AML programme
Read the PDF edition (2 pages)
The AML programme is the document regulators and banks ask for first and read most closely. Swiss and Singapore law impose the same architecture under different names: risk assessment, customer due diligence, ongoing monitoring, reporting, record-keeping, training and independent review.1 A group with entities in both hubs should write one programme with jurisdictional annexes, because the alternative is two programmes that diverge over time. The checklist below is the group version. A single-jurisdiction business strikes out the items that do not apply.
Checklist
- Board-approved AML policy stating the risk appetite, the prohibited client types and jurisdictions, and the governance of the programme.
- Enterprise-wide risk assessment covering client types, products, delivery channels, geographies and the specific risks of digital assets (mixers, privacy coins, high-risk exchanges, DeFi exposure, sanctions-exposed protocols).
- Client risk classification model with the criteria for standard, increased and high risk, and the approval level required for each.
- Identification and verification procedures for natural persons, legal entities, trusts, foundations and DAOs, including video and online identification where permitted (FINMA Circular 2016/7 in Switzerland; MAS requirements on non-face-to-face verification in Singapore).
- Beneficial ownership procedures: the 25 per cent threshold, the controlling persons fallback, the treatment of foundations and trusts, and the Swiss transparency register once in force.
- Politically exposed person procedures with the Swiss domestic and foreign PEP distinction and the MAS definition.
- Source of funds and source of wealth procedures with the specific evidence accepted for crypto wealth (wallet history, exchange statements, on-chain proof of control, tax returns).
- Occasional transaction thresholds: CHF 1,000 per 30 days for crypto exchange transactions in Switzerland; S$ 20,000 and the value-transfer rules in Singapore.
- Wallet screening and blockchain analytics procedures: provider, risk scoring, thresholds for enhanced review, treatment of indirect exposure, documentation.
- Travel rule procedures (see the next checklist).
- Transaction monitoring rules, alert handling, investigation documentation and time limits.
- Suspicious activity reporting procedures: to MROS under Art. 9 AMLA with the asset freeze under Art. 10; to STRO under s. 45 CDSA; tipping-off rules; decision authority; records of decisions not to report.
- Sanctions screening against SECO, UN, MAS, EU and OFAC lists, with wallet-address screening for listed addresses.
- Record-keeping for ten years (Switzerland) and five years (Singapore) in a form that allows reconstruction of each transaction.
- Training plan with annual refreshers, role-specific modules and attendance records.
- Independent testing: SRO or regulatory audit in Switzerland, independent audit under PSN02 in Singapore, internal audit for the group.
- Group-wide standards and intra-group information sharing protocol, with the data protection and secrecy constraints documented.
- Annual AML report to the board and the regulator where required.
Notes
- AMLA Art. 3–8; Anti-Money Laundering Ordinance-FINMA (AMLO-FINMA; GwV-FINMA, SR 955.033.0); MAS Notice PSN02 and its Guidelines; see Part F, Chapters III and VIII and Part L, Chapters II and VII. ↩
For general information only. This article does not constitute legal or tax advice, does not replace advice on an individual case and creates no lawyer-client relationship. It reflects the legal position as of October 2026.