Skip to content
← Dossiers

Regulatory analysis · Switzerland

What a Swiss SRO affiliation is actually worth

August 2026·CH
FINMASROsDue diligenceSupervisionSwitzerland

Regulatory analysis · Switzerland

A crypto business tells a counterparty in London, Lagos or Singapore that it is "regulated in Switzerland". The statement is almost always true. The question this note asks is what it is worth.

The answer turns on a distinction the phrase is designed to obscure. Switzerland supervises its financial sector through two channels. One is FINMA, a public authority with the power to end a firm. The other is a self-regulatory organisation — a private association, recognised by FINMA, whose ultimate sanction is to expel a member. Most Swiss crypto businesses sit in the second channel. Nothing in the phrase "regulated in Switzerland" tells you which.

This is a briefing note rather than a conclusion. It sets out the case for treating the claim as close to meaningless, then the case for treating it as substantive, and then weighs them. Both cases are stronger than their advocates usually make them.

In summary

  • The claim is true and uninformative. A firm affiliated to an SRO is genuinely inside a supervisory system, subject to the same statutory duties as a bank. The phrase simply does not say which system, or whether the firm does anything.
  • The duties do not vary by channel. The consequences do. An SRO cannot take a firm's profits, ban its executives, publish a decision against it, or put an investigating agent inside it. FINMA can do all four to a licensed institution.
  • Nobody can test SRO supervision from outside. Every SRO reports its enforcement to FINMA annually. None of it is published. The strongest claim either side can make is unfalsifiable.
  • The Federal Supreme Court has already graded the two channels, and the grading is not about effort: FINMA guarantees that the SRO system works; for firms it supervises directly it answers for whether they actually comply.

What the claim asserts, and what it leaves out

Switzerland's Anti-Money Laundering Act catches financial intermediaries outside the banking sector — money changers, money transmitters, payment providers, crypto businesses, trustees, lessors — and requires them to affiliate to one of the eleven FINMA-recognised SROs. FINMA states the division without hedging: such intermediaries "are supervised by the SROs where they are affiliated, and not by FINMA."

So the phrase can be earned three ways, and they are not equivalent:

RouteWhat it meansWho supervises
FINMA authorisationA licence under a financial market act — bank, securities firm, fintechFINMA, directly
SRO affiliationMembership of a recognised private body, compulsory for professional intermediariesThe SRO
Neither, but Swiss-incorporatedA Swiss company doing something the Act does not catchNobody, for AML purposes

The third is not fraud if the firm says only that it is a Swiss company. It becomes a problem when "based in Switzerland" and "regulated in Switzerland" are used interchangeably in the same paragraph, which is common.


The case that the badge is thin

1. A dormant firm did not have to affiliate at all. The Act applies only to intermediaries acting berufsmässig — professionally — and Article 7 of the Anti-Money Laundering Ordinance sets four thresholds: gross revenue above CHF 50,000 a year, more than 20 business relationships, unlimited power of disposal over more than CHF 5 million, or transactions above CHF 2 million a year. A firm meeting none is outside the Act entirely. Its affiliation is voluntary, and its only function is to be quotable.

2. Nearly half the supervised crypto population is inactive, and FINMA says it knows why. Of 203 SRO-affiliated virtual asset service providers on FINMA's 2024 count, 88 were inactive. In 2023 FINMA had its inspectors checking whether SROs recognise "empty shells" and sales of shell companies, and gave the reason: "VASPs in particular often seek affiliation with an SRO due to the progressive regulation in Switzerland, but then choose not to carry out operational activities or do so outside Switzerland."

3. FINMA has warned that its own registers mislead. In 2024 it discussed with the SROs amendments to their member lists "in particular with regard to members who do not engage in any activity subject to the AMLA, so as to avoid misleading information about the actual activity of the members and the scope of their supervision." The supervisor is telling you the list overstates both things the reader infers from it.

4. The consequences differ by an order of magnitude. Against a licensed institution FINMA can, under Articles 31 to 37 FINMASA, order restoration of compliance, issue a declaratory ruling of serious breach, disgorge profits, ban an individual from the industry for up to five years, publish the ruling naming the person, install an investigating agent inside the firm, and withdraw authorisation. An SRO's catalogue comes from its own rulebook; the Act names only expulsion. It cannot do any of the other six things.

