Switzerland's crypto licensing regime: from SRO membership to the DLT trading facility

The Swiss method: classify, then apply existing law

The foundations were laid early. FINMA's ICO guidelines of 16 February 2018 established the token taxonomy the market still runs on: payment tokens (cryptocurrencies with no further function), utility tokens (digital access to an application or service) and asset tokens (representing claims, participations or entitlement to earnings), with hybrids carrying the requirements of every category they fall into, so a token that is both an asset token and a payment token is treated as a security and as a means of payment. The classification has consequences: payment tokens pull the activity into anti-money-laundering law, asset tokens are securities, which puts them under the prospectus regime and makes dealing in them for others a securities-firm activity, and utility tokens escape securities law only where their sole purpose is digital access to an application or service and that access works at the point of issue; a token that also, or only, carries an investment purpose at issue is treated as an asset token. Every Swiss crypto analysis starts here, and FINMA's overview of crypto services and its authorisation-enquiry procedure (Unterstellungsanfrage) exist to test the result.

The civil-law foundation: ledger-based securities and statutory segregation

The second layer is where Switzerland chose statute over supervisory practice. The DLT Act, a package amending ten existing federal statutes, with no new code, entered into force in two steps: on 1 February 2021, the provisions introducing ledger-based securities (Registerwertrechte) into the Code of Obligations, so that securities can be natively issued and transferred on a distributed ledger with full civil-law effect; and on 1 August 2021, the remainder, including the DLT trading facility licence and the insolvency provisions that allow crypto-assets held for customers to be segregated from a custodian's estate, namely article 242a of the Debt Enforcement and Bankruptcy Act and, for banks, article 16 number 1bis of the Banking Act, each on the conditions that the debtor undertook to keep the assets available for the customer at all times and that they are either individually allocated or held in a pool in which the customer's share is identifiable.

For custody that meets those conditions, the bankruptcy treatment of customer crypto is settled in Swiss statute, which is a principal reason sophisticated custody businesses choose Swiss law. Whether staked assets meet the "available at all times" condition is, on FINMA's own account, an open question: its practice under Guidance 08/2023 treats them as segregable pending clarification in legislation or case law, on conditions.

The EU has no single civil-law regime for tokenised securities, and member-state law fills the gap, Germany's Electronic Securities Act among others, while MiCA requires custodied crypto-assets to be legally segregated from the custodian's estate (Article 75(7)); the Swiss difference is that one federal statute carries both the securities and the insolvency rule. Background materials sit with the State Secretariat for International Finance.

Rung one: SRO membership, the entry point

Trading, brokerage, exchange and custody of payment tokens are financial intermediation under the Anti-Money Laundering Act, although the Act itself is technology-neutral and says nothing about crypto: the characterisation comes from the Anti-Money Laundering Ordinance, whose article 4 treats helping to transfer virtual currencies and exercising power of disposal over them as a payment service, and whose article 6 captures the safekeeping of securities. A firm conducting these activities professionally without holding a FINMA prudential licence must join a FINMA-recognised self-regulatory organisation.

The mechanics matter. The SRO is a private-law body whose regulations implement the AMLA due diligence duties; it admits the firm on the statutory criteria of article 14(2) of the Act, being internal rules and organisation and the good repute of the firm, its management and its qualified participants, controls compliance under articles 24 and 25, with the audit periodicity fixed by the organisation's own FINMA-approved rulebook, the Act leaving it open, and answers to FINMA for the quality of that supervision, with membership verifiable through FINMA's public member search.

What SRO membership requires, in substance: a real Swiss organisation, an AML framework (identification of clients and beneficial owners, risk classification, transaction monitoring, MROS reporting readiness), a designated AML officer, and clean people behind the firm. What it is not: it is not a prudential licence, it confers no client-asset protection status, and marketing that dresses SRO membership up as a FINMA licence is itself a supervisory problem. For a large share of crypto business models, exchange and brokerage without holding client assets in deposit-like form, this rung is the entire Swiss regulatory perimeter, which is why speed to market in Switzerland is measured in months.

Custody sits here in one form only: each client's assets on their own address, with an undertaking to keep them available at all times (article 16 number 1bis letter a of the Banking Act). Pooled custody with identifiable client shares needs the fintech licence, and pooled custody without that segregation is a deposit.

