The ECJ confirmed in Commission v Malta that investor citizenship schemes are incompatible with EU law — and with that, the buffer a Maltese or Cypriot passport once supplied during onboarding collapses. Holding a valid EU passport issued after a wire transfer to a national investment fund is now a positive indicator for enhanced due diligence, not a clean identifier against it. The question your KYC file now needs to answer is not whether the client has an EU passport, but how they obtained it. Servatius von Tatzenberg's analysis today identifies the practical scope: which passports are affected, how far back the review obligation reaches, and what the updated file needs to show.

Two FINMA prohibition decisions issued in June close a gap that wealth managers with proprietary fund lines had been navigating since FinSA came into force: deploying in-house funds without a documented suitability assessment is now explicitly prohibited, not merely inadvisable. The decisions are the enforcement follow-through on the conflicts-of-interest theme FINMA emphasised at its April media conference. Servatius von Tatzenberg explains today which distribution arrangements are caught, which product architectures require a remediation plan, and what a Q4 review cycle looks like for houses that missed this in H1.

FINMA Guidance 03/2026, issued in June, sharpens the suitability documentation obligation under Art. 12 FIDLEG for portfolio managers already licensed under FINIG Art. 17. The document maps the product-choice patterns FINMA uses to trigger supervisory escalation against already-licensed managers — 68 such cases in 2025 show how consistently product-selection deficiencies draw enforcement attention. Servatius von Tatzenberg's analysis today unpacks the three most frequent configurations and explains what a compliant product-selection record needs to show to withstand a FINMA examination under the guidance.

The European Court of Human Rights found in Ferrieri v Italy that the Italian Guardia di Finanza's bulk automated access to the national bank-relationship database violated Art 8 ECHR — the court accepted that the lack of prior authorisation might be justified by the need not to jeopardise the bank investigation, but found decisive the complete absence of any ex-post judicial or independent review of the access. The ruling is not limited to Italian practice: it places an Art 8 ceiling on the data-access appetite that DAC8 and national fiscal transparency regimes would otherwise satisfy unrestricted. Servatius von Tatzenberg's piece today draws the line between what the ruling permits and what it constrains for Swiss institutions receiving EU tax authority data requests — and confirms that the Art. 47 BankG / Art. 271 StGB channel remains the only legally safe Swiss response in any case.

The Court of Justice ruled in EDPS v SRB (C-413/23 P, September 4, 2025) that transferring pseudonymised data to Deloitte, acting as independent valuer in the Banco Popular resolution, does not take it outside the EU data protection framework — where the receiving party holds the re-identification key or where contextual re-identification is reasonably possible. Casimir von Firn's analysis today traces what this means for M&A due diligence involving regulated entities: the NDA template needs a re-identification risk clause, the data minimisation obligation runs to the anonymisation threshold rather than the pseudonymisation threshold, and breach-notification timelines start from the date of access, not from closing.

FINMA examined 12,000 registered insurance intermediaries and found approximately 1,200 operating without a valid licence under the Insurance Supervision Act. The 10% figure is the headline; the number that matters for transactions is how many of those unlicensed intermediaries are embedded in distribution networks that licensed entities depend on. Today's scorecard by Servatius von Tatzenberg gives the sector breakdown. The companion piece by Casimir von Firn on ISA representations in insurance broker acquisitions explains what the standard SPA annex is missing and what the warranty package needs to cover before signing.

The CJEU ruled in Penny Market (C-658/24, June 18, 2026) that Hungary's mandatory food price-discount scheme — requiring retailers above a revenue threshold to sell specified food products at prices at least 15% below their own recent floor — is incompatible with the common organisation of agricultural markets under Regulation 1308/2013 and the Services Directive. The court found that a member state cannot impose a pricing mandate that overrides the market price-formation rules Union law reserves to the agricultural markets regulation. Casimir von Firn's analysis today identifies where the challenge is viable for EU retailers operating in Hungary and where comparable national pricing schemes will survive a proportionality review under the Services Directive.

Between June 5 and June 17, FINMA published three sanction-list update notices: Sudan (SR 946.231.18), Russia/Ukraine (SR 946.231.176.72), and Hamas/Palestinian Islamic Jihad (SR 946.231.09), effective June 16. Each triggers a fresh screening obligation on the day FINMA publishes. A monthly cycle running in June would have captured Sudan on June 5 and then missed the Russia and Hamas/PIJ updates until July's run. A fourth Q2 update — ISIL/Al-Qaida (SR 946.231.08) — was published April 1 and falls outside the June window; a monthly May cycle would likewise have missed it. Our earlier analyses of the Sudan ordinance and the ISIL UNO-track mechanics explain what each update requires at the asset level.

FINMA's partial revision of the Anti-Money Laundering Ordinance closed its consultation period on June 9. Our May analysis identified the three ownership-transparency clauses that carry practical weight despite FINMA's characterisation of the revision as introducing no new obligations. The record is now closed. If your legal function submitted comments, the file can be deprioritised until FINMA publishes its response. If it did not, the window for influencing the text is gone — the next action is reading the final version and mapping it to your existing GwG documentation.

A recurring error in corporate sustainability workstreams: treating the political fate of Swiss CO2 pricing legislation as a variable that affects Art. 964b OR's TCFD-aligned reporting obligations. It does not. Art. 964b OR has been in force since January 2024 and runs independently of any carbon levy. Whatever the ballot outcome on CO2 pricing, the disclosure obligation remains. Our May analysis of what Art. 964b OR requires today — independent of the KIG trajectory — is the standing reference for counsel being asked to scope climate reporting obligations for a Swiss parent.

Two of today's rulings share a logic worth extracting. In Commission v Malta, EU citizenship obtained through investment was supposed to transmute a high-risk client profile into a clean EU passport fact — the ECJ said no. In EDPS v SRB, pseudonymisation was supposed to transmute personal data into non-personal data safe for the data room — the Court of Justice said no, where re-identification is reasonably possible for the recipient (C-413/23 P, September 4, 2025; the CJEU referred elements back to the General Court, so the litigation is not fully concluded). In both cases, a technical conversion step that practitioners relied on to exit a more demanding regulatory regime has been removed. Wherever a compliance design rests on that kind of conversion logic, the question is worth asking again. The Art. 89 GDPR research privilege for AI training data is the next candidate in line.