A Swiss-headquartered trading house receives a request from its Singapore affiliate to supply components to a buyer in a third market. The compliance officer runs a quick screen. Nothing flags. But has she mapped the buyer's ownership chain against Switzerland's own consolidated sanctions list? Has she considered whether the transaction also attracts US or EU secondary-sanctions risk? And does the firm even know which SECO ordinance governs the goods?
A sanctions risk assessment under SECO (Switzerland's State Secretariat for Economic Affairs) is the structured process by which a business identifies, measures, and records its exposure to Switzerland's autonomous and UN-mandated sanctions ordinances. SECO administers Switzerland's sanctions regime under the Embargo Act, maintaining its own consolidated sanctions list and sector-specific ordinances. As of mid-2026, Switzerland's autonomous measures align closely with, but are not identical to, EU Council regulations – which means that a business relying solely on EU screening may miss or miscalibrate Swiss-specific obligations.
This page explains what a SECO sanctions risk assessment covers, how the Swiss regime compares with OFAC, EU, and OFSI standards, what the common risk flags are, and how Calder & Vance structures the exercise for cross-border businesses.
What does the SECO sanctions regime require, and who is in scope?
Switzerland's Embargo Act provides the legal basis for all Swiss sanctions measures, whether they implement UN Security Council resolutions or reflect Switzerland's autonomous policy decisions. SECO is the administering authority. It maintains the Swiss consolidated sanctions list and publishes binding ordinances that cover asset freezes, financial prohibitions, trade restrictions, and – in some regimes – arms embargoes and technical-assistance bans.
Scope is broader than many businesses expect. Swiss sanctions obligations fall on any person or entity that conducts transactions or activities in Switzerland, regardless of where the counterparty is located. A foreign company routing a payment through a Swiss bank, or a trading house using a Swiss commodity platform, can be directly in scope. Swiss-domiciled subsidiaries of multinational groups carry full obligations, even if the parent sits outside Switzerland.
The ownership and control test under Swiss law tracks the UN and EU approach. An entity majority-owned by a listed person is treated as subject to the relevant prohibition, regardless of whether the entity itself is named. The exact threshold and the control analysis – including indirect holdings, voting rights, and board control – must be assessed by reference to the applicable ordinance. In our cross-border practice, we frequently advise groups that apply only the OFAC 50 percent rule (OFAC's rule treating entities owned 50 percent or more in the aggregate by blocked persons as themselves blocked) and miss the Swiss and EU control elements, which can capture entities at lower ownership levels through governance rights alone.
The standard of care has risen. SECO has expanded its enforcement resources and, in recent years, has increased the frequency of its outreach to the Swiss financial and trading sectors. A credible risk assessment is no longer a box-ticking exercise for Swiss annual reporting purposes. It is the primary evidence a business will rely on if SECO enquires into a transaction or relationship.
How does a SECO sanctions risk assessment compare with OFAC and EU standards?
A SECO risk assessment shares the five-element structure familiar from OFAC and OFSI compliance guidance – risk identification, risk measurement, controls design, testing, and documentation – but the regime-specific inputs differ in ways that matter for cross-border businesses.
Under OFAC, the primary list risk is the SDN List (OFAC's list of Specially Designated Nationals and blocked persons), and the primary ownership test is the aggregate 50 percent rule. OFAC also applies extraterritorial secondary-sanctions measures to non-US persons in certain programmes. Under the EU, ownership and control is tested separately – control at any level of ownership can trigger a freeze where a listed person directs the entity's conduct. SECO's approach draws on the UN Security Council framework and, where Switzerland acts autonomously, mirrors much of the EU's structure. The divergences are real and consequential.
Three divergences matter most in practice. First, list content: the Swiss consolidated list includes all UN Consolidated List entries and autonomous Swiss additions. The EU list includes EU-autonomous additions that Switzerland may or may not adopt. Businesses that rely on EU-only screening will not catch Swiss-specific designations. Second, timing: Switzerland and the EU sometimes designate simultaneously, but this is not guaranteed. A business operating under both regimes needs a monitoring process that captures updates from both. Third, licensing: SECO's licensing and authorisation process operates separately from OFAC's and from EU national-competent-authority licensing. A business with an EU derogation cannot assume Swiss authorisation follows automatically.
