Swiss SRO License Requirements in 2026: Directors, AML Officer, Office and Capital

At a glance

1. A Swiss “SRO licence” is legally an affiliation with a FINMA-recognised self-regulatory organisation for anti-money-laundering supervision. It does not make the company a FINMA-licensed bank, securities firm or FinTech institution. [1]

2. Article 14 AMLA requires an applicant to have an organisation and internal rules capable of meeting AML duties. The company, its directors and managers, and its qualified owners must also meet good-reputation and proper-conduct requirements. [2]

3. There is no single AMLA minimum capital amount for SRO affiliation. A Swiss GmbH generally requires CHF 20,000 fully paid, while an AG requires CHF 100,000 share capital with at least CHF 50,000 paid at formation. Higher regulatory capital applies if the model requires a separate FINMA licence. [5, 6, 7]

4. Swiss corporate law requires a GmbH or AG to be represented by at least one person resident in Switzerland. Individual SROs can impose more specific operational requirements. PolyReg, for example, states that the contact person for a VASP must be an operational board or management member resident in Switzerland. [4, 6]

5. The AML officer must be more than a name in an organisation chart. The application should demonstrate knowledge, authority, system access, time allocation, reporting lines and continuity. VQF states that every affiliated company must appoint an AML officer and applies higher experience and training expectations to VASPs. [3]

Founders searching for Swiss SRO licence requirements often receive a checklist that mixes company-law rules, AMLA obligations, one SRO’s internal practice and requirements belonging to a FinTech or banking licence. That can lead to unnecessary hiring or, more seriously, an application that does not address the actual supervisory test.

The correct approach is to separate four layers: the regulatory perimeter, Article 14 AMLA eligibility, Swiss corporate requirements and the chosen SRO’s rules. The application then has to show how those layers work together in the live business, including customer onboarding, asset flows, monitoring, reporting, record access and management control.

1. What a Swiss SRO licence is — and what it is not

Professional financial intermediaries under Article 2 paragraph 3 AMLA must affiliate with a FINMA-recognised SRO unless they fall under another supervisory regime. The SRO translates AMLA duties into member regulations, supervises compliance, conducts or commissions audits and can impose sanctions or exclude a member. FINMA recognises and supervises the SRO itself. [1]

The member is supervised by the SRO for AML purposes. It is not thereby directly licensed and prudentially supervised by FINMA. This matters whenever a website, banking file or commercial proposal refers to a “Swiss crypto licence.” The description must not imply permissions that the affiliation does not provide.

A perimeter analysis should therefore come before incorporation, hiring and application drafting. If the product changes who controls customer assets or how transactions are executed, the required Swiss authorisation can change with it.

2. The legal admission test under Article 14 AMLA

Article 14 provides the core admission test. A professional financial intermediary is entitled to affiliate if it can guarantee compliance through its internal rules and organisation, has a good reputation, and can be expected to comply with AMLA. The persons responsible for administration and management must meet the same reputation and assurance standard. Qualified participants must also have a good reputation and must not exercise their influence against prudent and sound business operations. [2]

The SRO may limit membership to particular sectors. Eligibility is therefore not established merely because a company is subject to AMLA. The selected SRO must also accept the activity, legal form, risk profile and operating model.

3. Swiss company and local representation requirements

Foreign founders can own a Swiss company, but the entity must satisfy Swiss corporate requirements. A GmbH must be represented by at least one person resident in Switzerland, who may be a managing director or director. An AG likewise requires at least one person authorised to represent it who resides in Switzerland. [5, 6]

This corporate-law representative should not automatically be presented as proof of regulatory substance. The SRO will look at what the person actually does, who controls the business, where decisions are taken and whether the AML organisation can respond effectively from Switzerland.

For PolyReg, the distinction becomes particularly concrete for crypto applicants. Its published FAQ states that the contact person must understand at least one Swiss national language, hold registered signatory authority and reside in Switzerland. For a VASP, the contact-person function must be held by an operational board or management member resident in Switzerland. PolyReg also expects AML functions to be allocated across at least two internal persons. [4]

These are PolyReg requirements and should not be presented as a universal statutory formula for every SRO. VQF, SO-FIT and other recognised organisations apply their own approved rules and forms. The staffing plan should be built only after confirming the intended SRO.

