On its “Whistleblowing” page, FINMA offers insiders an encrypted whistleblowing platform. On the same page, it warns against using it. Anyone with a suspicion must, as a rule, first report it within the institution concerned; only once that route has failed or appears futile is a report to the regulator justified — what the regulator itself calls the cascade system of permissible whistleblowing. Otherwise, the whistleblower risks prosecution for breach of the duty of confidentiality. That means the whistleblower’s criminal liability turns on a fact they do not control, but their employer does: how the internal channel is built.

Art. 321a para. 4 OR prohibits employees from disclosing facts that must be kept confidential during the employment relationship. The cascade itself does not appear there. It comes from BGE 127 III 310 of 30 March 2001: a night watchman at a care home had secretly filmed conditions there, handed the material to Western Switzerland’s public broadcaster, and appeared in the resulting programme. The Bundesgericht (Federal Supreme Court) upheld the summary dismissal under Art. 337 OR. Under that ruling, disclosure is proportionate only if the employee first approaches the employer, then the competent authority, and turns to the public only once the authority fails to act.

Twice, this cascade was meant to become statute. On 5 March 2020, the National Council voted 147 to 42 not to enter into debate on the Bundesrat’s bill — according to Transparency International Switzerland, the end of years of legislative work. On 27 February 2024, it rejected Motion 23.3844, which had called for a legal framework covering the private sector — as SRF reported. On 17 June 2025, the OECD Working Group on Bribery once again criticised Swiss whistleblower protection, demanding two “decisive” legislative reforms. No third attempt is currently pending.

The Criminal Provision and Its Narrow Carve-Out

In the banking sector, a criminal-law layer is added. Art. 47 BankG punishes the disclosure of a secret entrusted to the offender as an officer, employee, or agent of a bank with imprisonment of up to three years, rising to five where the offender acted for pecuniary gain. Paragraph 5 reserves only the provisions on the duty to testify and the duty to provide information to an authority — a duty, not a right. Anyone who reports to FINMA voluntarily fulfils no such duty, and the regulator draws that conclusion on its own platform. How narrow the way out otherwise is shown by the Elmer case: the Bundesgericht upheld the acquittal because the employee worked for a Cayman Islands sister company, not for a Swiss bank itself (6B_1314/2016). What decided the case was the perimeter of the corporate group, not the motive.

The First Criterion Is Your Channel

What the Swiss cascade leaves open, Strasbourg fills in. On 14 February 2023, the Grand Chamber found, by twelve votes to five, a violation of Art. 10 ECHR in Halet v. Luxembourg. Halet had passed documents belonging to his employer, PwC, to a journalist, and had been fined €1,000 for it in Luxembourg. Of the six criteria in the balancing test, the reporting channel comes first: internal channels are, in principle, the best means, but not mandatory. Where they are absent, unreliable, expose the whistleblower to retaliation, or where the disclosure concerns the very core of the employer’s activity, going external is permitted (analysis by Voorhoof).

The ECHR binds Switzerland even in disputes between two private parties. In Heinisch v. Germany, the Court ruled on 21 July 2011 that Art. 10 also covers dismissal under private law, and awarded the dismissed care worker €15,000. A criminal court applying Art. 47 BankG, and a labour court ruling on Art. 336 OR, must therefore conduct the same balancing test. Its first evidentiary question is the channel: did one exist, was receipt acknowledged, was the matter investigated, was feedback given — and did the person named in the report end up deciding the outcome?

The records for that sit with the employer. It is true that the employee bears the burden of proving the dismissal was abusive (Art. 8 CC). But an employer that cannot show its channel ever actually worked hands the other side the argument that an internal report would have been futile anyway. The EU approaches the problem from the other end: under Art. 21 para. 5 of Directive (EU) 2019/1937, any detriment is presumed to be retaliation for the report, and the employer bears the burden of proving otherwise. The OR knows no such reversal; instead, Art. 336a para. 2 OR caps compensation at six months’ salary, and the dismissal itself stands.

What to Do Now

For Monday morning, three things follow. First, the channel needs a clock, and your EU entities already run one: an internal reporting channel from fifty employees under Art. 8 para. 3 of the Directive, acknowledgment of receipt within seven days under Art. 9 para. 1(b), and feedback within three months under (f). Put your Swiss entity on the same clock — not because the Directive applies there, but because it generates the file that matters in court. Second, the policy needs a second route for reports concerning senior management itself, directed to the audit committee or an external ombudsperson, and documented in writing. Third, in banking specifically: a report to FINMA is not lawful merely because it goes to an authority.

No published Swiss decision has yet applied the Halet balancing test to Art. 47 BankG. Parliament will not close the gap. It will be closed in the first criminal proceeding in which a defendant invokes Art. 10 ECHR against a charge under Art. 47 BankG. Whatever your reporting channel has documented by then becomes the evidence.