FINMA licence: when it is really needed

“Do I need a FINMA licence?” is one of the most frequent — and most often poorly framed — questions asked by those starting a financial activity in Switzerland. The answer is not “yes” or “no” in the abstract: it depends on exactly what you do. Many activities require no authorisation at all; others are covered by membership of a self-regulatory organisation; still others require a genuine FINMA authorisation. Confusing the three levels leads to two opposite errors, both costly: seeking unnecessary authorisations or operating without the necessary ones.

The principle: the activity is what matters, not the label

The supervisory authority does not regulate persons or labels, but activities defined by law. A company may call itself a “management company” or a “fintech platform” without this saying anything about its status: what counts is whether it actually carries out one of the activities that the regulations make subject to authorisation. That is why the starting point is always a precise mapping of what you do and with whom.

The three levels, in practice

1. Activities that require no authorisation. Advisory, structuring, fiduciary and administrative services, accounting and legal support: many business-service activities are not in themselves subject to authorisation. They remain subject to the general rules, but do not require a licence.

2. Activities that require SRO membership. Financial intermediation within the meaning of the anti-money laundering act — for example providing payment, exchange or custody services under certain conditions — does not necessarily require a banking licence, but it does require subjection to the AMLA through membership of a self-regulatory organisation (SRO) or affiliation with an entity that is already supervised.

3. Activities that require a FINMA authorisation. Some activities require a genuine authorisation, with requirements as to capital, organisation and the guarantee of irreproachable business conduct. These include, by way of example:

• Accepting deposits from the public (banking activity).
• Managing collective assets or providing asset management services above certain thresholds and conditions.
• Providing trading services in securities as a securities firm.
• Operating a financial market infrastructure.

The crypto case

In the crypto-asset sector the three levels intertwine. The structuring of a project, the classification of a token, the drafting of a whitepaper and tax and accounting coordination are not, in themselves, authorised activities. They become regulated when you move on to holding tokens on behalf of third parties, providing payment or exchange services, engaging in intermediation or placing security tokens with the public. The same project may therefore have a free part and a part that requires an authorisation or a membership: distinguishing them is exactly the work to be done before starting.

The most costly mistake: realising it too late

Operating without the necessary authorisation is not a formal defect: it may entail an obligation to cease the activity, proceedings and personal liability for those who ran it. At the opposite extreme, launching the procedure for an authorisation you do not need means burning months and resources. Both errors stem from the same cause: not having mapped the activity before starting. The correct sequence is: define the activity, identify the level, build the structure accordingly.

How SIH ONE approaches the topic

SIH ONE handles structuring and advisory: mapping of activities, identification of the licensing perimeter, design of the corporate and governance structure, preparation of documentation. Where a FINMA authorisation or SRO membership is required, regulated activities go through authorised partners, unless and until the perimeter is formalised differently. The goal is for you to know, before you start, which of the three levels you are in and what it entails.

This content is informational and does not constitute legal or regulatory advice. The framework evolves: every activity must be verified on its specific facts.

Not sure whether your activity requires an authorisation? Together we map what you do and identify the correct perimeter, with the right partners where authorisation is needed. Let’s talk.