AML Gap Analysis in Switzerland
A policy can look complete on paper while the controls, evidence, risk analysis or escalation process behind it no longer match how the business actually operates. ComplyFactor's Swiss AML gap analysis helps a business identify which requirements actually apply to its activities and supervisory status, where the current framework falls short, which gaps carry the most regulatory or operational significance, what evidence is missing to support existing controls, and what should be remediated first.
What Does a Swiss AML Gap Analysis Cover?
Our AML compliance gap analysis in Switzerland is scoped to the rules that actually apply to the business, rather than to a generic checklist. ComplyFactor assesses a business's current AML framework against the requirements relevant to its specific activities, supervisory status, customer profile, products and services, geographic exposure and risk model. From that baseline, we identify gaps across governance, risk analysis, customer due diligence, beneficial ownership, higher-risk relationships, monitoring, escalation and reporting readiness, policies, training, and records and evidence. Not every requirement applies to every business in the same way: the applicable framework depends on the business's activities and supervisory route.
When an AML Gap Analysis Makes Sense
Businesses commonly use a gap analysis when:
Regulatory Readiness
Preparing for an SRO, SO or FINMA review.
Preparing for the October 2026 Swiss AML and transparency changes.
Business Change
New products or markets.
A significant business-model change.
Risk Profile Change
Customer-risk mix has changed.
Ownership or beneficial-owner processes have changed.
Control Maturity
Compliance programme grown organically.
Policies updated but implementation untested.
Prior Findings
Remediating findings from a prior review.
Risk analysis no longer reflects actual activity.
Transaction / Growth
Ahead of investment or acquisition.
Ahead of scale-up, where relevant.
Who We Support in Switzerland
Payment businesses, fintechs, virtual-asset businesses where AMLA applies, professional financial intermediaries, portfolio managers and trustees, and growing businesses whose AML obligations have become more complex than their original compliance programme was built for.
.svg)
.svg)
.svg){kind=small}
Not every payment, fintech or virtual-asset business is automatically subject to AMLA or FINMA supervision; whether, and how, a business is regulated depends on its actual activities. Scoping this correctly is the first step of our process, not an assumption we start from.
How We Conduct an AML Gap Analysis in Switzerland
Scope the Applicable Framework
We identify the business's activities and its supervisory route, whether that is direct FINMA supervision, a FINMA licence as a portfolio manager or trustee subject to ongoing supervision by a supervisory organisation (SO), or SRO affiliation where applicable, the AMLA obligations that follow, and any sector-specific expectations, before comparing anything against a control framework. Reviewing a business against the wrong framework produces findings that don't hold up.
FINMA
Direct prudential supervision, where applicable
SO
FINMA-licensed portfolio managers / trustees with ongoing SO supervision
SRO
Relevant AMLA financial intermediaries where affiliation applies
Review the Written Framework
Policies, procedures, risk methodology, governance, delegations, escalation arrangements and records.
Test Implementation and Evidence
We don't stop at whether a policy exists. We assess whether the business can evidence implementation: completed customer files, risk classifications, approvals, reviews, escalation records, monitoring evidence, and training records. The resulting AML controls assessment looks at both control design and evidence of implementation.
Identify and Risk-Rate Gaps
Findings are classified by regulatory significance, customer/transaction risk, control weakness, remediation urgency, and evidence availability.
Build the Remediation Roadmap
A prioritised remediation roadmap covering what to fix, why it matters, priority, and ownership.
What We Review Across Your AML Framework
AML Governance & Responsibilities
Ownership of controls, escalation lines, management oversight, role clarity.
Risk Analysis
Customer, product/service, geographic and delivery-channel risk; methodology; risk tolerance; the link between the risk analysis and actual controls.
Customer Due Diligence
Identification, verification, customer risk classification, and understanding of the purpose and nature of the relationship.
Beneficial Ownership
Identification, verification, and evidencing of ownership and control conclusions. Where 2026 Transparency Register questions go beyond this, see our Beneficial Ownership & Transparency Register service.
Higher-Risk Relationships
Enhanced clarification, PEPs, higher-risk countries, elevated-risk products or relationships, approvals and monitoring.
Ongoing Monitoring
Only where applicable to the business and its regulatory framework; whether controls reflect actual risk.
MROS / Escalation Readiness
Internal escalation and decision-making workflow, reviewed at a high level, not as a suspicious-activity reporting guide.
Policies & Procedures
Whether written policies reflect current rules, match actual operations, stay internally consistent, and assign responsibilities clearly.
Training
Relevant roles, frequency, content, completion evidence, and whether training keeps pace with risk and regulatory change.
Recordkeeping & Evidence
Whether controls can actually be evidenced; a control that cannot be evidenced can create real supervisory difficulty.
