Whistleblower law in Switzerland #

Switzerland has no general whistleblower protection law. The Federal Council’s partial revision of the Code of Obligations, Protection in the event of reporting irregularities in the workplace, was rejected by the National Council on 5 March 2020 by 147 votes to 42, after an earlier version had already been sent back to the Federal Council for redrafting. The business was closed the same day. A motion to tighten Switzerland’s implementation of the OECD Anti-Bribery Convention, including a legal framework to protect private-sector whistleblowers (23.3844) was rejected by the National Council on 27 February 2024, with the Federal Council opposed. The OECD Working Group on Bribery has recorded “the lack of concrete proposals to pursue the necessary legislative reforms” and expects a Swiss implementation report in December 2026. What governs instead is ordinary employment and criminal law, a separate statutory regime for federal public employees, and sectoral supervision.

Applicable law #

Does Directive (EU) 2019/1937 apply? #

No. Switzerland is neither an EU nor an EEA member, and the Directive does not extend to it through the bilateral agreements.

The exposure runs through subsidiaries in both directions, and the two directions are not symmetrical:

A Swiss group with EU subsidiaries is in scope through those subsidiaries. The 50-worker threshold applies per legal entity, not per corporate group, so each EU subsidiary answers to its own national transposing law regardless of where the parent sits. See our reading of the threshold and the country-by-country obligations.
An EU group with a Swiss entity gets no Directive obligation for that entity. A group channel that stops at the Swiss border still satisfies the Directive; the Swiss entity is simply governed by the rules below.

Who must establish an internal channel #

No general Swiss law requires one. One ordinance does, for a narrow group of companies, and two further provisions make the absence of a channel expensive for everyone else.

Supply-chain due diligence (Art. 964j–964k CO and Art. 14 of the ordinance, SR 221.433). Companies with their seat, head office or principal place of business in Switzerland that place in free circulation or process tin, tantalum, tungsten or gold above the ordinance’s annual import volumes, or that offer products or services with a reasonable suspicion of child labour, must provide “as an early-warning mechanism for risk detection, a reporting procedure that enables all interested persons to raise justified concerns” about adverse impacts in those areas. “The reports must be documented.” The procedure is limited to minerals, metals and child labour, and the child-labour limb exempts small and medium-sized companies (Art. 6) and companies with low child-labour risk (Art. 7). It is open to anyone, not only to staff.

Corporate criminal liability (Art. 102 para. 2 SCC). For bribery, money laundering, terrorism financing and criminal-organisation offences, the undertaking is penalised irrespective of the criminal liability of any natural person, provided it “failed to take all the reasonable organisational measures that are required in order to prevent such an offence”. Article 102 para. 1 caps the corporate fine at CHF 5 million. Swiss law does not enumerate those measures, so an organisation that has no way of learning about the conduct in the first place is arguing from a weak position.

The reporting cascade. Swiss case law permits a report to an authority only after an internal attempt has failed or would plainly be futile. FINMA states this in its own guidance: “According to case law for permitted whistleblowing you are fundamentally required first of all to attempt to report the suspected irregularity within the institution concerned. Only if this is not successful or appears futile is an external report to FINMA as the supervisory authority justified (so-called cascade system of permitted whistleblowing).” The regulator goes on to warn reporters that they “otherwise run the risk by submitting your report to FINMA of being liable to prosecution due to a potential breach of your duty of confidentiality.”

An employer with no internal route does not thereby keep reports in-house. It pushes workers straight to the step that carries the most legal risk for them, and the least control for the employer.

Soft law. Recommendation 12 of the 2023 Swiss Code of Best Practice for Corporate Governance states that the board “should ensure that employees can report the suspected irregularities they have identified in the company to an independent internal or external body without expecting disadvantages. The reports should be investigated.” It binds no one, but it is the benchmark auditors and boards of listed companies are measured against.

What protection a private-sector whistleblower has #

Very little, and it is worth being plain about that rather than implying otherwise.

