Version 1.1 · As of 29 October 2026
This is a translation. In case of discrepancies, the German version prevails. Deutsch
This agreement applies between the financial intermediary using the ComplySwiss intermediary module (the «Intermediary») and the operator of ComplySwiss as stated in the legal notice («ComplySwiss»). The Intermediary concludes it by confirming it when opening the account or by submitting a signed copy.
1.1 The Intermediary uses the intermediary module of the ComplySwiss platform to meet its due diligence obligations under the Anti-Money Laundering Act (AMLA), in particular to identify and risk-rate its customers, to screen for politically exposed persons and sanctions, to monitor transactions, to investigate and document anomalies and, where applicable, for video and ID document identification. This is based on the service agreement between the parties (the «Main Agreement»).
1.2 In doing so, ComplySwiss processes personal data on behalf of the Intermediary. This agreement sets out the parties' obligations under Art. 9 of the Federal Act on Data Protection (FADP) and the Data Protection Ordinance (DPO). The subject matter, purpose, data categories and data subjects are described in Annex 1.
1.3 The Intermediary is the controller within the meaning of Art. 5 let. j FADP. It is solely responsible for the lawfulness of the processing, informing data subjects, obtaining any required consent and complying with its retention obligations.
1.4 If the Intermediary grants an AML specialist firm (GwG-Fachstelle), an audit firm or other third parties access to its data on the platform, this is done on its instruction. These third parties are not sub-processors of ComplySwiss; the Intermediary governs its relationship with them itself.
2.1 ComplySwiss processes the personal data solely to provide the agreed services and in accordance with the Intermediary's instructions. The Main Agreement, this agreement and the Intermediary's use of the platform's functions are deemed instructions.
2.2 ComplySwiss does not process the data for its own purposes and does not disclose it to third parties, except where required by law; in that case ComplySwiss informs the Intermediary in advance unless the law prohibits this. Reports to the Money Laundering Reporting Office Switzerland (MROS) are made exclusively by the Intermediary.
2.3 If ComplySwiss considers an instruction to be unlawful, it informs the Intermediary without delay and may suspend its execution until the matter is clarified.
3.1 ComplySwiss treats all of the Intermediary's data as confidential. Persons with access to the data are bound to confidentiality in writing unless already subject to a statutory duty of secrecy.
3.2 ComplySwiss accesses the Intermediary's data only as far as necessary for operation, maintenance, troubleshooting or support. Support access to content takes place only on request or with the Intermediary's consent.
3.3 ComplySwiss observes the prohibition of information under Art. 10a AMLA: it informs neither the customers concerned nor third parties of investigations or reports that come to its knowledge in the course of the processing.
3.4 The duty of confidentiality continues after this agreement ends.
4.1 ComplySwiss takes the technical and organisational measures under Art. 8 FADP and Art. 1 et seq. DPO that are appropriate to the risk of the processing (Annex 2).
4.2 ComplySwiss may develop the measures further provided the agreed level of protection is not reduced. ComplySwiss informs the Intermediary of material changes.
4.3 The Intermediary is responsible for secure use on its side, in particular for assigning roles to its employees, activating two-factor login, protecting login credentials, removing access for persons who have left and storing downloaded documents securely.
5.1 The Intermediary approves the use of the sub-processors listed in Annex 3.
5.2 ComplySwiss informs the Intermediary at least 30 days in advance of any intended addition or replacement of a sub-processor. The Intermediary may object for good cause within this period. If the parties cannot agree, the Intermediary may terminate the Main Agreement with effect from the date of the change.
5.3 ComplySwiss passes its obligations under this agreement on to each sub-processor and remains responsible to the Intermediary for their performance.
5.4 Sub-processors engaged only for an optional function are marked as optional in Annex 3. Their engagement is deemed approved only once the Intermediary switches the function on.
6.1 The personal data are stored and processed in Switzerland, subject to clause 6.4.
6.2 Disclosure abroad takes place only with the Intermediary's prior written consent and in compliance with Art. 16 and 17 FADP.
6.3 If the Intermediary connects a service of its own, such as a blockchain analytics provider with its own access key, ComplySwiss transmits the necessary information (for example wallet addresses) on its instruction. That provider is not a sub-processor of ComplySwiss; the Intermediary concludes the contract with it directly.
