.jpg)
At a glance
1. Swiss SRO membership is an ongoing AML supervisory relationship, not a one-time registration. The member must continue to comply with the Swiss Anti-Money Laundering Act, the selected SRO's regulations and its reporting, training and audit rules.
2. The audit cycle is not identical across all SROs. VQF publicly describes risk-based cycles of 12, 24 or 36 months. PolyReg generally works from an annual audit and allows deferral only when stated conditions are met. Extraordinary reviews remain possible. [2, 3, 4]
3. The auditor tests the live business rather than the application narrative. The evidence normally includes customer and beneficial-owner files, risk classifications, transaction reviews, internal escalations, training records, change notifications and the organisation of the AML function.
4. Crypto, payment, money-transmission and other higher-risk models should expect their transaction flows, wallet or account controls, monitoring evidence and source-of-funds work to receive particular attention.
5. Audit readiness should run throughout the year. A clean data room, a control calendar and a documented remediation process are more reliable than reconstructing client files shortly before the review.
6. Material deficiencies can lead to follow-up work, an extraordinary audit, supervisory measures or sanctions under the applicable SRO rules. The business should therefore price audit and remediation into its operating model.
Founders often search for a “Swiss SRO audit” only after receiving an audit notice. By then, the auditor is testing months of operational evidence that cannot be recreated safely. This guide explains what an SRO-supervised financial intermediary should maintain during 2027, how published audit cycles differ and how to prepare an evidence pack before the review begins.
The expression “Swiss SRO licence” is common in search, but the legal mechanism is affiliation or membership in a FINMA-recognised self-regulatory organisation. The SRO supervises the member for AMLA compliance; it does not turn the member into a FINMA-licensed bank or securities firm. [1]
1. What is a Swiss SRO audit?
A Swiss SRO audit is a supervisory review of whether an affiliated financial intermediary complies with AMLA and the rules of its SRO. FINMA explains that SROs define the detailed due-diligence requirements for their members, monitor compliance and establish controls that can include periodic checks by internal or external auditors. SRO rules also determine how breaches are handled and sanctioned. [1]
The structure is deliberately multi-level. The member is supervised by its SRO. FINMA recognises and supervises the SRO, performs annual risk analysis and may use on-site reviews, supervisory consultations, annual-report analysis and assessment letters. The quality of member audits therefore feeds into the SRO's own accountability to FINMA. [1, 7]
The audit may be performed by the SRO, an auditor allocated by it or an external audit firm accepted under the relevant rules. The mandate, independence requirements, reporting format and fee model differ by SRO. Confirm the current arrangement with the selected organisation rather than assuming that one SRO's procedure applies to another.
2. How often are Swiss SRO members audited?
There is no universal audit frequency for every SRO member. Published models show that frequency is risk-based and can change as the business changes.
VQF states that its members are audited on a 12-, 24- or 36-month cycle. The allocation considers the risk profile, business model, transaction volume, customer structure and past audit results. VQF can also conduct extraordinary audits. [2]
PolyReg's regulations start from an ordinary annual audit. A member may qualify for one- or two-year deferral when the previous review was not an initial audit, the last two reviews disclosed no material deficiencies and the business has a low money-laundering risk. The rules identify money or asset transfer as higher risk, and PolyReg retains the right to conduct an audit at any time. [3, 4]
ARIF publishes a route for requesting authorisation for a three-year AMLA audit cycle. This should be treated as a conditional SRO-specific process, not an automatic entitlement for every member. [5]
| Published model | What it means | Planning assumption |
|---|---|---|
| VQF | Risk-based 12-, 24- or 36-month cycle; extraordinary audit remains possible. | Maintain continuous readiness even if the formal cycle exceeds one year. |
| PolyReg | Ordinary annual audit, with limited deferral where regulatory conditions are met. | Budget annually until the SRO confirms a deferral. |
| ARIF | Published application process for a three-year AMLA audit cycle. | Do not assume eligibility; confirm the current conditions and approval. |
| Any SRO | Extraordinary or intensified review may follow risk changes, deficiencies or supervisory concerns. | Do not let the compliance file go dormant between scheduled audits. |
A longer cycle is not an exemption from AML obligations. It changes the timing of the formal review, not the requirement to identify customers, monitor relationships, retain records, train staff, report changes and escalate suspicions throughout the period.