4. Directors, management and qualified owners

The application is an assessment of people as well as documents. The SRO needs to understand who sets strategy, who can bind the company, who controls customer activity and who can correct a compliance failure.

The management and ownership file should normally include:

• a complete group and ownership chart through to natural-person ultimate beneficial owners;
• shareholder agreements, voting rights and other arrangements that influence control;
• CVs showing relevant management, financial-services, technology and compliance experience;
• identity, residence, criminal-record, debt-enforcement and personal declarations as required by the SRO;
• source-of-wealth and source-of-funds evidence for launch capital and subsequent financing;
• a description of each director’s responsibilities, decision rights and expected time commitment;
• disclosure of current and historical proceedings, licence refusals, insolvencies or supervisory matters; and
• an explanation of how conflicts of interest are identified and managed.

A foreign shareholder or director is not automatically disqualifying. The concern is whether the structure is transparent and whether management can demonstrate knowledge, availability and effective control. A Swiss-resident nominee who signs documents but cannot explain the customer flow will weaken rather than strengthen the application.

5. AML officer and deputy requirements

The AML officer owns the practical implementation of AMLA within the company. VQF states that every affiliated company must appoint an AML officer. The person acts as the internal contact for AML due diligence, monitors compliance with internal directives and liaises with VQF and, where required, MROS. The appointee must have the necessary specialist knowledge and receive regular training. VQF expressly applies higher professional-experience and training requirements to VASPs. [3]

VQF also states that if fewer than six people in the company perform AML duties, an additional deputy AML officer does not have to be appointed. In that case, the company must designate an authorised person with access to the relevant systems so communication and platform access remain available. This is a VQF rule and should be checked against the current forms when applying. [3]

PolyReg divides the operational responsibilities into functions including the contact person, reporting officer and deputy, customer-file officer and internal-training officer. It states that these AML functions must be covered by at least two internal persons. [4]

Outsourcing support does not outsource accountability. If an external provider helps draft policies or review cases, the member must still understand the controls, retain access to evidence and maintain authority over decisions.

6. Office, records and operational substance

There is no single AMLA sentence requiring every SRO applicant to lease a particular size of office or employ a fixed number of staff. There are, however, several requirements that make a purely nominal structure difficult to defend.

The Swiss entity needs a registered office and Swiss-resident representation under corporate law. The SRO must be able to communicate with responsible persons, inspect records and test whether controls are operating. PolyReg states that its customer-file officer must ensure records are available on Swiss territory at all times so requests from the SRO, auditor, FINMA or law-enforcement authorities can be answered without delay. Its ordinary AML audits generally take place on site at the member’s business. [4]

A credible substance plan should answer:

• where management decisions are made and documented;
• where the AML officer and responsible management actually work;
• where customer and transaction records are stored and how Swiss access is maintained;
• which functions are performed internally and which are outsourced;
• how the company supervises overseas employees, contractors and group entities;
• how regulators and auditors obtain timely access to systems and personnel; and
• how operational continuity is maintained if one key person is unavailable.

A serviced address may satisfy a registration need, but it does not by itself demonstrate operational substance. The right setup depends on the SRO, business model, team and risk. Confirm the intended arrangement before signing a long office lease or appointing local personnel.

7. Is there a minimum capital requirement?

AMLA does not set one universal prudential capital amount for SRO affiliation. Capital is often confused with the minimum required to form the Swiss company or with capital required under a separate FINMA licence.

Even without a separate SRO capital floor, an underfunded plan can undermine the Article 14 assessment. The company should demonstrate realistic runway for management, compliance personnel, technology, office and records, training, audit, legal work, banking and remediation. Share capital and launch funding should have transparent and verifiable sources.

