The Islamic State/Al-Qaida list (SR 946.231.08) got a delisting update on 1 April and another on 14 July. Two touches on the same instrument inside a hundred days is unusual — this list normally moves on the UN 1267 committee's schedule, which is slower. Worth asking your screening vendor when their last sync ran, not assuming it caught both.

In the same stretch: Russia (Anhang 8), the Taliban list, Sudan (Anhang 2), Iran (Anhänge 12 and 14) — the same instrument our Iran-Verordnung piece covered — and a still-unnamed SR 946.231.09. None of these get a press release. All of them get checked in an audit if your list is stale.

The AMLO-FINMA partial revision consultation shut on 9 June. We wrote two pieces on why "no new obligations" wasn't quite the whole story — one on the beneficial-ownership clauses, one on where the burden of proof actually shifted. If your submission argued the burden-of-proof point, this is the week to check whether FINMA's summary of responses mentions it at all.

Proton's court win on Swiss surveillance obligations is the case behind the line we drew in our VÜPF piece: providers of derived communication services don't automatically inherit the same retention burden as classic telcos. The BVGer ruling (A-5373/2020) is five years old at its core reasoning; what's new is that it's still the line everyone cites, which tells you how little has moved since.

The push to add cobalt to Swiss responsible-business legislation is the subject of Casimir's piece running later today — why Art. 964j OR leaves it out, and why your EU customers already wrote around the gap in the contract themselves. Read that one when it's up rather than here; I'll just flag that this is the same due-diligence catalogue question as the CSDDD item below.

Same story we told in CSDDD vor NUFG: the Swiss legislature is still drafting NUFG, but your EU counterparty's due-diligence clause already binds you to CSDDD standards through the contract. This piece makes the same point from Brussels' side — the regulation doesn't need Swiss implementing law to reach a Swiss supplier, it just needs one EU customer with a compliance department.

The intuitive answer is "depends how much it's worth." The correct answer, laid out in our piece on Art. 322septies StGB, is that Switzerland never adopted a gift-value threshold — the question is whether the gift connects to an official act, full stop. A cheap gift tied to a pending decision is worse than an expensive one with no official act in sight. Compliance trainings that lead with a franc figure are teaching the wrong test.

Read alongside our piece on the Annex III delay: the high-risk obligations for border biometrics don't kick in until 2027, but the procurement contracts for the systems are being signed now. There's a connection here worth sitting with — the same surveillance-infrastructure question shows up in the Proton case above (who has to build retention capability) and in this morning's sanctions-list churn (who has to screen against it). Three stories, one underlying question: who bears the compliance cost of a state capability nobody voted on directly.

Closing the file on this one: our piece from May covered how the appeal against FINMA's licence withdrawal had suspensive effect until FinCEN's own action made the point moot. A reminder that a successful domestic appeal doesn't insulate you from a second regulator with its own timeline.