Compliance & data protection
Proportionate compliance: from data protection basics to FINMA licensing.
Compliance programmes written for multinationals do not survive contact with a 40-person company. We size the framework to the actual risk profile: what regulators will ask for, what customers audit, and what would genuinely damage the business if it went wrong. That includes supervised firms and companies applying for a FINMA licence, where the standard is set by the regulator rather than by the market.
What we do
Data protection
revFADP and GDPR gap analysis, records of processing, privacy notices, data processing agreements, international transfer mechanisms and breach response procedures.
Financial market regulation and licensing
FINMA authorisation and licence applications, regulatory submissions and supervisory correspondence, subordination questions for asset manager, trustee and fintech models, and the regulatory assessment of new technologies such as AI and blockchain.
Financial crime and governance
AML obligations and KYC procedures, sanctions and export-control screening, anti-bribery policies, plus risk registers, internal control documentation, delegation of authority, whistleblowing channels and board reporting that fits the company's size.
Audits, incidents and compliance rebuilds
Preparation for customer and regulator audits, internal investigations, support when an incident has already happened, and rebuilding or restructuring a compliance function after supervisory findings.
Typical situations we are called in for
- You need a privacy notice and/or a data processing agreement
- Personal data is processed across several tools and nobody has mapped it
- You are applying for a FINMA licence, or need to know whether your model requires one
- Supervisory findings landed and the compliance function needs to be rebuilt
Discuss your matter
Tell us briefly what you are dealing with. We will point you to the lawyer in the network who handles this kind of matter day to day.