A multinational with procurement operations across Europe and Switzerland discovers – mid-transaction review – that a payment made six months ago may have touched a counterparty subject to restrictions under both EU Council regulations and SECO ordinances. Two regimes. Two enforcement authorities. One internal investigation to run. The question is not merely what happened; it is how to investigate, what to preserve, what to disclose, and to whom, under rules that do not say the same thing.
Internal sanctions investigations under the EU regime and under Switzerland's SECO framework share a common objective – establishing whether a prohibited transaction occurred and what it means for ongoing compliance – but they differ materially on disclosure obligations, the weight given to voluntary cooperation, the enforcement posture of the administering authority, and the legal privilege that can be maintained over the investigation itself. As of March 2026, both regimes are active enforcement environments, and a business that investigates under one set of assumptions and ignores the other risks compounding its exposure.
This analysis maps the key divergences criterion by criterion, identifies the practical points at which the two regimes pull in different directions, and sets out the decisions a cross-border compliance team must make before the first interview is scheduled.
Who administers each regime, and what legal authority underpins it?
The EU sanctions regime is administered primarily through Council regulations, directly applicable across all Member States, with enforcement delegated to national competent authorities in each jurisdiction. There is no single EU enforcement body equivalent to OFAC or OFSI. A business operating across France, Germany, and the Netherlands faces three national authorities, each with its own procedural rules, investigation powers, and penalty scales, all applying the same underlying Council regulation. The EU General Court and the Court of Justice provide the judicial review route, but day-to-day enforcement is fragmented.
SECO – the State Secretariat for Economic Affairs – administers Swiss sanctions under the embargo ordinances issued pursuant to Switzerland's embargo legislation. Switzerland is not an EU Member State and does not transpose EU Council regulations. SECO issues its own ordinances, maintains its own lists, and conducts enforcement as the single competent authority at the federal level. This is a structurally simpler enforcement environment: one authority, one set of rules, one channel for voluntary engagement. That simplicity, however, does not mean a lighter touch in practice.
For a business with entities in both jurisdictions, the structural difference matters immediately. An internal investigation that satisfies the disclosure expectations of one national EU authority may not satisfy another. And a voluntary disclosure to SECO – with its single-authority architecture – is procedurally more straightforward than coordinating disclosures across multiple EU Member State regulators while avoiding inconsistent admissions.
The position above covers the standard case. Your facts – the counterparty, the goods, the payment route, the regime in play – change the analysis considerably. For a preliminary assessment of apparent violations under the EU regime, contact Calder & Vance at info@caldervance.com.
How do the two regimes treat voluntary disclosure and cooperation credit?
Voluntary disclosure – the practice of self-reporting an apparent violation to the competent authority before that authority discovers it independently – sits at the heart of any well-managed internal sanctions investigation. The two regimes treat it differently in ways that directly affect how an investigation is structured and sequenced.
Under EU Member State enforcement regimes, the weight given to voluntary cooperation varies by jurisdiction. Some national competent authorities have published guidance indicating that self-reporting and subsequent cooperation will be treated as significant mitigating factors in penalty determinations. Others have been less explicit. In our cross-border practice, we see material variation in how national authorities treat a firm that comes forward proactively versus one discovered through third-party reporting or transaction monitoring. There is no uniform EU-wide cooperation credit formula equivalent to the published guidelines of OFAC or OFSI.
SECO has demonstrated, in its published enforcement decisions and public guidance, a willingness to treat voluntary disclosure as a meaningful mitigating factor. Switzerland's single-authority structure makes the disclosure decision relatively clean: there is one authority to notify, one process to engage, and one channel through which cooperation credit can be earned. The timing of disclosure matters significantly – disclosure before SECO initiates an investigation of its own carries greater weight than disclosure made after a regulator enquiry has begun.
The cross-regime implication is this: a business that has exposure under both regimes must decide whether to disclose to each authority independently, to sequence disclosures strategically, and whether a disclosure in one jurisdiction creates an obligation or a risk in the other. These are decisions that require counsel active in both regimes before the disclosure decision is made, not after.
What are the divergences on legal privilege and document protection during an internal investigation?
Legal professional privilege – the protection that prevents compelled disclosure of confidential communications between a client and its legal adviser – operates differently across the EU and Switzerland, and those differences shape how an internal investigation should be documented.
Within the EU, privilege over in-house counsel communications is not uniformly protected at the Member State enforcement level. The Court of Justice has confirmed, in the context of EU competition law, that communications with in-house lawyers do not attract the same privilege protection as those with external, independent counsel admitted to a bar in an EU Member State. While sanctions enforcement is conducted at the national level and national procedural laws apply, businesses should not assume that interview notes prepared by in-house compliance officers will receive the same protection as external counsel memoranda. In practice, the most protective structure is for external EU-qualified counsel to lead the investigation and to hold the privileged work product.
