How to Respond to a Criminal Investigation in Switzerland 2026: Immediate Steps for Companies, Directors and General Counsel

When a Swiss company learns it is the target of a criminal investigation, whether triggered by a cantonal prosecutor, the Office of the Attorney General, or FINMA, the first hours matter more than any subsequent legal strategy. Knowing how to respond to a criminal investigation is now more urgent than ever: the revised Swiss Anti-Money Laundering Act (AMLA) implementation timetable and FINMA’s May 2026 consultation on the partial revision of AMLO-FINMA have tightened supervisory expectations and widened the scope of corporate exposure. This guide delivers the practical, step-by-step playbook that in-house counsel, directors and compliance heads need to protect evidence, preserve privilege, manage regulator contact and begin remediation from the moment the investigation becomes known.

Every checklist and decision matrix below is designed for immediate operational use by companies with Swiss exposure that may be investigated for white-collar crime in Switzerland.

Executive Summary, 3-Minute Playbook

If you have learned, or suspect, that your company is subject to a Swiss criminal investigation, follow these actions in sequence. The speed of your initial response directly affects your legal exposure, the integrity of evidence and your credibility with authorities.

• Minute 1–5: Identify the investigating authority (cantonal police, cantonal public prosecutor, federal Office of the Attorney General, or FINMA). Note the reference number and any documents served.
• Minute 5–15: Notify the general counsel or, if the GC is a potential subject, notify the chair of the board’s audit or legal committee directly.
• Minute 15–30: Instruct IT to suspend automatic data-deletion policies. Issue a litigation hold on all potentially relevant documents and electronic data.
• Within 2 hours: Engage experienced Swiss criminal-defence counsel with economic-crime and investigations expertise.
• Within 4 hours: Lock access for any individuals who may be subjects of the investigation. Do not terminate, suspend access on a risk-managed basis.
• Within 24 hours: Secure forensic imaging of relevant devices (laptops, phones, servers). Notify D&O and legal-expense insurers. Brief the board chair.
• Within 72 hours: Prepare a preliminary fact chronology. Assess whether AML reporting obligations to MROS are triggered. Decide on initial engagement posture with authorities.
• Within 7 days: Scope a formal internal investigation. Draft remediation priorities. Evaluate voluntary-disclosure options with counsel.

The sections that follow expand each of these steps with detailed checklists, scripts and decision matrices tailored to Switzerland’s enforcement framework in 2026.

Stage 0, Do Not Panic: Triage and Who to Notify Internally

Triage checklist: who inside the company needs to know

The natural instinct is to alert senior management immediately. Resist this. Premature disclosure to individuals who may themselves be subjects can compromise evidence and destroy privilege. The initial notification circle should be deliberately narrow:

• General counsel (unless a potential subject).
• Board chair or audit-committee chair, particularly if the GC or CEO is implicated.
• Head of IT / information security, to implement the litigation hold and disable auto-deletion.
• External criminal counsel, engaged before any substantive internal discussion occurs.

Preserve the chain of custody from minute one

Every action taken with documents, devices and electronic data from this point forward must be logged. A broken chain of custody can render evidence inadmissible or, worse, create an obstruction narrative for prosecutors. Log who accessed what, when and why, even if the initial steps feel informal.

Initial communications script for employees

Do not issue a company-wide communication at this stage. If employees ask questions or if rumours circulate, the approved script should be minimal: “The company is aware of an inquiry and is cooperating with its legal advisers. Please direct any questions to [general counsel / external counsel]. Do not discuss the matter internally or externally, and preserve all documents and communications that may be relevant.” This script protects privilege and prevents inadvertent admissions.

How to Respond to a Criminal Investigation, Immediate Operational Checklist (First 24–72 Hours)

This is the core operational checklist, the detailed answer to the question “What is the first step in investigating financial crimes?” Each item should be treated as mandatory unless counsel advises otherwise.