3. What does the auditor test?
The audit typically combines organisational review with file testing. PolyReg's current regulations describe a review of compliance with AMLA, its statutes and regulations; customer files; identification and clarification duties; reporting; training; ongoing membership conditions; and reported changes. Its audit report is generally due shortly after the review. [3]
FINMA's AML overview provides the wider control frame: financial intermediaries must verify the contracting party and beneficial owner, clarify unusual or high-risk activity, keep records, train staff, inspect their controls and report relevant suspicions to MROS. SROs regularly monitor those duties through recognised auditors or their own auditors. [6]
| Audit area | Likely evidence | Typical weakness |
|---|---|---|
| Regulatory scope | Current service map, contracts, transaction flows and perimeter analysis. | The live product differs from the activity disclosed at admission. |
| Governance | Board minutes, AML responsibilities, deputy coverage and escalation records. | The AML officer exists on paper but lacks authority or access. |
| Customer identification | Identity, representation, beneficial ownership and control-structure evidence. | Missing signatures, stale documents or unexplained ownership layers. |
| Risk classification | Customer risk scores, rationale, approvals and refresh triggers. | Scores are generated but do not change the level of review. |
| Enhanced due diligence | PEP, geography, source-of-funds, source-of-wealth and unusual-activity work. | High-risk files contain the same evidence as standard files. |
| Transaction monitoring | Rules, alerts, investigations, decisions and management reporting. | Alerts are closed without an evidenced explanation. |
| MROS escalation | Internal reports, legal analysis, goAML readiness and confidentiality controls. | No documented path from frontline concern to reporting decision. |
| Training | Role-based plan, attendance, certificates and missed-training follow-up. | Generic annual course with no coverage of the actual business. |
| Changes and reporting | Notification register and correspondence with the SRO. | Owners, directors, office, staff or activity changed without timely notice. |
4. Build an audit-ready customer file
The customer file should allow an independent reviewer to understand who the customer is, why the relationship was accepted, what activity was expected and how the company responded when actual activity differed. Evidence must be retrievable without relying on the memory of the account manager.
For a legal entity, the file normally needs current register and constitutional evidence, authorised representatives, ownership and control to the natural-person level, beneficial-owner declarations, business purpose, expected transactions and risk classification. For natural persons, identity, residence, occupation or source of economic activity and the purpose of the relationship must be coherent with the service.
When enhanced review is required, the file should show the trigger and the additional work. A label such as “high risk — approved” is not enough. The reviewer should see which source-of-funds or source-of-wealth evidence was obtained, how adverse information was assessed, why complex structures were accepted and who gave final approval.
Periodic and event-driven reviews matter as much as initial onboarding. Define when identification evidence expires, when ownership must be reconfirmed, which transaction or screening events trigger refresh and how dormant relationships are treated.
5. Prove that transaction monitoring works
The auditor is likely to compare the expected activity recorded at onboarding with actual flows. The company should retain the monitoring rule, alert, investigated transactions, external data, analyst reasoning, escalation and decision. A dashboard total without case-level evidence is rarely enough.
Manual monitoring can be proportionate for a small business, but it still needs a defined frequency, responsible person, review population and retained output. Automated monitoring needs documented scenarios, thresholds, change control and evidence that alerts are reviewed promptly.
| Evidence set | What it should demonstrate | Control owner |
|---|---|---|
| Scenario inventory | Which risks each rule or manual review addresses. | AML officer and operations. |
| Alert register | Date, customer, rule, value, owner, outcome and closure time. | Monitoring team. |
| Case file | Transactions reviewed, context obtained, analysis and decision. | Assigned analyst. |
| Escalation record | Why the case was escalated and who decided the next action. | AML officer or committee. |
| Quality review | Sample testing of closed alerts and corrective action. | Second line or independent reviewer. |
| Management information | Volumes, ageing, high-risk trends, backlogs and recurring causes. | AML officer and board. |
Rules should be adjusted when products, limits, corridors, customer populations or typologies change. Record why a threshold changed and test the effect. Otherwise the audit trail can suggest that monitoring was tuned only to reduce workload.