5. The reporting data do not flatter the sector. MROS received 21,087 suspicious activity reports in 2025. 91.3% came from banks. The category covering virtual asset service providers and fintech firms filed 276 — about 1.4%. In the same year MROS identified 2,873 reports involving virtual currencies, up 59.7% on 2024. Crypto-related suspicion is being surfaced, overwhelmingly, by banks looking at their customers' crypto activity rather than by the crypto firms themselves.

That last comparison needs care, and is worth stating precisely rather than dropping. The 2,873 is a count of reports whose subject matter involved virtual assets, filed by intermediaries of every kind. The 276 is a count of reports filed by firms whose main business is virtual assets. They are different measures and the gap between them is not, by itself, proof of under-reporting. It is, however, the shape one would expect if the supervised crypto sector were contributing little to the national reporting picture — and no published figure contradicts it.

6. The published framework has holes in it. FINMA Circular 2008/17 governs what SROs must tell FINMA. Its appendix still states that Article 2(3) intermediaries who are not SRO members "are subject to direct supervision by FINMA" — a route abolished when the Financial Institutions Act took effect on 1 January 2020, and inconsistent with Article 12 of the Act as it now stands. Its section headed "Practice of FINMA" consists of the word Abrogated, four times, while the body of the circular still directs the reader to it for a description of that practice.


The case that the badge means something

1. The standard does not change with the channel. This is the point most often lost. An SRO-affiliated intermediary owes the same statutory duties as a bank: identify the contracting party, establish the beneficial owner, clarify the background of unusual transactions, keep documentation, report suspicion to MROS. The Anti-Money Laundering Act does not have a lighter tier. What differs is who checks compliance, not what compliance means.

2. For a firm that actually trades, affiliation is compulsory, not decorative. The thresholds in point 1 of the sceptical case cut both ways. A business doing real volume is over them, is caught by the Act, and must affiliate. The dormant volunteers are the tail, not the sector.

3. Operating without affiliation is a crime, and it is prosecuted. Article 44(1) FINMASA with Article 14(1) of the Act makes unauthorised financial intermediation a criminal offence, prosecuted by the Federal Department of Finance and tried at the Federal Criminal Court. In SK.2021.17 (2 December 2021) an ICO issuer transferred tokens into investors' private wallets while affiliated to nothing; the responsible individual was convicted and sentenced to 120 day-fines of CHF 440, suspended, plus a fine of CHF 13,200 and costs. FINMA's own enforcement reporting has long carried "unauthorised AMLA financial intermediaries and/or not affiliated to an SRO" as a standing category of investigation and of charges referred to the FDF. Affiliation is the thing that keeps a firm out of that category.

4. FINMA sees the enforcement record even though the public does not. Under Article 27 of the Act an SRO must notify FINMA immediately of every expulsion, with reasons, and of any sanction proceedings that could end in expulsion, and must file an annual schedule of every sanction decision it has made. Circular 2008/17 adds quarterly reporting of all new members, and immediate notice — with reasons — of applications withdrawn or rejected. The absence of public data is a publication failure. It is not evidence that nothing happens.

5. FINMA inspects the SROs, and the inspections bite. Eight SROs were reviewed on site in 2023, three in 2024, with a follow-up round in 2025 that found the earlier shortcomings had been dealt with comprehensively. In 2024 travel-rule risk was the stated reason for targeted reviews at selected SROs. FINMA has run round tables with the SROs together with MROS, the State Secretariat for International Finance and, in one case, the Zurich cantonal prosecuting authorities, with the express aim of making SROs strengthen supervision "in order to avoid regulatory arbitrage".

6. FATF looked at this and did not object. Switzerland is rated Largely Compliant on Recommendation 15, and in its 2020 follow-up report FATF reasoned that Swiss SROs "fulfil the FATF definition of 'supervisor', because they have the necessary powers", concluding that VASPs in Switzerland "are supervised by financial supervisors which are either the FINMA or the Swiss OAR."

That last point carries a heavy asterisk, and we have set it out at length in Supervised by whom: FATF reached that conclusion by applying a 2016 finding about the word "supervisor" rather than the rule in the Interpretive Note to Recommendation 15, which says VASPs should be supervised by "a competent authority (not a SRB)". It is a defence of the Swiss model, but not the one its supporters usually think it is.


Weighing it

The sceptical case does not establish what it is usually deployed to establish. It shows that the phrase is uninformative, that the register is padded, and that the consequences of being caught are lighter. It does not show that SRO supervision is a sham. There is no published evidence that it is — and, equally, none that it is not, which is the real problem.