8. AML framework and technology requirements

The organisation described in the application must be capable of implementing the selected SRO’s regulations from launch. FINMA summarises the core duties as identifying the contracting partner and beneficial owner, clarifying unusual relationships and transactions, applying enhanced checks to higher-risk relationships and reporting suspicious activity. [1]

The application package should connect the following components:

• enterprise and AML risk assessments based on products, customers, countries, channels and transaction patterns;
• KYC and KYB procedures, identification standards and beneficial-owner verification;
• customer-risk scoring, approval thresholds and enhanced due diligence;
• PEP, sanctions and adverse-media screening, including ongoing rescreening;
• transaction-monitoring rules, alert investigation, case management and management information;
• suspicious-activity escalation, MROS reporting and asset-blocking procedures where applicable;
• record retention, data retrieval, privacy and access controls;
• outsourcing due diligence, contracts, monitoring and exit arrangements;
• staff training and competence records; and
• independent testing, issue tracking and audit remediation.

A policy document does not prove that these controls work. The file should identify the systems used, the data available to each control, the responsible person, the decision record and the escalation path.

9. Additional requirements for crypto and VASP applicants

Crypto applications receive closer attention because custody, blockchain exposure, unhosted wallets and cross-border counterparties can materially change the risk. PolyReg requires a personal supervisory meeting before admitting a VASP and states that blockchain-based financial services are higher-risk activities for which an audit deferral is unavailable. VQF states that higher experience and training standards apply to the VASP AML officer. [3, 4]

A VASP file should explain:

• which legal entity contracts with the customer and performs each service;
• who controls private keys and whether wallets are individual or omnibus;
• how fiat and cryptoassets move through every deposit, trade, transfer and withdrawal;
• which chains, tokens, stablecoins and fiat currencies are supported;
• how wallet ownership, unhosted wallets and counterparties are assessed;
• which blockchain-analytics data is used and how alert thresholds are governed;
• how mixers, privacy tools, sanctions exposure, scams and high-risk services are handled;
• how travel-rule obligations are implemented where applicable;
• how market, custody, cyber and outsourcing incidents affect AML controls; and
• whether custody, public deposits, securities or trading functions require direct FINMA authorisation.

Calling the service “non-custodial” is not enough. The legal agreements, technical architecture, transaction flow and recovery rights must support that conclusion.

10. What changed on 1 October 2026?

Switzerland’s revised AMLA and the new beneficial-ownership transparency framework entered into force on 1 October 2026. The reform brings certain professional advisers involved in specified high-risk legal transactions within AMLA. It also starts transition periods connected with the new transparency register. [8, 9]

An adviser already carrying on an activity covered by the new Article 2 paragraphs 3bis or 3ter on 1 October 2026 must submit an SRO affiliation application by 1 December 2026. Under the transitional rule, the adviser may continue only within existing business relationships until the decision. Existing financial intermediaries that also perform the newly covered advisory activity must notify their supervisory authority or organisation by the same deadline. [8]

This reform should not be treated as a universal extension of SRO membership to every lawyer, accountant or consultant. Applicability depends on the actual advisory activity and professional-activity thresholds. Businesses affected by the new regime should map the covered mandates, customers and transaction values before relying on the transition.

11. Documents to prepare for the SRO application

Exact forms differ by organisation and legal form. A company applicant should expect a file covering:

VQF begins its review after a complete application and processing fee have been received. It performs a completeness review, Legal & Compliance assessment and admission interview before deciding on membership. PolyReg similarly conducts formal and substantive review and typically exchanges written questions with the applicant. [4, 10]

12. Common reasons an application is delayed

• The product has changed since the regulatory perimeter was assessed.
• The ownership chart stops at a corporate shareholder and does not identify natural-person control.
• The Swiss director or contact person has little knowledge of the product or no practical authority.
• The AML officer is qualified on paper but lacks time, data access or an effective escalation route.
• The policies describe controls that have not been configured in the selected systems.
• Customer, fiat and cryptoasset flows contradict the contracts or business plan.
• The company cannot explain where records are held or how Swiss access is guaranteed.
• Outsourcing contracts do not preserve access, audit and termination rights.
• The launch budget covers formation and membership fees but not staff, technology, audit and banking.
• The application treats SRO affiliation as authority for activities that require a separate FINMA licence.