6. Additional evidence for crypto and payment businesses
FINMA identifies virtual-asset service providers, money transmitters and payment service providers among the businesses supervised through SROs. These models often involve high velocity, cross-border activity and several technical or banking counterparties. [7]
A crypto audit file should connect customer due diligence to wallet and transaction evidence. It may include proof of wallet ownership or control, hosted and unhosted wallet treatment, blockchain-analytics alerts, exposure to mixers or sanctions, asset-risk rules, transaction tracing and the rationale for releasing or blocking a transfer.
A payment or money-transmission file should show sender and beneficiary information, corridor risk, agent or partner oversight, settlement accounts, exception handling and reconciliation. The product diagram should match what the monitoring system sees.
For outsourced screening, analytics, custody or payment infrastructure, maintain the contract, due-diligence file, service description, access rights, incident process, performance review and evidence that the member can obtain data for an audit. Outsourcing a task does not outsource the member's accountability.
7. AML officer, governance and board oversight
VQF's public guidance describes the AML officer as the contact point with the SRO and MROS and as the person responsible for implementing and monitoring internal AML directives. It also stresses specialist knowledge and regular training, with heightened expectations for virtual-asset service providers. [2]
The audit should therefore find a functioning role rather than a name in an organisation chart. The AML officer needs access to onboarding, transactions, screening, vendors and management. Their authority should cover enhanced review, rejection, suspension, escalation and remediation.
Board or senior-management evidence can include approval of the enterprise AML risk assessment, review of monitoring metrics, open findings, suspicious-activity escalation statistics, training completion and material changes. Minutes should record decisions, owners and deadlines rather than simply state that “compliance was discussed”.
Where the AML officer also runs sales or operations, document conflict controls and independent challenge. Where the function is external, identify the internal accountable person, access to systems, service levels, deputy arrangements and the process for urgent decisions.
8. Training is an auditable control
Training is not satisfied by retaining one slide deck. The SRO will expect the right people to complete the required basic and continuing education and the company to train staff on its own risks and procedures.
PolyReg's published guidance describes basic training for new members and relevant staff and continuing training from the first membership year. VQF also treats mandatory training as a continuing member obligation. Exact timing, accepted providers and exemptions depend on the SRO's current rules. [2, 4]
Keep a training matrix showing role, required course, due date, completion, evidence and follow-up. Add product-specific exercises: identifying the beneficial owner of a layered company, reviewing a blockchain alert, escalating an unusual corridor or deciding what information is needed before a high-risk transfer proceeds.
9. Report material changes to the SRO
An audit can identify not only deficient customer files but also changes that should have been reported. PolyReg's published duties include immediate notification of changes to the name, legal form, address, ownership, responsible persons, AML-relevant staff, business scope and certain proceedings or enforcement actions. [4]
Maintain a regulatory change register even if the selected SRO uses a different form or threshold. Each entry should state the change, effective date, assessment, notification requirement, person responsible, date reported and SRO response.
Common triggers include:
- a new shareholder, beneficial owner, director or signing authority;
- replacement of the AML officer, deputy or AML-relevant staff;
- a new office, address, legal name or group structure;
- a new product, customer type, geography, asset, corridor or transaction flow;
- a material outsourcing, banking, custody or technology change;
- criminal, administrative, insolvency or supervisory proceedings; and
- a significant incident, control failure or inability to meet a membership condition.
Do not assume that updating the commercial register or website automatically informs the SRO. Follow the selected organisation's current notification method.
10. MROS readiness and suspicious-activity reporting
Where the legal reporting test is met, reports and supporting information are submitted to the Money Laundering Reporting Office Switzerland through goAML. MROS states that financial intermediaries must use the system and maintain the appropriate registered profile. [8]
Audit readiness therefore includes more than a policy reference to MROS. The company should know who can access goAML, who acts as deputy, where supporting evidence is stored, how legal analysis is documented and how confidentiality and transaction handling are controlled.
A useful internal record separates three questions: what created the suspicion, what additional clarification was performed and why the final reporting decision was reached. Preserve the facts and reasoning even where the conclusion is not to report. Restrict access to the case and avoid inappropriate disclosure.
