Switzerland 2026: How Criminal Investigations Into Crypto & Digital Assets Work, What Banks, Exchanges and Executives Should Do

Crypto criminal investigations switzerland now sit at the centre of the country’s financial-crime enforcement agenda, and 2026 has brought sharper regulatory attention to virtual assets than most previous years. As Swiss prosecuting authorities, cantonal police and the Federal Office of Police (fedpol) deepen their technical capacity to trace on-chain value, banks, regulated exchanges and individual executives face procedural demands that can move faster and cut deeper than conventional financial-crime probes. This guide sets out, step by step, how such investigations proceed under the Swiss Criminal Code (Strafgesetzbuch, StGB) and the Swiss Criminal Procedure Code (Strafprozessordnung, StPO), what institutions must do at each stage, the documents and timelines involved, and what is changing for 2026.

It is written for in-house counsel, compliance officers, senior management and defence counsel who need an actionable playbook rather than a general overview.

This is general information and not legal advice. Readers facing an active matter should contact qualified Swiss counsel without delay.

Overview: the stages of crypto criminal investigations in Switzerland

This guide is intended for those who may have to respond within hours, not weeks: compliance teams at banks and virtual asset service providers (VASPs), chief operating officers and chief risk officers, and the defence counsel who represent them. It explains the mechanics of crypto criminal investigations switzerland from first intelligence to confiscation, with indicative time spans and required documentation rather than vague generalities.

A Swiss criminal investigation into digital assets typically moves through a recognisable sequence. It often begins with initial intelligence, a report filed under the Anti-Money Laundering Act (AMLA) to the Money Laundering Reporting Office Switzerland (MROS), a FINMA referral, a criminal complaint, or a foreign request for assistance. The matter then passes to a police preliminary investigation conducted by cantonal police or fedpol, during which evidence is preserved and searches or seizures may occur. Control then shifts to the public prosecutor, who directs the formal investigation and can impose provisional measures such as freezing and seizure orders under the StPO.

Where assets, suspects or evidence cross borders, mutual legal assistance (MLA) mechanisms are engaged through the Federal Office of Justice within the Federal Department of Justice and Police. The process culminates, where the evidence supports it, in indictment, trial and confiscation or forfeiture before a cantonal court or the Federal Criminal Court, with appeal routes ultimately reaching the Federal Supreme Court. Each stage carries distinct obligations and risks for institutions and individuals alike.

Eligibility and scope: when Swiss jurisdiction applies to crypto cases

Swiss criminal jurisdiction can attach more readily in crypto matters than many foreign actors expect. Jurisdiction is commonly triggered where an offence is committed in Switzerland, where the result occurs in Switzerland, or where a Swiss-supervised institution, a bank or a FINMA-supervised financial intermediary, holds, custodies or processes the assets in question. Cross-border triggers include transactions routed through Swiss exchanges, proceeds laid down in Swiss custodial accounts, and the involvement of Swiss-resident executives or Swiss-incorporated entities. Because blockchain value moves without regard to borders, a single wallet cluster can engage Swiss, EU and third-country authorities simultaneously.

The offences most frequently at issue in crypto investigations switzerland include money laundering (StGB Art. 305bis), fraud (StGB Art. 146), market manipulation, breaches of sanctions regimes, embezzlement and misappropriation, and failure to meet AMLA diligence and reporting obligations. A single fact pattern often supports several of these charges at once, and the regulatory dimension, FINMA administrative measures, can run in parallel with the criminal track.

Step-by-step: how crypto criminal investigations in Switzerland proceed

The following six steps form the core procedural sequence. Each is written as a practical how-to with an expected timeframe; durations are indicative only and may vary with case complexity, the number of wallets and chains involved, and the degree of cross-border cooperation required.

Step 1, Initial notification, intelligence and complaints

Investigations often begin before any institution is formally served. Intelligence reaches the authorities through the Money Laundering Reporting Office Switzerland (MROS), FINMA referrals, criminal complaints from victims or counterparties, or requests from foreign law enforcement. For a bank or exchange, the first indication may be an informal enquiry, a production request, or, in higher-risk cases, a coordinated search.

