A Swiss trading company closes a commodity transaction. Weeks later, an internal audit flags that the counterparty held a minority stake in an entity under the Swiss embargo. The compliance team freezes. Did a breach occur? Who must be notified? How quickly does the firm need to act? These are not abstract questions. They carry real legal consequences under Swiss embargo law, and the window for orderly remediation is short.
Remediation after a sanctions breach under SECO – the State Secretariat for Economic Affairs, Switzerland's primary sanctions authority – follows a defined sequence: scope the apparent violation, assess the legal basis under the applicable Swiss embargo ordinance, report to SECO if disclosure is required, and rebuild controls to prevent recurrence. Switzerland operates an autonomous sanctions regime that aligns closely with, but does not automatically mirror, EU Council measures. As of March 2026, SECO administers a significant portfolio of country and thematic embargoes, and its enforcement posture has tightened in recent years.
This guide walks through each stage of post-breach remediation under the Swiss regime, notes where the analysis diverges from OFAC, OFSI, and EU positions, and identifies the risk flags that most frequently complicate the process in our cross-border practice.
Step 1: Identify the governing regime and the legal basis
The first step in any SECO remediation is to identify precisely which legal instrument applies to the apparent breach. Switzerland's sanctions rest on the Federal Act on the Implementation of International Sanctions – the Embargo Act – and the implementing ordinances that SECO issues for each programme. Each ordinance is programme-specific: the prohibitions for one country or thematic target do not automatically extend to another, and the carve-outs and licensing provisions differ between them.
Begin with a plain reading of the relevant ordinance. What activity does it prohibit? Does the prohibition cover the specific transaction type – goods, funds, services, or a combination? Was the counterparty a designated person, an entity subject to an asset freeze, or an entity caught through an ownership or control test? The answers to these questions determine whether a breach occurred at all, and if so, under which instrument.
Switzerland applies ownership and control (the test under which a non-listed entity may be caught because a listed person owns or controls it) in a way that is broadly consistent with EU practice. The SECO regime looks beyond formal ownership to de facto control. This is different from OFAC's mechanical 50 percent aggregate ownership threshold under the EAR and IEEPA. A transaction that would not trigger an OFAC breach because no single ownership line reaches the threshold may still constitute a breach under the Swiss or EU tests if a listed person exercises effective control through other means.
In our experience, firms that operate across the Swiss and EU regimes simultaneously sometimes apply the OFAC ownership test by default and miss control-based exposure under SECO. Getting the legal basis right at this stage shapes every subsequent decision.
Step 2: Scope the apparent violation – what actually happened?
Once the governing ordinance is identified, scope the facts of the apparent violation before taking any external step. A premature or inaccurate disclosure can be more damaging than a carefully prepared one. The scoping exercise has three components: transaction reconstruction, counterparty mapping, and internal-records review.
Transaction reconstruction means building a chronological account of what occurred. When was the contract signed? When did funds move? What goods or services were involved? Were any intermediate parties involved in the payment or delivery chain? Each event is dated and sourced to a document.
Counterparty mapping traces the ownership and control structure of every party at the time of the transaction. This is often where the analysis is most contested. A listed person may have appeared on the SECO list after the contract was signed but before delivery occurred. The question of whether a continuing transaction must be unwound, or whether completion is still prohibited, turns on the dates of designation relative to the transaction lifecycle. Have you confirmed the exact designation date against your own deal timeline?
Internal-records review covers screening logs, sign-off documentation, and any communications in which employees identified or discussed the counterparty's status. These records matter both for assessing culpability and for demonstrating to SECO – if disclosure follows – that the apparent violation was not wilful. In a recent matter, a financial services firm discovered that a screening alert had been dismissed without escalation. The remediation strategy turned in part on documenting the process failure and showing that new controls had closed it. The outcome of that matter cannot be guaranteed as a model for others, but the lesson – document what failed, not just what happened – is consistent across SECO enforcement.
Step 3: Assess the disclosure obligation
Switzerland's embargo law imposes a reporting obligation on persons who hold frozen assets or who become aware that assets subject to a freeze are within their sphere of control. The obligation is active: knowledge of a freeze, or of a transaction that may have infringed an ordinance, triggers a duty to report to SECO without delay. This is not a voluntary self-disclosure regime in the style of OFAC's VSD (voluntary self-disclosure) programme, where a firm elects to self-report in exchange for a defined penalty reduction. Under the Swiss regime, the duty arises by law.
Several questions determine the scope and urgency of the obligation. Was frozen property involved? Is the asset still under the firm's control? Is the transaction completed or still in progress? Has any fund transfer occurred that amounts to a dealing in frozen assets? Answering these questions honestly, on the basis of the scoped facts, is the foundation of the disclosure decision.