The cross-border complexity increases further when US secondary-sanctions risk is live. A Swiss business that transacts with a party that OFAC has sanctioned under a programme with extraterritorial reach may face US consequences even if the transaction is lawful under Swiss law. In our experience, the most significant compliance gaps arise at exactly this intersection – where Swiss, EU, and US risk overlap but are assessed in silos.
The position above covers the standard case. Your facts – the counterparty's jurisdiction, the ownership chain, the nature of the goods or services, and which SECO ordinances are engaged – change the analysis materially.
For an initial assessment of your exposure under SECO and the overlapping regimes, contact Calder & Vance at info@caldervance.com.
What is the procedure for carrying out a SECO sanctions risk assessment?
A well-constructed SECO risk assessment proceeds in defined stages, each building on the last. The exercise is not a one-time event. It is a structured review that produces a documented baseline and a set of controls, updated at a frequency calibrated to the business's risk profile.
The first stage is scope identification. The business maps all the activities, counterparties, geographies, and products that could bring it within the reach of Swiss sanctions. This includes upstream and downstream relationships, not just direct counterparties. Commodity traders, freight forwarders, financial intermediaries, and technology exporters each face a different risk profile, and the scope exercise should reflect the actual operating model.
The second stage is list screening and ownership-chain analysis. Every counterparty, beneficial owner, shareholder, and controlling person identified in stage one is screened against the Swiss consolidated list and relevant sector ordinances. Where ownership structures are complex or opaque, the analysis extends to indirect holdings and governance rights. This is the stage at which most businesses find their existing screening processes were not designed for SECO specifics – they cover SDN and EU consolidated but not the Swiss autonomous additions.
The third stage is risk measurement. For each identified exposure, the business assigns a risk level based on the nature of the prohibition (asset freeze, financial prohibition, or trade restriction), the likelihood of the counterparty or the goods being caught, and the consequence of a violation. The output is a risk register, graded by severity and probability, that forms the basis for controls design.
The fourth stage is controls assessment and gap analysis. The business's existing controls – screening tools, due-diligence workflows, contract representations and warranties, escalation procedures – are tested against the risk register. Gaps are documented. Priority remediation actions are identified.
The fifth stage is documentation and reporting. The completed assessment, the risk register, the gap analysis, and the remediation plan are recorded and retained. Under the Embargo Act, businesses are expected to be able to demonstrate their compliance position to SECO on request. A well-documented assessment is the primary evidence in that conversation.
The frequency of the review depends on the risk profile. A business with direct exposure to high-risk sectors or geographies should review at least annually and after any material change in business activity, counterparty relationships, or the regulatory landscape. A business with lower inherent risk may work to a longer cycle, but should monitor for list updates in real time.
What are the main risk flags in SECO sanctions compliance?
Certain patterns recur in SECO sanctions risk that, in our experience, produce the most significant gaps between a business's assessment of its position and its actual exposure.
The first is list-coverage gaps in screening tools. Many enterprise screening platforms are calibrated for the OFAC SDN and EU consolidated lists. Swiss autonomous additions to SECO's list may not be included, or may be updated on a different refresh cycle. A business that has not verified the coverage and update frequency of its screening tool against the Swiss list is carrying a gap it does not know about.
The second is shallow ownership analysis. A first-layer screen of a counterparty is not sufficient where the ownership structure is layered, nominee arrangements are in use, or the counterparty operates in a jurisdiction with limited transparency on beneficial ownership. The Swiss control test, like the EU equivalent, can catch entities that are not directly listed but are controlled by a listed person. Stopping at the first layer misses the risk.
The third is the assumption of EU equivalence. Switzerland's autonomous measures are largely aligned with EU positions, but they are not identical. There are cases where Switzerland has moved more slowly, and cases – fewer, but real – where Switzerland has moved differently. A business that treats Swiss compliance as automatic where EU compliance is confirmed is taking a risk that is small in probability but potentially significant in consequence if the gap happens to fall on a transaction under review.
The fourth is the failure to capture secondary-sanctions risk. The Swiss-incorporated subsidiary of a US-parented group may be in scope of OFAC extraterritorial measures and Swiss measures simultaneously. Neither analysis is a substitute for the other. The same applies where EU-programme secondary effects are in play. A SECO-only assessment that does not flag the overlapping US or EU risk profile produces a false picture of the business's total exposure.
