News

At the beginning of 2020 FINMA had appointed an auditor to investigate Credit Suisse in the context of its observation activities (see press release published on 20 December 2019). It subsequently opened enforcement proceedings against the bank as a result of these investigations (see press release published on 2 September 2020). FINMA has now concluded these.

FINMA’s investigation revealed that in the period between 2016 and 2019 Credit Suisse planned seven observations, most of which were carried out. In two cases members of the executive board were observed in Switzerland and, in addition, other former employees and third parties abroad. FINMA’s investigation focused on how the bank managed and controlled observations, which can involve significant legal and reputational risks.

Corporate governance failings

The way in which the observation activities were planned and carried out revealed serious shortcomings in the bank’s corporate governance. Observations were not specifically prohibited in Credit Suisse’s policies, but neither were they regulated. Corresponding risk management processes and integration into the internal control system were lacking. In most cases, decisions to carry out observations were taken informally and without comprehensible reasons being given. No documented considerations were made of the risks associated with observation. Finally, the observations and their background were concealed. Contrary to the bank’s internal policies, for example, external means of communication (text messaging services) were used. Then, third-party providers were involved as intermediaries or very rudimentary invoices were issued and settled for costs incurred. In one case, an invoice was subsequently altered in order to conceal the costs of an observation.

The bank’s security service was significantly involved in the events described. Within the bank, views on physical observations differed and knowledge of observations actually carried out also varied. Knowledge of and decisions to plan or carry out individual observations were discovered to varying degrees and involving different groups of people each time – right up to executive board level. For example, several members of the former executive board were informed about the planned observation of an employee in Asia in August 2019.

The observations and, in particular, the way in which they were conducted, kept secret and partly concealed are evidence of an inappropriate corporate culture among parts of Credit Suisse’s operational management at that time. In addition, individual members of the former executive board used external means of communication in some cases, meaning that the messages were no longer able to be traced in full. This was at odds with internal policies and the expectation of managers to set an example (“right tone from the top”).

Organisational shortcomings and errors in the internal investigation

The considerable reputational risks posed to Credit Suisse in connection with the observation activities described ultimately materialised. The coming to light of certain observations attracted a great deal of media attention and the bank was criticised in the national and international press. During its internal investigation into the events, Credit Suisse was not able to comprehend the full scale of the observation activities for a long time. Statements made by the bank to the public and to FINMA subsequently proved to be partially incomplete or even inaccurate.

Accordingly, in the context of the observation activities it investigated at Credit Suisse, FINMA identified organisational shortcomings encompassing the policy level, the behaviour of parts of the executive board, the documentation, the investigation of risk-relevant events and the bank’s internal communication. The bank carried out various observation activities that posed considerable reputational risks, without these activities being incorporated into proper, documented decision-making processes and an adequate control environment.

As a result, Credit Suisse did not have a suitable organisational structure in place within the meaning of the Swiss Banking Act in the security area concerned. Neither did it offer a guarantee of irreproachable business conduct in the relevant period.

Measures and clarification of individual responsibility

Credit Suisse has already taken various organisational and operational measures in the areas of security and means of communication, which aim to ensure responsibility at the appropriate hierarchical level as well as clear decision-making processes and monitoring mechanisms. FINMA considers these measures to be essentially suitable for addressing the identified shortcomings, but has decreed additional measures. For example, it is obliging the bank to set up a new internal reporting system, via which the executive board will continuously inform the board of directors or one of its committees about important governance topics. In addition, any observations must be approved by top-level management (CEO and BoD Chair), so that responsibility can be attributed clearly and quickly in the future, while also being documented. Furthermore, the bank must take measures to document business-relevant communication in a comprehensible manner. FINMA will check that the measures are implemented and that the shortcomings are addressed.

FINMA has also reprimanded two individuals in writing and opened enforcement proceedings against three further individuals. In these proceedings, FINMA will investigate in depth the knowledge, behaviour (including with regard to information provided to FINMA) as well as the individual responsibility of these individuals in the context of the identified violations of the law by the bank.

Contact

Tobias Lux, Spokesperson
Tel. +41 31 327 91 71
tobias.lux@finma.ch

Vinzenz Mathys, Spokesperson
Tel. +41 31 327 19 77
vinzenz.mathys@finma.ch