Checklist: preparing for SRO membership
For: Financial intermediaries and newly covered advisers
Updated: 2026-11
SRO membership is prepared in seven steps: clarify coverage and professional activity, choose a suitable SRO from the current FINMA list, define organisation and AML responsibility, align directives with the regulation, prepare a risk assessment, submit a complete application and set up operations with documentation from the first client.
This checklist is for financial intermediaries under Art. 2 para. 3 AMLA and advisers newly covered by the Anti-Money Laundering Act since 1 October 2026. It describes preparation, not legal assessment of individual cases.
Who must join and how to choose is covered in our article on SRO membership in Switzerland.
The checklist
- 01
Clarify coverage
Check whether the activity falls under the AMLA and is carried out on a professional basis.
Done when: A written assessment with reasons exists, with external confirmation for borderline cases.
- 02
Choose an SRO
Check FINMA’s current list and compare SROs by business model, language, regulation, audit model and cost.
Done when: The choice is recorded with reasons, and the chosen SRO’s regulation is at hand.
- 03
Define the organisation
Appoint the person responsible for AML and ensure their training.
Done when: The person is named, their training is documented and a deputy is arranged.
- 04
Prepare directives
Align internal directives on identification, beneficial owners, risk rating, clarifications and documentation with the regulation.
Done when: The directives reference the regulation’s provisions and fit the actual business process.
- 05
Prepare the risk assessment
Assess the business’s risks by clients, countries, products and channels.
Done when: The risk assessment is approved by the governing body and derives the criteria for higher risk.
- 06
Submit a complete application
Compile all required documents, from commercial register extract to evidence of good repute.
Done when: The SRO’s checklist is fully ticked and the application submitted with acknowledgement of receipt.
- 07
Set up operations
Set up forms, filing and deadlines for periodic reviews so every file can be audited.
Done when: For a test client, identification, rating and evidence can be produced within minutes.
Common mistakes
- —Starting the activity before membership is confirmed.
- —Adopting directives from a template that does not fit the business model.
- —Writing the risk assessment only for the application and never using it again.
- —Tying documentation to individuals rather than the file.
What this checklist does not cover
- —The checklist does not replace legal assessment of coverage; where in doubt, consult a specialist or the SRO itself.
- —Requirements, deadlines and costs differ between SROs and must be confirmed there.
- —Institutions with a FINMA licence and a supervisory organisation are subject to different requirements.
Parent service: Digital Transformation
FAQ
By when must advisers apply?
The transition period expires in December 2026. The chosen SRO confirms the exact date and requirements.
Can you change SRO later?
In principle yes, under the conditions of the SROs involved. A change needs preparation so there is no gap in supervision.
What does the SRO check after admission?
Samples from client files to see whether due diligence was carried out and documented, plus organisation and training.
More checklists
Checklist: introducing Microsoft 365 governance
Microsoft 365 governance is introduced in seven steps: take inventory, set rules for creating teams and sites, require at least two owners per team, review guest access regularly, classify sensitivity and retention, define a lifecycle with archiving and steer flows and apps through an approval process.
Checklist: writing an app brief
A good app brief describes the goal and user groups, the three to five most important flows, platform requirements, the necessary data and interfaces, requirements for operations and data protection, and measurable success criteria. It leaves the technical solution open and makes proposals comparable.
Checklist: a secure Microsoft 365 baseline configuration
A secure Microsoft 365 baseline covers seven points: multi-factor sign-in for everyone, few and specially protected administrators, legacy sign-in protocols disabled, restricted consent to third-party apps, active logging, SPF, DKIM and DMARC for your domains, and an independent backup of the data.