Back to insights
Compliance2026-04-01

Periodic verification is a FINMA expectation, not a best practice

Swiss finance has long been synonymous with discretion, precision and trust. In 2026, keeping that means running a documented, repeatable fit-and-proper programme — not a one-off check at hire.

The regulatory obligation is clear

FINMASA Art. 3 and FINMA Circular 2017/1 require supervised institutions to ensure, on an ongoing basis, that key-function holders continue to meet the fit-and-proper standard. That is not a best-practice recommendation. It is a licence condition.

The practical consequence: a pre-hire background check does not discharge the obligation. The regulator expects documented, periodic verification at a cadence proportionate to each role and risk profile.

What happens between cycles

The professional and public profile of covered employees evolves continuously. A few examples a hiring check would not catch:

  • A portfolio manager starts publicly criticising a client's ESG practices on LinkedIn. The posts draw attention from industry media.
  • A compliance officer takes a board seat at a company that later appears on a sanctions list. The directorship was not declared at the last attestation.
  • A client adviser's corporate credentials surface in a third-party data breach.
  • Not hypotheticals. These are the kinds of findings that a periodic cycle surfaces — and that manual processes miss.

    The legal basis for verifying staff already in post

    Verifying existing staff rests on a different legal footing than an onboarding check. Under nFADP Art. 31, periodic verification can proceed on an overriding-interest basis, provided the institution has first informed the person — purpose, data categories, retention period, rights.

    That notice-and-consent framework is not optional. It is what distinguishes a defensible programme from one that creates its own compliance exposure.

    What a defensible programme requires

  • A versioned register of the covered population — who is covered, in which role, from when.
  • Documented notice and consent — nFADP Art. 19 notices, stored and exportable.
  • A reproducible methodology — consistent sources, documented scope.
  • Delta analysis — findings compared cycle-to-cycle so the Compliance Officer sees only what is new.
  • An attestation binder — a structured deliverable the Compliance Officer can sign off and the auditor can examine.
  • Swiss data residency is non-negotiable. Running covered-employee data through US-based tools creates Chapter 5 nFADP transfer issues that no SCC arrangement fully resolves for this use case.

    Getting started

    Premtrace's annual programme (CHF 10'000 floor + CHF 150–250 per covered employee / year) covers the full cycle — consent ledger, verification cycles, delta analysis and attestation binder — for firms of 30–150 FTE.

    Book a 30-minute demo to see the programme in operation.

    See the programme in practice

    Book a 30-minute demo. We’ll walk through a live cycle and present the attestation binder your Compliance Officer signs off.

    Book a demo