Version 1.1 · As of 29 October 2026
This is a translation. In case of discrepancies, the German version prevails. Deutsch
This agreement applies between the AML specialist firm (GwG-Fachstelle) using the ComplySwiss specialist firm module (the «Specialist Firm») and the operator of ComplySwiss as stated in the legal notice («ComplySwiss»). The Specialist Firm concludes it by confirming it when opening the account or by submitting a signed copy.
1.1 The Specialist Firm uses the specialist firm module of the ComplySwiss platform for financial intermediaries that have delegated to it tasks for meeting their due diligence obligations under the Anti-Money Laundering Act (AMLA) (the «Clients»), and where applicable for its own purposes. This includes in particular identifying and risk-rating customers, screening for politically exposed persons and sanctions, monitoring transactions, investigating and documenting anomalies and, where applicable, video and ID document identification. Each Client is kept as a separate organisation on the platform. This is based on the service agreement between the parties (the «Main Agreement»).
1.2 In doing so, ComplySwiss processes personal data on behalf of the Specialist Firm. This agreement sets out the parties' obligations under Art. 9 of the Federal Act on Data Protection (FADP) and the Data Protection Ordinance (DPO). The subject matter, purpose, categories of data and data subjects are described in Annex 1.
1.3 Where the Specialist Firm processes personal data on behalf of a Client, the Client is the controller within the meaning of Art. 5 let. j FADP, the Specialist Firm is its processor and ComplySwiss is a sub-processor of the Specialist Firm. Where the Specialist Firm processes personal data for its own purposes, for example to manage its mandates and users, it is itself the controller.
1.4 The Specialist Firm warrants that each Client has authorised the engagement of ComplySwiss in advance (Art. 9 para. 3 FADP) and that its mandate agreement contains data protection obligations at least equivalent to this agreement. Until authorisation is given, it does not record any personal data for that Client on the platform. On request, it provides evidence of the authorisation.
1.5 The Specialist Firm is the sole point of contact for ComplySwiss in respect of its Clients. ComplySwiss accepts instructions from a Client only through the Specialist Firm, unless the Specialist Firm can no longer be reached or has ceased its activity.
1.6 If the Specialist Firm grants employees of a Client, an audit firm or other third parties access to the platform, this is done on its instruction. These third parties are not sub-processors of ComplySwiss; the Specialist Firm governs its relationship with them itself.
2.1 ComplySwiss processes the personal data solely to provide the agreed services and in accordance with the Specialist Firm's instructions. The Main Agreement, this agreement and the Specialist Firm's use of the platform's functions are deemed to be instructions.
2.2 ComplySwiss does not process the data for its own purposes and does not disclose it to third parties. Legal obligations are excepted; in that case ComplySwiss informs the Specialist Firm in advance, unless prohibited by law. Reports to the Money Laundering Reporting Office (MROS) are made exclusively by the Clients or by the Specialist Firm on their behalf.
2.3 If ComplySwiss considers an instruction to be unlawful, it informs the Specialist Firm without delay and may suspend its execution until the matter is clarified.
3.1 ComplySwiss treats all data of the Specialist Firm and its Clients as confidential. Persons with access to the data are bound to confidentiality in writing, unless they are already subject to a statutory duty of secrecy.
3.2 ComplySwiss accesses data only to the extent necessary for operation, maintenance, troubleshooting or support. Support access to content takes place only on request or with the consent of the Specialist Firm.
3.3 ComplySwiss observes the prohibition of information under Art. 10a AMLA: it informs neither the customers concerned nor third parties of investigations or reports of which it becomes aware in the course of processing.
3.4 The duty of confidentiality continues after the end of this agreement.
4.1 ComplySwiss takes the technical and organisational measures under Art. 8 FADP and Art. 1 et seq. DPO that are appropriate to the risk of the processing (Annex 2).
4.2 ComplySwiss may further develop the measures provided that the agreed level of protection is not reduced. ComplySwiss informs the Specialist Firm of material changes.
