With the Financial Institutions Act Switzerland reorganised the supervision of independent asset managers and trustees in 2020. They need a FINMA licence but are not supervised on an ongoing basis by FINMA itself; that is the job of a supervisory organisation. The model sits between direct supervision of banks and AML-only supervision by an SRO.
What an SO does
The SO monitors whether the institutions it supervises continuously meet the licensing requirements and comply with the Financial Institutions Act, the Financial Services Act and the Anti-Money Laundering Act. It relies on audits carried out by audit firms or its own auditors and can set the audit frequency on a risk basis. If it finds serious deficiencies, it informs FINMA, which decides on measures up to withdrawal of the licence.
SO or SRO
The difference is fundamental. An SRO supervises only AML compliance of financial intermediaries under Art. 2 para. 3 AMLA that need no FINMA licence. An SO supervises licensed institutions comprehensively, including organisation, risk management, capital and conduct rules. A licensed portfolio manager belongs to an SO, not an SRO; a payment service provider without a licensing obligation belongs to an SRO, not an SO.
Which SO
FINMA publishes the list of authorised supervisory organisations. It includes organisations such as AOOS, FINcontrol Suisse, OSFIN, OSIF and SO-FIT; the current list on finma.ch is decisive. Language, audit model, cost structure, accessibility and experience with one’s own business model, such as cross-border mandates or trust structures, all matter.
What the audit wants to see
As with every supervisory audit, the documented control counts, not the performed one. Risk ratings with reasons, traceable clarifications for higher risks, a current AML risk assessment and a complete audit trail shorten the audit considerably.