Swiss Crypto Privacy: What the Law Actually Protects, and What It Doesn’t

Swiss law protects financial data through three layers. The Federal Act on Data Protection governs how a company may use it. Strict confidentiality duties restrict who may see it. And Article 271 of the Swiss Criminal Code, the Swiss blocking statute, makes it a criminal offence to hand data directly to a foreign authority: foreign police forces and foreign court orders have no direct power on Swiss territory, and requests run through Switzerland’s own legal channels, where a Swiss authority decides. What Swiss privacy is not: anonymity. Swiss financial intermediaries verify their clients and operate under Swiss AML law, which is exactly why the protection is credible.

The Email That Prompted This Page

Not long ago, a national police cybercrime unit from outside Switzerland emailed us. Politely, professionally, through official channels, they asked whether TrustLinq would accept their country’s formal requests or court orders and hand over subscriber information and log data.

Our answer, on Swiss counsel’s advice, wasn’t a refusal to cooperate. It was a redirection: Swiss law prohibits us from acting on foreign requests directly, on pain of criminal liability, and routes requests like theirs through Switzerland’s official legal cooperation channels, where they will be handled properly. Legitimate investigations get their road; it just runs through Bern, not through our inbox. That surprises people on both sides: authorities used to platforms that cooperate on request, and crypto users who assume every company folds the moment a badge appears. Both are working from assumptions Swiss law doesn’t share, so it’s worth laying out precisely how this works.

Layer One: Data Protection by Default

The revised Swiss Federal Act on Data Protection, in force since September 2023, governs the ordinary life of your data: collected for defined purposes, protected proportionately, never sold, never shared commercially. This layer resembles what Europeans know from the GDPR, and it’s the baseline, not the story.

Layer Two: Article 271, the Blocking Statute

The story is Article 271 of the Swiss Criminal Code, in force since 1935. It prohibits carrying out, on Swiss territory and without Swiss authorization, acts that belong to public authority, on behalf of a foreign state. Producing evidence for a foreign investigation is such an act. That means a Swiss financial intermediary generally cannot execute a foreign authority’s demand for confidential client records, or comply directly with a foreign court order, without committing a criminal offence in Switzerland, prosecuted by the Office of the Attorney General.

This is not a theoretical rule. The Swiss Federal Supreme Court confirmed a conviction in 2021 (6B_216/2020, published as ATF 148 IV 66) in a case where a Swiss company’s chairman personally delivered client files to the US Department of Justice, under a negotiated non-prosecution agreement, after the DOJ had declined to use official channels. Cooperation with the world’s most powerful enforcement agency, in his own company’s interest, was still a crime, because the decision to move Swiss-held data abroad belongs to Swiss authorities and no one else. The court’s standard: information that could only lawfully be obtained in Switzerland through a Swiss authority’s order may not be handed to a foreign state directly.

For a TrustLinq client, the practical meaning is simple. A foreign authority seeking your confidential records cannot compel us, and we could not volunteer them if we wanted to. The road runs through Switzerland’s own legal channels, where Swiss law decides.

Layer Three: The Road That Exists

Switzerland is not a data black hole, and pretending otherwise would be dishonest. Foreign authorities have legitimate routes: international legal cooperation, with criminal matters administered through the Swiss Federal Office of Justice. A request is examined by Swiss authorities under Swiss standards before anything moves: where coercive measures like producing confidential records are involved, the conduct must generally be criminal under Swiss law too, fishing expeditions are refused, and information that is granted may only be used for the proceedings it was granted for, with production ordered through the competent Swiss authority.

The difference between this and “cooperating on request” is the difference between a process and a phone call. Under Swiss legal cooperation, a Swiss authority weighs the request, applies Swiss law, and orders any production itself. The gatekeeper is the Swiss state, with its own courts reviewing the decisions, not a compliance officer under pressure at 5pm on a Friday.

Switzerland vs the EU vs the UK: Who Can Order Your Data

The Swiss position is easiest to see next to its neighbours, and 2026 made the contrast sharper than it has ever been.

