Casimir von Firn's piece today runs Article 30 DORA clause by clause — the provision that specifies exactly what must appear in every ICT service contract for supervised institutions, including the audit right and the exit-strategy requirement. Most contracts signed before 17 January 2025 are short several of them. FINMA's April 2026 media conference again identified cyber and ICT resilience as a principal supervisory risk; the gap between "our ICT framework says the right things" and "our contracts actually contain the required provisions" is precisely where enforcement conversations begin.

Also Casimir von Firn today: what happens when your no-sanctions representation was accurate when you signed but the SECO or EU list updated before you closed? The Sudan ordinance under Annex 2 of SR 946.231.18 was revised on June 5 — nine days ago. Our MAC clause piece from May 30 covered the change-in-law angle; this one addresses the representation mechanics and what bring-down language actually needs to say to work. If your current rep doesn't have a bring-down with a list-update carve-out, that is a conversation to have before next closing.

Dr. iur. Servatius von Tatzenberg's piece on Wendelspiess Partners documents what enforcement practitioners have observed for two years: the industry ban under Art. 33 FINMAG has become FINMA's default response to serious personal misconduct at supervised institutions, not an exceptional sanction. The Wendelspiess facts are specific; the principle is general. The institutional question for any compliance function is how to frame "responsible person" risk when the consequence at the far end is an indefinite professional ban rather than a fine. The answer requires rethinking accountability structures, not drafting better policies.

The partial revision of FINMA's Anti-Money Laundering Ordinance closed for consultation on June 9. We flagged in May that three clauses shift the burden on beneficial ownership documentation despite FINMA's "no new obligations" framing. The industry file is now closed. Q3 is the likely timeline for the final text and transition guidance; the "layered structures" clause — the one with the most practical bite for funds and holding companies — is the one to watch.

Connection worth making: DORA Article 30 and the AMLO-FINMA revision are not the same regulation or the same regulator, but they're running the same play simultaneously — closing the gap between framework adoption and actual implementation in contracts and compliance systems. FINMA is squeezing from both sides at once.

WBF revised Annex 2 of the Sudan ordinance (SR 946.231.18) nine days ago. Routine maintenance — but if your periodic screening runs on a calendar-month cycle with a June 1 refresh, you missed it. The Sudan regime is bilateral mandate, not UN-track, so country-based screening workarounds don't catch it. Run the check this week, then check the update frequency assumptions in your screening program design.

SECO amended SR 946.231.08 on March 31, 2026 (FINMA notice published April 1). This is the UN 1267-track ordinance we covered in May — the one that doesn't surface in country-based screening because the designations run on UN mandate, not by nationality. A quarterly cycle with a March last-run has been running blind against this list for two and a half months. Patch it, then reconsider whether quarterly is still the right interval given the current update cadence across all Swiss sanction regimes.

WBF amended Annexes 12 and 14 of the Iran ordinance (SR 946.231.143.6) in April — the first revision since the December 2025 total revision replaced the JCPOA-era framework with a new architecture. Useful calibration: the new Iran regime is running on a roughly quarterly amendment cadence. If your compliance program was designed around the old, slower update cycle, adjust the review frequency accordingly.

FINMA's January guidance on crypto-asset custody — which moved the segregation analysis from the ledger to the wallet — is five months old. Practitioners report that custody arrangements structured around the Lehman-test for securities-law segregation have not been retested at the wallet level. The insolvency scenario is where the gap bites. If this is on your Q3 agenda, it should probably move to Q2 — the question of whether wallet-level controls actually work under Swiss insolvency law doesn't become easier with more time.

FINMA's Zürich office relocates to Oerlikon — cost savings, better working conditions per workstation. The practical implication for firms that use proximity for informal supervisory pulse-taking: FINMA now concentrates in Bern and Oerlikon, further from Paradeplatz than the current Wasserwerkstrasse location. Nobody will say it affects supervisory tone. Worth noting when planning your next compliance briefing venue.

Swissinfo covers AI deployment at European border crossings — automated screening, biometric matching — that sits in the category the EU AI Act's Annex III was designed to govern. We noted in May that Annex III high-risk obligations are deferred to August 2027 for systems already deployed (new systems face the August 2026 deadline), but the technology is live under existing national frameworks right now. The gap between "we sell into this use case" and "we have a conformity assessment ready for 2027" is closing faster than most vendors realize. Swiss suppliers into border-management AI should treat 2027 as an operational deadline, not a planning horizon.

Law.com reports a consistent pattern: Hong Kong's largest foreign firms continue downsizing while Reed Smith opens in Saudi Arabia and multiple firms hire Riyadh partners. The Geneva and Zurich angle: Middle East holding structures and cross-border M&A that used to route through Hong Kong increasingly flows through Swiss-law vehicles.

Swissinfo reports Switzerland handling more international bribery investigations but notes persistent gaps in outcomes — attributing them in the piece to prosecutorial resource constraints and light penalties, not compliance program design. Our May analysis placed the gap elsewhere: Art. 102 Abs. 2 StGB corporate liability requires documented organizational failures, and most compliance programs still don't generate the records prosecutors need — or that companies would need to mount a defense. More cases opened raises the probability that one of them lands on a firm that treated the risk as theoretical. The open question our May piece flagged, and not one the Swissinfo article raises: whether MROS referral rates are driving the new case volume, or bilateral cooperation channels. The answer changes how you assess your exposure.