The 10 criteria
- 1. Specialisation in your type of institution: the provider knows the duties of portfolio managers under Art. 17 FinIA or managers of collective assets under Art. 24 FinIA, and the markets you operate in.
- 2. Scope of the function: the provider takes over compliance in full, for selected tasks or as deputy cover – whatever suits your organisation. Ideally, it also covers risk management and the internal control system.
- 3. Supervisory and audit experience: mandates with supervised institutions, cooperation with supervisory organisations, support with audits and licensing procedures.
- 4. Independence: those who perform risk management and internal control may not be involved in the activities they monitor (Art. 21 para. 3 FinIA). The provider discloses potential conflicts of interest.
- 5. Qualifications and continuity: a dedicated contact person, deputy arrangements and documented know-how, so the function keeps running during absences.
- 6. A clear contract: tasks and powers, reporting, audit and access rights, confidentiality, rules on sub-delegation and termination are set out in writing.
- 7. Digital tools: controls, follow-ups and evidence are kept in a digital internal control system accessible to management, the board and the audit firm.
- 8. Data protection and confidentiality: the provider protects client data and business secrets and explains where and how data is processed.
- 9. Transparent pricing: scope and price are fixed before signature; changes follow a clear procedure.
- 10. Language and availability: the provider works in the languages of your organisation and is available on site and remotely.
Checklist for the first meeting
| Question to the provider | What to look for |
|---|---|
| Which types of institution do you work for? | Portfolio managers, managers of collective assets, family offices |
| Which tasks do you take over? | A list of second-line tasks |
| How do you report to management and the board? | Frequency, content and format of reports |
| Who stands in for my contact person? | A named deputy |
| How do you document controls? | A digital ICS with evidence |
| How do you support audits? | Preparation of documents, attendance at the closing meeting |
| How can the agreement be terminated? | Flexible, clear termination rules |
How to proceed
- 1Define your needswhich tasks will be outsourced and which stay in-house?
- 2Compare providersapply the criteria and checklist to two or three providers.
- 3Hold first meetingsask the checklist questions and record the answers.
- 4Review proposalscompare scope, reporting and price.
- 5Document the decisionrecord the reasons for your choice, as Art. 14 FinIA suggests.
- ✓Monitorassess the provider's performance regularly on the basis of its reports.
Typical situations for choosing or changing a provider
- Set-up and licensing: the compliance function must already be described in the licence application.
- Growth: new client segments, products or markets broaden the scope of tasks.
- Staff changes: an in-house specialist moves on and the function should continue without interruption.
- New requirements: legislative changes or supervisory expectations call for additional controls or reports.
Legal basis
- Art. 14 FinIA: delegation only to third parties with the necessary skills, knowledge, experience and licences; careful instruction and monitoring.
- Art. 21 FinIA: risk management and internal control, delegation to a qualified external body, independence.
- Art. 26 FinIO: principles of risk management and risk tolerance.
English versions of Swiss federal law are provided for information only; the German, French and Italian texts are authoritative.
Scope of this guide
This guide sets out general selection criteria. It does not replace a case-by-case assessment and does not rate individual providers. Responsibility for the choice lies with the institution.
How Peak Compliance applies these criteria
- Specialisation: exclusively portfolio managers, managers of collective assets and family offices in Switzerland and Liechtenstein
- Scope: compliance outsourcing and risk management outsourcing with a digital ICS, as your entire second line of defence; plus licensing and Liechtenstein
- Supervision: mandates with portfolio managers supervised by FINMA and the FMA, cooperation with the supervisory organisations AOOS and OSFINcontrol, experience with licensing procedures before FINMA and the FMA
- Contract: can be accepted online, flexible and terminable at any time
- Team: founded in Zurich in 2024 by Isabelle Ledergerber and Reto Picenoni (About us)
For a regional perspective, read our article on compliance outsourcing in Geneva.
Assess Peak Compliance against these criteria: book a free initial consultation via the contact page.
At a glance
| Who it is for | Portfolio managers, managers of collective assets and family offices in Switzerland and Liechtenstein looking for an outsourcing partner for compliance and risk management |
| What | Ten neutral criteria and a checklist of questions for the first meeting |
| Legal framework | Careful selection, instruction and monitoring of the provider (Art. 14 FinIA) |
| Outcome | A documented, traceable selection decision |
Frequently asked questions
What does Swiss law require when selecting a provider?
An institution may delegate tasks only to third parties with the necessary skills, knowledge, experience and, where required, licences, and must instruct and monitor them carefully (Art. 14 FinIA). For risk management and internal control, Art. 21 para. 2 FinIA expressly allows delegation to a qualified external body. The selection should therefore be documented.
How does outsourcing differ from hourly advice?
With outsourcing, the provider takes over a function with a defined scope, ongoing tasks and regular reporting. Hourly advice answers individual questions. For a portfolio manager's ongoing compliance function, a clearly defined mandate is usually the better basis.
Should the provider cover both compliance and risk management?
It helps, because both functions form the second line of defence and rely on the same internal control system. One provider for both simplifies interfaces and reporting.
How can I assess a provider's supervisory experience?
Ask about mandates with supervised institutions, cooperation with supervisory organisations and experience with licensing procedures. In this industry, client names are usually kept confidential, but the nature of a provider's experience can still be described precisely.
What should a provider deliver after outsourcing?
A good provider takes over the entire second line of defence and regularly gives the board and executive management the reports and information they need to steer the business with confidence.