In the EU, the e-Evidence Regulation became applicable on 18 August 2026. Judicial authorities in one member state can now issue production orders directly to communications services, hosting providers and online platforms in another, bypassing mutual legal assistance: ten days to comply, eight hours in emergencies, penalties up to 2% of worldwide turnover. Financial institutions sit outside that regulation’s scope, but their position is telling in a different way: no EU law prevents a payment company from answering a foreign authority, and nothing makes compliance a crime. The decision sits with the institution and its lawyers, case by case.

The UK moved the same direction earlier: under the UK-US Data Access Agreement, in force since 2022, US authorities serve data demands directly on covered UK communications and data providers, and vice versa, without government-to-government procedure. UK financial institutions are not those covered providers, but as in the EU, nothing in UK law criminalizes a payment company’s decision to cooperate with a foreign authority.

Switzerland is the counter-model, and the difference is sharpest exactly where the others are silent. The EU and the UK have no blocking statute: when a foreign authority asks, the institution decides. In Switzerland, that same cooperation is a criminal offence unless it runs through Swiss channels. Elsewhere, protection is a policy; here, it is the criminal code.

One reading of that table matters most: elsewhere, the entity deciding whether your data moves is the institution holding it, weighing each request itself. In the Swiss model, it’s a state authority applying published standards, with courts above it, and never TrustLinq itself. Neither system is lawless; only one puts a government’s own judgment between your data and a foreign request, every time.

Privacy, Properly Understood

Swiss privacy is often confused with anonymity, and it’s better than that. TrustLinq is a Swiss-regulated financial intermediary, supervised by SO-FIT, a FINMA-recognised self-regulatory organisation, which means clients verify once and payments are screened under Swiss law, the routine housekeeping of regulated finance, and the very reason TrustLinq transfers land cleanly at recipient banks. The ordinary duties that come with Swiss status, domestic reporting where Swiss law requires it, and Switzerland’s own treaty-based tax cooperation covered in our DAC8, CARF and Swiss privacy analysis, are the same ones every bank in Zurich has carried for decades. None of them puts a foreign authority in contact with your data, and none of them touches the ordinary client’s experience: verify once, then every payment is bank details and send.

That’s also why the protection holds. Privacy that lives inside a functioning legal order is privacy with a state and its courts behind it, credible to banks, durable across decades, and of no use to anyone with something to hide, which is exactly what keeps it strong for everyone else. Your funds stay in your wallet because the architecture is non-custodial; your data stays under Swiss law because Article 271 permits nothing less.

Why This Matters More for Crypto Than for Anything Else

Crypto users have watched a decade of the opposite model. Exchanges and platforms in most jurisdictions respond to domestic and foreign data demands as a matter of routine, and their terms of service say so. The industry’s answer was to flee regulation entirely, which produced platforms with no duty to anyone, until they collapsed or were seized, taking the data and the funds with them.

The Swiss model is the third option nobody built for crypto until now: a regulated intermediary whose confidentiality is defended by Swiss law itself. Combined with non-custodial architecture, funds in your own wallet until the moment a payment executes, it means the two things a client actually worries about, their money and their data, are each protected by structure rather than by promise. The full framework sits in our guide to Swiss crypto regulations, and the model it protects in crypto-funded fiat settlement.

What This Means for You, in Practice

Legal architecture is abstract until it touches a payment, so here’s where it lands.

Your on-chain life stays yours. When you pay rent or a supplier through TrustLinq, the recipient’s bank sees a clean transfer from a Swiss-regulated intermediary with an ordinary reference. Your wallet address, your holdings and your transaction history are not attached to the payment and are nobody’s business at the receiving end.

No personal account collecting a crypto history. The classic route, cash out to your own account, then pay, hands your bank a running log of crypto-origin inflows, which is exactly what triggers the reviews and freezes covered in why banks freeze crypto transfers. With direct settlement your personal bank account isn’t in the loop at all, because you don’t need one.

No honeypot. Custodial platforms concentrate two tempting things in one place: everyone’s funds and everyone’s data. TrustLinq’s non-custodial architecture means your funds sit in your own wallet until the moment a payment executes, and your data sits under one of the strongest privacy jurisdictions in the world. Privacy here isn’t a toggle in the settings; it’s how the thing is built.

Frequently Asked Questions

Can foreign governments access my TrustLinq data?