Under Swiss law, legal professional privilege attaches to licensed Swiss attorneys. Communications with external Swiss lawyers engaged to conduct or oversee the investigation are protected. As with the EU position, in-house communications carry a more uncertain status, and the protection afforded by Swiss procedural law to documents held by the company itself differs from the protection available to documents held by external Swiss counsel.
The practical divergence is this: a single investigation document set, prepared under one privilege standard, may not receive the same protection when a different authority demands access. Businesses running parallel EU and SECO investigations should consider whether a single external counsel structure – or a co-counsel arrangement with practitioners qualified in both jurisdictions – can maintain consistent privilege across the full document set.
How do enforcement postures and penalty structures compare?
Enforcement posture – how actively and how severely a competent authority pursues apparent violations – shapes the risk calculus of every internal investigation decision. EU Member State authorities and SECO sit in materially different positions on this dimension.
EU Member State enforcement has intensified since 2022, with several national competent authorities significantly expanding their sanctions enforcement units, increasing the frequency of outreach to financial institutions and corporates, and publishing enforcement decisions with a degree of transparency not previously common. Penalty scales differ by Member State, but the upward trend in enforcement activity is consistent across the major European jurisdictions. The fragmented enforcement architecture means that a business with entities in multiple Member States can face simultaneous or sequential investigations by different national authorities for the same underlying conduct.
SECO's enforcement posture is measured and transparent. It publishes its enforcement decisions, and its penalty practice has historically reflected the scope of the violation and the degree of cooperation. The authority has increased its activity in line with the expansion of Swiss sanctions measures, particularly since Switzerland adopted measures aligned with EU positions on specified regimes. That alignment is not automatic: Switzerland assesses its own measures on its own legislative schedule, and there are periods where EU restrictions exist but the corresponding SECO ordinance has not yet been amended to match.
That gap – the window between an EU restriction and its Swiss equivalent – is a recurring source of cross-border risk. A transaction that is prohibited under EU Council regulations may not yet be prohibited under the applicable SECO ordinance, or vice versa. An internal investigation must map both regimes to the timeline of the transaction, not assume that they were identical at the relevant date.
If a transaction has already been flagged, or a filing has been refused, an early review can preserve options that narrow with time. Contact Calder & Vance at info@caldervance.com to discuss your position under either regime.
What are the key procedural divergences in running the investigation itself?
An internal sanctions investigation – as distinct from a regulatory audit or a transaction review – involves a defined set of procedural steps: scoping, evidence collection, witness interviews, document preservation, analysis, findings, and a disclosure or remediation decision. The two regimes create different pressures at each stage.
Under the EU regime, the first procedural question is which national authority or authorities are relevant to the apparent violation. If the transaction touched EU financial infrastructure, EU-established entities, or EU-listed persons, there may be several Member State authorities with a legitimate interest. The internal investigation must scope not only the conduct but the regulatory geography: which entities are in scope, in which Member States, and which national authority would receive a disclosure or an enquiry. Getting this wrong – disclosing to one national authority while a different authority is the more directly relevant regulator – is a material procedural error.
Under SECO, the procedural sequence is simpler. SECO is the single federal authority. The internal investigation should identify whether Swiss-established entities, Swiss financial infrastructure, or Swiss-resident persons were involved. If so, SECO is the competent authority. The disclosure decision is made to one body, under one procedural regime, with one set of expectations. This does not reduce the forensic demands of the investigation, but it reduces the coordination burden materially.
Document preservation is a point of shared importance. Both regimes expect that a business discovering an apparent violation will act to preserve relevant records immediately. Destruction – or even routine document management that has the practical effect of destroying relevant records after a potential violation is identified – creates an independent compliance failure that compounds the original issue. In our experience, businesses that delay the preservation decision while awaiting internal sign-off have routinely found that retention periods have passed before the investigation formally begins.
Witness interviews require careful handling under both regimes. Interview notes should be prepared under external counsel privilege where possible. The interviewee should understand the purpose of the interview and should not be given false assurances about how the information may subsequently be used. Under EU Member State regimes, employee rights – including works council consultation requirements in several jurisdictions – may affect how and when interviews are conducted. No comparable employee-representation constraint applies under SECO practice, though Swiss employment law has its own protections that counsel active in Switzerland should address.
Where do the regimes diverge most sharply? A criterion-by-criterion map
Five criteria account for the most operationally significant divergences between an EU internal sanctions investigation and a SECO internal sanctions investigation. Each one requires a specific decision before work begins.
Enforcement architecture. The EU regime is multi-authority and jurisdiction-specific; SECO is a single federal authority. The immediate practical effect is that EU investigations require a preliminary mapping of which national authorities are in scope before a disclosure strategy can be designed. A SECO investigation does not carry this burden.
