Financial market law obligations of Swiss banks in dealing with sanctions

The geopolitical landscape and the expansion of sanctions regimes have substantially increased the requirements for an effective sanctions compliance programme at banks in recent years. Dealing with listed persons, sectoral prohibitions, restrictions on goods and services and regulations with extraterritorial effect (notably US sanctions law) presents banks with complex challenges. FINMA has classified sanctions as a persistent key risk in its risk monitors. The case of MBaer Merchant Bank AG, which FINMA reported to the public on 27 February 2026, vividly illustrates how potential sanctions violations can coincide with supervisory deficiencies and lead to far-reaching measures by FINMA.

In the enforcement proceedings conducted against the bank, FINMA identified severe and systematic deficiencies in the compliance with anti-money laundering due diligence obligations, in the bank's organisational structure and in its risk management. FINMA considered it particularly serious that the bank had allegedly actively assisted clients in circumventing governmental asset freezes. In addition, transactions were reportedly carried out for sanctioned clients or with frozen funds. FINMA revoked the bank's licence and ordered its liquidation. In parallel, it initiated several proceedings against natural persons considered potentially responsible (FINMA media release of 27 February 2026, "FINMA proceedings: MBaer Merchant Bank AG in liquidation").

Adequate organisation and risk management

Supervisory requirements demand that banks maintain an adequate organisation and effective risk management. Pursuant to Article 3(2)(a) of the Banking Act (BA) and Article 12 of the Banking Ordinance (BO), banks must identify, limit and monitor their material risks and maintain an effective internal control system for this purpose. FINMA has already emphasised in the past that this obligation also encompasses sanctions risks, as these constitute legal and reputational risks that can materially affect business operations (FINMA Risk Monitor 2022, pp. 14 et seq.). 

According to FINMA practices, this also requires assessments on foreign sanctions regimes. The FINMA media release on the conclusion of the proceedings against BNP Paribas (Suisse) SA in 2014 expressly states that financial institutions must analyse, minimise and adequately control the legal and reputational risks arising from US sanctions. In that case, FINMA classified repeated US sanctions violations as a severe breach of the organisational requirements under Swiss supervisory law and ordered a prohibition on conducting business with counterparties affected by EU or US sanctions as well as an additional capital requirement for operational risks (FINMA media release of 1 July 2014, "Inadequate risk management of  US sanctions: FINMA closes proceedings against BNP Paribas (Suisse)"). 

FINMA's more recent risk assessment confirms this approach. In its Risk Monitor 2025, FINMA highlighted the exposure associated with goods sanctions, where trading with clients in sanctioned countries and the provision of certain related financial services are prohibited even if clients are domiciled in third countries. In FINMA's view, risks arising from US secondary sanctions must also be consistently identified, mitigated and monitored (FINMA Risk Monitor 2025, pp. 17 et seq.).

In the explanatory report to the consultation on the partial revision of the FINMA Anti-Money Laundering Ordinance opened on 12 May 2026, FINMA states that the requirement of adequate risk management already demands under current law that supervised entities strictly comply with the coercive measures under the Embargo Act and limit the risks associated with the disregard or circumvention of international sanctions (Explanatory Report, p. 11). The report further indicates that FINMA already today considers the following measures to be required from the perspective of adequate risk management with regard to sanctions: 

• Preparation of a risk analysis at regular intervals; 
• Introduction of internal directives; 
• Depending on size and activity, establishment of an IT-supported system for screening business relationships, and originators and beneficiaries of transactions. 

In the event of sanctions violations, breaches of relevant legal requirements or internal directives or shortcomings in internal risk management, it is advisable for banks to conduct a timely and thorough internal investigation of the facts. A robust internal review allows for findings to be documented in a comprehensible manner and for effective remedial measures to be taken.

Obligations under the Anti-Money Laundering Act

In terms of sanctions, the obligations under the Anti-Money Laundering Act (AMLA) are also important since sanctions violations frequently correlate with typical money laundering risks and anti-money laundering risk management structurally mirrors key elements of a sanctions compliance programme. The due diligence obligations for identifying contracting parties and establishing beneficial owners are fundamental for detecting listed persons, controlling ownership structures and uncovering circumvention structures, such as through shell companies or complex ownership cascades. 