Typical triggers

• AMLA reports to MROS. A report filed under AMLA by the institution itself or by a counterparty bank.
• FINMA referral. Supervisory findings escalated to a prosecuting authority.
• Cross-border request. A foreign preservation or assistance request naming Swiss-held assets.

Immediate institution actions

On first notice, the compliance function should escalate internally to the general counsel and senior management, open a file, and instruct that relevant data be preserved rather than altered or deleted. Engage external counsel at once and observe any applicable reporting obligations and prohibitions on tipping off the subject. The institution’s objective at this stage is to demonstrate cooperation while protecting its own position and any applicable legal protections over communications.

Step 2, Police preliminary investigation and evidence preservation

Cantonal police or fedpol conduct the preliminary investigation, gathering evidence, interviewing witnesses and, where justified, executing searches and seizures. This phase can run from a few weeks to considerably longer in complex, multi-jurisdictional matters.

Search warrants, seizures and dawn raids affecting banks and exchanges

Searches and seizures are governed by the StPO and generally require an order from the competent authority, though urgency provisions exist. A raid on an exchange or a bank’s premises may target servers, access credentials, custody records and personal devices. When a search occurs, institutions should verify the scope of the order, record what is seized, and ensure that legally protected materials are identified and, where appropriate, sealed under the StPO’s sealing (Siegelung) procedure before they are examined. A lawyer should attend. Cooperation should be real but controlled: nothing beyond the order’s scope should be volunteered without legal advice.

Technical preservation: wallet freezing, hot and cold wallet issues, smart contracts

Digital asset seizure switzerland raises technical problems absent from traditional cases. Hot wallets can be frozen quickly if the custodian controls the keys; cold storage and multi-signature arrangements require coordinated internal action and may need several authorised signatories. Assets locked in smart contracts, staking protocols or decentralised platforms can be far harder to immobilise, because control may be distributed or time-locked. Forensic snapshots, complete transaction exports with cryptographic hashes, should be taken promptly to fix the evidential record before any movement occurs.

Step 3, Prosecutor phase and provisional measures

Once the public prosecutor assumes direction, the formal investigation begins and provisional measures become central. Freezing and seizure orders can be issued to secure assets suspected of being proceeds of crime or instrumentalities. Orders can be issued rapidly once the triggering decision is taken, and can be renewed or extended.

Legal thresholds for freezing and seizure under the StPO

Under the StPO, seizure requires a sufficient suspicion that the assets are connected to an offence, as proceeds, as instrumentalities, or as items likely to be confiscated. The measure must be proportionate: the prosecutor must weigh the strength of suspicion against the intrusion. Asset freezing crypto switzerland therefore requires the prosecutor to articulate a credible link between the targeted wallets and the alleged offence, and institutions may challenge orders that exceed that link.

How exchanges can expect orders and timelines for compliance

A regulated exchange will typically receive a written order specifying the accounts, wallets or assets to be held, and a deadline for compliance. The exchange must act to prevent dissipation, confirm compliance in writing, and preserve the underlying records. Where the order is technically impossible to execute in full, for instance, where keys are held offshore or by the customer, this should be documented and communicated to the prosecutor promptly rather than left unaddressed.

Step 4, Cross-border cooperation and evidence gathering

Because crypto value and counterparties rarely sit within one jurisdiction, cross-border cooperation is often decisive. Switzerland provides and requests assistance through mutual legal assistance channels administered by the Federal Office of Justice under the Federal Act on International Mutual Assistance in Criminal Matters (IMAC), and may rely on preservation requests and letters rogatory. It is important to note that Switzerland is not a member of the EU and does not operate the European Investigation Order; cooperation with EU authorities proceeds through MLA treaties and conventions rather than EU instruments. These processes commonly take weeks to months.