4.3 The Specialist Firm is responsible for secure use on its side, in particular for assigning roles to its employees and to users of its Clients, enabling two-factor sign-in, protecting login credentials, removing access for persons who have left and for ended mandates, and storing downloaded documents securely.
5.1 The Specialist Firm authorises the engagement of the sub-processors listed in Annex 3, also on behalf of its Clients.
5.2 ComplySwiss informs the Specialist Firm at least 30 days in advance of the intended engagement or replacement of a sub-processor, so that it can inform its Clients in good time. The Specialist Firm may object within this period for good cause, including because a Client objects. If the parties cannot agree, the Specialist Firm may terminate the Main Agreement with effect from the date of the change.
5.3 ComplySwiss imposes its obligations under this agreement on every sub-processor and remains responsible to the Specialist Firm for the sub-processor's performance.
5.4 Sub-processors engaged only for an optional function are marked as optional in Annex 3. Their engagement is deemed approved only once the Specialist Firm switches the function on.
6.1 The personal data is stored and processed in Switzerland, subject to clause 6.4.
6.2 Disclosure abroad takes place only with the prior written consent of the Specialist Firm and in compliance with Art. 16 and 17 FADP.
6.3 If the Specialist Firm connects its own service, for example a blockchain analytics provider with its own access key, ComplySwiss transmits the information required for this (for example wallet addresses) on its instruction. This provider is not a sub-processor of ComplySwiss; the Specialist Firm concludes the contract with it itself.
6.4 Optional AI assistant. The Specialist Firm can switch on an AI assistant in the platform that drafts texts on alerts and cases. By switching it on through a person with administrator rights, the Specialist Firm gives the prior written consent under clause 6.2 to disclosure to Mistral AI in France (Annex 3), also on behalf of the Clients for whose alerts and cases it uses the assistant. It warrants that these Clients have consented to the disclosure and informs them of any withdrawal. The following applies:
a) Only the details of the alert or case for which an authorised person requests a draft are sent.
b) Names, company names, customer numbers, addresses, beneficial owners, email addresses, IBANs, wallet addresses and phone numbers are replaced with placeholders before sending.
c) ID and face images as well as video and audio recordings are never sent.
d) Mistral AI may not use the data to train models and keeps it for no more than 30 days to detect abuse.
e) The draft is an aid; assessment and decision rest solely with the Specialist Firm and its Clients.
f) The Specialist Firm can withdraw its consent at any time in the platform or in writing. From the withdrawal onwards, no more data is sent.
ComplySwiss logs activation, withdrawal and every request with time and user.
7.1 If the Specialist Firm uses the ID document, face and video identification function, ComplySwiss processes images of identity documents, facial images and video and audio recordings of the persons to be identified. Facial images analysed to uniquely identify a person are biometric data and therefore sensitive personal data (Art. 5 let. c no. 4 FADP).
7.2 The processing serves solely to identify the contracting party under AMLA and the rules of the respective Client's self-regulatory organisation. Use for any other purpose, in particular for training models, is excluded.
7.3 Before capture, the person to be identified is informed about the processing and confirms it. The video call is recorded only with their separate consent. The Specialist Firm is responsible for ensuring that the information and consent meet the Client's obligations.
7.4 Text recognition, checking of the machine-readable zone and face comparison run on ComplySwiss servers in Switzerland. No external services are used for biometric analysis. Video calls are transmitted encrypted; ComplySwiss operates the relay servers in Switzerland.
7.5 Captures and recordings are stored by ComplySwiss only temporarily and are deleted automatically after the 24-hour period shown in the application. Within this period, the Specialist Firm downloads the documents required as evidence and keeps them securely itself or hands them over to the Client. ComplySwiss's temporary storage is not an archive within the meaning of Art. 7 AMLA.
7.6 The results of the automatic analysis are aids. They prove neither the authenticity of an identity document nor the liveness or identity of a person. The decision on identification rests with the Specialist Firm or the Client.
