarification of suspicious transactions: verify the origin and destination of funds
- Report to MROS: report well-founded suspicions of money laundering to the Money Laundering Reporting Office Switzerland (MROS)
- Internal organisation: designate an AML officer, train staff, document procedures
The FADP/LPD 2023 and Its Implications for Companies
The revised Federal Act on Data Protection (FADP/LPD), in force since 1 September 2023, significantly strengthens the obligations of companies:
- Obligation to notify data breaches to the FDPIC as soon as possible if the risk of harm is high
- Strengthened criminal sanctions: up to CHF 250,000 in fines for responsible natural persons in the event of intentional infringement
- Principle of privacy by design and privacy by default
- Obligation to conduct a data protection impact assessment (DPIA) for high-risk processing activities
Whistleblowing in Switzerland
The protection of whistleblowers is a developing subject in Swiss law. The current framework:
- Art. 321a CO imposes a duty of loyalty on the employee, which may conflict with public reporting
- The Federal Supreme Court's case law admits reporting if the following conditions are met: first inform the employer (internal route), then the authorities if the employer does not react, and finally the public if the authorities remain passive
- Dismissal of an employee for having in good faith reported a serious offence may be qualified as wrongful
- Sector-specific reporting obligations exist (AMLA/LBA, competition law, financial markets law)
Building an Effective Compliance Programme
The key elements of a robust compliance programme:
- Risk mapping: identify the legal risks specific to the company's activity
- Code of conduct: founding document setting out the values and expected behaviours
- Policies and procedures: detailed instructions for each risk area (AML, data protection, anti-corruption)
- Training: regular awareness-raising of all employees on legal obligations
- Internal reporting channel: hotline or anonymous platform for reporting
- Audit and control: regular verification of the programme's effectiveness
- Compliance officer: designation of a Chief Compliance Officer or equivalent
Frequently Asked Questions About Corporate Compliance in Switzerland
Which Swiss companies are subject to the Anti-Money Laundering Act (AMLA/LBA)?
The AMLA applies to financial intermediaries: banks, securities dealers, insurance companies, asset managers, trustees, exchange agents, and since 2021, providers of crypto-asset related services. Lawyers and notaries are subject to the AMLA only when they carry out financial intermediary activities (fund management, company formation on behalf of clients).
What is whistleblowing and how is it protected in Switzerland?
Whistleblowing is the internal or external reporting of irregularities by an employee. In Switzerland, legal protection is limited: art. 321a CO imposes a duty of loyalty that may conflict with reporting. Legal protection exists if the reporting is carried out in the public interest, in good faith and in an appropriate manner (internal reporting first, then external if the employer does not react). Several draft laws on the protection of whistleblowers are under discussion.
What are the FADP/LPD 2023 compliance obligations for companies?
Companies must notably: designate a data protection advisor (optional for private entities but recommended), maintain a register of processing activities (mandatory for companies with more than 250 employees), update their privacy policies, notify the FDPIC in the event of serious data security breaches, and practise privacy by design in their new processing activities.
Can COMCO sanctions (competition law) affect Swiss companies?
Yes. The Competition Commission (COMCO) may sanction companies that illegally agree on prices or share markets (horizontal cartels). Sanctions may reach up to 10% of turnover achieved in Switzerland during the last three financial years. Natural persons involved in unlawful agreements may also be sanctioned directly.
Can a compliance program reduce sanctions?
Yes. In several areas (competition law, FINMA, anti-corruption), the existence of an effective compliance program may be taken into account as a factor for reducing sanctions. However, the program must be real and operational (not a facade). A compliance program can also prevent offences and protect executives from personal liability.