Practical mechanics: preservation letters, Swiss letters rogatory and foreign counsel

In practice, speed matters most at the preservation stage: a short preservation request asking a foreign exchange or custodian to freeze and retain data can protect evidence while the slower formal MLA request is prepared. Institutions and their counsel should coordinate early with foreign counsel in each relevant jurisdiction, map where keys and records physically reside, and align the Swiss request with foreign procedural requirements to avoid rejection on form. On-chain tracing frequently depends on records held abroad, so sequencing these requests correctly is a core strategic task.

Step 5, Indictment, trial and confiscation or forfeiture

If the prosecutor concludes that the evidence supports charges, the matter proceeds to indictment and trial before the competent cantonal court or, for offences within federal jurisdiction, the Federal Criminal Court in Bellinzona. Depending on complexity, the path from indictment to first-instance judgment can span months to one or two years, with appeals available and the Federal Supreme Court as the final instance.

Confiscation of crypto: conversion or in-kind forfeiture

Confiscation of criminal proceeds is provided for under the StGB (notably Arts. 70 and 71). For digital assets, the court may order forfeiture of the assets themselves, for example by transfer to state-controlled wallets, or, where the specific assets cannot be secured, a compensatory claim for an equivalent value. Volatility complicates this: the value at seizure, at judgment and at realisation may differ sharply, and courts and parties must address how and when converted value is fixed. Post-conviction confiscation and any subsequent realisation can itself take months to years, particularly where appeals are pending.

Step 6, Post-investigation compliance and remediation

Resolution of the criminal track is rarely the end of the matter. Institutions commonly face continuing supervisory engagement, remediation obligations and reputational management. Self-reporting, internal audits and demonstrable improvements to controls can materially affect both the criminal outcome and FINMA’s administrative response.

Remediation playbook for institutions

A disciplined remediation programme should carefully handle internal investigation work product, document remedial control enhancements, and record cooperation with authorities. Institutions that can show they identified the weakness, reported appropriately and fixed the underlying failure place themselves in a far stronger position than those that react only under compulsion.

Required documents

Early, organised production is one of the most effective ways to demonstrate cooperation and control. The materials below are routinely sought in crypto criminal investigations switzerland. Treat sensitive material cautiously and seek a legal review before producing executive communications.

For banks and exchanges, immediate production list

For executives, recommended documentation and legal-protection flags

Individual executives should preserve, but not pre-emptively surrender, communications bearing on knowledge and intent, emails, chat logs and board materials. These can be decisive on the question of mens rea, which cuts both ways: they may exculpate as readily as they incriminate. Because the protections available over such materials are fact-sensitive, executives should secure personal counsel distinct from company counsel where interests may diverge, and allow a legal review before any disclosure.

Timeline and deadlines for crypto criminal investigations in Switzerland

The durations below are practical expectations, not statutory guarantees; they vary with complexity, the number of chains and wallets, and the speed of cross-border cooperation. What is non-negotiable in practice is the need to act fast at the preservation stage.

Costs and fees

The ranges below are purely indicative and move with scope, the number of wallets and chains, and the extent of international cooperation. Small, single-jurisdiction matters sit at the lower end; complex, multi-chain cross-border probes can greatly exceed the upper figures. Actual costs should be confirmed with counsel and forensic providers.

What changes in 2026

Several developments continue to reshape crypto criminal investigations switzerland for 2026. FINMA has sharpened its supervisory expectations for institutions handling virtual assets, pressing for more rigorous transaction monitoring, travel-rule compliance and clearer accountability within supervised firms. The practical effect, many practitioners expect, is that regulatory findings may more frequently feed into the criminal track, narrowing the gap between a supervisory enquiry and a prosecutor’s involvement.

Enforcement capacity has also matured. Fedpol and cantonal prosecuting authorities have invested in on-chain analytics and forensic expertise, meaning tracing that once took months can increasingly support earlier provisional measures. The FATF standards on virtual assets and VASPs remain the reference framework against which Swiss practice is measured, and continuing alignment with those standards drives both domestic reporting obligations and the handling of cross-border requests. Institutions should expect better-evidenced freezing orders and a lower tolerance for weak on-chain monitoring. The statutory architecture, the StGB, StPO and AMLA, remains the backbone, but its application to digital assets continues to be refined through accumulating Federal Supreme Court jurisprudence on electronic evidence and confiscation, which practitioners should monitor closely.