6.4 Optional AI assistant. The Intermediary can switch on an AI assistant in the platform that drafts texts on alerts and cases. By switching it on through a person with administrator rights, the Intermediary gives the prior written consent under clause 6.2 to disclosure to Mistral AI in France (Annex 3). The following applies:
a) Only the details of the alert or case for which an authorised person requests a draft are sent.
b) Names, company names, customer numbers, addresses, beneficial owners, email addresses, IBANs, wallet addresses and phone numbers are replaced with placeholders before sending.
c) ID and face images as well as video and audio recordings are never sent.
d) Mistral AI may not use the data to train models and keeps it for no more than 30 days to detect abuse.
e) The draft is an aid; assessment and decision rest solely with the Intermediary.
f) The Intermediary can withdraw its consent at any time in the platform or in writing. From the withdrawal onwards, no more data is sent.
ComplySwiss logs activation, withdrawal and every request with time and user.
7.1 If the Intermediary uses the ID document, face and video identification function, ComplySwiss processes ID document images, facial images and video and audio recordings of the persons to be identified. Facial images analysed for unique identification are biometric data and therefore sensitive personal data (Art. 5 let. c no. 4 FADP).
7.2 The processing serves exclusively to identify the contracting party under the AMLA and the rules of the Intermediary's self-regulatory organisation. Use for any other purpose, in particular for training models, is excluded.
7.3 Before capture, the person to be identified is informed about the processing and confirms it. The video call is recorded only with that person's separate consent. The Intermediary is responsible for ensuring that the information and consent meet its obligations.
7.4 Text recognition, checking of the machine-readable zone and face comparison run on ComplySwiss servers in Switzerland. No external services are used for biometric analysis. Video calls are transmitted in encrypted form; relay servers are operated by ComplySwiss in Switzerland.
7.5 Captures and recordings are stored by ComplySwiss only temporarily and are deleted automatically once the 24-hour period shown in the application has expired. The Intermediary downloads the documents it needs as evidence within this period and keeps them in its own protected archive. ComplySwiss's temporary storage is not an archive within the meaning of Art. 7 AMLA.
7.6 The results of the automatic analysis are aids only. They prove neither the authenticity of an ID document nor the liveness or identity of a person. The decision on identification rests solely with the Intermediary.
8.1 ComplySwiss supports the Intermediary, within reason, in fulfilling data subjects' rights (in particular access, rectification, erasure and data portability under Art. 25 et seq. FADP). Requests received directly by ComplySwiss are forwarded to the Intermediary without delay. Restrictions of the right of access, in particular to preserve the prohibition of information under the AMLA, are assessed by the Intermediary.
8.2 On request, ComplySwiss provides the Intermediary with the information it needs for a data protection impact assessment (Art. 22 FADP) and for its record of processing activities (Art. 12 FADP).
8.3 ComplySwiss may charge for effort beyond normal use of the platform, after prior notice, at the rates of the Main Agreement.
9.1 ComplySwiss notifies the Intermediary of a data security breach affecting the Intermediary's data as soon as possible (Art. 24 para. 3 FADP), at the latest within 48 hours of becoming aware of it.
9.2 As far as known, the notification states the nature of the breach, the data categories concerned and the approximate number of data subjects, possible consequences and the measures taken and proposed. Missing information is provided later.
9.3 Notification to the Federal Data Protection and Information Commissioner (FDPIC) and informing data subjects are the Intermediary's responsibility. ComplySwiss supports it in doing so.
10.1 The Intermediary may verify compliance with this agreement. On request, ComplySwiss provides the necessary information and documents, including for the Intermediary's self-regulatory organisation, its AMLA audit firm or FINMA.
10.2 Further audits, including by an audit body appointed by the Intermediary and bound to confidentiality, are possible by arrangement with at least 14 days' notice, at most once a year, except where there is a justified suspicion of a breach of this agreement or at the request of a supervisory authority.
11.1 This agreement applies for the term of the Main Agreement.
11.2 During the term and up to 30 days after it ends, the Intermediary can export its data itself or request an export from ComplySwiss in a common format.
11.3 No later than 90 days after the agreement ends, ComplySwiss deletes all of the Intermediary's data, including uploaded documents. Copies in backups are overwritten in the regular rotation cycle. On request, ComplySwiss confirms the deletion in writing.
