Internal Investigation Reports

Introduction

This section outlines the role and relevancy of internal investigation reports in the financial sector and particularly in the context of parallel or subsequent criminal proceedings related to the same underlying matter. This topic has been the subject of significant case law in Switzerland.

Against this backdrop, certain limitations apply and need to be carefully considered at the outset of an internal investigation.

One of the key questions is whether it is possible to avoid or challenge the prosecution authorities’ reliance on an internal investigation report by invoking (i) the right not to incriminate oneself (nemo tenetur principle), and/or (ii) attorney-client privilege, where outside legal counsel was instructed to conduct the internal investigation and issued a report.

Right not to incriminate oneself

In the financial sector, supervised entities and people within them are subject to a very broad duty to cooperate with the Swiss Financial Market Supervisory Authority (FINMA), which is responsible for monitoring the Swiss financial market and protecting its integrity. The key provision dealing with the cooperation duty is Article 29 of the Federal Act on the Swiss Financial Market Supervisory Authority.

As a result, supervised entities must provide FINMA, on their own initiative or upon request, with all documents and information which the regulator requires to carry out its supervision duties. In practical terms, the disclosure duties vis-à-vis FINMA often require the supervised entity to document its findings yielded during an internal investigation and to disclose the report (or at least the key findings) arising therefrom, which often identifies potential legal or regulatory shortcomings related to the underlying matter.

At times, however, the duty to co-operate with the regulator conflicts with the nemo tenetur principle, pursuant to which no person may be required to incriminate themselves by their own testimony, by positively providing evidence or through any other form of active cooperation in criminal proceedings. The conflict between these two principles becomes obvious where the information provided to FINMA (i) is incriminating for the supervised entity, and (ii) is subsequently shared by FINMA with the criminal prosecution authorities. Such sharing of information might typically occur in the context of mutual assistance proceedings and the exchange of information between authorities.

In Switzerland, companies such as banks are largely denied the right to invoke the nemo tenetur principle to prevent the prosecution authorities from getting hold of internal investigation reports, whether this occurs by means of coercive measures (dawn raids, seizures, etc) or through mutual legal assistance with FINMA.

The reasoning behind this is that (i) if documents and evidence already existed before coercion was applied, and (ii) they were issued notably in the context of administrative proceedings, without the threat of criminal penalties, the nemo tenetur principle does not apply (Swiss Federal Supreme Court [FSC] 142 IV 207). However, this strict stance tends to be softened in more recent FSC decisions (see, in particular, 7B_45/2022 of 21 July 2025, discussed below).

As a result of (i) the increasing appetite of prosecution authorities for internal investigation reports, and (ii) the very limited legal protection afforded to supervised entities and their employees, other avenues need to be considered by supervised entities concerning how the findings of internal investigations are documented and eventually shared with FINMA.

Attorney-client privilege: what is the scope of privilege protection?

While attorney-client privilege remains intact as a matter of Swiss criminal procedure law for lawyers defending the accused individual or a legal entity, the scope of protection is significantly more precarious for other participants (witnesses, informants, etc) or third parties to the proceedings. Indeed, for these other categories, recent case law has held that only Swiss, EU and EFTA-admitted lawyers – to which one should now add UK-admitted lawyers – benefit from attorney-client privilege protection in Switzerland (FSC 147 IV 385).

As a result, written communications between a client (who is not the target of a criminal investigation) and a US law firm, for instance, are not protected by attorney-client privilege if the information is seized by a Swiss prosecution authority. Consequently, such information may be accessed and exploited by the authority. This can be of relevance in the context of cross-border internal investigations in which non-Swiss/EU/EFTA lawyers are involved.

Moreover, where the purpose of an internal investigation is to assess a supervised entity’s compliance with AML rules and regulations, attorney-client privilege might not afford an absolute protection, even for Swiss lawyers. Indeed, according to case law, whenever an external counsel is tasked with an internal investigation related to the AML compliance of a financial institution, these fact findings amount to a delegation of the supervised entity’s core AML duties, and attorney-client privilege does not extend to this portion of the mandate (FSC 150 IV 470; FSC 1B_85/2016 of 20 September 2016). This is particularly true where lawyers perform compliance tasks (including the monitoring/controlling and documenting thereof) that are typically the duty of the bank itself (and are therefore being carried out on behalf of the bank). Such work products are not deemed privileged (FSC 150 IV 470; FSC 1B_433/2017 of 21 March 2018).

