The practitioner’s perspective

Governance and the three lines of defence

In a Zurich bank or asset manager, anti-money-laundering compliance is organised according to the model of the three lines of defence. The first line consists of the client advisers and their managers, who bring in the client, collect the documentation, understand the source of wealth and monitor the relationship. The second line is the compliance function, which sets the rules, approves high-risk relationships, analyses alerts, decides on reports to MROS and reports to the executive board and the board of directors. The third line is internal audit, which tests whether the first two lines work, followed by the external audit firm, which reports to FINMA. The FINMA cases show that failures rarely lie in the absence of rules. They lie in a first line that treats the compliance function as an obstacle, in a compliance function that lacks the authority or resources to prevail and in boards that tolerate a remuneration system rewarding growth without regard to risk. The Julius Bär decision of 2020 expressed this in unusually direct terms.

The FINMA guidance on the money laundering risk analysis places the board at the top of this structure. The board must define the institution’s risk tolerance, which the executive board translates into limits on countries, client segments, products and structures. The compliance officer’s task is to measure the business against these limits and to escalate deviations. An institution that cannot show a documented chain from risk tolerance to client acceptance decisions and transaction monitoring will find itself criticised in a FINMA review. For boards of directors, the lesson of the enforcement cases is that anti-money-laundering compliance belongs among the core strategic questions. It determines the target markets, the client base and ultimately the licence of the institution.

The external compliance officer model for asset managers

Portfolio managers and trustees licensed under the Financial Institutions Act must have an adequate risk management and an effective internal control system, including a compliance function. In principle these functions must be independent of the revenue-generating business. Small institutions, with five or fewer full-time positions or an annual gross revenue of less than CHF 2 million, may dispense with independence if their business model does not involve high risks. The organisational rules must document any tasks delegated to third parties.¹ Many of the several hundred small asset managers in Zurich have therefore chosen to outsource the compliance function, including the anti-money-laundering tasks, to an external provider. The external compliance officer, often a lawyer, a former bank compliance officer or a specialised consultancy, reviews new client files, maintains the directives, carries out the periodic reviews and advises on reports to MROS.

The model has advantages for small firms, which could not afford a full-time compliance officer and would lack the experience to handle difficult cases. It brings outside expertise and a degree of independence that an internal employee dependent on the founder could not provide. Its limits must nevertheless be understood. Responsibility remains with the licensed institution and its management. Outsourcing leaves the legal duties with the institution. The supervisory organisation will also examine the quality of the arrangement. An external compliance officer who sees a file only once a year and signs off on relationships he has not examined provides a false sense of security. The arrangement works best when the external officer has direct access to the managing partners, receives all alerts and client documentation in real time and has the contractual right to escalate matters to the board and, if necessary, to insist on a report. The same model is likely to spread among lawyers and fiduciaries who become subject to the Act as advisers in October 2026.

Criminal risk

The criminal risk for bankers, compliance officers and advisers arises from four provisions. Article 305bis SCC punishes as money laundering any act aimed at frustrating the identification of the origin, the tracing or the forfeiture of assets which the offender knows or must assume originate from a felony or a qualified tax offence. The penalty is a custodial sentence of up to three years or a monetary penalty, rising in serious cases to five years combined with a monetary penalty. A serious case exists in particular when the offender acts as a member of a criminal or terrorist organisation or of a group formed for the continued conduct of money laundering, or achieves a large turnover or substantial profit through commercial money laundering. The offender is also liable where the main offence was committed abroad, provided it is also punishable there.² The words “must assume” extend liability to conditional intent. A banker who executes a transfer while accepting the possibility that the assets are criminal can commit money laundering even without knowing the predicate offence. The Federal Supreme Court has held that a simple deposit into the personal account used for everyday payments is not an act of money laundering, and that a transfer from one account to another within Switzerland, which merely extends the paper trail, as a rule is not one either. Since 2018 the court has also rejected the view that every transfer abroad amounts to money laundering. Such a transfer qualifies only if it is capable of frustrating confiscation abroad.³

Article 305ter paragraph 1 SCC punishes a person who professionally accepts, holds on deposit or assists in investing or transferring outside assets and fails to establish the identity of the beneficial owner with the care required by the circumstances. The penalty is a custodial sentence of up to one year or a monetary penalty.⁴ This is the offence on which the Zurich courts convicted the Gazprombank employees. Its practical importance lies in the fact that it does not require proof of a predicate offence or of knowledge of criminal origin. The failure to identify the beneficial owner with due care is sufficient.