The fifth is inadequate escalation procedures. Screening produces hits. A hit on a Swiss-autonomous addition to the SECO list requires a different response from a hit on the UN Consolidated List, because the licensing and authorisation route differs. Businesses whose escalation procedures do not distinguish between list sources may apply the wrong process – and the wrong timeline – to a genuine hit.
If a transaction has already been flagged, or a filing has been refused, an early review can preserve options that narrow with time. Contact Calder & Vance at info@caldervance.com for a confidential review.
When should a business involve specialist counsel for a SECO risk assessment?
Specialist counsel adds most value at three points in the risk-assessment cycle: at the design stage, when the scope and methodology of the assessment are being set; at the gap-analysis stage, when the findings need to be translated into a defensible remediation plan; and when a specific transaction or counterparty raises a question that the standard process cannot resolve.
The design stage is where the scope decisions are made. Which legal entities are in scope? Which products and services attract trade-restriction risk? Does the business's operating model create exposure through Swiss-platform activity even where the primary transaction is elsewhere? These are questions of legal analysis, not just process design. Getting the scope wrong at the outset produces an assessment that is thorough in the wrong areas and silent on the real exposures.
The gap-analysis stage requires a view on the legal adequacy of existing controls. An internal compliance team can identify that screening coverage is incomplete. It takes a practitioner's judgment to assess whether that gap, combined with the business's risk profile and the enforcement posture of SECO, creates a material risk of regulatory contact – and, if so, what priority remediation should take.
The transactional stage arises when a specific deal or counterparty sits at the boundary of the analysis. Is this ownership structure enough to trigger the control test? Does this product require a licence under the relevant Swiss ordinance? Would a voluntary self-disclosure (VSD, a proactive disclosure to SECO of an apparent violation) improve the outcome if a past transaction is now in doubt? These questions require an answer grounded in how SECO reads the law, not just how the law reads on its face.
There is a myth that specialist counsel is only needed once a problem has materialised. In our experience, the businesses that engage counsel at the design stage of a risk assessment spend significantly less time, and face less regulatory risk, than those who engage only after SECO has already raised a question.
In a recent matter, a financial institution with Swiss-domiciled entities had conducted an internal sanctions risk assessment that it regarded as comprehensive. When a new counterparty relationship triggered a SECO enquiry, a review of the assessment revealed that Swiss autonomous additions had not been included in the list-coverage analysis, and that the ownership-chain review had stopped at the first layer for counterparties below a certain transaction value. We assisted in rebuilding the assessment, mapping the ownership chains for the flagged relationships, and preparing the response to SECO. The remediation was completed within the regulatory window. The lesson was not that the internal team had failed – it was that the scope and methodology had not been calibrated to the SECO-specific risks that the business actually carried.
How Calder & Vance structures a SECO sanctions risk assessment
Calder & Vance structures its SECO sanctions risk-assessment engagements around the five-stage process described above, adapted to the specific risk profile of each business. Our approach reflects practical experience advising cross-border businesses at the intersection of the Swiss, EU, and US regimes – and, where relevant, the Singapore, UAE, and other national regimes that their operations engage.
At the outset, we agree the scope with the client's compliance function and, where relevant, its legal team. We then work through the screening and ownership-chain analysis, applying the Swiss consolidated list, the UN Consolidated List, and the relevant sector ordinances. We identify gaps in existing controls, rank them by risk, and produce a documented gap analysis with a prioritised remediation plan.
Where a transaction or counterparty raises a licensing question, we assess eligibility, prepare the authorisation request to SECO, and manage the regulator's queries. Where a past transaction raises a VSD question, we scope the apparent violation, advise on disclosure, and prepare the submission. Where the business's group structure creates overlapping EU or OFAC risk, we ensure the SECO assessment is positioned within a coherent group-level view.
Our engagement model includes a fixed-fee entry point for a defined-scope assessment, with clear deliverables at each stage. We advise on timeline and priority in the first call. We do not advise on circumventing or evading sanctions.
Related practices
- Compliance audit and testing (Australia) – structured review of sanctions controls under the Australian autonomous regime
- Sanctions risk assessment (Singapore) – risk assessment and counterparty analysis under Singapore's MAS-administered regime
- Sanctions risk assessment (UAE) – risk assessment under the UAE's Executive Office framework and autonomous measures