11. Prepare the audit data room
Start with the auditor's current request list. The following structure creates a practical baseline and makes gaps visible before fieldwork.
| Folder | Core contents | Readiness check |
|---|---|---|
| 01 Membership and scope | Admission decision, SRO correspondence, regulations, business description and changes. | Live services match the supervised scope. |
| 02 Governance | Organisation chart, roles, board minutes, policies and risk assessment. | Approvals and responsible people are current. |
| 03 Customer population | Complete customer list, risk, activity, geography and review dates. | Population reconciles to active systems. |
| 04 Sample files | CDD, beneficial owner, risk rationale, enhanced review and approvals. | Documents are readable, current and logically indexed. |
| 05 Transactions | Flow data, monitoring alerts, investigations, escalations and reconciliations. | Samples can be traced end to end. |
| 06 Reporting | Internal suspicion cases, goAML controls and restricted reporting evidence. | Access and confidentiality are controlled. |
| 07 Training | Matrix, attendance, certificates, materials and missed-course follow-up. | All covered roles meet current requirements. |
| 08 Outsourcing | Vendor due diligence, contracts, oversight, incidents and performance reviews. | The member can retrieve required audit evidence. |
| 09 Changes | Change register, notifications, SRO responses and implementation evidence. | Corporate and operating changes were assessed promptly. |
| 10 Findings | Previous audit, action plan, evidence of closure and internal testing. | No overdue or superficially closed finding remains. |
Lock the submitted version and use a response log for further requests. Record the request, owner, due date, response and document version. This prevents different employees from giving inconsistent explanations.
12. What happens when the auditor finds a deficiency?
Not every finding has the same significance. A missing document in one otherwise coherent file differs from a systematic failure to identify beneficial owners or monitor high-risk activity. The response should reflect severity, population affected and the possibility that the weakness changes earlier decisions.
For each finding, identify the root cause, affected period and customer population, immediate risk containment, retrospective review, permanent control change, responsible owner, deadline and closure evidence. Do not mark an issue complete because a policy was rewritten if the operational population has not been corrected.
FINMA states that SROs must take proportionate countermeasures when irregularities are detected and are responsible for sanctioning irregularities. SRO regulations may provide for penalties or suspension. An extraordinary audit or intensified review may be used to verify remediation. [1, 6]
| Finding response | Required output | Weak response |
|---|---|---|
| Scope | Identify all customers, transactions and periods potentially affected. | Correct only the single sample selected by the auditor. |
| Root cause | Explain whether the cause was people, process, system, data or governance. | State that an employee made an isolated mistake without testing. |
| Containment | Stop or control the immediate exposure. | Wait for the final report before acting. |
| Remediation | Correct files and improve the operating control. | Update the policy but not the live records. |
| Validation | Independent testing confirms the fix works across the population. | The control owner self-certifies closure. |
13. A 12-month SRO compliance calendar
| Frequency | Control activity | Evidence retained |
|---|---|---|
| Continuous | CDD, enhanced review, monitoring, escalation, record retention and change assessment. | Customer and case files, register entries and approvals. |
| Monthly | Review alert ageing, high-risk activity, screening exceptions and overdue customer reviews. | Compliance dashboard and action log. |
| Quarterly | Quality-test customer files and monitoring cases; review vendors and regulatory changes. | Sample report, findings and remediation tracker. |
| Semi-annual | Test goAML access, deputy coverage, data retrieval and incident escalation. | Test results and corrected access list. |
| Annual | Refresh enterprise risk assessment, policies, training, board review and audit data room. | Approvals, training evidence and readiness assessment. |
| Event-driven | Assess new owners, staff, products, countries, providers, incidents or proceedings. | Change decision and SRO notification where required. |
Set dates from the selected SRO's actual calendar and the company's customer-review cycles. The objective is to create evidence while controls operate, not immediately before the auditor arrives.
Swiss SRO audit readiness checklist
- Confirm the current SRO regulations, audit model, cycle and approved-auditor requirements.
- Reconcile the live product and transaction flows to the activity disclosed to the SRO.
- Update the enterprise AML risk assessment and obtain board approval.
- Export a complete customer population with risk, geography, activity and review dates.
- Quality-test low-, standard- and high-risk customer files.
