Banking secrecy as a civil-law duty and as a criminal norm

Custom, contract and personality

Long before 1934 the discretion of bankers was an established custom. Vogler describes the emergence of a pronounced relationship of trust between banks and clients that became usage in the manner of an unwritten law. He points to early written traces: the penal code of the canton of Basel-Stadt of 1872, which already punished certain breaches of professional secrecy, and the personnel regulations of the Schweizerische Bankgesellschaft of 1915, which obliged its employees to discretion.¹ The private bankers of Geneva and Basel, whose business rested on personal relationships with a small number of families, had practised discretion as a matter of course since the eighteenth century. What changed in 1934 was the addition of a public sanction to a private obligation.

The civil-law basis of that obligation has remained unchanged since. The relationship between a bank and its client is, for most purposes, a contract of mandate or a contract with mandate elements, governed by Articles 394 ff. of the Code of Obligations. Article 398 obliges the mandatary to perform the mandate faithfully and carefully, a duty that includes the duty to keep secret what the client has entrusted. The protection of personality under Article 28 of the Civil Code adds a second, non-contractual foundation that also protects persons who are not themselves clients but whose data appear in the bank’s records. Michlig describes this dual basis and emphasises that the protection extends to all information arising from the business relationship, including account numbers, transactions and the names of bank employees dealing with the client.² A legal opinion prepared for the Swiss Bankers Association on the use of cloud services by banks develops the same idea: the bank as mandatary owes careful performance, which includes the protection of the client’s personality rights and of his interest in the integrity of his data.³

The Historical Dictionary of Switzerland reflects this understanding when it states that the Banking Act introduced banking secrecy for the protection of the personality rights of clients.⁴ The formulation is accurate as to the purpose that the law itself names, although, as the previous section has shown, it simplifies the history by attributing to 1934 what was in substance older. Swiss lawyers today generally prefer the term Bankkundengeheimnis, the secrecy of the bank client, because it expresses the point that the secret belongs to the client. The client is the master of the secret. He may release the bank from its duty, and without his consent or a statutory basis the bank may not disclose.

What the criminal norm adds

The coexistence of a civil and a criminal layer has practical consequences. A breach of the civil-law duty exposes the bank to claims for damages and for satisfaction and entitles the client to injunctive relief. It is a matter between private parties, pursued before the civil courts at the initiative of the injured person. The criminal norm adds three things that the civil law cannot supply. It threatens the individual employee, in addition to the institution, with personal punishment. It makes the breach a matter of public prosecution, independent of the client’s willingness or ability to sue. And, most importantly in international relations, it turns the disclosure of client data to a foreign authority into a criminal act under Swiss law, which a Swiss bank employee may invoke when a foreign court or authority demands the information.

That last function explains why the criminal sanction mattered so much to the bankers of 1931 and 1932. Where a contractual duty is overridden by a foreign court order, a bank that refuses to comply may face sanctions abroad for contempt. A criminal prohibition under the law of the place where the bank keeps its records creates a genuine conflict of laws, which foreign courts have to weigh and which gives the Swiss authorities a formal basis for insisting on the official channels of mutual assistance. Article 271 of the Swiss Criminal Code, which prohibits unauthorised acts on behalf of a foreign state on Swiss territory, and Article 273, which punishes economic espionage, complement Article 47 in this defensive function.⁵

The consent of the client is the key to both layers. Michlig emphasises that effective consent requires the client to be informed and that it cannot be given retroactively. He is sceptical of attempts to justify disclosures to foreign authorities by necessity under Article 17 of the Criminal Code where formal procedures of mutual assistance are available, treating the safeguarding of legitimate interests as a justification of last resort.⁶ The same questions arise every day in the ordinary business of a Zurich bank, for example when data are processed by group companies abroad, when a bank outsources its IT to a cloud provider or when an auditor or a potential acquirer requires access to client files. In all these cases the answer depends on the consent obtained in the general terms and conditions, on the scope of the statutory exceptions and on the technical and organisational measures that keep the data out of unauthorised hands.

Notes

1. Vogler, Das Schweizer Bankgeheimnis (2005), p. 5 (“ein ausgeprägtes Treueverhältnis zwischen Banken und Kunden entstanden, welches als ungeschriebenes Gesetz Usus wurde”), with the examples of the Basel penal code of 1872 and the staff regulations of 1915. ↩
2. Michlig, “Bankgeheimnisverletzung” (2014), pp. 1056–1059, on the contractual duty of loyalty under Article 398 OR, the protection of personality under Article 28 ZGB and the scope of protected information and persons. ↩
3. Christian Laux, Alexander Hofmann and Mark Schieweck, Rechtsgutachten: Nutzung von Cloud-Angeboten durch Banken, prepared for the Swiss Bankers Association, 14 February 2019, https://www.swissbanking.ch/_Resources/Persistent/b/1/3/3/b13339fe5dcd344e715dbe0a899afe3c8c56ed0b/SBVg_Bankgeheimnis_und_Cloud_Gutachten_LLAG_2019_DE.pdf. ↩
4. Körner and Cassis, “Banken”, HLS (2006) (“Zum Schutz der Persönlichkeitsrechte der Kunden führte das Bankengesetz das Bankgeheimnis ein”). ↩
5. Articles 271 (“Verbotene Handlungen für einen fremden Staat”) and 273 (“Wirtschaftlicher Nachrichtendienst”) of the Swiss Criminal Code, bilingual text on droit-bilingue.ch, https://www.droit-bilingue.ch/de-en/3/31/311.0-271-334.html and https://www.droit-bilingue.ch/de-en/3/31/311.0-273-336.html. On the application of Article 273 to the transmission of bank client data to a foreign authority see the judgment 6B_508/2014 cited in section III. ↩
6. Michlig, “Bankgeheimnisverletzung” (2014), pp. 1060–1062, on consent, necessity under Article 17 StGB and the safeguarding of legitimate interests, with reference to the disclosures made in the context of the US tax dispute of 2013. ↩

For general information only. This article does not constitute legal or tax advice, does not replace advice on an individual case and creates no lawyer-client relationship. It reflects the legal position as of September 2025.