How We Assess AML Risk Analysis and Control Alignment
FINMA's 2026 supplementary guidance addresses banks and FinIA institutions, reinforcing that a money laundering risk analysis should function as a live management tool, not a static document: a clearly defined risk tolerance, including which countries, client segments or products a business deliberately excludes; a consistent separation between inherent, control and residual risk; and a clear link between the risk analysis and day-to-day controls and resourcing. FINMA notes that the same methodological principles also apply to FinIA institutions, although the appropriate level of detail can differ according to the institution's risk profile. FINMA's observations provide useful supervisory context for reviewing any business's risk analysis, while the precise framework still depends on the institution and its supervisory regime.
Illustrative alignment model — not a scoring system or regulatory rating.
What a High-Priority AML Gap Can Look Like
Examples of the kind of gap a review commonly surfaces, not universal findings:
Risk Analysis Drift
The AML risk analysis no longer reflects actual customer, product or geographic exposure.
Why It Matters
Controls calibrated to an outdated risk picture may miss where the business's actual exposure now sits.
Evidence Signal
Risk analysis last updated well before a material business change.
Unevidenced Approvals
High-risk approvals exist in policy but cannot be evidenced consistently in customer files.
Why It Matters
A control that exists on paper but can't be shown to have happened is difficult to rely on.
Evidence Signal
Sampled files missing sign-off or approval records for higher-risk relationships.
Incomplete BO Evidence
Beneficial-ownership conclusions are documented, but the evidence supporting those conclusions is incomplete or inconsistent.
Why It Matters
A stated conclusion without traceable supporting evidence is hard to defend under scrutiny.
Evidence Signal
Ownership file lacks the underlying documents behind a stated conclusion.
What You Receive From Our Swiss AML Gap Analysis
A typical engagement can include, depending on agreed scope:
Gap Matrix
Risk-Rated Findings
Remediation Roadmap
From Gap Analysis to Remediation
Identifying gaps only helps if management can close them. ComplyFactor can help translate findings into policy revisions, procedure changes, clearer ownership and accountability, control enhancements, documentation improvements, risk-analysis updates, training changes, evidence packs, and a remediation tracker, tied specifically to what the gap analysis found.
Why Businesses Use ComplyFactor for Swiss AML Gap Analysis
We Map the Correct Supervisory Framework First
We don't apply a generic FINMA checklist to every business; scoping the applicable framework is the first step, not an assumption.
We Review Implementation, Not Just Documents
Policy existence alone is not enough; we test whether controls are actually evidenced.
Findings Are Prioritised
You should know what matters now versus what can wait.
Findings Connect to Evidence
Each material issue shows the observed condition, the applicable requirement or expectation, the impact, the evidence, and the remediation action.
Remediation Is Implementation-Focused
The output is built to be operationalised by management, not filed away.
Swiss-Specific Regulatory Context
FINMA, SO and SRO distinctions are built into scoping from the outset.
Swiss AML Requirements Are Changing — Is Your Framework Still Aligned?
Revised AMLA
Extends AMLA's scope to certain consultancy activities, including services related to real estate transactions and the formation or structuring of legal entities.
Transparency Framework
The new Federal Act on the Transparency of Legal Entities and the Identification of Beneficial Owners, introducing new beneficial-ownership requirements.
AMLO-FINMA Revision
Consultation opened 12 May 2026 and closed 9 June 2026. As of 30 September 2026, FINMA had not published the final revised ordinance; the consultation materials proposed an effective date of 1 January 2027.
A gap analysis carried out around this period should distinguish clearly between what is already binding, what is enacted but not yet effective, and what remains proposed, and should check whether a business's existing framework, including its beneficial-ownership processes, remains aligned with the October 2026 changes.
Frequently Asked Questions
Is an AML gap analysis the same as an independent AML audit?
No. A gap analysis identifies control and evidence gaps against the requirements relevant to a business and prioritises them into a remediation roadmap. An independent, assurance-style effectiveness review is a distinct engagement with its own scope and standards.
Can an AML gap analysis be used before an SRO or supervisory review?
Yes, this is a common use case. A gap analysis does not guarantee any particular outcome or acceptance from an SRO, SO or FINMA.
What documents do you typically need for a Swiss AML gap analysis?
Depending on scope, this typically includes AML policies and procedures, the risk analysis, a selection of customer due-diligence files, risk classifications, approval and escalation records, monitoring evidence, training records, and any prior findings or remediation evidence. Exact requirements are agreed as part of scoping.
Identify the Gaps Before They Become Remediation Problems
Scope and timing depend on business complexity, supervisory framework, locations, customer profile, and the quality and availability of existing documentation.