8.1 ComplySwiss assists the Specialist Firm, within reason, in fulfilling the rights of data subjects (in particular access, rectification, erasure and data portability under Art. 25 et seq. FADP). ComplySwiss forwards requests received directly to the Specialist Firm without delay; the Specialist Firm forwards them to the Client concerned. The Specialist Firm and the Client assess restrictions of the right of access, in particular to preserve the prohibition of information under AMLA.
8.2 On request, ComplySwiss provides the Specialist Firm with the information that it or its Clients need for a data protection impact assessment (Art. 22 FADP) and for the record of processing activities (Art. 12 FADP).
8.3 ComplySwiss may charge for effort beyond normal use of the platform at the rates of the Main Agreement after giving prior notice.
9.1 ComplySwiss notifies the Specialist Firm of a data security breach affecting data of the Specialist Firm or its Clients as soon as possible (Art. 24 para. 3 FADP), at the latest within 48 hours of becoming aware of it. The notification names the Clients affected.
9.2 As far as known, the notification contains: the nature of the breach, the categories of data concerned and approximate number of data subjects, possible consequences, and measures taken and proposed. Missing information is provided later.
9.3 The Specialist Firm informs the Clients affected without delay. Notification to the Federal Data Protection and Information Commissioner (FDPIC) and informing data subjects are the responsibility of the respective controller. ComplySwiss assists with this.
10.1 The Specialist Firm may verify compliance with this agreement. On request, ComplySwiss provides it with the necessary information and documents, including for its Clients, their self-regulatory organisations and AMLA audit firms, or FINMA.
10.2 Further audits, including by an auditor bound to confidentiality and appointed by the Specialist Firm or a Client, are possible by arrangement with at least 14 days' notice. They are coordinated through the Specialist Firm and take place at most once a year, except where there is reasonable suspicion of a breach of this agreement or at the request of a supervisory authority.
11.1 This agreement applies for the term of the Main Agreement.
11.2 During the term, the Specialist Firm may export the data of each Client itself or request an export from ComplySwiss in a common format.
11.3 If the mandate with a Client ends, the Specialist Firm exports that Client's data, hands it over to the Client to the extent provided for in the mandate agreement, and removes the access of the Client's users. At the Specialist Firm's request, ComplySwiss deletes that Client's data within 30 days and confirms the deletion in writing.
11.4 After the end of the Main Agreement, the Specialist Firm may still export its data or request an export for 30 days. At the latest 90 days after the end of the agreement, ComplySwiss deletes all data of the Specialist Firm and its Clients, including uploaded documents. Copies in backups are overwritten in the normal rotation cycle. On request, ComplySwiss confirms the deletion in writing.
11.5 The Clients' retention obligations, in particular the ten-year retention under Art. 7 para. 3 AMLA, are met by timely export and handover; the Specialist Firm ensures this. Archiving beyond the end of the agreement may be agreed separately.
12.1 Liability is governed by the Main Agreement. Where it contains no provision, the statutory provisions apply.
12.2 The Specialist Firm indemnifies ComplySwiss against claims of its Clients based on a missing authorisation under section 1.4 or on an instruction of the Specialist Firm that contradicts the mandate agreement.
13.1 In matters of data protection, this agreement takes precedence over the Main Agreement.
13.2 ComplySwiss may amend this agreement, for example in the event of changes in the law or new sub-processors. Changes are notified to the Specialist Firm at least 30 days in advance; section 5.2 applies accordingly. Deviating agreements must be made in writing; an electronic signature or a signed scan is sufficient.
