Towards fully digital client onboarding and lifecycle management: the new CDB 27 and FINMA’s revised Circular 2016/7

The revision broadens the range of digital identification means while tightening security controls, notably in response to AI-driven fraud such as deepfakes and synthetic identities. It also clarifies the Circular’s personal scope: By referring to Article 2(2)(a) to (d^quater) of the Anti-Money Laundering Act (“AMLA”), the Circular now applies only to financial intermediaries supervised by FINMA. Casinos, large-scale gaming operators and precious-metal assayers are therefore no longer covered. Financial intermediaries affiliated with a self-regulatory organisation (“SRO”) remain subject to their SRO’s regulations.

• QES route: Since March 2022, a qualified electronic signature (“QES”) can be obtained through unattended remote identification, without any live interaction. FINMA therefore treats the QES route as onboarding by correspondence, which now requires verification of the address of domicile under Article 45(2) AMLO-FINMA, in addition to liveness detection, subject to a one-year transitional period.
• e-ID, for online identification only: The e-ID issued under the Federal Act on Electronic Identity and Other Electronic Credentials of 20 December 2024 (“e-ID Act”) is admitted as an alternative identification document for online identification, subject to validity checks, liveness detection and a verification of the client’s address of domicile.
• Liveness detection: Liveness detection – the check that a real person, not a photo or a deepfake, is in front of the camera – is extended to the QES and e-ID routes.
• Digital proof of domicile: The specific reference to geolocation included in the previous version of the Circular has been replaced by wording that expressly admits any “equivalent digital process that reliably links the contracting party and its infrastructure to a place of residence“. Geolocation remains one such method, and digital residence certificates issued by municipalities also qualify.
• QR-coded documents: Identity documents bearing a QR code are now accepted alongside MRZ documents, for both video and online identification. An example is the credit-card-format Swiss driving licence introduced in 2023, which no longer has an MRZ. For reasons of legal certainty, FINMA rejected open-ended wording that would have covered future technologies such as Data Matrix codes.

The revision consolidates a two-track model:

• • On the first track, video identification remains equivalent to in-person identification, but only with a physical identity document.
  • On the second, online identification with a verified electronic ID copy, QES or Swiss e-ID is treated as onboarding by correspondence and requires domicile verification and liveness detection. The electronic copy route additionally requires a bank transfer or a reading of the document’s chip. Alternatively, the intermediary may rely on a digital certificate of authenticity issued by an authentication provider under Article 49 AMLO-FINMA, which is the electronic equivalent of a certified copy and requires neither liveness detection nor a bank transfer.

This has consequences for how client journeys are designed. Because the Swiss e-ID is admitted only for online identification, a journey combining the e-ID with a video agent cannot, in principle, benefit from in-person equivalence. Switching channels also has consequences: a client redirected from video identification to the e-ID route triggers residence verification and liveness detection. FINMA does not expressly address such hybrid journeys, so how they qualify remains partly a matter of interpretation. Residence verification is likely to remain the main friction point in e-ID journeys, although the new digital methods should ease it. Finally, video identification keeps an advantage for foreign clients: FINMA does not currently plan to recognise electronic identities issued under the EU eIDAS framework, as the Swiss e-ID is conceived, for now, as a national system.

In terms of timing, it is important to note that QR-coded documents and digital domicile verification have been admissible since 1 November 2026. Domicile verification and liveness detection on the QES route will become mandatory on 1 November 2027. The e-ID route has no transitional period but effectively cannot be used until the Swiss e-ID is actually issued. On 30 June 2026, the Federal Office of Justice announced that the trust infrastructure is expected to go live in the first half of 2027. The e-ID itself has been postponed so that additional security measures against AI-related risks can be developed, and its launch date has yet to be announced.

Practical consequence: Against this backdrop, financial intermediaries should refresh their identification processes, review their contracts with identification service providers and their staff training. In doing so, they should bear in mind that FINMA regards the Circular as setting minimum requirements, which may need to be supplemented depending on the risks involved in specific cases.

CDB 27 primarily reflects legal and regulatory developments, FATF standards, key decisions of the CDB Supervisory Board and lessons from practice.

One further objective is the digitalisation of business processes. This is done in a technology-neutral manner, and the relevant provisions have been adapted to established practice.  This applies in particular to the formal requirements for contracting parties’ declarations, the CDB forms, their delivery and their retention.

Technology neutrality also shows in the identification rules. Article 10, which CDB 20 framed as identification “by correspondence”, now applies whenever the contracting party does not appear at the bank. Domicile may be verified by an exchange of correspondence or “any other appropriate means”. The commentary’s examples include extracts from public registers or from databases kept by trustworthy private providers.

As under CDB 20, the identification provisions refer dynamically to FINMA’s rules. Video identification “in accordance with FINMA’s applicable provisions“ qualifies as identification in person (Article 9(2)). Online identification qualifies as identification of a contracting party who does not appear at the bank (Article 10(2)). The novelty lies in delegation. As under CDB 20, a delegate may neither sub-delegate nor identify persons who do not appear before it. However, CDB 27 now provides that the use of third parties for video or online identification is governed by FINMA’s rules (Article 43(4)). According to the commentary, a delegate’s use of a technical provider to carry out video or online identification is therefore not a prohibited sub-delegation, provided it is agreed with the delegating bank and subject to appropriate oversight by it.