- Review beneficial ownership and representation evidence for legal entities.
- Test monitoring alerts from generation to closure and management reporting.
- Confirm that internal suspicion escalation and goAML access work in practice.
- Complete required training and close any missed or overdue courses.
- Reconcile all corporate, ownership, staffing and business changes to SRO notifications.
- Review outsourced providers and confirm access to underlying evidence.
- Close prior findings using population testing and independent validation.
- Build the indexed data room and appoint one audit-response coordinator.
- Budget for the audit and possible follow-up or remediation work.
Frequently asked questions
Is every Swiss SRO member audited every year?
No. Frequency depends on the SRO's rules and the member's risk. VQF publishes 12-, 24- and 36-month cycles. PolyReg generally starts from an annual review but permits deferral under stated low-risk and clean-audit conditions. Extraordinary reviews remain possible. [2, 3]
Can a member choose its own auditor?
The arrangement is SRO-specific. Some organisations use their own audit structure; others permit or require an external auditor accepted under their rules. Confirm the mandate and approval before appointing a firm.
What documents are sampled in an SRO audit?
The sample can include identity and beneficial-owner evidence, risk classification, enhanced due diligence, transaction monitoring, internal escalation, training, governance, change notifications and previous remediation. The exact scope depends on the member's business and risk.
Does a longer audit cycle reduce compliance work?
No. It changes when the formal audit occurs, not the member's ongoing AMLA obligations. Customer reviews, monitoring, reporting, training and change controls continue throughout the cycle.
What should a crypto company prepare?
In addition to standard AML evidence, prepare wallet ownership or control, blockchain-analytics cases, hosted and unhosted wallet treatment, sanctions and mixer exposure, transaction tracing, asset-risk rules and links between customer risk and on-chain activity.
Can an audit finding threaten SRO membership?
Material or unresolved failures can lead to intensified supervision and measures under the SRO's rules. FINMA states that SRO regulations govern penalties and that an SRO can sanction or suspend members. The consequence depends on the breach, response and applicable rules. [1]
Should the audit be prepared during the SRO application?
Yes. The application should establish the audit route, AML roles, evidence model and training plan. It is much easier to preserve compliant records from the first client than to reconstruct them after an audit notice.
Related DM Strategy guides
- Swiss SRO License Requirements, covering directors, AML responsibility, office and operational substance.
- Swiss SRO Membership Cost and Process, covering admission, annual, training and audit costs.
- Which Swiss SRO Should You Join?, comparing selection factors and operating fit.
- Swiss SRO Application Checklist, covering the documents and controls needed before filing.
- Swiss Crypto Licence Routes, comparing SRO membership, the FinTech route and banking authorisation.
- Swiss SRO Membership, outlining DM Strategy's structuring and application support.
Key primary sources
| Ref | Primary source |
|---|---|
| 1 | FINMA: Self-regulatory organisations and supervision of SROs, membership supervision, audit controls and FINMA's oversight model. |
| 2 | VQF FAQ, AML officer, member obligations, training and risk-based 12-, 24- and 36-month audit cycles. |
| 3 | PolyReg Regulations, audit deferral conditions, audit scope and reporting. |
| 4 | PolyReg: Association duties and costs, change reporting, cooperation, training and audit information. |
| 5 | ARIF: Forms and regulations, including the published request for a three-year AMLA audit cycle. |
| 6 | FINMA: Combating money laundering, core due-diligence, organisational, training and reporting duties. |
| 7 | FINMA Annual Report 2025: Supervisory activity by sector, multi-level supervision of payment, money-transmission and virtual-asset businesses. |
| 8 | MROS: Entering and submitting reports, mandatory goAML communication and supporting information. |
Disclaimer
This article is for information only and is not legal, tax, audit or regulatory advice. SRO regulations, forms, audit cycles and supervisory practice can change. The applicable duties depend on the selected SRO, business model, customer and transaction risk, findings and other Swiss regulatory requirements.
DM Strategy helps founders structure Swiss payment, crypto and para-banking businesses, prepare SRO applications and build the operating evidence needed after admission. If your company is approaching its first audit or correcting a compliance gap, book an introductory call with DM Strategy before the audit request becomes a remediation project.