13.3 If any provision is invalid, the remainder of the agreement remains valid.
13.4 Swiss law applies. The place of jurisdiction is the registered office of ComplySwiss.
| Service | Provision, operation and maintenance of the specialist firm module as a web application, including management of several Clients under one firm account, team management, hosting, backups, support and email notifications; where applicable, ID document, face and video identification; on request, the optional AI assistant (clause 6.4). |
|---|---|
| Purpose | Fulfilment of the Clients' AMLA due diligence obligations by the Specialist Firm: identification of the contracting party and establishment of the beneficial owners and controlling persons; risk rating; screening for politically exposed persons and sanctions; transaction monitoring and rule set; alerts, investigations and case management (with optional four-eyes principle); periodic reviews; documentation and exports for audits; management of mandates. |
| Nature of processing | Recording, importing, receiving via onboarding links, storing, displaying, modifying, automated analysis (risk, rules, text recognition, face comparison), exporting, sending notifications, logging, backing up and deleting; on request, drafting of texts by the optional AI assistant. |
| Data subjects | Customers of the Clients and their representatives; beneficial owners and controlling persons; authorised signatories; counterparties to transactions, where recorded; officers and contact persons of the Clients; users of the Specialist Firm and of the Clients. |
| Categories of data | Identification data (name, date of birth, nationality, address, ID document data); contact details; information on occupation, source of assets and purpose of the business relationship; company data of legal entities; mandate data (company, industry, status); transaction data and wallet addresses; risk rating and its history; PEP and sanctions screenings including results; alerts, case notes and investigation results; uploaded documents; images of identity documents and faces as well as video and audio recordings (temporary); user accounts (login, role, two-factor status); log data (time, user, action, IP address). |
| Sensitive personal data | Biometric data during face capture (Art. 5 let. c no. 4 FADP). Data on administrative or criminal proceedings or sanctions (Art. 5 let. c no. 5 FADP) may also occur, for example in investigations or sanctions hits. The Specialist Firm decides which such data it records. |
| Tenant separation | Each Specialist Firm has its own firm account; each of its Clients is kept as a separate organisation. Users with firm access see only the organisations of their Specialist Firm, users of an organisation only that organisation. All queries are restricted to these permissions on the server side. |
|---|---|
| Access control | Role-based permissions (firm administration, administration, compliance officer, employees, audit, training); every modifying action is checked on the server side. Audit and training roles have read-only access. |
| Authentication | Personal user accounts; passwords stored only as hashes; two-factor sign-in available, secrets stored encrypted; protection against repeated failed logins; time-limited, single-use password reset links. |
| Four-eyes principle | At the Specialist Firm's request, the same person cannot both open and close a case or alert; the setting applies to all Clients of the Specialist Firm. |
| Transmission and storage | Encrypted transmission via HTTPS. Uploaded documents can only be retrieved after a permission check. Video calls are transmitted encrypted; captures and recordings are deleted automatically after 24 hours. |
| Logging | Logins and changes to customers, risk ratings, alerts, cases and rules are logged in the audit log with time and user. |
| Availability | Hosting in Switzerland; regular backups; database backup before every database change. |
| Change management | New versions are first tested in a separate test environment with fictitious data. |
| Organisation | Confidentiality undertaking by all persons with access; access to content only for operation and support; reporting process for security incidents under section 9. |
| AI assistant (optional) | Only after activation by the Specialist Firm; masking of names, company names, customer numbers, addresses, beneficial owners, email addresses, IBANs, wallet addresses and phone numbers before sending; encrypted transmission (HTTPS); training switched off at the provider; log of every request with user, time and model; monthly quota. |
| hosttech GmbH, Seestrasse 15a, 8805 Richterswil | Hosting of the web application, database and files; sending of email notifications; virtual server for ID document, face and video identification, including relay servers for video calls. Location: Switzerland. |
|---|---|
| Mistral AI, 15 rue des Halles, 75001 Paris, France (optional) | Drafting of texts on alerts and cases by the AI assistant; only after activation by the Specialist Firm (clause 6.4). Location: France (EU). No training; retention at the provider for up to 30 days to detect abuse. |
See also: Privacy policy · Legal notice · Data processing agreement (intermediary module).
