Suisse Secrets: when the ledger left the vault

In 2022 a leak of Credit Suisse client records reached 48 newsrooms in 39 countries, but none in Switzerland. What the ledger showed, what it could not show, how the bank, FINMA and parliament responded, and what it teaches anyone doing due diligence.

Charles Pycraft · October 2026 · London

Cover card: Suisse Secrets - when the ledger left the vault. An investigation by Charles Pycraft

On 20 February 2022 a group of newsrooms published what OCCRP called the largest leak ever from a major Swiss bank, and the only known leak of such client data to journalists. The project was called Suisse Secrets. It drew on records from Credit Suisse, then Switzerland's second-largest lender, covering more than 18,000 accounts and, by OCCRP's count, 30,000 account holders. Added together, the accounts' recorded peak balances exceeded US$100 billion, although those peaks were reached at different times, not on a single day.

The previous piece in this series traced how Swiss banking secrecy was built, then retreated under US prosecutions and automatic data exchange. Suisse Secrets is what happened when the ledger itself left the building. This is a calm account of what it contained, how the bank, the regulator and parliament responded, and what it teaches anyone doing due diligence. Public sources only.

How the leak travelled

The data reached the German newspaper Süddeutsche Zeitung through a secure digital mailbox more than a year before publication. The paper says it did not pay for the material and that the source attached no conditions. It is not known whether the source was one person or a group.

Süddeutsche Zeitung shared the files with the Organized Crime and Corruption Reporting Project (OCCRP). OCCRP describes the final collaboration as more than 160 journalists from 48 media outlets in 39 countries, including The Guardian, The New York Times and Le Monde. Reporters spent months checking names against court records, sanctions lists and disclosures.

One country was missing from the newsroom list: Switzerland. We return to that below.

What the source said

The source supplied a statement, published by Süddeutsche Zeitung under the headline "why I did it". Three lines matter for this series.

First: "I believe that Swiss banking secrecy laws are immoral." The source called automatic data exchange "a step in the right direction" that left many developing countries outside it.

Second, the source placed responsibility on the law rather than the bank: "Banks are simply being good capitalists by maximizing profits within the legal framework they operate in."

Third, the source made a point that careful readers should keep: "having an offshore Swiss bank account does not necessarily imply tax evasion or any other financial crime." A leak is a lens, not a verdict.

What the data held, and what it did not

According to OCCRP, each record showed the account number, the name of the holder or holders, opening and closing dates, and the maximum balance the account ever reached. Accounts and people do not map one to one: some holders had several accounts, and many accounts had several holders. OCCRP noted that the United States, Russia and China were not heavily represented, and that many holders came from countries outside the Common Reporting Standard. The average account peaked at around 7.5 million Swiss francs. The Guardian reported that almost 200 accounts exceeded 100 million francs and that some dated back to the 1940s.

There were no transaction histories, so the data cannot show where money came from, where it went, or how much moved through. Because each figure is one account's own maximum, the US$100 billion is not a snapshot of deposits on any date. It was also, in The Guardian's words, only "a partial capture" of a private bank with around 1.5 million clients.

Here the mechanism from earlier pieces becomes concrete. Some holders were people, others companies. When the holder of record is a company, or a trustee acting for a trust, the leaked name is the end of one chain, not necessarily the person who benefits. A compliance team has to separate three roles: the named account holder, the beneficial owner who ultimately benefits, and anyone who exercises effective control, such as a trustee, protector or signatory. In a trust these can be different people, and the leaked fields are not the bank's KYC file, which may have recorded more. A leak of holders shows the front door. It does not always show who lives in the house.

Even so, reporters identified dozens of accounts linked to people who, by OCCRP's account, included sanctioned individuals, convicted criminals and politically exposed figures. According to OCCRP, those accounts held more than $8 billion, in some cases for years. That does not establish wrongdoing across the dataset, and the leak does not show what the bank knew, when, or what checks it ran. The lesson is about timing: adverse public information has to be weighed against the dates an account was open.

What the leaked records showed, and what they did not. Generic illustration based on OCCRP's description.
What the leaked records showed, and what they did not. Generic illustration based on OCCRP's description.