However, in two recent decisions (FSC 150 IV 470 and FSC 7B_874/2023, both dated 6 August 2024), the FSC addressed critical issues regarding the applicability and scope of legal privilege in internal investigations. As set forth below, the FSC affirmed the applicability of attorney-client privilege to internal investigation reports and resolved some uncertainties arising from earlier FSC-rulings. The FSC also found that a voluntary disclosure of such findings to a regulator does not necessarily constitute a waiver of client-attorney privilege. However, the FSC further held that attorney-client privilege does not extend to a third party to whom documents have been voluntarily disclosed (see also 7B_691/2024 and 7B_796/2024 of 7 February 2025 paragraph 5.2.3). In these cases, the bank was able to successfully assert attorney-client privilege. However, the Prosecutor’s Office was still able to obtain the information it sought from FINMA, especially as this information was derived from, but did not include, the privileged documents themselves.

Both FSC decisions originate from proceedings of the Public Prosecutor’s Office of the canton of Zurich against an individual as well as unknown participants within a bank, regarding alleged violations of the Federal Act on Unfair Competition (UCA). The bank had mandated a law firm with conducting an internal investigation into the matter.

The first decision (FSC 150 IV 470) deals with the law firm’s investigation report, which the Prosecutor’s Office requested from the bank. The bank produced the report but requested that it be sealed on grounds of legal privilege. The ensuing unsealing request was denied by the District Court. Upon appeal by the Prosecutor, the FSC upheld the lower court’s decision, confirming the applicability of attorney-client privilege to internal investigation reports. In short, the FSC stated that:

• in order to be protected by privilege, an activity needs to fall within the typical activities of lawyers (not compliance tasks or business management etc);
• the fact-finding contained in the internal investigation report was directly related to legal representation in ongoing or impending litigation, and as such constituted a typical activity of a lawyer and a vital part of any effective representation;
• while the raw data pool of original internal bank documents is not protected by attorney-client privilege, the process of review, analysis and selection of documents by lawyers qualifies them as a work product that warrants legal privilege; and
• sharing confidential information with selected third parties does not make the information public or indicate that the person sharing it intends to make it generally accessible.

However, the FSC went on to state that whether a third party can be compelled to testify or hand over documents is a distinct issue. Generally, if confidential information is voluntarily shared with a third party, it leaves the scope of the protected attorney-client relationship, meaning that attorney-client privilege does not prevent the third party from being obliged to testify or produce such documents (see hereafter).

In the very same matter, the Prosecutor’s Office also made a request to the bank’s regulator, FINMA, for documents pertaining to its enforcement proceedings, namely the enforcement order and the report of the investigation agent appointed by FINMA. This led to the second decision (decision 7B_874/2023 of 6 August 2024). The bank had invoked attorney-client privilege because FINMA’s documents were in part based on the internal investigation report and supporting documents which the bank had voluntarily provided to FINMA. The FSC ruled in favour of the Prosecutor’s Office, allowing the use of the documents in the criminal investigation. The FSC stated that (i) legal privilege does not extend to a third party to whom information was voluntarily and deliberately disclosed, as it has left the attorney-client relationship and, (ii) as the disclosure was not elicited by the threat of coercive measures by FINMA, the disclosure qualified as voluntary in the present case. The bank’s argument that, while handing over the respective documents to FINMA, it had explicitly stated that their co-operation did not constitute a waiver of the attorney-client privilege was not heard by the FSC which noted that the law allows FINMA to invoke supervisory privilege and that it can do so at its own discretion to take the disclosing party’s interests into account.

Implications and outlook

The most recent FSC decisions outlined above provide a welcome clarification on the scope of the attorney-client privilege. The FSC has now made it clear that attorney-client privilege generally covers internal investigations, including the establishment of the underlying facts and the pre-existing documents that have been analysed and selected by lawyers. Legal privilege certainly applies when the investigation is linked to ongoing or potential future legal dispute.