Rung two: the fintech licence

The fintech licence under Article 1b of the Banking Act is the intermediate step for models that hold client money or crypto at modest scale: it permits accepting public deposits of up to CHF 100 million, or crypto-based assets designated by the Federal Council, provided they are neither invested nor interest-bearing. The franc ceiling is drafted as a cap on public deposits alone: article 1b of the Banking Act and article 24a of the Banking Ordinance tie the threshold to deposits, and neither states a ceiling for crypto-based assets, so any such figure is FINMA practice, with no basis in the text.

The legal-form and residence conditions sit in the Ordinance, the Act being silent on them: under article 14a of the Banking Ordinance the institution must be a company limited by shares, a partnership limited by shares or a limited liability company, with its registered office in Switzerland and its effective administration exercised here. Minimum capital is 3 per cent of the public deposits and pooled crypto-based assets accepted, and at least CHF 300,000, with the capital adequacy and liquidity ordinances disapplied (article 17a of the Banking Ordinance). It suits custody-adjacent and payment-adjacent models that outgrow the SRO-only perimeter but do not need, or cannot yet justify, a banking licence, and FINMA's fintech authorisation pages set out the file.

Rungs three to five: securities, trading venues, banks

Above that, the ladder rejoins classical financial-market law. Asset tokens are securities only where they meet the statutory test in article 2(b) of the Financial Market Infrastructure Act, being standardised and suitable for mass trading; the classification of a given token as an asset token is FINMA's work, the statute supplying only the test. Where that test is met, three separate questions follow, and classification answers none of them by itself. Trading in the tokens in one's own name for clients, short-term own-account dealing on the market or as a venue member, and market making are securities-firm activities under article 41 of the Financial Institutions Act; underwriting securities issued by third parties and offering them publicly on the primary market engages article 12; an issuer offering its own tokens does neither. A public offer meets the prospectus regime of the Financial Services Act, subject to its exemptions, among them offers to professional clients only, to fewer than 500 investors, of at least CHF 100,000 per investor, in denominations of at least CHF 100,000, or up to CHF 8 million over twelve months (article 36).

Multilateral trading of DLT securities has its own venue category: the DLT trading facility under the Financial Market Infrastructure Act, notable for admitting participants who are neither supervised institutions nor central banks, article 73c(1)(e) allowing any further natural or legal person who declares that it participates in its own name and for its own account, the Act itself using no concept of retail client; the licence existed on paper from August 2021 and became reality when FINMA granted the first one to BX Digital in March 2025, a milestone for the tokenised-securities market.

At the top, the banking licence: required under article 1a(a) of the Banking Act where public deposits exceed CHF 100 million, and under article 1a(b) at any volume where deposits or designated crypto-based assets are invested or interest-bearing, so scale is one trigger of two. In crypto that captures pooled custody failing the segregation conditions of article 16 number 1bis of the Banking Act once the balances exceed CHF 100 million or are invested or interest-bearing, invested or interest-bearing client balances generally, and, on FINMA's guidance, the statute being silent, stablecoin issuance carrying at-par redemption claims. Alongside the ladder, asset managers handling crypto for clients fall under the financial-institutions regime with its own authorisation and supervisory organisation, and fund structures carrying crypto exposure run through collective-investment law.

Stablecoins, staking and custody: where FINMA has drawn lines

Three guidance documents define current practice. On stablecoins, FINMA Guidance 06/2024 confirms the deposit logic: a token with an at-par redemption claim against the issuer is, as a rule, a deposit under banking law, so the issuer generally needs a banking licence or, under article 5(3)(f) of the Banking Ordinance, a default guarantee from a bank meeting the minimum requirements the guidance sets for holders' protection; the guidance reserves the other exceptions in article 5(2) and (3), and whether a model can sit inside one of them, or within the fintech licence's uninvested, interest-free deposits up to CHF 100 million, turns on the model's terms and is a question to put to FINMA.

The same document makes the issuer a financial intermediary in a permanent business relationship with every holder: it must verify the holder's identity and establish the beneficial owner (articles 3 and 4 AMLA), anonymous transfers are prohibited as a consistent application of those duties, and for issuance by supervised institutions FINMA requires every holder's identity to be verified by the issuer or an appropriately supervised intermediary and contractual and technological transfer restrictions to be built in, which decides whether a distribution model works at all, bank guarantee or not; the guidance also warns the guaranteeing banks about the money-laundering, sanctions and reputational risks they take on.

On staking, Guidance 08/2023 addresses the question that decides business models: when staked customer assets remain bankruptcy-protected custody assets and when they become claims against the provider, with the answer turning on control, allocation and the chain of sub-custodians, and with FINMA itself describing the position as legally uncertain and its practice as provisional.