Common pitfalls and practical tips

The following do’s and don’ts reflect recurring failures and good practice in crypto criminal investigations switzerland.

• Do preserve immediately. Take forensic snapshots and freeze accessible wallets as soon as possible after first notice.
• Do not alter or delete data. Any post-notice changes to logs or records risk allegations of obstruction.
• Do escalate internally at once. Involve the general counsel and senior management before responding to authorities.
• Do seek a legal review before producing executive communications. Protections can be compromised inadvertently.
• Do verify the scope of any warrant or order. Cooperate within it; do not volunteer beyond it.
• Do consider requesting sealing (Siegelung) over legally protected materials where appropriate under the StPO.
• Do engage forensic and legal specialists together. Technical and legal workstreams must be integrated from day one.
• Do not ignore cross-border exposure. Identify where keys and records physically reside early.
• Do document impossibility. Where an order cannot be fully executed, record and communicate why.
• Do not let executives and the company share counsel where interests diverge. Separate representation protects both.
• Do keep a contemporaneous timeline. A record of decisions demonstrates good faith and control.
• Do not tip off the subject where prohibited. Confirm reporting and confidentiality obligations before acting.
• Do plan remediation from the outset. Early control improvements can influence both criminal and supervisory outcomes.

Comparison: bank custodial accounts vs exchange custody vs personal wallets

The custody model affects how quickly authorities can act, how complex preservation is, and how readily evidence will be admitted. The table below contrasts the three principal models.

Who to engage, legal and technical specialists

Effective defence and response in these matters require a blend of disciplines: white-collar criminal practitioners who understand Swiss procedure, regulatory specialists fluent in AMLA and FINMA expectations, and blockchain forensic experts who can read on-chain evidence and validate chain of custody. When selecting counsel, prioritise demonstrable experience with both white-collar crime and digital assets, cross-border capability, and the ability to coordinate forensic work, rather than any published ranking. The best outcomes in swiss white-collar crypto defence come from teams that integrate legal strategy and technical evidence from the first hour.

Potential criminal penalties and corporate sanctions

Penalties for crypto-related offences in Switzerland range from monetary penalties to custodial sentences, depending on the offence and its gravity, and are accompanied by confiscation or forfeiture of criminal proceeds under the StGB. Corporate criminal liability can arise under StGB Art. 102 where organisational failings enabled the offence, and FINMA administrative measures, which may include restrictions, remediation orders and, in serious cases, licence consequences, can run alongside the criminal process. The combined exposure across criminal and supervisory tracks is often the decisive strategic consideration for institutions.

Conclusion and next steps

Crypto criminal investigations switzerland reward preparation and punish delay. The institutions and executives who fare best are those who preserve evidence quickly, escalate internally, protect legally privileged and confidential materials, and integrate legal and forensic expertise from the outset, while cooperating within, but not beyond, the scope of what authorities lawfully demand. With FINMA expectations tightening and enforcement capacity maturing in 2026, the margin for a slow or disorganised response has narrowed. If you are facing a notice, a search, a freezing order or a cross-border request, obtain specialist Swiss criminal and regulatory advice immediately, and use the Global Law Experts directory to identify counsel with the right combination of white-collar and digital-asset experience.

Sources

1. Swiss Criminal Code (Strafgesetzbuch / StGB), SR 311.0
2. Swiss Criminal Procedure Code (Strafprozessordnung / StPO), SR 312.0
3. Federal Act on Combating Money Laundering and Terrorist Financing (AMLA), SR 955.0
4. Federal Act on International Mutual Assistance in Criminal Matters (IMAC), SR 351.1
5. FINMA, Swiss Financial Market Supervisory Authority
6. Federal Office of Police (fedpol), including the Money Laundering Reporting Office Switzerland (MROS)
7. Federal Office of Justice (FOJ), Federal Department of Justice and Police
8. Federal Supreme Court (Bundesgericht / Tribunal fédéral)
9. FATF, Standards and Guidance on Virtual Assets and VASPs