A business may have policies, controls and compliance processes in place, but management still needs an objective view of whether they work as intended. ComplyFactor's independent AML review assesses whether a Swiss business's AML framework is designed appropriately, implemented consistently, and operating effectively in practice, tested against evidence. The review looks at design, implementation, evidence, operating effectiveness, governance and escalation, and the durability of any prior remediation, with findings management can act on.
Our independent AML compliance review in Switzerland is scoped to the controls, risks and supervisory requirements that actually apply to the business. It tests whether the controls already in place work in practice and whether the evidence supports that conclusion, with particular attention to higher-risk controls, governance, escalation and prior remediation.
Both services can be used together. Many businesses use a gap analysis first to build the framework, then commission an independent review later to test whether it holds up in practice. See our AML Gap Analysis in Switzerland service.
Businesses commonly commission an independent review when:
Payment businesses, fintechs, virtual-asset businesses where AMLA applies, financial intermediaries, portfolio managers and trustees, SRO-affiliated businesses, and FINMA-supervised institutions where appropriate, alongside growing firms that want an independent control assessment beyond internal sign-off.
Not every fintech, payment or virtual-asset business is automatically AMLA-regulated or FINMA-supervised; applicability depends on actual activity, which we confirm before scoping the review.
An independent reviewer should not simply validate controls that they themselves designed or operate without managing the conflict that creates. ComplyFactor's independent AML review is structured around reviewer objectivity, separation from day-to-day ownership of the controls being tested, disclosure of any prior implementation involvement, clearly defined scope boundaries, and conclusions tied to evidence.
Where ComplyFactor has previously designed or materially implemented part of the framework being reviewed, we assess whether the engagement can be structured with sufficient independence and transparency, or whether another reviewer should perform that area. This is a professional-independence standard for this advisory service, distinct from the formal independence requirements that apply to recognized statutory or regulatory audit firms.
We identify the business's activities, entity type and supervisory route: direct FINMA supervision, a FINMA licence as a portfolio manager or trustee with ongoing SO supervision, or SRO affiliation where applicable. We then confirm the AMLA obligations and sector-specific expectations that follow. The review scope follows the framework that applies to the business.
Direct supervision, where applicable
FINMA-licensed portfolio managers / trustees with ongoing SO supervision
Affiliated financial intermediaries where applicable
We define the review perimeter: locations, customer segments, products, time period, systems, any prior adviser involvement, and independence considerations specific to the engagement.
We assess whether the business's documented controls are appropriately designed for its actual risk.
We test whether controls work in practice, drawing on customer files, approvals, risk ratings, monitoring outputs, escalations, training records, and management oversight.
We look beyond symptoms to whether an issue is rooted in design, implementation, consistency, evidence, governance, resourcing, or methodology.
We deliver findings, a prioritization approach, supporting evidence, root cause, corrective action, and a management response where appropriate.
The AML effectiveness assessment combines control-design review with evidence-based testing of implementation and operation. Testing methods depend on scope and can include document review, walkthroughs, sample-based testing, customer-file review, risk-rating testing, high-risk approval testing, beneficial-owner evidence testing, monitoring and escalation tracing, training-evidence review, and remediation validation. Not every engagement uses every method; testing is proportionate to scope and risk.
Illustrative testing layers, not a scoring system.
Ownership of controls, escalation lines, management oversight.
Methodology, risk tolerance, and alignment with the actual business model.
Identification, verification, and risk classification in practice.
Identification, verification, and evidencing of ownership and control conclusions. Where 2026 Transparency Register questions go beyond this, see our Beneficial Ownership & Transparency Register service.
Enhanced clarification, approvals, and monitoring of elevated-risk relationships.
Whether controls reflect actual risk in practice, where applicable.
Internal escalation and decision-making workflow, reviewed at a high level.
Whether written policies match actual operations and assign responsibility clearly.
Completion evidence and whether training keeps pace with risk and regulatory change.
Whether controls can actually be evidenced.
Whether the business's own quality-assurance or testing processes are themselves working.
Whether earlier findings were actually closed and remain closed.
FINMA's 2026 supplementary guidance found that some risk analyses it reviewed at banks and FinIA institutions lacked explicit exclusions of countries, client groups or products, or that those exclusions did not fit the institution's business model, and that some applied methodological principles incorrectly. FINMA notes the same methodological principles also apply to FinIA institutions, with the level of detail varying by risk profile. We use these supervisory observations as context when reviewing any business's risk analysis, while the precise framework still depends on the institution and its supervisory regime.
Illustrative alignment model, with no numerical scoring and no claim that FINMA Guidance 04/2026 binds every entity.
An advisory effectiveness-review service.
Recognized/formal audit framework where required.
Formal supervisory and regulatory audit work for FINMA-supervised institutions, and for SRO- or SO-monitored intermediaries, can involve recognized audit firms. ComplyFactor's independent AML review is an advisory effectiveness-review service. It is not a FINMA regulatory audit, a formal SRO/SO supervisory audit, or a recognized audit-firm engagement, and it does not replace any formal audit required under the applicable supervisory framework.
A typical engagement can include, depending on scope:
Review Scope
Testing Record
Control Findings
Root-Cause Analysis
Final Review Report
Scope the entities, control areas and testing depth before the engagement begins.
Discuss Your Review ScopeEach material finding follows the same structure (illustrative field labels, not an actual client finding):
Yes. After management addresses findings, a follow-up validation can test whether corrective actions were actually implemented and whether evidence supports closure. This stays tied to the original review's findings rather than becoming an ongoing advisory or officer role.
Scope and reviewer role are defined before testing begins.
We assess whether controls operate in practice as well as on paper.
Testing focuses on material and higher-risk control areas.
Each finding traces the issue back to its root cause.
Written for management to use.
The applicable FINMA, SO or SRO framework is scoped correctly from the outset.
The revised AMLA entered into force on 1 October 2026.
The new Federal Act on the Transparency of Legal Entities and the Identification of Beneficial Owners also entered into force on 1 October 2026.
The AMLO-FINMA consultation closed on 9 June 2026. As of 30 September 2026, FINMA had not published the final revised ordinance, so the proposed changes should not be treated as current testing requirements.
A review scoped around this period should check whether the business's framework, including its beneficial-ownership processes, reflects these changes.
There is no single universal frequency. It depends on the applicable supervisory framework, the business's risk profile, prior findings, material change, and any specific SRO, SO or regulatory expectations that apply to that business.
Depending on scope, this can include AML policies and procedures, the AML risk analysis, a selection of customer files, risk ratings, beneficial-ownership evidence, higher-risk approvals, monitoring outputs, escalation records, training records, prior findings or remediation evidence, and governance records. Not all of these are required for every engagement.
Yes, depending on the objective. A review can be scoped to a specific area such as customer due diligence, high-risk relationships, beneficial ownership, transaction monitoring, AML risk analysis, escalation, or prior remediation. The scope still needs to be broad enough to support a meaningful conclusion about the area being tested.
Scope and timing depend on complexity, regulatory route, number of products or entities, customer base, systems, documentation, and testing depth.