Where disclosure is required, it must be made to SECO, typically through the State Secretariat's contact channels for embargo matters. The notification should cover: the identity of the parties, the nature of the transaction, the asset or value at stake, the date on which the firm became aware, and the steps already taken. Precision matters. SECO is accustomed to receiving notifications and will follow up with questions; a well-prepared first notification reduces the volume of subsequent correspondence and reduces the risk of the matter escalating to a formal investigation.
The position above covers the standard case. Your facts – the counterparty, the goods, the route, the regime in play – change the analysis. For a confidential review of a potential breach, contact us at info@caldervance.com.
How does the Swiss disclosure route differ from OFAC, OFSI, and EU equivalents?
The cross-regime comparison matters because most firms dealing with a SECO breach also operate under at least one other major sanctions regime. The disclosure and remediation postures diverge in ways that can create conflicting obligations or require sequenced action.
Under OFAC, a VSD is discretionary but carries a defined penalty benefit: a voluntary self-disclosure can reduce the base civil penalty by up to half. The OFAC process involves a formal submission to the Office of Foreign Assets Control with a detailed description of the apparent violation, and OFAC will issue a No Action Letter, a Cautionary Letter, or a penalty finding. There is no equivalent automatic penalty-reduction mechanism in the Swiss regime.
Under OFSI – the UK's Office of Financial Sanctions Implementation – the mandatory reporting obligation under the Sanctions and Anti-Money Laundering Act ("SAMLA") requires certain regulated firms to report knowledge or reasonable suspicion of a sanctions breach. The reporting window is short. Failure to report is itself an offence. The Swiss duty-to-report shares the mandatory character of the OFSI obligation, but the penalty structure and the licensing route for post-breach transactions differ.
Under EU Council regulations, the obligation to report frozen assets to competent national authorities in each member state is similarly mandatory. The EU regime also contains a prohibition on satisfying claims that would circumvent asset freezes – a provision that interacts with the Swiss position when a cross-border payment has been made from Switzerland into an EU member state. In such cases, both regimes may be engaged simultaneously, and the notification must be coordinated rather than sequential.
The key practical divergence: OFAC rewards voluntary disclosure with a defined procedural benefit. SECO, OFSI, and the EU operate mandatory reporting as the baseline, with enforcement discretion applied at the investigation and penalty stage rather than at the point of disclosure. If a firm is deciding whether to disclose a potential breach, the multi-regime dimension should inform the sequencing. Disclosing to one authority before another can affect the legal position under each.
If a transaction has already been flagged, or a filing has been refused, an early review can preserve options that narrow with time. Write to us at info@caldervance.com to discuss the multi-regime position.
Step 4: Engage with SECO – managing the process
Once disclosure has been made, the firm enters the SECO process. This typically begins with SECO acknowledging the notification and requesting further information. The authority may seek copies of contracts, payment records, and correspondence, as well as the firm's account of how the apparent breach occurred and what action has been taken since. Responding to these requests requires the same precision as the initial notification.
SECO has the power to conduct administrative investigations and to refer matters to the Federal Department of Economic Affairs, Education and Research for criminal enforcement. The Embargo Act provides for criminal sanctions – fines, and in serious cases, custodial measures – where violations are wilful or grossly negligent. Administrative and criminal tracks can run in parallel. The distinction between an administrative matter and a criminal referral is often made at this stage, based on the apparent severity of the breach, the firm's cooperation, and the evidence of intent or negligence.
Cooperation with SECO is not the same as waiving rights. A firm may respond to SECO's inquiries fully and accurately while still preserving its right to contest findings of fact or law. Legal privilege covers communications between the firm and its lawyers in connection with the investigation. Internal legal advice and attorney work-product prepared in anticipation of the investigation should be identified and protected before documents are reviewed or produced. This is a step that is sometimes overlooked in the urgency of responding to a regulator's request.
The timeline for a SECO investigation is not prescribed by statute in a way that imposes a defined deadline on the authority. In practice, straightforward matters with proactive disclosure and clear facts are resolved more quickly than contested cases. We regularly advise clients to establish a single point of contact within the organisation for all SECO correspondence, to maintain a running log of every exchange, and to avoid informal communications with the regulator that are not documented.
Step 5: Remediate the controls programme
Disclosure and cooperation with SECO are necessary. They are not sufficient. Regulators – across all major regimes – treat the post-breach period as a test of the firm's commitment to compliance. A firm that reports a breach and then makes no demonstrable change to its controls is in a weaker position than one that presents a structured remediation plan alongside its notification.