1. Identify the investigating authority. Swiss economic-crime probes may originate from cantonal police, a cantonal public prosecutor (Staatsanwaltschaft), the federal Office of the Attorney General (Bundesanwaltschaft), or FINMA acting in its supervisory-enforcement capacity. The identity of the authority determines procedure, privilege rules and cooperation dynamics.
2. Trace the source of the allegation. Was the investigation triggered by a suspicious-transaction report (STR) to MROS, a whistleblower complaint, a media report, a foreign mutual-legal-assistance request or an internal audit finding? Understanding the origin shapes the scope of your response.
3. Secure and forensically image devices. Engage a certified forensic-IT vendor. Image all laptops, phones, external drives and relevant server partitions of key custodians. Do not review content yet, preserve it first. Record the forensic hash values.
4. Lock down accounts and access. Suspend system access for individuals who may be subjects. Disable their ability to delete emails, modify shared drives or access financial systems. Document each suspension.
5. Suspend access of key individuals (risk-managed). Where an employee is a potential subject, consider garden leave rather than termination. Termination may trigger labour-law complications and reduce your ability to interview the individual later.
6. Notify insurance and the board. Report the matter to D&O insurers and legal-expense insurers within the policy notification windows. Brief the board chair or audit-committee chair, providing only facts confirmed by counsel.
7. Engage external counsel with Swiss criminal and investigations experience. In-house counsel should not attempt to run the defence alone. Swiss criminal procedure, cantonal variations, federal jurisdiction rules and FINMA’s supervisory-enforcement powers require specialist knowledge.
8. Assess AML reporting obligations. If the facts suggest money laundering, terrorist financing or sanctions breaches, obliged entities under the Swiss Anti-Money Laundering Act must consider filing an STR with MROS. Failure to report can itself constitute a criminal offence. In light of the Switzerland money laundering law 2026 changes under the revised AMLA, the threshold for reporting and the documentation expectations are stricter, coordinate with counsel before filing.

Privilege callout: Mark all communications between the company and external counsel as “privileged and confidential, prepared for the purpose of obtaining legal advice.” Keep strategy memos physically and electronically separate from operational documents.

Privilege, Professional Secrecy and Article 321 StGB, What Directors and GC Must Know

Overview of Article 321 of the Swiss Criminal Code

Article 321 of the Swiss Criminal Code (StGB) protects professional secrecy. It provides that members of certain professions, including lawyers, notaries, auditors and physicians, who disclose confidential information entrusted to them by virtue of their profession commit a criminal offence, unless the person concerned consents or a statutory exception applies. This provision, set out in the official consolidated text of the Swiss Criminal Code, is the foundation of legal privilege in Switzerland and directly shapes how evidence may be collected and shared during an investigation.

Privilege versus the criminal process, limits and exceptions

Professional secrecy under Article 321 StGB is not absolute. Swiss criminal-procedure law permits prosecutors to apply to a court to lift secrecy where there is an overriding public interest or where the secret-holder is personally suspected of a crime. In practice, documents held by external lawyers enjoy strong protection, but documents held by in-house counsel are treated differently. Swiss courts have consistently held that in-house legal counsel do not benefit from the same professional-secrecy protection as independent, bar-admitted lawyers. This distinction is critical during search-and-seizure operations.

Practical dos and don’ts for in-house counsel

• Do: Channel all sensitive investigation-related communications through external counsel. If external counsel provides advice in writing, label it clearly and store it in a segregated, access-restricted folder.
• Do: Maintain a privilege log from day one, recording each document claimed as privileged, the date, the author, the recipient and the basis for the privilege claim.
• Don’t: Mix legal-advice memos with operational documents. A strategy note attached to a routine business email may lose its privileged status.
• Don’t: Assume that communications with compliance officers or accountants are protected. Professional secrecy under Article 321 applies only to the professions listed in the statute.

Handling Evidence and Digital Forensics, Preserve, Collect and Document

Forensic imaging and chain-of-custody protocol

Use a reputable, independent forensic-IT firm, not the company’s own IT department, to image devices. The forensic vendor should produce verified hash values (SHA-256 or equivalent) for every image, document the time and location of acquisition, and sign a chain-of-custody certificate. Store images on encrypted, write-protected media in a secure location controlled by external counsel.

Employee interviews, who, when and how

Interviews should be conducted by external counsel, not by HR or internal compliance alone. Key rules for Swiss-context interviews:

• Inform the interviewee that the interview is conducted on behalf of the company, not as personal legal advice to them.
• Explain that the company, not the individual, holds any privilege over the interview record.
• Allow the employee to have their own personal counsel present if they request it.
• Take contemporaneous notes. Audio recording requires consent under Swiss law.
• Keep factual interview summaries separate from counsel’s legal analysis.

For cross-border data, assess whether Swiss data-protection law (nDSG) or foreign blocking statutes restrict the transfer of personal data to foreign authorities or counsel. Where data subjects are in the EU, GDPR transfer rules may also apply.

