A business may have policies, controls and compliance processes in place, but management still needs an objective view of whether those controls are actually working as intended. ComplyFactor's independent AML review assesses whether a Swiss business's AML framework is designed appropriately, implemented consistently, and operating effectively in practice, going beyond whether policies exist to whether they hold up under evidence and testing. The review looks at design, implementation, evidence, operating effectiveness, governance and escalation, and the durability of any prior remediation, with findings management can act on.
Our independent AML compliance review in Switzerland is scoped to the controls, risks and supervisory requirements that actually apply to the business. It tests whether the controls already in place work in practice and whether the evidence supports that conclusion, with particular attention to higher-risk controls, governance, escalation and prior remediation.
Both services can be used together. Many businesses use a gap analysis first to build the framework, then commission an independent review later to test whether it holds up in practice. See our AML Gap Analysis in Switzerland service.
Businesses commonly commission an independent review when:
Payment businesses, fintechs, virtual-asset businesses where AMLA applies, financial intermediaries, portfolio managers and trustees, SRO-affiliated businesses, and FINMA-supervised institutions where appropriate, alongside growing firms that want an independent control assessment rather than another internal sign-off.
Not every fintech, payment or virtual-asset business is automatically AMLA-regulated or FINMA-supervised; applicability depends on actual activity, which we confirm before scoping the review.
An independent reviewer should not simply validate controls that they themselves designed or operate without managing the conflict that creates. ComplyFactor's independent AML review is structured around reviewer objectivity, separation from day-to-day ownership of the controls being tested, disclosure of any prior implementation involvement, clearly defined scope boundaries, and conclusions tied to evidence rather than assumption.
Where ComplyFactor has previously designed or materially implemented part of the framework being reviewed, we assess whether the engagement can be structured with sufficient independence and transparency, or whether another reviewer should perform that area. This is a professional-independence standard for this advisory service, distinct from the formal independence requirements that apply to recognised statutory or regulatory audit firms.
We identify the business's activities, entity type, and supervisory route, whether that is direct FINMA supervision, a FINMA licence as a portfolio manager or trustee subject to ongoing SO supervision, or SRO affiliation where applicable, and the AMLA obligations and sector-specific expectations that follow. We don't apply a generic FINMA checklist to every business.
Direct supervision, where applicable
FINMA-licensed portfolio managers / trustees with ongoing SO supervision
Affiliated financial intermediaries where applicable
We define the review perimeter: locations, customer segments, products, time period, systems, any prior adviser involvement, and independence considerations specific to the engagement.
We assess whether the business's documented controls are appropriately designed for its actual risk.
We test whether controls work in practice, drawing on customer files, approvals, risk ratings, monitoring outputs, escalations, training records, and management oversight.
We look beyond symptoms to whether an issue is rooted in design, implementation, consistency, evidence, governance, resourcing, or methodology.
We deliver findings, a prioritisation approach, supporting evidence, root cause, corrective action, and a management response where appropriate.
The AML effectiveness assessment combines control-design review with evidence-based testing of implementation and operation. Testing methods depend on scope and can include document review, walkthroughs, sample-based testing, customer-file review, risk-rating testing, high-risk approval testing, beneficial-owner evidence testing, monitoring and escalation tracing, training-evidence review, and remediation validation. Not every engagement uses every method; testing is proportionate to scope and risk rather than following one fixed programme.
Illustrative testing layers — not a scoring system.
Ownership of controls, escalation lines, management oversight.
Methodology, risk tolerance, and alignment with the actual business model.
Identification, verification, and risk classification in practice.
Identification, verification, and evidencing of ownership and control conclusions. Where 2026 Transparency Register questions go beyond this, see our Beneficial Ownership & Transparency Register service.
Enhanced clarification, approvals, and monitoring of elevated-risk relationships.
Whether controls reflect actual risk in practice, where applicable.
Internal escalation and decision-making workflow, reviewed at a high level.
Whether written policies match actual operations and assign responsibility clearly.
Completion evidence and whether training keeps pace with risk and regulatory change.
Whether controls can actually be evidenced.
Whether the business's own quality-assurance or testing processes are themselves working.
Whether earlier findings were actually closed and remain closed.
FINMA's 2026 supplementary guidance identified continuing weaknesses in how banks and FinIA institutions define risk tolerance, exclude specific countries, client groups or products, and apply risk-analysis methodology consistently with their actual business model. FINMA notes the same methodological principles also apply to FinIA institutions, with the level of detail varying by risk profile. We use these supervisory observations as context when reviewing any business's risk analysis, while the precise framework still depends on the institution and its supervisory regime.
Illustrative alignment model — no numerical scoring, and not a claim that FINMA Guidance 04/2026 binds every entity.
An advisory effectiveness-review service.
Recognised/formal audit framework where required.
Formal supervisory and regulatory audit work for FINMA-supervised institutions, and for SRO- or SO-monitored intermediaries, can involve recognised audit firms. ComplyFactor's independent AML review is an advisory effectiveness-review service. It is not a FINMA regulatory audit, a formal SRO/SO supervisory audit, or a recognised audit-firm engagement, and it does not replace any formal audit required under the applicable supervisory framework.
A typical engagement can include, depending on scope:
Review Scope
Testing Record
Control Findings
Root-Cause Analysis
Final Review Report
Scope the entities, control areas and testing depth before the engagement begins.
Discuss Your Review ScopeEach material finding follows the same structure — illustrative field labels, not an actual client finding:
Yes. After management addresses findings, a follow-up validation can test whether corrective actions were actually implemented and whether evidence supports closure. This stays tied to the original review's findings rather than becoming an ongoing advisory or officer role.
Scope and reviewer role are defined before testing begins.
We assess whether controls actually operate, not just whether they're written down.
Testing focuses on material and higher-risk control areas.
Not just symptoms.
Built for management to use, not file away.
The applicable FINMA, SO or SRO framework is scoped correctly from the outset.
The revised AMLA entered into force on 1 October 2026.
The new Federal Act on the Transparency of Legal Entities and the Identification of Beneficial Owners also entered into force on 1 October 2026.
The AMLO-FINMA consultation closed on 9 June 2026. As of 30 September 2026, FINMA had not published the final revised ordinance, so the proposed changes should not be treated as current testing requirements.
A review scoped around this period should check whether the business's framework, including its beneficial-ownership processes, reflects these changes.
There is no single universal frequency. It depends on the applicable supervisory framework, the business's risk profile, prior findings, material change, and any specific SRO, SO or regulatory expectations that apply to that business.
Depending on scope, this can include AML policies and procedures, the AML risk analysis, a selection of customer files, risk ratings, beneficial-ownership evidence, higher-risk approvals, monitoring outputs, escalation records, training records, prior findings or remediation evidence, and governance records. Not all of these are required for every engagement.
Yes, depending on the objective. A review can be scoped to a specific area such as customer due diligence, high-risk relationships, beneficial ownership, transaction monitoring, AML risk analysis, escalation, or prior remediation. The scope still needs to be broad enough to support a meaningful conclusion about the area being tested.
Scope and timing depend on complexity, regulatory route, number of products or entities, customer base, systems, documentation, and testing depth.