A SECO remediation plan should address at least four elements. First, root-cause analysis: what failure in the controls programme permitted the breach to occur? Was it a screening gap, a process failure, an oversight in the ownership-mapping methodology, or a training deficit? Second, immediate fixes: what has already been done to prevent a recurrence? Suspending the relationship, correcting the screening logic, and re-running recent transactions through an updated screening tool are typical immediate steps. Third, structural changes: what systemic changes are required to the programme? This may involve upgrading the screening tool, revising escalation procedures, or redesigning the ownership-tracing methodology to account for control-based tests under the Swiss and EU regimes. Fourth, governance and sign-off: who in the organisation is responsible for sanctions compliance, and is that responsibility clearly documented? SECO, like other regulators, looks to governance as an indicator of institutional commitment.
The EU standard for a controls programme – sometimes described as the five-element model of governance, risk assessment, controls, training, and audit – is a useful benchmark for Swiss firms operating across both regimes. In our practice, we test the screening logic, map ownership and control chains, and redesign the programme to the five-element standard where the existing approach has produced a breach. This is not a guarantee of any particular regulatory outcome, but it is the baseline of what SECO and other regulators expect to see.
Step 6: Assess secondary-sanctions and cross-border risk
A SECO breach does not occur in isolation. Switzerland is a major financial centre and a hub for commodity trading, shipping finance, and asset management. Transactions that touch the Swiss regime frequently also involve US persons, EU institutions, or UK financial intermediaries. Each of those connections may engage a separate sanctions regime.
US secondary-sanctions risk is the most common cross-border overlay. OFAC's extraterritorial reach – the capacity to designate non-US persons for supporting certain sanctioned activities, or to cut off access to the US financial system for non-US banks that facilitate certain transactions – applies regardless of whether Swiss law has been violated. A Swiss commodity trader who conducts a transaction that breaches SECO may simultaneously have facilitated activity that OFAC considers a basis for secondary designation or correspondent-banking restrictions. The analysis under each regime is independent.
The EU Blocking Regulation adds a further complication for Swiss entities with EU-based subsidiaries or EU counterparties. Where a transaction involves prohibited dealings with a designated party under the relevant EU Council regulation, the EU subsidiary may face its own reporting and freeze obligations, and EU counsel should be involved at the earliest stage.
For cross-border transactions involving maritime routes, the intersection of cargo documentation, flag-state obligations, and the maritime-sanctions provisions of the applicable regimes can introduce additional reporting and asset-freeze considerations. Dual-use goods add the export-control dimension: Switzerland operates controls under its own legislation that broadly align with EU dual-use rules, and a transaction that breaches SECO may also require a review of whether an export licence was required and whether any goods were transferred without one.
We have acted for Swiss and international clients facing this multi-regime exposure. The starting point is always a clear mapping of which regimes are engaged by the facts, followed by a sequenced response plan that addresses each authority's obligations without inadvertently prejudicing the position under another.
Related practices
- Apparent violation assessment – EU – scope, analyse and manage apparent violations under EU Council sanctions regulations.
- Post-breach remediation – Singapore – step-by-step guide to managing a sanctions breach under the Singapore regime.
- Post-breach remediation – UAE – remediation guide for breaches under the UAE sanctions framework.
Risk flags that complicate SECO remediation
Several fact patterns consistently elevate the complexity of a SECO remediation. Identifying them early allows the firm to adjust its strategy before they become more serious problems.
The first is a pre-existing audit or supervisory inquiry. If SECO or another Swiss authority has already begun inquiring into the firm's sanctions compliance when the breach is discovered, the options for voluntary disclosure in the ordinary sense narrow. The regulatory relationship has changed, and specialist counsel should be involved immediately.
The second is a transaction that was processed after a screening alert was dismissed. An alert that was generated and overridden without proper escalation is, in most enforcement contexts, evidence of negligence at minimum. The firm's culpability for the breach increases, and SECO's assessment of the remediation plan will be scrutinised accordingly. Documenting the reasons for the override, and showing what the firm has done to change the process, is a necessary part of the response.
The third is a counterparty relationship that continues to exist after the breach. If the firm is still holding assets connected to a designated party, or if a contract remains in force with an entity caught by the SECO ownership or control test, the ongoing exposure must be addressed as a priority, not as a post-disclosure clean-up exercise. Continuing relationships that are not suspended or unwound will be treated by SECO as evidence of an ongoing violation, not a historical one.
A common myth in this area is that self-reporting to SECO creates more risk than remaining silent. In fact, the reverse is almost always true. SECO, like other major sanctions authorities, treats proactive disclosure as a significant mitigating factor at the enforcement and penalty stage. Concealment, by contrast, can convert an administrative matter into a criminal referral. The risk in disclosure is manageable. The risk in silence is not.