Joining a self-regulatory organisation is the start, not the end. Once a Swiss company is a member of an SRO, an anti-money laundering auditor comes back every audit cycle and checks that the rules on paper are applied in practice. Getting in is easier than staying in.
This guide explains who audits, what the auditor looks at, the findings we see most often, and how to prepare. For the membership itself, see our Swiss SRO licence guide. It is part of our guide to doing financial business in Switzerland.
Who audits, and when
- An audit firm recognised by your SRO. You choose it from the SRO’s list, you pay it, and it reports to the SRO.
- In principle every year. The first audit comes early, normally for the first year of membership.
- A dormant company is still audited. As long as it is a member, it must show that its framework is in place, even with no clients.
What the auditor checks
The auditor does not stop at your manuals. He picks client files and follows the trail.
| Area | What the auditor wants to see |
|---|---|
| Risk analysis | A written analysis of your own money-laundering risks, current and adapted to what you actually do. |
| Internal directives | AML rules that match your business, approved by management and applied by staff. |
| Client files | Identification, beneficial owner, purpose of the relationship and source of funds, documented before the first transaction. |
| Higher-risk relationships | Politically exposed persons and other higher-risk clients identified, approved and reviewed. |
| Transaction monitoring | Unusual transactions spotted, clarified and the clarification written down. |
| Reporting | Suspicious cases reported to the Money Laundering Reporting Office (MROS) when the law requires it. |
| People | A compliance officer in place, and training of staff that you can prove. |
| Records and changes | Complete records, and every change of owner, director or activity reported to the SRO. |
| Name and communications | No protected terms such as “bank” in the name or on the website, and no misuse of the FINMA or SRO logo. |
The findings we see most often
- A risk analysis written once and never updated, while the business has changed.
- Source of funds asserted, not documented. “The client said so” is not a clarification.
- No proof of training. If it is not recorded, for the auditor it did not happen.
- Changes not reported: a new director, a new shareholder, a new activity. The SRO learns it from the audit, and that is the worst way.
- An activity outside what was declared, for example crypto transactions in a company admitted for something else.
The dormant-company audit: a form, not a test
Many SRO members have no activity yet, or none any more. Their audit is very different. At some SROs it is an online questionnaire of a few pages: an independence checklist for the auditor, a description of the company and its owners, an attestation that there was no activity subject to the Anti-Money Laundering Act, proof that the compliance officer followed a training course, and a check on protected terms. A box is ticked, and the report says “compliant”.
Let us be frank: such a report proves very little. It shows that the company exists, has a responsible person and has not been operating. It says nothing about whether its framework would survive real clients. The real test is the first audit after activity starts, when the auditor opens client files for the first time.
What happens after a bad report
Minor findings come with a deadline to fix them. Serious or repeated breaches lead to sanctions under the SRO’s rules, which can go up to exclusion. An excluded financial intermediary may no longer carry on its activity unless it joins another SRO, and FINMA is informed. In practice, a company with an exclusion on its record is very hard to place with another SRO.
How to prepare
- Update the risk analysis every year, and every time the business changes.
- Run your own file review before the auditor arrives: ten files, the full trail, gaps fixed.
- Keep a training log with dates, content and attendees.
- Report every change to the SRO when it happens, not at audit time.
- Give the auditor one organised folder. A clear file shortens the audit, and the invoice.
Why the audit history matters when you buy
Many of our clients do not start from scratch: they buy a company that is already an SRO member. In that case, the last audit reports are part of what you buy. Read them, do not just count them: a clean report on an active company shows a working framework, a clean report on a dormant one mainly shows that nothing happened. Check also that the report matches reality, for example that a change of shareholder was actually reported. Open findings, or a company that has not been looked after, become your problem on the day of the transfer. See Buying a Swiss Regulated Company: What to Check Before You Sign, and the Swiss SRO companies currently for sale.
Not sure whether an SRO is enough for your activity? Read SRO or Licence: Which Do You Need?.
Ask us to review your file before the auditor does, or write to insight@fintechlex.com.
This article is for general information only and does not constitute legal advice.
