How FINMA authorisation works: steps and timeline

Scoping the licence category comes first

The first stage decides which FINMA licence the planned activity actually needs, because everything after it is built to that category's requirements. Get the scoping wrong and the file is built to the wrong standard. A portfolio manager who trades for own account on a commercial basis may in fact need a securities-firm licence. A crypto custody model that holds client assets on its balance sheet can fall under banking law. The activity, not the brand or the marketing, sets the category.

FINMA's authorisation overview lists the licence types and the act each sits under. Where the categorisation is genuinely uncertain, FINMA offers a preliminary-enquiry route: a structured question about whether and how the model is subordinate to financial-market law, answered before any full application. Using it early is cheaper than building a file to the wrong category and rebuilding it later. The licence types and the statutes that govern them are mapped in our guide to FINMA, Switzerland's financial market regulator.

The application file is the centre of gravity

The application file is the document set FINMA examines to decide whether to grant the licence, and its weight scales with the category. A FinIA portfolio manager files less than a bank, but the spine is the same. Across categories the file typically contains:

• a business plan describing the model, the client base and the services, with financial projections, usually over three years;
• the organisation: governance, the board, the management, reporting lines, internal control and, above a size threshold, an independent risk and compliance function;
• evidence of capital meeting the category minimum, fully paid up;
• fit-and-proper documentation for every manager, board member and qualified shareholder;
• the anti-money-laundering framework under the Anti-Money Laundering Act;
• the risk-management and internal-control system, sized to the business; and
• the audit arrangement: the licensed audit firm, or the Supervisory Organisation for portfolio managers and trustees.

The capital line is the one most applicants worry about and the one that causes the least trouble. It is a published figure. You either hold it or you raise it. The numbers below are fixed in the Financial Institutions Act and the sector acts; they are statutory minimums, never a matter for negotiation with FINMA.

How the capital, the qualified-manager rules and the Supervisory Organisation route fit together for the most common licence is set out in our service page on the Swiss asset manager licence.

Fit-and-proper and AML are the parts that bite

Fit-and-proper and the anti-money-laundering framework are the two sections that most often decide how long a file takes. Both depend on third parties and on FINMA's scrutiny of substance rather than form, which is why neither can be rushed at the end.

Fit-and-proper is FINMA's judgement that the people running the institution offer a guarantee of irreproachable business conduct and are qualified for their roles, and that the owners do the same. It reaches the management, the board and the qualified shareholders. The evidence is concrete: curricula vitae, references, extracts from the criminal record and the debt-enforcement register, regulatory questionnaires, and frequently interviews. A thin CV, an unexplained gap, or a manager who cannot show the relevant experience for the role will all draw questions. Foreign managers add a step, because FINMA may seek information from the supervisory authority in their home country, and that response sits outside the applicant's control.

The AML framework has to match the actual business model and cannot be lifted from a template. It sets out how the firm identifies clients and beneficial owners, how it classifies and monitors risk, what triggers enhanced due diligence, how it screens against sanctions, and who the responsible AML officer is. FINMA reads it against the clients the business plan describes. A payments model, a crypto model and a classic portfolio-management model each carry different money-laundering risk, and the framework has to show that the firm has understood its own. In the authorisation matters we run, the part that bites is almost always the fit-and-proper evidence and the AML section, rarely the capital threshold, which is the simplest condition to meet.

The supervisory dialogue runs in rounds

The supervisory dialogue is the back-and-forth between FINMA and the applicant after the file is filed, and it is where most of the elapsed time goes. FINMA assigns a named case handler, confirms what is still outstanding, examines the documents, and comes back with questions, corrections and requests for further evidence. This happens in rounds. A clean file might close in a couple of rounds; a file with gaps in governance, capital evidence or AML design will run longer as each round resolves one layer and exposes the next.

For portfolio managers and trustees the dialogue runs through the firm's Supervisory Organisation as well as FINMA: the SO reviews much of the file before and alongside FINMA, which keeps the final authorisation decision. FINMA describes its own licensing process for portfolio managers and trustees on its site. For banks and securities firms the path is set out under first-time licensing, and it is heavier at every stage. The quality of the original file is the single biggest lever an applicant holds over the length of the dialogue.

Approval usually comes with conditions, then supervision begins

Approval is rarely a single clean yes. FINMA can grant the authorisation subject to conditions and requirements: confirm a key hire, finalise a named policy, top up capital, or close a specific gap before the licence takes effect. The ruling lists what must be in place. Once those conditions are met the licence is effective, and the firm carries its ongoing obligations from that day.

Ongoing supervision is the standing relationship. The firm undergoes a periodic regulatory audit by a licensed audit firm, or, for portfolio managers and trustees, day-to-day supervision by its Supervisory Organisation, with FINMA above it. It reports through FINMA's electronic platform, pays an annual supervisory levy scaled to its category, and must notify or seek fresh approval for material changes such as new owners, managers or business lines before they happen rather than afterwards. A licence is a continuing condition the firm has to keep satisfying. Carrying that standing compliance load is what our ongoing compliance retainer is built for.

A realistic timeline, without false precision

There is no statutory deadline for a FINMA decision, and FINMA does not publish a guaranteed turnaround. What it does say is plain: the duration depends on the licence type, the quality and complexity of the application, and the dialogue with the applicant. For securities firms it adds that the time needed for foreign supervisory authorities to respond also affects the length. The honest planning answer is a range, scaled to category and to how clean the file is on the day it is filed.

One published figure is narrower and worth not over-reading. For fintech subordination enquiries, the question of whether a model needs a licence at all rather than a full application, FINMA reported an average processing time of 25 days in 2024, down from 60 days in 2022. That measures preliminary enquiries, and it does not transfer to a full bank or portfolio-manager authorisation. Read it as evidence that a focused, well-framed question is answered quickly, and not as a turnaround you can expect for a full licence.

What FINMA authorisation does not do

A FINMA licence is narrower than it is often assumed to be, and three limits matter most. It does not certify that the business will succeed: the authorisation confirms capital, organisation, fit-and-proper management and AML controls, and says nothing about whether the strategy is sound or the returns real. It does not let you start before approval: the licensed activity may not begin until FINMA grants the licence, and operating without it is itself an offence under the Financial Market Supervision Act that can land an operator on the warning list. And it does not end the obligations; it starts them, because the conditions in the licence run for as long as the firm holds it.

There is also a category for whom full authorisation is the wrong path. A financial intermediary whose activity sits below the prudential threshold, including many fiduciaries, payment agents and smaller crypto brokers, does not apply to FINMA for a licence at all. It affiliates to a self-regulatory organisation for AML supervision instead. If the model fits there, building a full FINMA application file is wasted effort and wasted capital. Which side of the line a business falls on is the question to settle first, and it is covered in our service pages on FINMA authorisation and across our FINMA and financial licensing guides.