Swiss Banking Secrecy Communications: How to Review Client Content for Confidentiality Compliance

Swiss banking secrecy — enshrined in Article 47 of the Federal Act on Banks and Savings Banks (Banking Act) — remains a criminal offense to violate, punishable by up to five years' imprisonment and fines up to CHF 250,000. While international developments like the Common Reporting Standard (CRS) and bilateral tax information exchange agreements have significantly reduced secrecy in cross-border tax matters, banking secrecy continues to protect client information in domestic contexts and against unauthorized disclosure.

For Swiss banks, private banks, wealth managers, and financial intermediaries, the content of every client communication, internal document, and external publication must be reviewed against confidentiality requirements. A single improperly disclosed client detail — in an email, a report, a marketing case study, or even an internal presentation shared too broadly — can constitute a criminal violation.

The Legal Framework

Banking Secrecy Scope

What Banking Secrecy Protects

Banking secrecy covers all information about the bank-client relationship, including:

• The existence of the relationship itself
• Account balances and transaction history
• Investment holdings and portfolio composition
• Advisory discussions and recommendations
• Loan applications and credit decisions
• Trust and fiduciary arrangements
• Beneficial ownership information
• Any information that could identify a client or their financial position

Exceptions and Limitations

Banking secrecy is not absolute. Legally authorized disclosures include:

• Client consent (explicit or implied within defined scope)
• Court orders and judicial proceedings
• FINMA supervisory requests
• Criminal investigations (within defined scope)
• CRS and tax information exchange treaty obligations
• Anti-money laundering (AML) reporting obligations
• Within the same banking group (with appropriate safeguards)

Common Confidentiality Compliance Issues in Content

1. Marketing and Case Studies

Banks and wealth managers often want to showcase their expertise through case studies, performance examples, and client testimonials. Confidentiality risks include:

• Case studies that contain enough detail to identify specific clients
• Performance examples derived from actual client portfolios without aggregation
• Client testimonials where the client's identity is disclosed without written authorization
• Marketing materials that reference specific transactions or deal sizes from identifiable clients
• Conference presentations that discuss specific client situations

Best practice: Use hypothetical examples, aggregated data, or fully anonymized case studies where no combination of details could identify a client.

2. Internal Communications

Banking secrecy applies not just externally but also internally:

• Need-to-know principle — client information should only be accessible to staff who need it
• Internal presentations and reports should be classified by confidentiality level
• Email distribution lists should be reviewed to prevent unnecessary information access
• Cross-departmental sharing requires documented business justification
• Compliance reports circulated internally must protect client identity

3. Regulatory Reporting Content

While banks are required to report certain information to FINMA, tax authorities, and other regulators, the content of these reports must be precise:

• Only information required by law or regulation should be included
• Voluntary disclosure beyond what is legally required may violate banking secrecy
• CRS and AEOI reporting must follow the defined scope — not exceed it
• AML suspicious activity reports must be proportionate and factual

4. Digital and Cloud Communications

The move to digital banking and cloud infrastructure creates new confidentiality challenges:

• Client data in emails, messaging apps, and collaboration tools must be encrypted
• Cloud storage of client documents must comply with data localization requirements
• Video conferencing about client matters requires appropriate security
• Mobile device management must prevent unauthorized access to client information

A Client Communication Confidentiality Checklist

• No client-identifying information in marketing materials without written consent
• Case studies are hypothetical, aggregated, or fully anonymized
• Performance examples cannot be reverse-engineered to identify clients
• Client testimonials have documented written authorization
• Internal documents are classified by confidentiality level
• Email distribution lists are reviewed for need-to-know compliance
• Cross-departmental sharing has documented business justification
• Regulatory reports contain only legally required information
• CRS/AEOI reporting follows defined scope without excess disclosure
• Digital communications are encrypted where containing client information
• Cloud storage complies with data localization requirements
• External presentations do not reference identifiable client situations
• Third-party service providers have appropriate confidentiality agreements
• Annual review of all published content for ongoing confidentiality compliance

Building a Confidentiality Review Process

Swiss financial institutions should implement a structured confidentiality review workflow:

1. Content classification: Assign a confidentiality level to every document and communication
2. Client information scanning: AI-assisted detection of potentially identifying client information in marketing materials, reports, and presentations
3. Anonymization verification: Review anonymized content to ensure no combination of details could re-identify a client
4. Distribution review: Verify that recipient lists comply with need-to-know principles
5. Periodic audit: Annual review of published and distributed content for confidentiality compliance

TeamBench enables Swiss financial institutions to build confidentiality-specific content reviewers that scan communications for potentially identifying client information. Custom criteria can check for named clients, identifiable transaction details, portfolio specifics, and relationship references — catching confidentiality risks before content is published or distributed.

In a jurisdiction where banking secrecy violations carry criminal penalties including imprisonment, the quality of your content review process is not just a compliance matter — it is a personal liability shield for every employee who handles client information.