Not directly: under Article 271 of the Swiss Criminal Code, executing a foreign authority’s demand for confidential records is a criminal offence. A foreign authority’s route is Switzerland’s own legal cooperation process, examined under Swiss standards, with fishing expeditions refused and production ordered by the competent Swiss authority. Requests arriving through that channel are handled promptly and completely; foreign authorities simply never obtain data from us directly, because Swiss authorities decide what leaves Switzerland.

What is Article 271 of the Swiss Criminal Code?

Switzerland’s blocking statute, in force since 1935. It makes it a criminal offence to perform acts reserved to public authority, including producing evidence or disclosing data for foreign proceedings, on Swiss territory for a foreign state without Swiss authorization. The Federal Supreme Court has confirmed convictions under it, including for disclosure made voluntarily to foreign enforcement agencies.

Does Swiss privacy mean my payments are anonymous?

No, and no legitimate route offers that. Every TrustLinq client is verified once, and every payment is screened under Swiss AML law before fiat is released. That verification is precisely what makes the transfers land cleanly at recipient banks, and what makes the privacy protections credible rather than cosmetic.

Who can actually see my payment data?

Your data is handled under Swiss data protection law, on a need-to-know basis, never sold, never shared commercially. The only parties who touch it are the ones your payment needs: the regulated partners who execute settlement, and Swiss authorities where Swiss law itself requires it. Foreign authorities have no direct route to it; their road runs through Switzerland’s own legal channels, where a Swiss authority decides.

How does Swiss privacy compare to the GDPR?

The GDPR and the Swiss FADP are close cousins on how companies handle data day to day. The divergence is what happens when a foreign authority asks: the EU has no blocking statute, so a financial institution facing a foreign request decides for itself under GDPR and national law, while Swiss law criminalizes exactly that kind of direct compliance and routes every such request through Swiss authorities. Same data-protection baseline, opposite answer on foreign reach.

Does the EU e-Evidence Regulation or the US CLOUD Act reach a Swiss company like TrustLinq?

Those regimes bind providers within their jurisdictions: the e-Evidence rules address providers offering covered communication, storage and platform services in the EU, and the CLOUD Act reaches providers subject to US jurisdiction. TrustLinq is a Swiss financial intermediary with data held in Switzerland under Swiss law, where Article 271 makes direct compliance with foreign orders a criminal offence. Any foreign authority’s road to Swiss-held data runs through Switzerland’s mutual legal assistance process, where a Swiss authority decides.

Do crypto platforms share my data with governments?

Most platforms operate in jurisdictions where responding to domestic and foreign data demands is routine, and their terms of service say so, and nothing in EU or UK law makes that cooperation a crime; the institution weighs each request itself. The Swiss model is structurally different: a Swiss intermediary answers to Swiss law alone, and handing data directly to a foreign authority is a criminal offence here, not a policy choice.

What is the most private way to pay with crypto legally?

A verified, non-custodial, Swiss-regulated settlement service, and each of those words carries weight. Verified, because unverified routes end in frozen transfers. Non-custodial, because funds that never leave your wallet can’t be pooled, profiled or seized from a platform. Swiss, because your data ends up under the one framework where foreign reach is criminally blocked. Legal privacy comes from jurisdiction and architecture, not from hiding.

Is Swiss banking secrecy still real?

The casual version died with automatic tax-information exchange, and anyone selling you 1970s-style numbered-account secrecy is selling nostalgia. What remains is stronger where it matters: data protection law, strict confidentiality duties, and a blocking statute with criminal teeth that keeps foreign authorities on the official road. Process replaced secrecy, and process is enforceable.

What is mutual legal assistance?

The treaty-based channel through which one country’s authorities request evidence from another. In Switzerland it runs through the Federal Office of Justice, applies Swiss legal standards, generally including dual criminality where coercive measures are involved, and ends, where granted, in production ordered by the competent Swiss authority. It exists so that legitimate investigations proceed and unilateral foreign reach doesn’t.

Privacy by Law, Not by Promise

Your funds stay in your wallet until the moment you pay. Your data stays under Swiss law, where handing it to a foreign authority without Swiss authorization is a crime. Register once and pay any bank account in 190+ countries from your own wallet: verified, compliant, and with your data governed by Swiss law from end to end.