Article 37 AMLA punishes breaches of the reporting duty, as described above. The fourth provision is Article 102 SCC on corporate liability. Under paragraph 1 a company is liable, with a fine of up to CHF 5 million, for a felony or misdemeanour committed within the company in the exercise of commercial activities if the offence cannot be attributed to a specific natural person because of the company’s deficient organisation. Under paragraph 2, for a closed list of offences that includes criminal organisation, the financing of terrorism, money laundering and bribery, the company is liable independently of the liability of natural persons if it failed to take all reasonable organisational measures required to prevent the offence. The fine is assessed according to the seriousness of the offence and of the organisational deficiency, the damage caused and the economic capacity of the company.⁵ The PKB case of 2024 is an example of the use of this provision through a summary penalty order. The Credit Suisse case shows its difficulties in contested proceedings.

Defence against money-laundering charges

The defence of a banker or adviser accused of money laundering starts from the structure of the offence. The prosecution must prove a predicate offence, at least in its essential elements, as well as the accused’s knowledge or assumption of the criminal origin. In cases with foreign predicate offences the evidence often lies abroad and depends on mutual legal assistance. The defence will examine whether the foreign conduct constitutes a felony or a qualified tax offence under Swiss law, whether it is punishable at the place of commission and whether the assets can actually be traced to it. The subjective element is frequently the decisive point. The prosecution will argue from the red flags in the file, such as unusual transaction patterns, inconsistent explanations and media reports, that the accused must have assumed a criminal origin. The defence will reconstruct the information actually available to the accused at the time, the clarifications carried out and the internal approvals obtained.

The compliance file therefore plays a double role. For the institution it is the evidence of due diligence. For the individual employee it can be either exculpatory or incriminating, depending on whether it shows that concerns were raised, examined and resolved in good faith or that they were raised and ignored. Employees who face investigation should be aware that the interests of the institution and their own interests may diverge. A bank that wishes to show FINMA that its organisation was adequate may be inclined to attribute failures to individual advisers, whereas the adviser will point to the pressure of targets and the approval of superiors. Separate counsel is advisable in such situations. The limitation periods deserve careful attention as well. For the violation of the reporting duty, the continuing nature of the offence established in BGE 144 IV 391 postpones the start of the limitation period as long as the duty persists.

Parallel proceedings add a further layer. A FINMA enforcement proceeding, a criminal investigation by a cantonal prosecutor or the Office of the Attorney General, an administrative criminal proceeding by the Federal Department of Finance and foreign proceedings may concern the same facts. Documents produced in one proceeding can reach another. FINMA may forward information to criminal authorities, and findings of a FINMA investigating agent can become evidence in a criminal trial. The coordination of these proceedings from the outset, including decisions on cooperation, internal investigations and the privilege of documents prepared by lawyers, is one of the most demanding tasks in Swiss white-collar practice. The preceding chapter on the prosecution of economic crime describes the procedural framework in Zurich.

Notes

1. Pestalozzi, “Authorisation requirements for portfolio managers” (above). ↩
2. Swiss Criminal Code, Article 305bis (above). ↩
3. BGE 124 IV 274, Regeste (“Eine einfache Einzahlung auf das dem üblichen privaten Zahlungsverkehr dienende persönliche Bankkonto am Wohnort ist objektiv nicht Geldwäscherei”), https://servat.unibe.ch/dfr/bge/c4124274.html; BGE 144 IV 172 of 16 March 2018, consid. 7.2.2, https://servat.unibe.ch/dfr/bge/c4144172.html (“Geldwäscherei ist bei einer Auslandsüberweisung demnach nur dann zu bejahen, wenn die Transaktion geeignet ist, die Einziehung im Ausland zu vereiteln”). ↩
4. Swiss Criminal Code, Article 305ter (above). ↩
5. Swiss Criminal Code, Article 102, bilingual text on droit-bilingue.ch, https://www.droit-bilingue.ch/de-en/3/31/311.0-102-133.html. ↩

For general information only. This article does not constitute legal or tax advice, does not replace advice on an individual case and creates no lawyer-client relationship. It reflects the legal position as of September 2025.