Where interactions with regulatory authorities such as FINMA are concerned, the most recent FSC decisions emphasise and illustrate the risk connected to any voluntary disclosure, by clearly stating that the attorney-client privilege does not extend to third parties and that it is at the sole discretion of FINMA whether to invoke regulatory privilege to oppose the sharing of information and documents with prosecution authorities. The fact that the targeted documents were not the privileged work product itself, but rather documents containing information derived from these privileged materials, may have been a detrimental factor in this second ruling which unlike the first decision has not been published in the official collection of the FSC.

Conclusion

There are many cases in which financial institutions engage outside counsel to conduct internal investigations and prepare a report, frequently as part of their duty to cooperate with their regulator. Such reports are often ultimately forwarded to the prosecution authorities and are used as incriminating evidence in criminal proceedings. As a result, tensions may well arise regarding the fundamental right not to incriminate oneself, as well as in relation to attorney-client privilege.

The FSC has invoked the principle of the rule of law in explaining that upholding attorney-client privilege outweighs the prosecution’s interest in unhindered access to evidence (FSC 150 IV 470). This has been put into perspective by the second FSC decision (7B_874/2023 of 6 August 2024), where the court prioritised the smooth collaboration between regulatory bodies and criminal authorities. In doing so, case law might further deter supervised entities from maintaining an open discourse and collaboration with the regulatory authorities regarding privileged documents. It remains to be seen whether this case law will increase the importance and frequency of supervisory privilege invoked by FINMA.

Inadmissibility in Criminal Proceedings of Evidence Submitted to FINMA

Introduction

Criminal proceedings, particularly within the financial sector, are frequently initiated as a result of criminal complaints filed by FINMA following pre-enforcement or enforcement actions. Moreover, due to FINMA’s denunciation duty and the extensive cooperation between FINMA and prosecution authorities (Article 38 et seq FINMASA), evidence gathered in FINMA proceedings often ends up as part of criminal proceedings. This inevitably raises the question of its admissibility, particularly considering the nemo tenetur principle.

This section examines a recent FSC decision (7B_45/2022 of 21 July 2025) that addresses this issue and marks a departure from previous case law.

Factual background and FSC decision

In 2014, B SA, with A as president and board member, sought confirmation from FINMA regarding its regulatory obligations for fund management activities. FINMA responded by requesting the completion of detailed questionnaires, emphasising the obligation to provide truthful information and warning of potential consequences for non-cooperation.

After B SA submitted the completed forms, FINMA filed a criminal complaint with the Federal Department of Finance (FDF) against the responsible persons for allegedly conducting unauthorised financial intermediary activities between 2012 and 2014. Administrative criminal proceedings were initiated, resulting in a penal order from the FDF and subsequent judicial review.

Ultimately, A was found guilty by the Federal Criminal Court, a decision that was partially upheld on appeal, before A brought the matter before the FSC, raising, among other issues, the violation of his right not to self-incriminate (nemo tenetur principle).

In its decision, the FSC reaffirmed that the nemo tenetur principle is a core component of the right to a fair trial under Article 6 of the European Convention on Human Rights (ECHR) and Swiss constitutional law. This principle protects individuals from being compelled, directly or indirectly, to provide evidence or statements that could expose them from a criminal-law standpoint.

The FSC further examined the statutory obligation to co-operate with FINMA under the Financial Market Supervision Act (FINMASA), noting that, while parties are generally required to provide information and documents in administrative proceedings, this obligation is not absolute. Specifically, the FSC highlighted that, when the information requested by FINMA could expose the individual or entity to criminal liability, the right to refuse cooperation applies, and the person or entity must be informed of this right before any evidence gathering by FINMA.

In the present case, the FSC found that FINMA had required B SA and A to complete detailed questionnaires as part of a pre-enforcement investigation, without informing them of their right not to self-incriminate. The FSC determined that the absence of such a warning, combined with the context and the risk of criminal liability, constituted a violation of procedural safeguards. The FSC clarified that the duty to cooperate in administrative law does not override the nemo tenetur principle when there is a risk of self-incrimination.

The FSC held that if such documents/statements (collected by FINMA without having informed the affected individual or company of their right not to self-incriminate) were to be admitted as evidence in criminal proceedings, this would undermine the procedural protections guaranteed by law and could enable law enforcement authorities to circumvent the safeguards of criminal procedure by first collecting evidence in an administrative context.