Cooperation credit. Under SECO, voluntary disclosure to a single authority produces a cleaner and more predictable cooperation credit outcome. Under the EU regime, the value of voluntary disclosure varies by Member State, and there is no uniform published formula. A business disclosing under multiple EU national regimes cannot assume that the same disclosure approach will receive equal credit from each authority.
Privilege. External, independent counsel hold the most protective privilege position under both regimes. In-house counsel communications are more vulnerable under EU competition-derived doctrine, and the position in individual Member States on sanctions enforcement investigations requires specific advice. Swiss privilege for licensed Swiss attorneys is well-established, but the cross-border privilege question – whether Swiss-attorney privilege protects documents demanded by an EU authority – is not a given.
Temporal alignment of restrictions. The EU and SECO restrictions are not always identical at the same point in time. An internal investigation must reconstruct the precise legal position under each regime at the date of the transaction, not at the date of the investigation.
Penalty and remediation outcomes. Both regimes have civil and, in serious cases, criminal enforcement routes. The specific penalty parameters differ and should be verified against the current position before any remediation or disclosure decision is made. What is common to both is that the quality of the internal investigation itself – its thoroughness, its privilege structure, the credibility of its findings – is the single most significant variable a business controls once the underlying conduct has occurred.
What is the common myth a cross-border business should correct before it starts?
The most persistent myth we encounter is this: "We are a Swiss entity, so EU sanctions do not apply to us." This is incorrect in several directions at once. EU sanctions apply to transactions conducted in whole or in part within the EU, to EU-established entities and branches, to persons present in the EU, and – under certain measures – to conduct outside the EU that touches EU financial infrastructure or involves EU-incorporated entities in the ownership chain. A Swiss-headquartered group with subsidiaries or branches in EU Member States, or that processes payments through EU correspondent banks, is not outside the reach of EU Council regulations merely by reason of its Swiss domicile.
The reverse error is equally common: assuming that because EU measures have been adopted, Switzerland has automatically adopted the same restrictions. Switzerland assesses each set of measures independently. There are points at which EU restrictions have been tighter than SECO restrictions, and points at which the reverse has been true. A business cannot treat the two regimes as interchangeable. An internal sanctions investigation that maps only one regime and assumes the other matches it will reach inaccurate conclusions about the scope of any apparent violation.
In our practice we regularly advise businesses that have begun an internal investigation under one regime's assumptions and have then needed to reopen the scope when the second regime produces a different legal analysis. Reopening a partially completed investigation is costly, delays the remediation decision, and – where a privilege boundary has already been crossed through inconsistent documentation – can compromise the overall privilege structure.
How should a cross-border business approach the decision to involve external counsel?
The decision to bring in external sanctions counsel is itself a key procedural choice. It is not a decision to make after the internal investigation is complete and a problem has been found. Counsel should be engaged before the investigation design is finalised, for three reasons.
First, privilege attaches from the point of engagement. An internal investigation report prepared without external counsel is not privileged in most EU and Swiss procedural contexts. One prepared under external counsel supervision, as part of a legal advice exercise, has a stronger – though not absolute – claim to privilege. The earlier counsel is engaged, the larger the protected document set.
Second, the investigation scope must be designed to cover all potentially relevant regimes. A compliance team that has not previously handled a cross-border EU and SECO investigation may scope it too narrowly – focusing, for example, on the Swiss transaction and missing the EU element, or vice versa. External counsel who are active in both regimes can identify the full regulatory geography at the outset.
Third, the disclosure decision requires legal advice specific to both regimes before it is made. In our cross-border practice, we have seen businesses make disclosure to one authority before understanding their position under the second, only to find that the disclosure created an obligation or a risk that adequate preparation could have managed. The sequencing of disclosures, the content of any voluntary disclosure submission, and the decision whether to disclose at all in respect of a given authority are all matters of legal judgment, not compliance process.
We have acted for financial institutions, trading companies, and manufacturing groups in internal investigations where the initial apparent violation involved both EU and SECO restrictions. In those matters, the quality of the initial investigation design – scope, privilege structure, document preservation, and disclosure sequencing – proved to be the decisive factor in the final regulatory outcome. No outcome can be guaranteed; but a well-constructed investigation puts a business in the strongest position it can occupy given the underlying facts.
Related practices
- Apparent Violation Assessment – EU – assessing scope, exposure and disclosure options under EU Council sanctions regulations
- Internal Investigations: OFAC vs Canada – how the US and Canadian regimes diverge on investigation procedure and voluntary disclosure
- Internal Investigations: OFAC vs OFSI – a criterion-by-criterion comparison of US and UK investigation and disclosure regimes