CDB 27 largely maintains its approach, with Form A remaining the standard instrument for the contracting party’s declaration of the beneficial owner of the assets, and Form K the instrument for identifying controlling persons. The digital framework for CDB forms, which is a novelty, rests on the following elements:

• No written form under the Code of Obligations (“CO”). The Commentary of the CDB 27 now specifies that, unless the CDB 27 expressly requires it, the written form within the meaning of Articles 12 et seq. CO is not required. Declarations and CDB forms need only be attributable to the contracting party in a verifiable manner, which leaves some discretion as to the quality of the signature or confirmation used.
• Declaration in lieu of a form: In line with Article 4(2) AMLA, the contracting party may confirm the required information by a written declaration instead of a form. The bank may also have the data recorded in CDB forms confirmed by such a declaration.
• Electronic transmission: As under CDB 20, the declarations on the beneficial owner and on controlling persons may be obtained through a procedure under FINMA’s video and online identification rules (Articles 21(5) and 28(5)). New Article 44(4) allows banks to accept forms printed and signed by hand but transmitted electronically, e.g. as a scan or photo, provided the transmission (for example by email) is documented.
• Digital retention: Article 44(5) now states expressly that CDB forms need not be kept as physical originals and that digital copies suffice. This codifies established practice: the CDB 20 commentary already permitted exclusively electronic storage under Article 957 CO. The receipt stamp may now take the form of an electronic timestamp. As before, an undated form is considered correctly completed if internal and external auditors can establish when it was received or became available in the bank’s system.
• Limits for standardised processes: The bank may exceptionally waive Form A by recording the data in a file note, or Form K by relying on other evidence. The commentary stresses, however, that these exceptions must be interpreted restrictively and cannot be invoked for standardised processes. Digital journeys must therefore still capture the client’s declaration.

CDB 27 also codifies and clarifies how KYC documentation is maintained during the business relationship:

• As before, a person whose identity has been correctly verified need not be identified again when establishing further relationships. Likewise, no new Form A is required when an existing relationship is extended, unless doubts arise. New Article 46bis now requires, in the text itself, that identification be repeated if a closed relationship is resumed. This extends to controlling persons and beneficial owners. Temporarily reactivating an account to book reversed or deferred incoming items does not count as a resumption.
• Under new Article 46(3), changes in the master data of natural persons, such as a change of address or of name following a civil-status event, do not trigger a repetition of due diligence. The bank simply updates its records.
• By contrast, as under CDB 20, due diligence must be repeated in case of doubt as to the accuracy of the identity data, a possible change of controlling persons or beneficial owners, or the accuracy of Forms A, I, K, R, S or T, unless the doubt can be dispelled by appropriate clarifications. What is new is the time frame: the repetition must be completed within a reasonable period, which the commentary sets at sixty days. If it cannot be completed in time, the bank decides how to proceed on a risk-based basis and documents its decision.
• A discrepancy with the new Transparency Register does not in itself trigger a repetition (Article 46(4)), nor does it prevent an account from being used at onboarding (Article 45(2)), provided the bank has no doubt about its own CDB data.

In practice, CDB 27 now permits a largely digital KYC documentation chain, provided that attribution to the contracting party and traceability are ensured. The safekeeping test is unchanged: physical or electronic archives must show in a traceable manner when each document became available, so that internal audit and the external audit firm can verify it.

Banks that wish to use these options, and to bring their documentation and processes into line with the revised rules, have little time. CDB 27 will enter into force on 1 January 2027, with only a four-month transitional period. Once that period ends, the new rules will apply to new business relationships, whenever due diligence is repeated under Article 46, and whenever data or forms are updated because of changed circumstances. Existing forms for ongoing relationships need not be replaced.

Swiss banks should already start checking that their signature, archiving and form practices comply with CDB 27 and make full use of the scope it offers for digital processes.

The other changes and stricter requirements should not be overlooked either, and CDB 27 calls for a detailed review. In particular, the banks’ own forms must remain equivalent to the revised SBA models. Forms K, S and T, for example, include additional fields, respectively new declarations.

One further change with potentially significant reach concerns relationships with foreign financial intermediaries. Under Article 33(2) CDB 27, a foreign intermediary must now disclose the beneficial owners where it holds sub-accounts for individual clients, however well supervised it is. Banks will therefore have to review their correspondent and custody relationships in which client assets can be attributed to individual end clients.

Taken together, these two regulatory instruments point in a clear direction: identification and KYC documentation can increasingly be handled digitally. On the identification side, this comes with stricter security requirements. On the documentation side, it comes with flexibility as to form, coupled with a requirement of verifiable attribution. Because the CDB has referred dynamically to FINMA’s video and online identification rules since CDB 20, and CDB 27 keeps these references, the revised Circular already directly shapes compliant digital onboarding under the CDB.

The changes to the CDB forms, in particular, remove one of the last obstacles to fully digital onboarding and lifecycle management. Only a handful of specific contractual documents still require the client’s handwritten signature (or a qualified electronic signature).

Banks should use the coming months to review their onboarding journeys for in-person and remote clients, and to align their forms, signature and archiving practices accordingly.