FINMA licence or SRO membership: which does your business need

Swiss financial regulation is often described as though there were one door. There are two, and they lead to very different places. Choosing the wrong one wastes either a great deal of money or a great deal of time — and in one direction it means operating without the authorisation you needed.

The two tiers

Prudential supervision by FINMA applies to institutions whose failure would harm clients or the financial system: banks, securities firms, insurers, fund managers, portfolio managers and trustees, and businesses operating under the fintech authorisation. FINMA authorises them, sets capital and organisational requirements, and supervises them directly and continuously.

Anti-money-laundering supervision through an SRO applies to financial intermediaries outside those sectors. The SRO is recognised and overseen by FINMA, and it supervises its members' compliance with anti-money-laundering obligations — and only those. It says nothing about solvency, conduct towards clients or capital adequacy, because it is not asked to.

The distinction is not about size or seriousness. It is about what kind of risk the activity creates.

The question that usually decides it

Roughly: do you take custody of client assets, or exercise discretion over them?

A business that holds client money or securities, or manages them on a discretionary basis, creates the risk prudential supervision exists to address — the client can lose everything if you fail. That points to FINMA authorisation.

A business that facilitates transfers, exchanges value, lends its own money, or provides services to companies, without taking custody or discretion, creates a money-laundering risk rather than a prudential one. That points to SRO affiliation.

The formulation is a guide, not a test. Real cases turn on detail — whether an account is held in the client's name or yours, whether an instruction is executed or judged, how briefly funds pass through your control. Businesses sit near the boundary far more often than they expect.

Where each typically lands

Ordinarily requiring FINMA authorisation: accepting deposits from the public; managing individual client portfolios on a discretionary basis; acting as trustee; managing collective investment schemes; dealing in securities for clients; holding client assets in your own name.

Ordinarily SRO territory: money transmission and payment services; currency and crypto-asset exchange where you do not hold client assets; lending your own funds; factoring and finance leasing; trading in precious metals for others; company formation, administration and related services; certain introducing and advisory activities without custody or discretion.

Crypto is where the boundary is most contested. Exchanging assets without custody usually sits in the SRO tier; holding clients' private keys and their assets can take a business across into FINMA territory or into a specific authorisation category. Businesses in this space should get the classification in writing before they build, because the two answers imply entirely different capital, systems and timelines.

What each costs you, beyond money

SRO affiliation requires a Swiss entity, fit-and-proper management, a competent anti-money-laundering officer, written internal directives tailored to your business, and a coherent business plan. There is no regulatory capital requirement as such. Supervision is periodic audit against the AML rules. Timelines are measured in months, and acceptance is not guaranteed.

FINMA authorisation requires all of that and a great deal more: minimum capital, a governance structure with genuine separation of functions, risk management and internal control frameworks, a regulatory audit relationship, and management whose experience matches the activity in FINMA's judgement rather than your own. Timelines run to a year and beyond, professional costs are an order of magnitude higher, and the organisation you must build is substantial before you earn anything.

Getting it wrong in either direction

Under-classifying — assuming SRO affiliation is enough when the activity required authorisation — means carrying on a regulated activity without authorisation. FINMA can order the activity to cease, appoint an investigator at your expense, and pursue enforcement against the individuals responsible. Banking relationships end quickly when this becomes known.

Over-classifying — pursuing a FINMA licence for a business that only ever needed SRO affiliation — is not dangerous, only expensive. We have seen businesses spend a year and a very large sum assembling an application for a licence they did not require.

Both errors come from the same place: deciding the answer by analogy with another business rather than by analysis of your own.

How to settle it properly

1. Describe the business mechanically. Not what you call it — what happens. Whose name is the account in, who holds the asset at each moment, who decides, what your discretion consists of, how money moves and through whose control.
2. Have Swiss counsel classify it in writing, against the actual statutory categories.
3. Where it is genuinely borderline, ask FINMA. A preliminary assessment can be sought, and a documented regulatory view is worth substantially more than an opinion when a bank later asks on what basis you operate.
4. Then build for the answer, rather than building first and classifying afterwards.

One thing neither tier does

Neither authorisation makes you Swiss for tax purposes, and neither substitutes for substance. A regulated Swiss entity directed from elsewhere, with no real presence, has a residency problem that its regulatory standing does nothing to solve. The two questions are independent, and both have to be answered.