CDB 27: Key Changes and Required Action for Financial Institutions

Overview¹

¹_{This overview is highly simplified and is intended to provide an initial framework for understanding the issue. Each institution should assess its own exposure and the specific need for action on a case-by-case basis.}

Controlling persons: Revised three-step approach

One of the most important substantive changes concerns the process for establishing the identity of the controlling persons of an operating legal entity or partnership using Form K.

As before, individuals holding 25% or more of the capital or voting rights must generally be established (first level). However, where there are obvious indications that another person exercises control over the company by other means, these indications must be clarified (second level). Unlike under the previous rules, the second level must now also be considered even if a controlling person has already been established at the first level. If such control is confirmed, this person alone must be established as the controlling person, rather than the person holding the relevant capital or voting rights. In the absence of such indications, there is no obligation to actively search for additional controlling persons. If no controlling person can be established at either level, the senior managing official must be established as the controlling person (third level).

Form K has also been amended. The controlling persons’ dates of birth and nationalities must now also be recorded.

Action required: Institutions should align their directives, Form K and onboarding processes with the revised three-step approach. The process must ensure that indications of control exercised in other ways are identified, investigated and documented. Existing client documentation should be supplemented where necessary as part of the periodic update.

New requirements for foundations and trusts

For non-operating foundations, the required information must generally be recorded by means of a written declaration or Form S. This also applies to foundations that exclusively pursue non-commercial purposes. For operating foundations, the identity of the controlling person must continue to be established.

For non-operating foundations that exclusively pursue non-commercial purposes, individual details concerning founders or beneficiaries may be omitted only in justified exceptional cases. Examples include foundations financed by a large or continually changing number of donors, or foundations that exclusively benefit other organisations pursuing non-commercial purposes.

For trusts and foundations, the requirements regarding the persons and structures that must be documented are also clarified. In particular, in the case of underlying companies, additional information concerning the trustee or the foundation must be documented.

Action required: Institution-specific rules for the classification and documentation of foundations and trusts should be reviewed. Institutions must also ensure that the new Forms S and T are integrated into the relevant processes in good time. For existing relationships, the documentation should be reviewed as part of the periodic update and supplemented where necessary.

Greater flexibility for digital processes

CDB 27 takes greater account of digital business processes. Information required in the CDB forms may also be confirmed by the contracting partner by means of another form of declaration that may be evidenced in text. This provides greater flexibility as to the form in which the required information is obtained, while ensuring that the declaration can be attributed to the contracting partner.

CDB 27 also takes a more technology-neutral approach to the receipt and retention of CDB forms. Forms printed out and physically signed by the contracting partner may be received electronically as electronic copies, provided that the electronic transmission is documented. Physical originals do not need to be retained; electronic copies are sufficient.

Action required: Institutions can simplify existing paper-based processes. At the same time, they must ensure that the receipt of the relevant documents, or their availability in the institution’s system, is fully documented. Internal directives and processes governing electronic forms, document retention and audit trails should be reviewed accordingly.

Repetition of due diligence and resumption of business relationships

CDB 27 also clarifies the requirements applicable to existing business relationships. If doubts arise as to the identity of the contracting partner, the controlling person or the beneficial owner and those doubts cannot be resolved through relevant enquiries, the relevant due diligence procedures must be repeated. The commentary issued by the Swiss Bankers Association generally interprets the “reasonable time” allowed for completing this process as 60 days. If the process cannot be completed in full within this period, the institution must take a risk-based decision on how to proceed and document that decision accordingly.

Changes solely to the master data of natural persons, such as a change of address or name as a result of events relating to civil status law, do not in themselves trigger a repetition of the due diligence procedures. The client data must be updated accordingly.

CDB 27 also expressly regulates the resumption of a business relationship. Where a business relationship is resumed, the verification of the identity of the contracting partner and the establishment of the identity of the controlling person and/or beneficial owners must be repeated. The temporary reactivation of accounts or securities accounts for the booking of assets returned in connection with the closure of a business relationship, or of deposits to be booked retroactively in connection with assets that have already been booked out, does not constitute a resumption of the relationship.

Transparency register: a discrepancy does not automatically give rise to doubts

CDB 27 now expressly regulates its interaction with the transparency register. If, when consulting the register, an institution identifies a discrepancy between the data in the register and its own data, or an annotation in the register, this does not prevent the use of the account, provided that there is no doubt concerning the data recorded by the institution under the CDB. Subject to the same condition, the due diligence procedures do not need to be repeated.

In practice, processes for reconciling data with the transparency register should clearly distinguish between a discrepancy or annotation in the register and actual doubts concerning the data recorded by the institution under the CDB.

Further relevant changes

CDB 27 contains various additional changes that may require adjustments depending on the business model. These include in particular:

• CDB 27 clarifies that a contracting partner whose identity has already been duly verified does not need to be identified again when additional business relationships are established, provided that the identity verification was properly carried out within an existing business relationship.
  
  
• The previous mandatory requirement to obtain Form A for natural persons where the business relationship is established without a face-to-face meeting, formerly referred to as correspondence-based account openings, has been abolished. If the bank is satisfied beyond doubt that the contracting partner and the beneficial owner are the same person, appropriate documentation of this fact is sufficient.
  
  
• Lending transactions involving a direct contractual relationship with the borrower, as well as certain money and value transfers, are expressly subject to the relevant identity verification and determination requirements.
  
  
• Removal of the high-risk-country criterion: Certain exemptions from the obligation to establish the identity of the controlling person or beneficial owner now apply irrespective of whether there is a connection to a country presenting increased risks. The risk-based clarification and due diligence obligations under the AMLA and AMLO-FINMA remain unaffected.

Transitional period and recommended implementation

CDB 27 will enter into force on 1 January 2027. A four-month transitional period applies. Following the expiry of the transitional period, the new requirements will apply in particular to new business relationships and where due diligence procedures are repeated. However, institutions are not required to update all existing client files across the board to bring them into line with the new requirements.

Institutions should use the transitional period in particular to:

• update their AMLA and CDB directives to reflect the new requirements;
  
  
• update Forms K, S and T, or equivalent proprietary forms;
  
  
• align onboarding and review processes with the revised three-step approach to establishing the identity of controlling persons;
  
  
• update rules for foundations, trusts and underlying companies; and
  
  
• provide targeted training to front-office, operations and compliance staff.

Conclusion

CDB 27 does not fundamentally redesign the due diligence framework. It does, however, change its practical implementation in several areas. Particularly relevant are the revised three-step approach to establishing the identity of controlling persons, the expanded requirements for foundations and trusts, the greater flexibility for digital processes, and the clarified requirements for repeating due diligence. The short transitional period makes an early review of existing directives, forms and processes advisable.

How we can help

Grant Thornton assists companies in assessing regulatory developments and supports their practical implementation. We also act as a point of contact for implementation from both a conceptual and technological perspective.