FINMA Alert: SECO Updates ISIL and Al-Qaida Sanctions List
Switzerland's State Secretariat for Economic Affairs (SECO) revised its ISIL (Da'esh) and Al-Qaida sanctions list on 16 October 2026, one day after the relevant UN Security Council sanctions committee passed its resolution. The change is directly applicable in Switzerland under the Ordinance of 21 March 2025 on Measures against Persons and Organisations Associated with ISIL (Da'esh) and Al-Qaida (SR 946.231.08), and every Swiss financial intermediary, including virtual asset service providers (VASPs) and crypto-focused firms, must act on it immediately. For compliance teams that rely on crypto accounting software with integrated sanctions screening, this update demands a prompt database refresh and a documented re-screening run.
What Changed and Why It Matters Now
SECO administers Switzerland's implementation of the UN Security Council's consolidated sanctions regime targeting individuals and entities linked to ISIL and Al-Qaida. When the UN sanctions committee amends its list, the change flows directly into Swiss law without further legislative action, because the 2025 ordinance mirrors the UN list by design. SECO reflected the 15 October 2026 UN committee decision in its SESAM database (SECO Sanctions Management) the very next day, making the revised list the operative legal standard from that date.
The SESAM database as the operative source
SESAM is the authoritative Swiss sanctions reference. Financial intermediaries are legally required to align their screening against SESAM, not against any intermediary or third-party aggregation. If your firm's crypto bookkeeping software or sanctions module pulls from a data vendor, verify that vendor has ingested the 16 October update before clearing any counterparty from the list. A lag of even a few hours creates a compliance exposure window.
Scope of the ordinance
The ordinance applies broadly to all financial intermediaries supervised under Swiss law, a category that includes banks, securities dealers, fund managers, and VASPs registered or operating in Switzerland. Crypto exchanges, custody providers, OTC desks, and DeFi-adjacent firms with Swiss nexus are all within scope. The ordinance prohibits making funds or economic resources available, directly or indirectly, to listed persons and organisations, and requires immediate asset freezing where a match is identified.
Dual Reporting Obligation: SECO and MROS
The language in FINMA's 16 October notice is deliberately emphatic on a point that is sometimes misunderstood in practice: reporting a frozen relationship to SECO and reporting a money-laundering suspicion to the Money Laundering Reporting Office Switzerland (MROS) are two separate, non-substitutable duties.
The SECO report
Once a financial intermediary identifies a business relationship or transaction involving a newly listed person or entity, it must freeze any assets and notify SECO. This is an administrative obligation under the sanctions ordinance. It confirms that the firm has identified and immobilised the relevant assets and is cooperating with the sanctions regime.
The MROS report under the Anti-Money Laundering Act
Article 9 of Switzerland's Anti-Money Laundering Act (GwG) requires a separate, immediate report to MROS when a firm cannot dispel suspicion of money laundering or terrorist financing through its own enhanced due diligence under Article 6 GwG. The FINMA notice makes clear that filing the SECO sanctions report does not satisfy this obligation. A firm that freezes assets and notifies SECO but stops there, without conducting Article 6 enhanced due diligence and, where suspicion remains, filing an Article 9 MROS report, is in breach of the GwG.
In practice this means compliance teams face a two-track workflow. Track one is operational: screen, match, freeze, notify SECO, document. Track two is investigative: assess whether the underlying activity raises money-laundering or terrorist-financing suspicion beyond the mere fact of a list match, and escalate to MROS if it does. Neither track excuses the other.
Accounting and Operational Implications for Swiss Firms
Asset freezing and balance sheet treatment
When a crypto firm freezes digital assets belonging to a sanctioned counterparty, those assets do not leave the firm's custody but become legally encumbered. Under Swiss accounting standards, frozen assets held on behalf of third parties remain off-balance-sheet if they are custody assets, but the firm must disclose the restriction in its books and flag the relationship in any regulatory reporting. Firms using digital asset accounting software should tag frozen wallets or accounts at the point of freezing, creating an auditable trail that regulators can inspect.
Segregation and documentation
Good practice, and arguably required under FINMA supervisory expectations, is to segregate frozen digital assets operationally: move them to a clearly labelled quarantine wallet, suspend any automated settlement or staking functions, and record the date and legal basis for the freeze. Any accruing rewards or yield associated with frozen assets should also be suspended pending SECO guidance, as distributing economic benefits to a sanctioned person is itself prohibited.
Sanctions screening cadence
Swiss VASPs and financial intermediaries that run periodic rather than continuous sanctions screening face heightened risk every time a list update occurs. The gap between the UN committee decision (15 October) and a firm's next scheduled screening run could be days. Firms should have a process to trigger an ad hoc screening run within hours of any SECO SESAM update. Automated alerts from SESAM or your data vendor are a minimum standard; waiting for a weekly batch run is no longer defensible.
Audit trail requirements
Both the sanctions ordinance and the GwG require firms to retain records of their screening activity, match analysis, freeze decisions, and reports filed. Compliance leads should ensure their crypto accounting or compliance platform captures a timestamped log of each screening event, the database version screened against, and any disposition decisions. This record will be the first document FINMA requests in a supervisory review.