Engagement Strategy with Investigating Authorities

Identifying the authority and its powers

Swiss economic-criminal investigations may be conducted by cantonal prosecutors (for offences under cantonal jurisdiction), the federal Office of the Attorney General (for complex financial crime, money laundering and organised crime), or FINMA (for supervisory-enforcement matters involving supervised institutions). Each authority has different procedural tools, different cooperation expectations and different settlement cultures. Your first task is to confirm precisely who has opened the proceeding and under which legal basis.

The cooperation decision matrix

For FINMA-supervised entities, industry observers expect that full or high-level cooperation is effectively mandatory: FINMA’s supervisory communications signal that institutions that delay or obstruct supervisory proceedings face escalated enforcement, including the appointment of an investigating agent at the entity’s cost. Coordinate the cooperation posture with counsel before any substantive contact with authorities.

AML and FINMA 2026 Considerations, What to Watch and Do Now

FINMA AMLO consultation (May 2026): key changes for obliged entities

FINMA launched a consultation on the partial revision of the Anti-Money Laundering Ordinance (AMLO-FINMA) in May 2026. The likely practical effect of the consultation will be stricter documentation requirements for customer due diligence (CDD), enhanced obligations around the identification and verification of beneficial owners, and more granular expectations for transaction-monitoring systems. Banks, securities dealers and other financial intermediaries supervised by FINMA should review their existing AML frameworks against the proposed changes immediately, even before the consultation closes.

AML red flags and immediate reporting to MROS

If an internal investigation uncovers suspicious transactions, unusual payment patterns, unexplained cash flows, structuring to avoid reporting thresholds, transactions with sanctioned jurisdictions, obliged entities must file a suspicious-transaction report (STR) with MROS (the Swiss Money Laundering Reporting Office). Under the revised AMLA framework, the expectation is that STRs are filed promptly and that the entity freezes the relevant assets pending MROS instructions.

Interplay with EU AMLA developments for cross-border firms

Companies operating across both Swiss and EU jurisdictions must now monitor developments under the EU Anti-Money Laundering Authority (AMLA) as well. While AMLA Switzerland and the EU AMLA framework operate independently, industry observers expect growing convergence in CDD standards, beneficial-ownership transparency and cross-border information sharing. Firms with dual exposure should align their compliance programmes to the higher of the two standards to avoid gaps.

Directors and Officers, Duty of Care and Potential Personal Exposure

Typical charges versus corporate sanctions

Under Switzerland corporate criminal liability rules, a company may face criminal sanctions where an offence was committed within the scope of the company’s business activities and cannot be attributed to a specific individual due to organisational deficiencies. Directors and officers, however, may face personal criminal charges, including for fraud, criminal mismanagement (Art. 158 StGB), money laundering or failure to prevent corruption, if they are directly implicated or failed in their supervisory duties.

How directors should act during an investigation

• Document board discussions and decisions regarding the investigation in formal minutes.
• Where a director is personally a subject or has a conflict, that director should recuse themselves from board discussions about the investigation and seek independent personal counsel.
• Do not destroy, alter or conceal any documents. Even the appearance of destruction can lead to obstruction charges.
• Review D&O insurance coverage immediately, confirm the policy covers criminal-defence costs and whether the insurer requires notification within a specific window.

D&O insurance and criminal exposure

Most D&O policies contain exclusions for intentional criminal conduct. However, defence costs up to final adjudication are typically covered. Notify the insurer early, in writing, and preserve the notification correspondence. If multiple directors are implicated, each may need separate personal counsel to avoid conflicts of interest.

Internal Investigation Design and Remediation Plan

Scoping the investigation

The scope must be defined carefully: too narrow, and you miss critical facts; too broad, and you waste resources and risk alerting subjects prematurely. Work with external counsel to define the investigation scope by reference to the known allegations, the relevant time period, the business units and geographies involved, and the categories of documents and data to be reviewed.

Use of independent counsel

For credibility with prosecutors and regulators, appoint external counsel who are independent from the company’s regular legal advisers. If the company’s usual law firm has advised on the transactions under scrutiny, a different firm should run the investigation. Independence is not merely desirable, it is often a precondition for prosecutors to give weight to the investigation’s findings.