The duty of clarification under Article 6 AMLA requires that in cases of uncertainty regarding beneficial ownership, the source of wealth or the source of funds enhanced clarifications must be carried out and documented. In sanctions-sensitive sectors, high-risk jurisdictions or transaction patterns that may indicate proximity to goods or services restrictions, heightened diligence and enhanced clarifications are required. The reporting obligation under Article 9 AMLA becomes relevant in the sanctions context where there is a reasonable suspicion of money laundering or terrorist financing. In practice, this means that a sanctions hit without additional suspicious elements will not trigger a duty to report, whereas a reporting obligation may, for example, arise from circumvention structures or false or misleading information.

The revision of the AMLA adopted by the Swiss Parliament on 26 September 2025, the entry into force of which is planned for the second half of 2026, explicitly enshrines organisational obligations to prevent sanctions violations and thereby intensifies the convergence of AMLA and sanctions compliance. The substantive scope of the AMLA will be expanded and the organisational measures under Article 8 AMLA will be specified with the effect that financial intermediaries must additionally take necessary precautions to prevent violations of coercive measures under the Embargo Act. At the same time, an express legal basis for the exchange of information between the Money Laundering Reporting Office (MROS) and the State Secretariat for Economic Affairs (SECO) will be established as the interface between AMLA and embargo law. For banks, this means in practice not so much an entirely new set of obligations but rather a legislative consolidation of FINMA’s organisational expectations, which will increase legal certainty.

Fit and proper requirement

Sanctions violations may further affect the “fit and proper” requirement (Gewährserfordernis), both at the institutional level and at the level of the persons required to meet the fit and proper standard under Art. 3(2)(c) BankG. The fit and proper requirement targets correct conduct in business dealings and presupposes compliance with the legal order (laws and ordinances), internal regulations, professional standards and the principle of good faith in business dealings. Business activity that violates these requirements is hardly compatible with the standard of proper business conduct.

Against this background, severe or systematic violations of sanctions law provisions or related internal directives, circumvention of asset freezes or disregard of sanctions-related compliance recommendations can negatively affect the prognosis for future proper business conduct to such a degree that the fit and proper requirement may be called into question. The MBaer case illustrates this. According to FINMA, the misconduct in this case was so severe that both organisational and anti-money laundering obligations and the fit and proper requirement were seriously violated. In parallel, FINMA initiated proceedings against several natural persons considered to be responsible under supervisory law (FINMA media release of 27 February 2026).

Conclusion

From a financial market law perspective, banks are required to treat sanctions risks as an integral part of their organisational and risk management framework. Banks are well advised to establish a governance structure that addresses sanctions risks in a top-down manner, establishes clearly defined responsibilities and provides for an effective internal control system with timely screening and transaction filtering processes. In the sanctions context, FINMA expects compliance with Swiss sanctions and takes into account the handling of foreign sanctions in its assessment of risk management. The cases of BNP Paribas (Suisse) SA and MBaer Merchant Bank AG demonstrate that the consequences of deficiencies can be substantial: imposed capital and business-related requirements, restrictions on business activities, and license revocation and liquidation. In addition, FINMA may take measures against responsible persons.

In day-to-day operations, this means that banks should embed sanctions-specific controls along the entire client and transaction lifecycle, in addition to complying with their anti-money laundering obligations. This includes a robust sanctions risk analysis, the monitoring of sanctions-sensitive sectors and supply chains, geographically and sectorally targeted transaction filters, robust escalation and decision-making processes, regular training and independent testing of effectiveness. Given the extraterritorial effect of the OFAC regime, cross-border risks must also be taken into account. Equally critical is a bank's response to violations of relevant legal requirements and internal directives or deficiencies in internal risk management. Experience shows that it is beneficial for banks to investigate critical matters promptly, reconstruct decision-making processes in a comprehensible manner and implement remediation measures in a timely fashion. In supervisory practice, the quality of a bank's internal review and remediation of deficiencies has proven to be a significant factor.

The ongoing revision of anti-money laundering legislation marks a regulatory turning point. The anchoring of sanctions prevention in the Anti-Money Laundering Act will strengthen organisational requirements and the coordination between authorities, particularly between FINMA, SECO and MROS. In the light of these developments, banks should critically review the existing framework, close identified gaps and deepen the integration of AMLA and sanctions compliance.

For more information, contact the CMS experts who contributed to this article.