Switzerland -- AML/CFT Compliance Regulatory Overview

Switzerland regulates cryptocurrency and virtual asset service providers (VASPs), such as exchanges and wallet providers, under its Anti-Money Laundering Act (AMLA, or GwG in German), extended to these entities by the Swiss Financial Market Supervisory Authority (FINMA). The primary oversight body is FINMA (www.finma.ch), with VASPs required to affiliate with a recognized self-regulatory organization (SRO) for AML compliance[1][5][6].

Key AML/CFT Legislation

• Anti-Money Laundering Act (AMLA/GwG): Core legislation mandating AML/CFT obligations for financial intermediaries, including VASPs handling cryptocurrencies, custodians, and exchanges. It requires joining a recognized SRO and full compliance with KYC, record-keeping, and reporting[5][6][8].
• FINMA AML Updates (e.g., September 2021): Lowered KYC thresholds for crypto transactions and mandated enhanced due diligence (EDD) under the AML/CFT framework[2].
• Supporting frameworks like the DLT Act (2021) adapt existing financial laws to crypto without creating bespoke rules[6].

Customer Due Diligence (CDD/KYC) Requirements

VASPs must perform risk-based KYC on all customers, verifying identity with valid documents (e.g., passport, commercial register extract) and beneficial owners at onboarding[2][6].

• Threshold: KYC mandatory for transactions exceeding CHF 1,000 per month; prove ownership of non-custodial wallets[1][2].
• Enhanced Due Diligence (EDD): Required for high-risk clients (e.g., PEPs), unusual transactions, or third-party involvement; includes ongoing risk reviews and client segmentation[2][6].
• Collect personally identifiable information (PII) to prevent fraud, identity theft, and money laundering[2].

Suspicious Transaction Reporting

VASPs must immediately report suspicious activities indicative of money laundering or terrorist financing to the Money Laundering Reporting Office (MROS, www.fedpol.admin.ch/mros)[1][6].

• Internal controls, staff training, and transaction monitoring (e.g., blockchain analytics for amounts over CHF 1,000) are required[1][3].

Record-Keeping Obligations

• Retain client identification data, beneficial owner details, and transaction records for at least 10 years (per AMLA standards)[5][6].
• Conduct regular, risk-based reviews to keep data current; applies to both supervised and SRO-affiliated VASPs[6].

FINMA enforces a "same risks, same rules" approach, with strict internal controls, fit-and-proper personnel checks, and ongoing reporting for licensed entities[3][4][6]. Non-compliance risks enforcement actions.