Remediation roadmap, 0 to 90 days

• Days 0–7: Secure evidence, implement litigation hold, suspend access of subjects, engage forensic-IT vendor, brief the board.
• Days 7–30: Complete document collection and forensic imaging, conduct first-wave interviews, prepare preliminary fact chronology, assess AML reporting obligations, evaluate cooperation posture.
• Days 30–90: Complete key interviews, produce investigation report for the board, implement immediate policy and control fixes (quick wins), design medium-term remediation programme (training, system upgrades, governance changes), and prepare any voluntary-disclosure or remediation submissions to authorities.

Quick-wins checklist for control repair

• Update the code of conduct and whistleblower policy.
• Re-train finance and compliance staff on red-flag identification.
• Strengthen dual-authorisation controls for payments above defined thresholds.
• Review and update the company’s AML/KYC procedures in line with the FINMA AML consultation 2026 proposals.
• Commission an independent review of the compliance function’s reporting lines and resources.

Disclosure, Self-Reporting and Settlement Options

Voluntary disclosure, benefits and risks

Swiss prosecutors and FINMA do not operate a formal leniency programme comparable to the US DOJ’s voluntary self-disclosure policy. However, in practice, voluntary disclosure, when combined with genuine remediation and cooperation, can materially reduce the severity of sanctions. The key risk is that disclosure provides prosecutors with evidence they did not previously have. This calculation must be made case by case, with experienced counsel.

Negotiated remediation and fines

For FINMA-supervised entities, remediation agreed with the regulator, including the appointment of an independent auditor, enhanced reporting and governance changes, may resolve the matter without public-enforcement proceedings. For criminal matters, abbreviated proceedings (abgekürztes Verfahren) allow a negotiated resolution if both sides agree on the facts and the sanction. Early indications suggest this route is increasingly favoured for corporate economic crime where the company demonstrates credible remediation.

Structuring remediation reports

Whether addressed to prosecutors or FINMA, a remediation report should include: a clear factual narrative, identification of root causes, a description of the remedial measures already implemented and those planned, a timeline for completion, and an independent verification mechanism. Structure the report to show that the company has internalised the failure and built durable controls, not merely reacted to the investigation.

Reporting Obligations by Entity Type

Templates and Checklists

The following templates support the immediate-response and internal-investigation workflow described in this article. Each should be adapted to the company’s specific circumstances and reviewed by external counsel before use:

• Internal evidence log. A structured spreadsheet for recording every item collected, its custodian, the date and method of collection, hash values for digital items and current storage location.
• Forensic terms of reference. A template engagement letter for a forensic-IT vendor, specifying the scope of imaging, chain-of-custody requirements, reporting format and confidentiality obligations.
• Employee interview script. An opening statement (Upjohn-style warning adapted for Swiss law), standard questions, instructions on note-taking and a closing statement confirming confidentiality and privilege.
• Limited-disclosure memo. A template for communicating minimal, approved information to employees and, where required, to business partners or counterparties.
• Board notification memo. A structured memo for briefing the board chair or audit committee, covering known facts, legal exposure assessment, recommended immediate actions and next steps.

Quick Timeline: What to Expect from a Swiss Economic-Criminal Probe

Industry observers note that complex economic-crime investigations in Switzerland, particularly those involving cross-border elements or multiple suspects, routinely extend beyond five years from trigger to final resolution.

Conclusion, How to Respond to a Criminal Investigation and Protect Your Organisation

Understanding how to respond to a criminal investigation in Switzerland is no longer a theoretical exercise for boards and general counsel, it is an operational imperative. The 2026 regulatory environment, shaped by the revised AMLA framework and FINMA’s ongoing AMLO consultation, demands faster responses, tighter evidence handling and more sophisticated engagement with authorities than at any previous point. The companies that navigate investigations successfully are those that act within hours, not days; that preserve privilege from the first conversation; that engage specialist Swiss criminal counsel immediately; and that build a remediation narrative that demonstrates genuine organisational change.

Every section of this guide is designed to be used under pressure, print the checklists, adapt the templates and seek qualified legal advice without delay. For experienced criminal-law practitioners in Switzerland, use our directory to connect with the right adviser for your situation.

Sources

1. ACAMS, FINMA Launches Consultation on AML Ordinance Revisions
2. Swiss State Secretariat for International Finance (SIF), Anti-Money Laundering Act (AMLA)
3. Fedlex / admin.ch, Swiss Criminal Code (StGB)
4. FINMA Supervisory Communication 02/2026
5. CMS, Switzerland Revises FINMA Anti-Money Laundering Ordinance: Main Changes
6. Lenz & Staehelin, Amendments to the Swiss Anti-Money Laundering Act