Internal Investigation Reports


This contribution outlines, from a high-level perspective, the role and relevancy of internal investigation reports in the financial sector and particularly in the context of parallel or subsequent criminal proceedings related to the same underlying matter. This topic has been the subject of recent case law in Switzerland.

Against this backdrop, certain limitations apply and need to be carefully considered at the outset of an internal investigation.

One of the key questions is whether it is possible to avoid or challenge the prosecution authorities' reliance on an internal investigation report by invoking (i) the right not to incriminate oneself (nemo tenetur principle), and/or (ii) attorneyclient privilege, where outside legal counsel was instructed to conduct the internal investigation and issued a report.

Right not to incriminate oneself

In the financial sector, supervised entities are subject to a very broad duty to co-operate with the Swiss Financial Market Supervisory Authority (FINMA), which is responsible for monitoring the Swiss financial market and protecting its integrity. The key provision dealing with the cooperation duty is Article 29 of the Federal Act on the Swiss Financial Market Supervisory Authority.

As a result, supervised entities must provide FINMA, on their own initiative or upon request, with all documents and information which the regulator requires to carry out its supervision duties. In practical terms, the disclosure duties vis-à-vis FINMA often require the supervised entity to document its findings yielded during an internal investigation and to disclose the report (or at least the key findings) arising therefrom, which often identifies potential legal or regulatory shortcomings related to the underlying matter.

The duty to co-operate with the regulator, at times, however, conflicts with the nemo tenetur principle, pursuant to which no person is required to incriminate himself or herself by his or her own testimony, by positively providing evidence or through any other form of co-operation in criminal proceedings. The conflict between these two principles becomes obvious where the information provided to FINMA (i) is incriminating for the supervised entity, and (ii) is subsequently shared by FINMA with the criminal prosecution authorities. Such sharing of information might typically occur in the context of mutual assistance proceedings and the exchange of information between authorities.

In Switzerland, companies such as banks are to a large extent denied the right to invoke the nemo tenetur principle to prevent the prosecution authorities from getting hold of internal investigation reports, whether this occurs by means of coercive measures (dawn raids, seizures, etc) or through mutual legal assistance with FINMA.

The reasoning behind this is that (i) if documents and evidence already existed before coercion was applied, and (ii) they were issued notably in the context of administrative proceedings, without the threat of criminal penalties, the nemo tenetur principle does not apply (SFT 142 IV 207).

As a result of (i) the increasing appetite of prosecution authorities for internal investigation reports, and (ii) the very limited legal protection afforded to supervised entities and their employees, other avenues need to be considered by supervised entities concerning how the findings of internal investigations are documented and eventually shared with FINMA.

Attorney-client privilege

Scope of privilege protection

While attorney-client privilege remains intact as a matter of Swiss criminal procedure law for lawyers defending the accused individual or a legal entity, the scope of protection is significantly more precarious for other participants (witnesses, informants, etc) or third parties to the proceedings. Indeed, for these other categories, recent case law held that only Swiss, EU and EFTA-admitted lawyers benefit from attorneyclient privilege protection in Switzerland (Swiss Federal Tribunal 1B_333/2020 of 22 June 2021).

As a result, written communications between a client (who is not the target of a criminal investigation) and a US law firm, for instance, are not protected by attorney-client privilege if the information is seized by a Swiss prosecution authority. This can be of particular relevance in the context of cross-border internal investigations in which non-Swiss/EU/EFTA lawyers are involved.

Moreover, where the purpose of an internal investigation is to assess a supervised entity's compliance with AML rules and regulations, attorney-client privilege might not afford an absolute protection either, even for Swiss lawyers. Indeed, according to case law, whenever an external counsel is tasked with an internal investigation related to the AML compliance of a financial institution, these fact findings amount to a delegation of the supervised entity's core AML duties, and attorney-client privilege does not extend to this portion of the mandate (Swiss Federal Tribunal 1B_85/2016 of 20 September 2016).

Indeed, typical lawyer activity, such as legal advice provided on issues relating to compliance with AML legislation and the consequences of non-compliance related thereto, is in principle protected by attorney-client privilege. However, where lawyers perform compliance tasks (including the monitoring/controlling and documenting thereof) which are typically the duty of the bank itself (and are therefore being carried out on behalf of the bank), their internal investigation does not constitute typical legal counsel work, as it is viewed as accessory business support to the bank, and related work products are, therefore, not deemed privileged (Swiss Federal Tribunal 1B_433/2017 of 21 March 2018). Furthermore, when the legal entity is not accused in the Swiss criminal proceedings, the above-mentioned limitation regarding the country of origin of the lawyer to Switzerland and EU and EFTA states should in any event be kept in mind to avoid losing the protection afforded by attorneyclient privilege.