11.4 The Intermediary meets its retention obligations, in particular the ten-year retention under Art. 7 para. 3 AMLA, by exporting its data in time. Archiving beyond the end of the agreement can be agreed separately.
Liability is governed by the Main Agreement. Where it contains no provision, the statutory rules apply.
13.1 In matters of data protection, this agreement takes precedence over the Main Agreement.
13.2 ComplySwiss may amend this agreement, for example due to changes in the law or new sub-processors. Amendments are communicated to the Intermediary at least 30 days in advance; section 5.2 applies accordingly. Deviating agreements must be in writing; an electronic signature or a signed scan is sufficient.
13.3 If any provision is invalid, the remainder of the agreement remains valid.
13.4 Swiss law applies. The place of jurisdiction is the registered office of ComplySwiss.
| Service | Provision, operation and maintenance of the intermediary module as a web application, including hosting, backups, support and email notifications; where applicable, ID document, face and video identification; on request, the optional AI assistant (clause 6.4). |
|---|---|
| Purpose | Identification of the contracting party and establishment of the beneficial owners and controlling persons; risk rating; screening for politically exposed persons and sanctions; transaction monitoring and rules; alerts, investigations and case management (with optional four-eyes principle); periodic reviews; documentation and exports for audits. |
| Type of processing | Recording, importing, storing, displaying, changing, automated analysis (risk, rules, text recognition, face comparison), exporting, sending notifications, logging, backing up and deleting; on request, drafting of texts by the optional AI assistant. |
| Data subjects | The Intermediary's customers and their representatives; beneficial owners and controlling persons; authorised signatories; transaction counterparties where recorded; the Intermediary's users; where applicable, users of an appointed AML specialist firm. |
| Data categories | Identification data (name, date of birth, nationality, address, ID document data); contact details; information on occupation, source of assets and purpose of the business relationship; company data of legal entities; transaction data and wallet addresses; risk rating and its history; PEP and sanctions screenings and their results; alerts, case notes and investigation results; uploaded documents; ID document and facial images as well as video and audio recordings (temporary); user accounts (login, role, two-factor status); log data (time, user, action, IP address). |
| Sensitive personal data | Biometric data during face capture (Art. 5 let. c no. 4 FADP). Information on administrative or criminal proceedings or sanctions (Art. 5 let. c no. 5 FADP) is also possible, for example in investigations or sanctions hits. The Intermediary decides which such information it records. |
| Client separation | Each Intermediary is a separate client. All queries are limited to the organisations the logged-in person is authorised for. |
|---|---|
| Access control | Role-based permissions (administration, compliance officer, employees, audit, trainee); every changing action is checked on the server. Audit and trainee roles have read-only access. |
| Authentication | Personal user accounts; passwords stored only as hashes; two-factor login available, secrets stored encrypted; protection against repeated failed logins; time-limited, single-use password reset links. |
| Four-eyes principle | At the Intermediary's request, the same person cannot both open and close a case or alert. |
| Transmission and storage | Encrypted transmission via HTTPS. Uploaded documents can be retrieved only after an authorisation check. Video calls are transmitted in encrypted form; captures and recordings are deleted automatically after 24 hours. |
| Logging | Logins and changes to customers, risk ratings, alerts, cases and rules are logged in the audit log with time and user. |
| Availability | Hosting in Switzerland; regular backups; database backup before every database change. |
| Change management | New versions are first tested in a separate test environment with fictitious data. |
| Organisation | Confidentiality undertaking by all persons with access; access to content only for operation and support; reporting process for security incidents under section 9. |
| AI assistant (optional) | Only after activation by the Intermediary; masking of names, company names, customer numbers, addresses, beneficial owners, email addresses, IBANs, wallet addresses and phone numbers before sending; encrypted transmission (HTTPS); training switched off at the provider; log of every request with user, time and model; monthly quota. |
| hosttech GmbH, Seestrasse 15a, 8805 Richterswil | Hosting of the web application, database and files; sending of email notifications; virtual server for ID document, face and video identification, including relay servers for video calls. Location: Switzerland. |
|---|---|
| Mistral AI, 15 rue des Halles, 75001 Paris, France (optional) | Drafting of texts on alerts and cases by the AI assistant; only after activation by the Intermediary (clause 6.4). Location: France (EU). No training; retention at the provider for up to 30 days to detect abuse. |
See also: Privacy policy · Legal notice · Data processing agreement (SRO module).