What Accounting Firms and CFOs Must Do Now
For accounting firms advising Swiss crypto clients, and for CFOs at VASPs or digital asset businesses, the 16 October SESAM update triggers a concrete checklist rather than an abstract compliance concern. The steps below reflect the obligations set out in the FINMA notice and the underlying ordinance.
Immediate actions
First, confirm that your sanctions data feed has been updated to reflect the 16 October SESAM revision. If you rely on a third-party data vendor for your crypto bookkeeping software or compliance platform, obtain written confirmation of the update timestamp. Second, run an ad hoc screening of your full active counterparty list against the revised SESAM database today. Do not wait for your next scheduled batch. Third, if any match is identified, freeze the relevant assets immediately, suspend related services, and notify SECO as required by the ordinance. Fourth, open a parallel Article 6 GwG enhanced due diligence file for any matched relationship. Document your analysis of whether the facts raise a money-laundering or terrorist-financing suspicion. If suspicion cannot be dispelled, file an Article 9 GwG report with MROS without delay.
Ongoing governance
Beyond the immediate response, firms should review their sanctions screening policy to confirm it includes a trigger for ad hoc runs on every SESAM update, not just on a fixed calendar cycle. Governance documentation should reference the dual reporting obligation explicitly, so that front-line compliance staff understand that a SECO notification and a MROS report are distinct steps, each with its own legal basis and deadline.
For accounting firms that audit or advise Swiss VASPs, this is also a moment to assess whether clients' internal controls adequately address list-update responsiveness. A control that only screens on client onboarding, or that relies on manual processes to catch mid-relationship list changes, will not meet the standard the ordinance implies. Revisiting this as part of a broader AML controls review, particularly in light of how AI is reshaping crypto AML supervision across VARA, FCA, and HKMA, is timely.
The Broader Sanctions and AML Context
This update is routine in one sense: SECO regularly refreshes the SESAM database as the UN committee acts, and Swiss law requires immediate domestic effect. But "routine" does not mean low-stakes. Sanctions violations in Switzerland carry serious civil and criminal consequences, and FINMA has consistently signalled that AML and sanctions compliance is a supervisory priority for the crypto sector.
The dual SECO/MROS reporting structure also reflects a wider regulatory expectation that financial intermediaries treat sanctions compliance and AML compliance as complementary disciplines rather than siloed obligations. A firm that freezes assets but fails to assess whether the underlying activity warrants a MROS report is treating the sanctions ordinance as the finish line when it is only the starting point. The risks associated with inadequate on-chain AML controls, including those arising from crypto-specific channels, are well illustrated by the patterns discussed in our analysis of Bitcoin ATM scams and what banks must know about AML and on-chain risk.
For firms building or upgrading their compliance stack, the lesson is that crypto accounting software and digital asset compliance tools need to support real-time or near-real-time sanctions screening, with clear audit logs, automated freeze workflows, and configurable reporting triggers. A system that handles only tax and bookkeeping functions without integrated sanctions screening leaves a material gap in the compliance architecture.
Frequently Asked Questions
Does this sanctions update apply to crypto firms and VASPs in Switzerland?
Yes. The ordinance applies to all financial intermediaries under Swiss law, and FINMA's supervisory perimeter for the crypto sector includes exchanges, custody providers, OTC desks, and other VASPs with Swiss nexus. If your firm transacts in digital assets and holds a Swiss registration or operates with Swiss clients, you are within scope.
What is SESAM and where can firms access it?
SESAM (SECO Sanctions Management) is the official Swiss sanctions database maintained by SECO. It is publicly accessible via the SECO website and is updated each time the underlying UN list or Swiss ordinance changes. It is the authoritative source for Swiss sanctions screening, and firms should ensure their compliance tools reference SESAM directly or receive data from a vendor that ingests SESAM updates in real time.
Do we need to file both a SECO report and an MROS report?
Potentially yes. The SECO report is mandatory whenever you identify and freeze assets belonging to a listed person or entity. The MROS report under Article 9 GwG is separately required if, after conducting Article 6 enhanced due diligence, you cannot dispel suspicion of money laundering or terrorist financing. Filing one does not satisfy the obligation to file the other. Both duties exist in parallel.
How quickly must frozen assets be reported to SECO?
The ordinance requires reporting without delay once a match is identified and assets are frozen. There is no fixed statutory deadline expressed in hours, but "without delay" in Swiss regulatory practice means as soon as practically possible after the freeze decision, typically the same business day. Delays must be justifiable and documented.
What records should firms retain to evidence their compliance with this update?
At a minimum, retain a timestamped log of the screening run triggered by the 16 October SESAM update, the database version screened against, any match analysis, the freeze decision and its legal basis, the SECO notification, and any Article 6 enhanced due diligence file and Article 9 MROS report. These records should be stored in a format that can be produced promptly in a FINMA supervisory review.
Source: FINMA