Swiss Transparency Register: Wealth Managers Demand Delay After Hack

The Swiss transparency register is due to go live on 1 October, and the people who manage Switzerland’s private wealth want it stopped. The Swiss Association of Wealth Managers has asked the government to delay the launch of the country’s new beneficial ownership register after hackers copied the entire equivalent database in neighbouring Liechtenstein. Their argument is short. Putting the names, birth dates and home countries of the people behind more than half a million Swiss companies, foundations and other legal entities into one central database creates a target that somebody, somewhere, will eventually hit.

Liechtenstein just proved the point for them. On the night of 30 July 2026, an unknown attacker gained unauthorised access to the principality’s beneficial ownership register and left with roughly 31,000 records covering companies, foundations and trusts. Nobody has demanded a ransom. Nothing has surfaced on the dark web. That silence is what worries people who understand how this data gets used.

Bern hasn’t responded to the delay request. The law is signed, the pilot phase has been running since June, and the first filing deadline for audited Swiss corporations falls on 31 December. Unless the Federal Council blinks in the next four weeks, Switzerland will switch on a database twenty times the size of the one Liechtenstein just lost.

What Happened in the Liechtenstein Register Hack?

Hackers gained unauthorised digital access to Liechtenstein’s Register of Beneficial Owners (the VwbP) on the night of 30 July 2026 and copied around 31,000 records covering the owners of companies, foundations and trusts. The government confirmed the breach on 3 August, took the system offline, and said no ransom demand had been received and no data had appeared online.

The Office of Justice runs the register. It noticed irregularities on a Thursday, pulled the system, and by the weekend Prime Minister Brigitte Haas and Justice Minister Emanuel Schädler had convened a crisis team. The official line was careful. An unknown perpetrator, digital access, no sign that anything was altered or deleted. Just copied.

Ten days later the real story leaked out through the Swiss IT press. The attacker didn’t crack encryption or bribe an insider. According to reporting from inside-it.ch, the register’s access-permission logic was faulty. Once a user logged in, under certain conditions they could see entries that weren’t theirs. That’s an authorisation bug. First-year stuff. An external contractor built and maintained the system, regular security tests had been run, and the hole was there anyway.

Since the breach broke, the question we’ve heard most from clients holding Liechtenstein foundations has been the same one: what exactly do they have on me? The honest answer is that the government has been deliberately vague. The register stores name, date of birth, nationality, country of residence and the nature of each person’s interest. Whether every field sat in every exfiltrated copy is unconfirmed. Assume it did.

Why the silence is the scary part

No ransom note usually means one of two things. Either the attacker is sitting on the data while deciding how to monetise it, or the buyer already exists. A list of 31,000 wealthy families, their birth dates and their home countries is worth far more to a kidnapping ring, a divorce lawyer or a hostile tax authority than it is to a ransomware crew looking for a quick Bitcoin payout. This is where people get burned. The damage from a register breach doesn’t show up in week one. It shows up eighteen months later as a spear-phishing email that knows your foundation’s name.

What the Swiss Transparency Register Actually Is

The Swiss transparency register is a central federal database, run by the Federal Office of Justice, recording every natural person who controls 25% or more of a Swiss company, cooperative, or other legal entity, or who controls it by other means. It was created by the Federal Act on Transparency of Legal Entities (TJPG), passed by Parliament on 26 September 2025, and enters into force on 1 October 2026.

The Federal Office of Justice has been running a pilot since 16 June 2026 to test the infrastructure. The register was pushed through under FATF pressure and sits alongside a revised Anti-Money Laundering Act that takes effect on the same day. Both were waved through by the Federal Council on 12 June.

Bern’s defenders will tell you this register is nothing like the EU model. They’re half right. The Swiss version is closed to the public. Access is limited to federal and cantonal authorities (tax, criminal, supervisory) and to financial intermediaries and advisers regulated under the Anti-Money Laundering Act, and only where they need it for their own due diligence. Every query has to be authenticated, justified and logged.

Read that access list again, though. Thousands of banks, asset managers, fiduciaries, lawyers and trustees will hold credentials. The Liechtenstein register wasn’t public either. It fell because a logged-in user could see more than they were supposed to. The Swiss system will have vastly more logged-in users.

Who Has to File, and When

Every Swiss AG, GmbH, cooperative, SICAV and SICAF, plus foreign entities effectively managed from Switzerland or operating a Swiss branch, must report its beneficial owners to the Swiss transparency register. Filing windows are staggered by entity type between 31 December 2026 and 31 March 2027, and new entities must file within one month of commercial-register entry.

The penalties aren’t symbolic. Intentional breaches of the reporting duty carry fines of up to CHF 500,000. Ignoring a final order from the control office costs up to CHF 100,000 more. Listed companies, their 75%-owned subsidiaries, pension institutions and majority state-owned entities are exempt. Everyone else files.

Foundations get special treatment, and this is the part that matters for anyone who used a Liechtenstein or Panama structure to hold Swiss assets. Where a foundation controls a Swiss entity, the law looks straight through it. The founder, named beneficiaries, beneficiary classes and anyone with power to appoint board members or change distributions are all treated as beneficial owners. The register will record them. So much for the foundation as a privacy screen.

