Checklist: Swiss AMLA coverage for advisers since 1 October 2026
For: Law firms, fiduciaries and consultancies
Updated: 2026-10
Advisers settle AMLA coverage in eight steps: map activities with a concrete legal transaction, assess coverage with reasons, secure deadlines, choose an SRO and read its regulations, define a risk method, turn due diligence duties into processes, set up filing and an audit trail, and train staff.
With the revision of the Swiss Anti-Money Laundering Act in force since 1 October 2026, certain advisory activities are subject to due diligence duties even if advisers never handle assets. FINMA gives as examples advice in connection with real estate transactions and with the formation and establishment of non-operating legal entities.
This checklist guides through assessment and implementation. It is written for smaller law firms, fiduciaries and consultancies without their own compliance department.
The checklist
- 01
Map activities
Go through the mandates of the last twelve months and record which concerned a concrete legal transaction: real estate transactions, formation and establishment of entities, restructurings, transactions shifting assets. For each, note whether your own advice contributed to that transaction.
Done when: A list of relevant mandate types exists, each with an example, type of legal transaction and your role.
- 02
Assess coverage with reasons
Assess coverage using the features professional activity, concrete legal transaction and causal contribution. Check exemptions such as work in connection with court, criminal and administrative proceedings. In case of doubt, have the assessment confirmed by the chosen SRO or a specialised law firm.
Done when: A dated, signed memo records the result, even if negative, with reasons per activity type.
- 03
Secure deadlines
Due diligence duties have applied to new mandates since 1 October 2026. Confirm the cut-off for the SRO membership application with the chosen SRO; the transitional period ends in December 2026. FINMA-supervised entities acting as advisers on 1 October 2026 notify FINMA by 1 December 2026.
Done when: All relevant dates are in the responsible person’s calendar, with source and deputy.
- 04
Choose an SRO and read its regulations
Compare the FINMA-recognised SROs: sector fit, regulations, audit model, training offering, cost. Read the regulations before applying, because they shape daily life with the due diligence duties.
Done when: An SRO is chosen, the application is submitted and the confirmation of receipt is on file.
- 05
Define a risk method
Define risk criteria, such as residence and seat, type of legal transaction, complexity of structure, politically exposed persons, source of funds, and specify what a higher-risk classification concretely triggers: additional enquiries, approval by a second person, shorter review cycle.
Done when: A directive describes criteria, levels and consequences; it is dated and approved by management.
- 06
Turn due diligence duties into processes
Describe a process for each duty: identifying the contracting party, establishing beneficial owners using the transparency register as a cross-check, sanctions and PEP screening, additional enquiries, handling suspicious cases up to a report to MROS, including the prohibition of information.
Done when: For each new mandate you can show which process was applied and with what result.
- 07
Set up filing and an audit trail
File records per mandate so that an audit firm can review samples without searching: identification, determination, risk classification, enquiries, decisions with date and person. Ensure retention for at least ten years after the mandate ends, including across system changes.
Done when: A sample file can be produced completely within minutes, and the retention rule is recorded.
- 08
Train staff
Train everyone handling mandates with relevant legal transactions on coverage, processes, red flags and the prohibition of information. Document attendance and repeat training on a fixed cycle.
Done when: An attendance list with dates exists, and new staff are trained before taking on their first mandate.
Common mistakes
- —The assessment is skipped on the grounds that you never touch money — precisely the assumption the revision removes.
- —Legal work is treated as exempt across the board, although only certain litigation-related activities are exempt.
- —Forms are introduced but no risk method; at audit, the reasoning behind decisions is missing.
- —The SRO application is prepared in December, leaving no time to read the regulations and adapt processes.
- —Records are spread across email, filing and spreadsheets, so a sample audit becomes a search operation.
What this checklist does not cover
- —This checklist is not legal advice and not a binding assessment of coverage. The AMLA, its ordinance, the chosen SRO’s regulations and, where applicable, the SRO’s guidance are authoritative.
- —It reflects the legal position as of October 2026. Specific transitional cut-off dates and SRO practice must be confirmed with the SRO.
- —Sector-specific rules, for example for cantonal official notaries with postponed entry into force or for prudentially supervised institutions, are covered only in passing.
- —Tax and professional-law assessment of individual mandates is outside the scope of this list.
Parent service: Digital Transformation
FAQ
Does the 2026 revision apply to lawyers?
For certain advisory activities, yes, for example setting up structures or real estate deals. Exempt, among others, are activities in connection with court, criminal and administrative proceedings. What counts is the specific activity, not the profession.
By when must we join an SRO?
The transitional rules provide a short period ending in December 2026. The chosen SRO confirms the binding cut-off date and application requirements.
May we keep advising until we join?
FINMA states for its supervised entities that existing clients may continue to be advised and new mandates accepted. Due diligence duties, however, have applied since 1 October 2026; other advisers should clarify their situation with the chosen SRO.
Who checks compliance with due diligence duties?
The SRO supervises its members and has compliance checked by audit firms. It specifies the scope of the duties in its regulations.
Do advisers have access to the transparency register?
Yes, within their anti-money laundering duties. The register is a cross-checking source and does not replace your own determination of beneficial owners.
More checklists
Checklist: making an LLM feature production-ready
An LLM feature is production-ready when error costs are known, an evaluation set measures quality, the architecture limits prompt injection, data flows are contractually secured, a fallback exists, cost per use is capped, monitoring runs, human oversight is defined and the AI Act classification is documented.
Checklist: data breach — the first 72 hours
After a data breach: contain immediately, secure facts and timing, form a decision team, assess the risk to data subjects, notify the FDPIC as soon as possible where risk is high and, under the GDPR, the supervisory authority within 72 hours, inform data subjects where needed, involve processors and document everything.
Checklist: security before a SaaS launch
Before launching a SaaS product, eight points must hold: tested tenant isolation at data level, secure authentication with multi-factor, secrets outside the code, up-to-date dependencies, backups with tested restoration, logging of security events, abuse protection and a prepared process for security incidents.