Art. 321a CO binds the employee to “loyally safeguard the employer’s legitimate interests” and, in para. 4, not to reveal confidential information. This is the duty a report is measured against.
Art. 336 CO makes some terminations unlawful, and the courts have treated dismissal for a lawful report as falling within it. The provision does not name whistleblowing.
Art. 336a para. 2 CO caps the remedy: compensation “must not exceed an amount equivalent to six months’ salary”. The dismissal itself stands. There is no reinstatement.
Art. 162 SCC punishes betrayal of a manufacturing or trade secret that the person is under a statutory or contractual duty not to reveal.
Art. 273 SCC punishes making a manufacturing or trade secret available to a foreign official agency, a foreign organisation or a private enterprise, or their agents.

Article 273 is the provision multinational groups underestimate. Where a report crosses the Swiss border — into a group intake abroad, or to a foreign authority — the routing decision is a question of Swiss criminal law, not of system architecture.

Storage by a contracted processor abroad is the open question, and we know of no court decision on it. The Federal Supreme Court holds that a secret is made available as soon as the recipient has the possibility of learning it and that the information must have a connection to Switzerland, and records that prevailing doctrine favours applying Article 273 with restraint (BGE 141 IV 155, E. 4.2.2–4.2.4). Swiss commentary on cloud services takes a risk-based approach: what matters is whether access by a foreign authority must still reasonably be expected (Rosenthal, Jusletter IT, 15 February 2024, in German).

The federal public sector #

Federal employees are covered by a real statutory regime. Art. 22a of the Federal Personnel Act obliges them to report felonies and misdemeanours prosecuted ex officio that they observe in the course of their duties, to the prosecution authorities, their superiors or the Swiss Federal Audit Office (SFAO). Paragraph 4 gives them the right to report other irregularities to the SFAO, which then establishes the facts and takes the necessary measures. Paragraph 5 provides that anyone who reports in good faith or testifies as a witness may not be disadvantaged in their professional position as a result.

The SFAO operates an external reporting platform at whistleblowing.admin.ch, open to federal employees and to the public, covering the federal administration, affiliated organisations and subsidy recipients.

A revision of 20 June 2025 rewrites Article 22a with effect from 1 January 2027. The reporting duty then attaches to a reasonable suspicion connected with a federal task, and a new paragraph gives the reporter’s privacy precedence over freedom-of-information requests.

Article 22a covers employers under the Federal Personnel Act. Cantonal and communal employees fall under cantonal personnel law instead, which varies by canton.

External reporting authority #

There is no general external whistleblowing authority for the Swiss private sector. Reporting runs through whichever supervisory body has jurisdiction over the subject matter:

FINMA for breaches of financial market law, through a secured external platform with voluntary disclosure of identity.
The Swiss Federal Audit Office for the federal administration and bodies connected to it.
The prosecution authorities for criminal conduct.

Data protection authority #

The competent authority is the Federal Data Protection and Information Commissioner (FDPIC), under the Federal Act on Data Protection of 25 September 2020, in force since 1 September 2023.

Key compliance points #

“No general Swiss obligation” is not the same as “no Swiss exposure”. Article 102 para. 2 SCC attaches corporate liability to the absence of reasonable organisational measures, and a Swiss group’s EU subsidiaries carry the Directive’s obligations on their own account.
Who receives reports about the Swiss entity, and where, is a question under Art. 273 SCC. Handing them to an intake team or an authority abroad is the clearest risk; whether storage by a contracted processor abroad is caught has not been decided. Where reports are stored is also a disclosure duty: under Art. 19(4) FADP the privacy notice must name the state to which personal data is disclosed. The Federal Council recognises all EU and EEA states as providing adequate protection (Annex 1 to the Data Protection Ordinance), so EU hosting needs no further transfer safeguards, but it still has to be named.
A company in scope of the supply-chain ordinance needs a documented reporting procedure open to outside parties. A whistleblowing channel that accepts reports from suppliers and other third parties can serve as that procedure.
Nothing in Swiss law corresponds to the Directive’s seven-day acknowledgment or three-month feedback deadlines. A group that applies those deadlines uniformly is above the Swiss floor, not below it.
A Swiss employee weighing whether to report is deciding between a duty of loyalty with criminal edges and a remedy capped at six months’ salary if the employer dismisses them. Internal handling that visibly works is what changes that calculation.

Official sources #

Primary law

Parliament and authorities

Deploy your whistleblowing channel →

Last updated: October 12, 2026