A foreign court, a US law enforcement authority, or a foreign regulator demands your bank’s customer data. Two Swiss provisions engage at the same moment. Art. 47 BankG prohibits disclosure of banking secrecy; Art. 271 StGB punishes anyone who, on Swiss soil, performs without authorisation an act on behalf of a foreign state that is reserved to a public authority. The only lawful routes are administrative assistance or mutual legal assistance, direct transmission under Art. 42c FINMAG, or an official authorisation. Whoever delivers the data directly commits an offence.

On 1 November 2021, the Federal Supreme Court (Bundesgericht) upheld the conviction of the chairman of the board of directors of a Zurich-based asset management company who in November 2013 had travelled to the United States carrying a USB stick containing 109 client files and had it handed over to the US Department of Justice through a lawyer (BGE 148 IV 66; commentary). He had previously filed a voluntary disclosure with the US Department of Justice concerning clients of B. AG who were allegedly subject to US tax obligations; the handover was intended to secure a non-prosecution agreement. It was nonetheless a criminal act under Art. 271 para. 1 StGB. The final sentence was lenient — a fine of CHF 10,000, the outcome of a second set of proceedings following an intervening acquittal. But the conviction stands, and Art. 271 catches anyone on Swiss soil, not just banks.

What Art. 47 BankG says is unambiguous. Para. 1 punishes with a custodial sentence of up to three years or a fine anyone who discloses a secret entrusted to them in their capacity as an officer, employee, or agent of a bank. Where the offender obtains a financial advantage in doing so, the maximum penalty under para. 1bis rises to five years. The secret, however, belongs to the customer. If the customer consents, the prevailing view holds that the elements of the offence are not satisfied, and the bank may disclose.

Consent Changes Nothing

This is where the misconception sits that proves costly for legal departments. Customer consent removes Art. 47 BankG from the picture; it does not remove Art. 271 StGB. That provision does not protect the customer’s secret — it protects Swiss territorial sovereignty: the state’s right to determine which acts of official authority take place on its soil on behalf of foreign states. The customer cannot waive that legal interest. That is why the handover in BGE 148 IV 66 remained a criminal act.

Evidence that can be produced in Switzerland only on official order cannot be obtained abroad by bypassing the state — the mere act of handing it over becomes an exercise of sovereign authority. When a US court demands documents, the prescribed channel is a mutual legal assistance request to the competent Swiss authority. Whoever delivers directly deprives Switzerland of control over an act that its legal order reserves to itself. That is what Art. 271 para. 1 penalises — in aggravated cases under para. 2 with a custodial sentence of not less than one year.

Which Channels Are Available

Only a few clearly defined channels are lawful. When a foreign financial markets regulator requests information, the route runs through administrative assistance under Art. 42 FINMAG: FINMA transmits where confidentiality and the speciality principle are preserved, and the customer may oppose transmission under Art. 42a FINMAG. Tax data flows through the Tax Administrative Assistance Act on the basis of applicable treaties. When a foreign court or criminal authority seeks documents, the route runs through mutual legal assistance under Art. 63 IRSG.

A bank may also transmit directly, within narrow limits. Art. 42c FINMAG has permitted supervised entities since 2016 to provide non-public information to foreign supervisory authorities without individual authorisation, provided the rights of customers and third parties are preserved (FINMA-RS 2017/06). Where none of these routes applies, only the authorisation under Art. 271 itself remains: the competent department grants it under Art. 31 RVOV, and politically significant cases go to the Bundesrat. That was the route the Bundesrat chose in 2013 when it permitted banks to participate in the US programme by means of a standard authorisation.

Even the regulator has stumbled on this. When FINMA transmitted the data of 255 UBS clients directly to US authorities in 2009, the Federal Administrative Court (Bundesverwaltungsgericht) initially declared the disclosure unlawful (B-1092/2009). The Bundesgericht held it lawful in 2011 by three votes to two — relying on the general police-powers clause and the agreement of the Bundesrat, that is, on a state of necessity. Those who cannot point to the imminent insolvency of a systemically important bank do not have access to that exception.

In practice, the mistake rarely arises from bad faith. A US law firm issues a litigation hold, the customer signs a waiver, management wants the dispute resolved — and no one checks whether the act of delivery itself constitutes a Swiss criminal offence. That very reflex led to the conviction in BGE 148 IV 66. The customer’s consent and pressure from the opposing side change nothing: the choice of channel remains a matter of Swiss criminal law.

What Remains Open

One grey area remains: the production of documents in foreign civil proceedings. Whether producing documents in US discovery constitutes an act reserved to Swiss sovereignty has not been definitively decided by the Bundesgericht; part of legal scholarship reads Art. 271 more narrowly in this context. Legislative clarification through a general sovereignty-protection statute is not to be counted on: Switzerland has instead opted for sector-specific solutions such as Art. 42c FINMAG. Where the line of sovereign authority lies will therefore be drawn by the next published ruling on civil-proceedings production, not by a statute.

The practical upshot: every request from a foreign authority or opposing party must first be assigned to a channel, not answered. Regulator to regulator through Art. 42 or Art. 42c FINMAG; courts and criminal authorities through the IRSG; everything else through an authorisation request under Art. 271. Whoever delivers directly because the customer consents or a deadline looms is conflating banking secrecy with sovereignty and turning a civil dispute into criminal proceedings against their own officers. The sequence is simple: read the request, assign it to a channel, follow the official route.