The defence does not establish what it is usually deployed to establish either. Compulsory affiliation, identical statutory duties, a criminal backstop and an inspected second tier are all real. None of them is a reason for a counterparty to rely on the phrase, because none of them is visible in the phrase.

The honest resolution is that "regulated in Switzerland" is not a statement about the firm. It is a statement about a register entry — and the register entry answers a narrower question than the reader believes.

Three things follow.

The Federal Supreme Court has already drawn the line, and it is not a line about diligence. In BGE 143 II 162 the court held that in anti-money-laundering self-regulation FINMA bears a Gewährleistungsverantwortung — a responsibility to guarantee that the system functions — while for directly supervised intermediaries it bears, in addition, an Erfüllungsverantwortung: responsibility for actual performance. Whatever any individual SRO does, that difference is structural and judicially stated. A counterparty relying on Swiss supervision of an SRO-affiliated firm is relying on a guarantee that a system exists, not on anyone having answered for that firm.

The unfalsifiability runs in both directions, and it is the supervisor's to fix. FINMA receives, every year, a complete account of SRO enforcement. Publishing even an aggregate — expulsions, sanction proceedings, findings by category — would settle an argument that currently runs on inference in both directions. Until then, nobody making either case has the evidence.

And the whole question has a scheduled end date. The proposed FinIA crypto-institution licence would move Swiss crypto firms from the SRO channel into direct FINMA authorisation. The Federal Council's own explanatory report describes the benefit in exactly the terms this note has been examining: the licence "wirkt als Qualitätssiegel" — acts as a seal of quality. That is the government saying that what is being sold is the signal. The consultation closed on 6 February 2026 and nothing has been published since.

For the practitioner

The phrase is not the thing to test. These five questions are.

  1. Which channel? FINMA-authorised or SRO-affiliated. FINMA's public directory and the SRO member searches answer it; the firm's own marketing will not.
  2. Which SRO, and does its register entry match the business? The eleven are AOOS, ARIF, OAD FCT, PolyReg, SRO SLV, SRO SAV/SNV, SRO-SVV, SRO SVIG, SO-FIT, SRO-Treuhand Suisse and VQF.
  3. Is the firm active, and active where? Affiliation with no Swiss operations is a documented pattern, not a hypothetical, and FINMA has named it.
  4. How old is the affiliation relative to the business? A dormant affiliation is an asset that transfers with the share register, which is why FINMA asked the SROs about sales of shell companies.
  5. What would actually happen if this firm failed an inspection? For an SRO member: expulsion, and an entitlement to apply elsewhere. Not a fine, not a ban on the individuals, not a published decision.

None of that makes an SRO-affiliated counterparty a bad counterparty. It makes the phrase a starting point for diligence rather than a substitute for it.

Key takeaways

  • "Regulated in Switzerland" does not identify the supervisor, and the two Swiss supervisors differ in powers by an order of magnitude.
  • The statutory duties are identical across both channels. The difference is who verifies compliance and what happens when it fails.
  • 88 of 203 SRO-affiliated crypto firms were inactive on FINMA's own count, and FINMA has stated the reason: firms affiliate for the Swiss standing and operate elsewhere, or not at all.
  • Crypto firms filed 276 of 21,087 suspicious activity reports in 2025, while 2,873 reports involving virtual currencies were filed across the sector — mostly by banks.
  • No SRO publishes its enforcement output and FINMA does not publish it either, so neither side of this argument can currently be tested from outside.

Sources

Law

Courts

FINMA

  • Self-regulatory organisations and supervision of SROs; the register of recognised SROs, read 24 August 2026
  • FINMA Circular 2008/17, Exchange of information between SROs and FINMA
  • FINMA Annual Reports 2023, 2024 and 2025 — SRO on-site reviews, the VASP population, the empty-shells finding
  • FINMA Enforcement Reports 2014–2018 — the "unauthorised AMLA financial intermediaries and/or not affiliated to an SRO" category

MROS

  • MROS Annual Report 2025 — 21,087 SARs, the category table, and SARs involving virtual currencies

FATF and the Federal Council

  • FATF, Switzerland: 3rd Enhanced Follow-up Report, January 2020 — the criterion 26.1 reasoning
  • Federal Council, Erläuternder Bericht zur Änderung des Finanzinstitutsgesetzes, 22 October 2025 — the crypto-institution licence and the Qualitätssiegel passage

Research and analysis, not legal advice · positions stated as at 24 August 2026. The information provided is for research and educational purposes only and does not constitute legal advice.

Working on a matter this touches?

Start a conversation