Why Swiss Wealth Managers Want the Register Delayed

The Swiss Association of Wealth Managers argues that launching a central database holding sensitive identity data on more than 500,000 legal entities, weeks after an identical register in Liechtenstein was copied in full, hands criminals a single high-value target. They want the 1 October start pushed back until the security of the system can be independently demonstrated.

Let’s be blunt about what the association is and isn’t saying. Nobody in the Swiss financial industry is publicly arguing against transparency itself. That fight was lost years ago, and the FATF would have put Switzerland on a grey list if Bern had refused to build a register at all. The argument is about sequencing. Build the register, fine, but don’t flip the switch on a 600,000-entity database three months after the neighbouring country’s version leaked because of an access-control bug.

The wealth managers have a point that goes beyond this one incident. Their clients are precisely the people a stolen register hurts most. A software founder in Zug, a Middle Eastern family with a Geneva holding company, a Latin American industrialist with Swiss trustees. The moment their name, birth date and home city sit in one queryable database, they become a lookup. The quiet part out loud is that Switzerland’s entire value proposition for the last century was that this lookup didn’t exist.

What the Federal Office of Justice hasn’t said

As of publication, Bern has offered no public response to the delay request. No statement on the register’s penetration testing. No comment on whether the access-control model was reviewed after the Liechtenstein incident. Given that the law is already in force by decree and the filing calendar is published, the base case is that the register launches on schedule and the wealth managers’ letter goes in a drawer.

Something we’ve seen repeatedly across jurisdictions that rolled out ownership registers, from the BVI to Bermuda to the EU: the launch date almost never moves, and the security review almost always happens after the first incident. Liechtenstein had the misfortune of being the first incident. Switzerland gets to decide whether to be the second.

What This Means for Owners of Swiss and Liechtenstein Structures

Owners of Swiss entities can’t opt out of the Swiss transparency register, but they can control how much sits behind the registered name. Owners of Liechtenstein structures should assume their data is in circulation and act accordingly. In both cases the practical response is the same: reduce what any single register reveals and separate the registered owner from the assets that matter.

Three things worth doing this month if you hold either kind of structure.

One pattern we see constantly: clients arrive convinced that a Swiss company plus a Swiss bank equals privacy. It hasn’t for a decade. Switzerland reports under the Common Reporting Standard to more than 100 partner jurisdictions, its surveillance rules were tightened again last year, and from October the ownership layer joins the reporting layer. The Swiss bank account is still excellent for what it does. Privacy is no longer one of those things.

The Bigger Picture: Every Beneficial Ownership Register Is a Target

Liechtenstein wasn’t a one-off. The UK’s Companies House has published beneficial ownership data since 2016 and has been used for identity fraud ever since. The EU was forced to shut public access to its registers in November 2022 when the Court of Justice of the European Union ruled that open access was a disproportionate interference with privacy. The United States built its own register under the Corporate Transparency Act, then gutted it for domestic companies in 2025. Bermuda is tightening its rules this year. Every one of these registers was sold as a tool against money laundering. Every one of them is also a shopping list.

The FATF’s own guidance on beneficial ownership pushes countries toward central registers because they’re convenient for investigators. Convenience for investigators is convenience for everyone else with a login. Liechtenstein had 31,000 entities and a small, tightly controlled user base, and it still leaked. Switzerland will have twenty times the records and a user base that spans every bank compliance desk in the country.

Bottom line: the register is coming, the delay request will probably fail, and the only variable you control is how much of your wealth is reachable from the name it records. That’s a structuring problem, and it’s solvable.

Common Misconceptions About the Swiss Transparency Register

“The register is closed, so it doesn’t matter.” Non-public registers are the ones that get hacked, because the data inside them is worth more. Public registers have nothing left to steal.

“My GmbH is already in the commercial register, so nothing changes.” Quotaholders of a GmbH appear in the commercial register, which is why those entities get until September 2028 to file. But the transparency register captures indirect owners and controllers behind the quotaholder, which the commercial register never did.

“My Liechtenstein foundation keeps me off the Swiss register.” Where the foundation controls a Swiss entity, the founder, beneficiaries and appointers are all beneficial owners under the TJPG. The foundation is transparent for register purposes.

“I can just not file.” CHF 500,000 says otherwise. And a control office within the Federal Department of Finance is tasked with auditing the accuracy and completeness of what gets filed.

Frequently Asked Questions About the Swiss Transparency Register

Final Thoughts

The Swiss transparency register will almost certainly launch on 1 October. The wealth managers are right that it’s a target, and Bern is right that the FATF left it little choice. Both things are true, and neither helps you if your name ends up in the next breach. The Liechtenstein register hack is the clearest warning yet that the ownership layer of your structure is now the weakest link, and the time to reinforce it is before your filing deadline. Waiting for the next press conference in Vaduz is how people end up on the wrong list.

If you hold Swiss or Liechtenstein entities and want to know how much of your wealth is reachable from the name on the register, start with our guide to non-CRS countries and the current best jurisdictions for an offshore bank account, or talk to us about a strategy call to map the structure properly.