How the bank, the industry and the regulator answered

In its public statement of 20 February 2022, Credit Suisse said it "strongly rejects the allegations and insinuations" and described the matters as "predominantly historical", based on "partial, inaccurate, or selective information taken out of context". It said about 90 per cent of the accounts it had reviewed were closed or being closed before the press inquiries, that more than 60 per cent of that group had been closed before 2015, and that it was comfortable appropriate checks had been carried out on those still active.

The Swiss Bankers Association said the financial centre had no interest in money of dubious origin. FINMA, the supervisor, would not comment on individual reports but confirmed it was in contact with the bank and that anti-money laundering compliance had been a supervisory focus for years.

FINMA's concerns about the bank's controls predated the leak. In September 2018 it found anti-money laundering shortcomings at Credit Suisse in cases linked to suspected corruption at FIFA, Petrobras and PDVSA, and in a relationship with a politically exposed person, ordered remedial measures and appointed an independent reviewer. That is context only: separate cases, not findings about the Suisse Secrets accounts.

The three answers reflect different roles: the bank spoke to its own account reviews, the association to industry standards, and the supervisor to its remit. The bank also said it was investigating the alleged leak.

Three public answers from three different roles, February 2022, with FINMA's separate 2018 findings as context.
Three public answers from three different roles, February 2022, with FINMA's separate 2018 findings as context.

Article 47 and the Swiss press

The reason given for Swiss media staying out was Article 47 of the Federal Act on Banks and Savings Banks. Since 1 July 2015 it has covered not only bank staff but anyone who passes on or exploits a secret disclosed in breach of it. The offence carries up to three years in prison or a monetary penalty, or five where there is a financial advantage. Tamedia, publisher of the Tages-Anzeiger, was approached as a partner and declined. "The judicial risk is simply too big," the group said, as reported by AFP. Its editor in chief, Arthur Rutishauser, called the law "a massive restriction of press freedom in Switzerland", according to OCCRP. Not everyone accepted that reading. In the February 2023 parliamentary debate, the minority opposing reform argued that Tamedia could have taken part without difficulty.

In March 2022 the UN Special Rapporteur on freedom of expression, Irene Khan, wrote to Bern with concerns that the law lacked explicit protection for journalists and whistleblowers. In a reply dated 29 April 2022, Switzerland's ambassador in Geneva, Jürg Lauber, said the Federal Council knew of no legal action brought against media professionals under the provision, and that a parliamentary committee would examine its effect on journalists.

Parliament then took up the question. In May 2022 the National Council's economic affairs committee first concluded that no change was needed. On 14 November 2022 the same committee tabled motion 22.4272, asking the Federal Council to examine changes so that Article 47 could not deter good faith journalism. The Federal Council supported it, and the National Council adopted the motion by 113 votes to 78 on 27 February 2023. On 14 December 2023 the Council of States rejected it by 32 votes to 10, with 2 abstentions. That ended the proposal, and Article 47 was not amended as a result.

A separate track concerned the leak itself. In February 2023 the Office of the Attorney General of Switzerland confirmed that, following a criminal complaint whose author it did not name, it was conducting proceedings on suspicion of economic intelligence and violations of business and banking secrecy. Reporting at the time described it as a probe into the leak and its source.

From the 2015 extension of Article 47 to the Council of States vote of 14 December 2023.
From the 2015 extension of Article 47 to the Council of States vote of 14 December 2023.

What the record shows

Suisse Secrets did not end Swiss banking secrecy; automatic exchange had already done much of that for tax purposes. What the leak showed was the gap between two kinds of visibility. Confidentiality never barred every authority: tax offices in participating countries receive specified account data through legal channels, and supervisors and courts have their own routes. The public, and countries outside the exchange network, see far less. The bank at the centre of the story has also gone. In March 2023 Credit Suisse agreed to a government brokered takeover by UBS, completed on 12 June 2023, so its legacy client book now sits inside another institution's controls. The takeover followed a wider crisis of confidence and was not presented as a consequence of Suisse Secrets.

Five practical points follow for anyone doing KYC or due diligence:

Swiss banking confidentiality, the legal vault of this series, remains in force, but it is no longer absolute. Tax offices read part of the ledger through data exchange. Since 2022 the public knows that a leak can, occasionally, let everyone else read some of it too, within the limits of what such records can prove.

Next in the series: FINMA, what the Swiss supervisor can and cannot do.

Public sources only. This field note describes published reporting, public statements and parliamentary records. It is not legal or tax advice and makes no claim about any private matter, or about any individual account holder.

Sources

Sources