Six sanctions-annex updates crossed the FINMA feed in the space of a few weeks — Taliban, Sudan, ISIL/Al-Qaida twice over, and Iran — and the temptation is to treat each one as routine housekeeping. It isn't, if your sanctions screen still runs against a cached SECO list rather than the live one. That gap is exactly the subject of one of today's articles on Art. 3 GKG: the licence a Swiss exporter holds does not survive an unnoticed annex amendment, and these updates are the mechanism by which the ground moves under a licence that looked fine last quarter.

The partially revised Anti-Money Laundering Ordinance-FINMA opened for consultation back in May, and if your compliance team filed it under "read later," later is now. The draft touches beneficial-ownership verification and correspondent-banking due diligence — the same terrain the crypto-inventory notice and the LiqV-FINMA/RVV-FINMA package are already rewriting from adjacent angles. Three parallel ordinance-level tracks converging on one compliance function is not a coincidence; it's how FINMA does policy now — guidance first, ordinance second, never both on the same calendar page.

The too-big-to-fail dispatch is now with parliament, and FINMA's welcome statement is doing more work than its two paragraphs suggest: it signals the regulator isn't planning to soften the capital-surcharge mechanics in the drafting that follows. If your treasury desk has been asking why the Art. 37a BankG depositor-privilege math matters this year specifically, this is why — TBTF reform tends to drag adjacent depositor-protection provisions into the same debate, whether or not they were the intended target.

An American designation landing on a Swiss bank already in FINMA-ordered liquidation looks redundant until you read what FinCEN actually alleges: correspondent-banking exposure that FINMA's own enforcement file didn't need to reach, because liquidation mooted the question. That's the same gap this week's Wendelspiess coverage traced under Art. 33 vs. Art. 33a — a professional ban closes the individual case faster than an asset-forfeiture order closes the institutional one. MBaer is the third name in six months where a foreign regulator moved after FINMA had already wound the entity down, following Swiss Fund Management. Three is a pattern, not a coincidence.

A Zurich-based email provider beating a Swiss surveillance order in Swiss court is the kind of headline that reads better than it litigates — the court narrowed the specific data-retention demand, it didn't touch the underlying obligation. Providers reading this as a green light on lawful-intercept requests generally are reading it wrong; the ruling turned on the scope of one order, not the statute behind it.

Switzerland's pro-business instinct keeps colliding with the same question everyone else in Europe already answered: does the buyer's passport matter more than the buyer's cheque. Worth reading next to the Maltese golden-passport ruling covered in our piece on residency-as-warning-signal — a formal screening regime would give onboarding teams a bright line the EuGH's Malta ruling only implied.

The gap the reporting keeps circling back to is sponsoring and gift-giving that never touches a compliance system because it was booked as a donation. Which connects, unglamorously but directly, to the concerns raised over corporate money flowing to Swiss universities the same week — chairs, scholarships and "sponsoring" are the same category of spend our Art. 322quinquies piece covered eleven days ago, and neither the universities nor, per this report, the prosecutors are treating it as one.

Swiss suppliers sitting outside the CSDDD's direct scope keep discovering they're inside it anyway, through the EU customer's contract clause. That's the mechanic our forced-labour regulation piece laid out for the December 2027 product ban, and it's also why the "Stop-the-clock" delay covered in our CSDDD timeline piece buys less relief than the headline suggests — the deadline moved, the customer's contract clause didn't wait for it.

Border-management AI is exactly the kind of deployment the AI Act's Annex III was written for — biometric verification, risk scoring, asylum triage — and exactly the kind the Digital Omnibus just pushed out to December 2027, as our Anhang III timeline piece covered this week. The procurement contracts being signed now will still be running when the obligations finally bite.