Mixed mandates

In light of the above, when outside counsel is tasked with an internal investigation relating to AML issues, the parties should pay particular attention to the way the mandate is structured, as it will typically consist in a so-called mixed mandate and thus encompass a fact-finding exercise in addition to legal advice.

In this regard, the existence of protected attorney-client privilege must be examined in the concrete circumstances of a given case. A reference to attorney-client privilege in the engagement letter or on the documents seized might not be sufficient to establish the existence of such privilege (Swiss Federal Tribunal 1B_453/2018 of 6 February 2019).

It is incumbent on the law firm accepting a mixed mandate to be aware of this issue and to take appropriate steps to ensure that the (privileged) lawyer's typical activity can be clearly distinguished from any other (non-privileged) activity, in order for information covered by attorneyclient privilege to remain segregated from other information.

This means that, when preparing documents during an internal investigation, care must be taken to ensure that knowledge gained from the lawyer's typical activity is not mixed with work products emanating from atypical work in the field of the supervised entity's duties. Possible measures to consider include, among others, separate file management or even separate teams handling the respective workstreams. Moreover, documents prepared for the purpose, or in the course, of the lawyer's typical activity should be marked as "Privileged and Confidential".

It is important to note that in the case of a document which could seemingly fall under both types of activities of the lawyer, it is up to the supervised entity to demonstrate, in the event of a dispute on the matter, that attorney-client privilege indeed applies.

Types of documents

Documents drawn up by outside counsel containing an assessment of the risks incurred by the supervised entity are fully protected by attorney-client privilege, as this is typically part of a lawyer's activity. The factual findings that such an assessment contains, even if they have been made on the basis of the work of an external consultant and include aspects relating to the bank's obligations, are also covered by attorneyclient privilege.

In this context, the Swiss Federal Tribunal recently ruled that secrecy must therefore be maintained over the entire document and not just over the portions strictly relating to legal advice (Swiss Federal Tribunal 1B_509/2022 of 2 March 2023). However, in so far as these findings of facts are also relevant to the fulfilment of the supervised entity's AML-related duties, it is advisable that they are documented, additionally, in a separate document that can be made available to the authorities if and when necessary.

By contrast, documents drawn up by the supervised entity for its outside counsel are not subject to attorney-client privilege, unless the supervised entity can demonstrate that the documents were prepared for the sole purpose of enabling its outside counsel to advise or defend it. Indeed, pre-existing company documentation does not attract attorney-client privilege simply because it was subsequently handed over to a lawyer (SFT 143 IV 462).


In many cases, financial institutions engage outside counsel to conduct internal investigations and prepare a report, for example as part of their duty to co-operate with their regulator.

Such reports are often ultimately forwarded to the prosecution authorities and are used as incriminating evidence in criminal proceedings. As a result, tensions might arise with regard to the fundamental right not to incriminate oneself, as well as with regard to attorney-client privilege.

It is therefore strongly recommended to clearly define from the outset the scope of the internal investigation and the legal issues to be addressed. The following issues should especially be taken into account:

  • the likelihood that criminal proceedings might be opened;
  • the intention of the legal entity to make use of the documents arising out of the internal investigation in subsequent or parallel criminal proceedings;
  • the stage of the investigation at which it can be expected that the internal investigation report might become relevant for criminal proceedings; and
  • the person who will conduct the internal investigation, whose report might become relevant evidence for criminal proceedings.

Summaries of facts should use neutral language, ideally as found in the documents reviewed, and should contain no evaluation, comments or conclusions. To the extent possible, internal investigations should be conducted as the fact-finding part in the building of the criminal defence in pending or anticipated criminal proceedings.

Although it is difficult to draw a clear dividing line between, on the one hand, the lawyer's typical legal advisory activity and, on the other, assistance provided to a supervised entity in the performance of its AML obligations, such separation is key to avoid jeopardising the protection afforded by attorney-client privilege under Swiss law. Moreover, in cross-border matters involving also non-Swiss/EU/EFTA lawyers as counsel to a non-accused company, the relevant communications should be stored, and the instructions structured in such a way that attorney-client privilege under Swiss law is fully preserved.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.