13. A practical readiness sequence

1. Freeze the launch model. Define services, entities, customers, countries, assets, custody and transaction channels.
2. Confirm the regulatory perimeter. Determine whether SRO affiliation is sufficient and identify any FINMA authorisation issue.
3. Select the company form. Choose GmbH or AG based on governance, ownership and funding rather than the minimum capital alone.
4. Design Swiss representation and substance. Appoint people who can demonstrate real authority, availability and access.
5. Pre-check SRO fit. Confirm that the preferred SRO accepts the activity, legal form and risk profile.
6. Complete the people file. Resolve ownership evidence, reputation documents, roles, conflicts and source of funds.
7. Build the AML operating model. Connect risk assessment, procedures, staff, systems, vendors and management oversight.
8. Test the controls. Walk through onboarding, a high-risk customer, an alert, a suspicious case, record retrieval and staff absence.
9. Prepare banking in parallel. Use the same service and asset-flow narrative for the SRO and banking partners.
10. Submit one consistent file. Keep a controlled master version and update every affected document if the model changes.

Frequently asked questions

What are the main Swiss SRO licence requirements?

The applicant must fall within the AMLA financial-intermediary perimeter, have suitable internal rules and organisation, and meet the Article 14 standards for reputation and reliable conduct. Its management and qualified owners must also meet the relevant standards. The selected SRO may impose sector-specific requirements. [2]

Do I need a Swiss resident director?

A Swiss GmbH or AG must be represented by at least one person resident in Switzerland. Some SROs impose additional operational conditions. PolyReg states that a VASP’s contact person must be an operational board or management member resident in Switzerland. [4, 6]

Does the AML officer have to live in Switzerland?

There is no universal answer that applies identically to every SRO and model. The role, residence, internal status, knowledge and deputy arrangements must be checked against the chosen SRO’s current rules. What is universal in practice is the need for effective authority, competence, access and continuity.

Can the AML officer be outsourced?

Some support functions can be outsourced, subject to the SRO’s rules, but accountability and effective control remain with the member. PolyReg requires specified AML functions to be held by at least two internal persons, while VQF defines its own AML officer and continuity requirements. Confirm the structure before appointing a provider. [3, 4]

How much capital is required for a Swiss SRO company?

AMLA does not prescribe one universal prudential capital amount for SRO membership. A GmbH generally requires CHF 20,000 fully paid; an AG requires CHF 100,000 share capital with at least CHF 50,000 paid at formation. The business must also have credible operating funding. Separate FINMA licences have their own capital rules. [5, 6, 7]

Is a physical office mandatory?

Swiss corporate presence, record availability, management control and audit access must be credible. The precise office and staffing arrangement depends on the company and SRO. A registered address alone does not demonstrate that the regulated functions can operate effectively.

Can foreign founders own the company?

Foreign ownership is possible, but ownership, control, reputation, source of wealth and source of funds must be transparent. The Swiss company still needs resident representation and must meet the selected SRO’s organisation and conduct requirements.

Is SRO membership enough for a crypto exchange?

It depends on the services and custody model. Brokerage, exchange or transfer activity may fall within AMLA, while public deposits, collective custody, securities or multilateral trading can trigger additional authorisation. Assess the actual technical and contractual model before filing.

How long does approval take?

There is no single statutory timetable. PolyReg says a decision can be possible within four to twelve weeks after a complete application, but VASP and complex applications often take longer. VQF does not promise a fixed number of weeks because completeness and complexity determine the review. [3, 4]

Related DM Strategy guides

• Swiss SRO Membership Cost in 2026, covering published fees, application stages and first-year budgeting.
• Swiss Self-Regulatory Organisation Membership, the commercial overview of DM Strategy’s Swiss SRO support.
• Swiss Crypto Licence: SRO vs FinTech vs Bank, explaining which authorisation route fits different models.
• Why Crypto and Payment Businesses Get Rejected by Banks, covering the operating evidence expected by banking partners.

Key primary sources

Disclaimer

This article is for information only and is not legal, tax or regulatory advice. Swiss laws, SRO regulations, forms and supervisory practice can change. Requirements depend on the actual services, customer and asset flows, custody architecture, ownership, people, systems and selected SRO. Obtain a project-specific assessment and confirm current requirements before commencing activity.

DM Strategy helps founders align the Swiss entity, regulatory perimeter, SRO application, AML organisation and banking file. If you are preparing a Swiss SRO application, book an introductory call with DM Strategy before appointing directors, selecting an SRO or committing to the operating structure.