As a result, the Court concluded that evidence obtained in violation of the right not to self-incriminate – in this case specifically referring to the completed questionnaires – was inadmissible in subsequent criminal proceedings.

Accordingly, the FSC ordered that the contested decision be cancelled, and the case returned to the lower court for a new decision, explicitly excluding the inadmissible evidence from consideration. Consequently, the lower court was instructed by the FSC to assess whether the remaining evidence was sufficient to support a conviction.

Implications and outlook

The new FSC decision confirms that FINMA is, in principle, obliged to hand over evidence to the prosecution authorities and can only refuse to do so in exceptional circumstances outlined in Article 40 FINMASA. The person or entity affected by the sharing of documents/information between FINMA and the prosecution authorities is not a party to the cooperation proceedings and cannot prevent such information from being transmitted. However, the person or entity concerned can still dispute the admissibility of such evidence in criminal proceedings, especially invoking the nemo tenetur principle.

The FSC’s decision is based on the premise that the duty to collaborate with FINMA no longer applies where the person or entity concerned is exposed to criminal prosecution or if its position in pending or future criminal proceedings could be affected.

In the present case, FINMA had invited B SA and A to complete detailed questionnaires by stressing not only their duty to collaborate (Article 29 FINMASA) but also the criminal consequences of conducting unauthorised financial intermediary activities (Article 44 FINMASA) and providing inaccurate information (Article 45 FINMASA). In such circumstances, according to the FSC, nemo tenetur applies and prevails over the duty to collaborate. By failing to inform B SA and A about their right not to incriminate themselves, FINMA breached the nemo tenetur principle, rendering the evidence inadmissible in the FDF’s administrative criminal proceedings opened upon FINMA’s denunciation.

The FSC has issued a decision that, while not formally characterised as a landmark ruling, is nevertheless clear and strikingly progressive. Before this point, evidence gathered in administrative proceedings was deemed inadmissible in criminal matters only where it had been obtained through improper compulsion – eg, under threat of criminal sanctions (cf, FSC 142 IV 207, paragraph 8 et seq; FSC 140 II 384, paragraph 3.3; FSC 138 IV 47, paragraph 2.6).

This latest FSC decision 7B_45/2022 marks a clear departure from this reasoning, adopting a more rigorous approach that offers greater protection under the nemo tenetur principle and avoids its circumvention by law enforcement agencies through administrative proceedings.

It is also noteworthy that the FSC expressly states that the nemo tenetur principle applies not only to individuals in this context, but also to legal entities, as soon as they face the risk of criminal prosecution. For example, under Article 102 of the Swiss Criminal Code and/or Article 49 FINMASA. This statement is welcome as it contrasts with past decisions of the FSC which suggested that the nemo tenetur principle should not provide as much protection for corporations (see FSC 140 II 384, para. 3.3.4).

As a result of the FSC decision 7B_45/2022, we anticipate that:

• FINMA will have to proactively inform persons and entities from whom it seeks cooperation of their right not to incriminate themselves, particularly where there is a risk of criminal exposure;
• co-operation with FINMA and, ultimately, the latter’s supervisory activities could be affected where the relevant parties rely on their right not to incriminate themselves; and
• the outcome of pending criminal proceedings which rely on evidence collected by FINMA in breach of the nemo tenetur principle might be significantly affected.

How this FSC decision impacts the interaction between administrative and criminal proceedings outside the financial industry will also have to be monitored. There are indeed many other legal fields (eg, tax law) where the duty to co-operate with the administrative authorities often paves the way for a criminal prosecution, and, ultimately, a conviction.

Conclusion

The FSC’s decision in case 7B_45/2022 marks a significant shift in the treatment of evidence collected by FINMA for use in criminal proceedings. The FSC made clear that the right not to self-incriminate (nemo tenetur) takes precedence over the statutory duty to cooperate with FINMA whenever there is a risk of criminal liability. As a result, evidence obtained from individuals or entities without a proper warning of this right is inadmissible in subsequent criminal proceedings.

This development obliges FINMA to inform parties of their right to remain silent in situations involving potential criminal exposure, and it provides affected persons and entities with stronger grounds to challenge the admissibility of such evidence. The decision is likely to have a broader impact on the interaction between administrative and criminal proceedings, both within and beyond the financial sector, as authorities and courts adapt to these reinforced procedural safeguards.