On custody itself, Guidance 01/2026 of 12 January 2026 draws the line for regulated institutions: a portfolio manager must keep managed crypto with a prudentially supervised custodian that has the technical infrastructure and expertise and from whose bankruptcy the assets can be segregated and, abroad, one under supervision and bankruptcy protection equivalent to Switzerland's; an existing arrangement with a Swiss custodian that is SRO-supervised only, or a foreign one without equivalent bankruptcy protection, may continue by way of exception where clients have been told of the added risk and of the alternatives and have consented in writing, and the responsibility stays with the Swiss institution. An SRO-only custodian can lawfully operate; on this guidance it is no suitable custodian for a regulated manager's clients without those steps.

What changes in 2026, and the EU question

Three horizon items belong in every Swiss crypto plan. First, the ladder itself is being redrawn: on 22 October 2025 the Federal Council opened a consultation on a revision of the Financial Institutions Act creating two new licence categories. Payment institutions (Zahlungsmittelinstitute) would, in the Federal Council's words, replace the existing fintech licence: the CHF 100 million ceiling on accepting client funds would be abolished, client funds would become segregable in the institution's bankruptcy in place of falling into the estate, and such institutions would be permitted to issue a defined class of stablecoins subject to specific duties. Crypto institutions (Krypto-Institute) would cover services with cryptocurrencies under authorisation conditions modelled on, but less extensive than, those for securities firms. The consultation closed on 6 February 2026; as at the date of this update the Federal Council has not published its dispatch to Parliament, the State Secretariat for International Finance still recording the consultation as the most recent step, so the current ladder remains the law and the revision belongs in planning assumptions only.

Second, the AML reform in force on 1 October 2026, which we analysed separately: the transparency register and the extension of due diligence duties to advisers touch crypto structures and their counsel directly.

Third, the EU relationship. Switzerland's regime confers no passport into the EU: a Swiss SRO member or fintech licensee that offers crypto-asset services to clients in the EU needs a MiCA authorisation in a member state whatever the size of the book, the only carve-out being a client's own exclusive initiative under Article 61, which any solicitation in the Union defeats; and where the token is a financial instrument MiCA does not apply at all (Article 2(4)(a)) and the securities framework does, so a MiCA licence answers only part of the question. What the authorisation brings, we set out in our EU stablecoin and CASP updates. In our judgement the structure that works for EU-facing business is dual-track, because neither regime substitutes for the other: a Swiss base for speed, custody quality and non-EU business, and an EU entity for the passported market, with group-level compliance built once and mapped to both regimes.

What this means for you

• Classify first, formally. The 2018 taxonomy drives licensing, prospectus and AML outcomes; an authorisation enquiry to FINMA settles hard cases with authority.
• Do not oversell the SRO rung. It is fast and real, and it is AML supervision without a prudential licence; describe it accurately in marketing and bank files.
• Design custody around segregation. The statutory insolvency protection is the Swiss regime's principal advantage; use it deliberately, including in staking chains.
• Regulated managers: check the custodian. Under Guidance 01/2026 managed crypto belongs with a prudentially supervised custodian from whose bankruptcy the assets can be segregated; an existing SRO-only or foreign custodian without equivalent protection continues only by way of exception, with the client informed and consenting in writing, and the responsibility stays with the Swiss institution.
• Stablecoin issuers: start from the deposit rule. Guidance 06/2024 treats an at-par redemption claim as a deposit, so the issuer holds a banking licence, works with a bank default guarantee meeting FINMA's minimum requirements, or shows that its model fits another Banking Ordinance exception or the fintech licence, each a question of the model's terms; the pending FinIA revision would add a statutory route through the proposed payment-institution licence, and it is a consultation draft and no law yet.
• Plan Switzerland and the EU as one architecture. No passport flows from the Swiss regime; in our judgement the dual-track structure is the answer for EU-facing business.

Isak Legal advises crypto businesses, custodians, issuers and investors on Swiss regulatory strategy, SRO and licensing processes, FINMA authorisation enquiries and dual Swiss-EU structures. See our Digital Assets and Financial Regulation pages, or get in touch.

This client update is provided for general information only, reflects the position as at 26 September 2026 and does not constitute legal advice or create a lawyer-client relationship. FINMA practice and the cited guidance evolve; verify the current texts at the official sources linked above before acting. For advice on a specific matter, please contact us.