Banking Secrecy Laws: What Remains of Financial Privacy in 2026

The phrase "Swiss bank account" once conjured an image of impenetrable privacy — a numbered account known only to the client and a discrete banker in Geneva. Today, that image belongs to history. Banking secrecy as it existed in the twentieth century has been systematically dismantled through a combination of international regulatory pressure, bilateral treaties, and multilateral information exchange regimes.

Understanding what has changed, what legitimate financial privacy still exists, and what compliance obligations international clients face is essential for anyone managing wealth across borders.

The Architecture of Traditional Banking Secrecy

Switzerland's banking secrecy laws, codified in Article 47 of the Federal Banking Act 1934, made it a criminal offence for Swiss bankers to disclose client information to third parties, including foreign governments. Similar laws existed in Austria, Luxembourg, Liechtenstein, and various offshore jurisdictions including the Channel Islands, Cayman Islands, and others.

The original rationale for these laws was not to enable tax evasion. Swiss banking secrecy, for example, was partly designed to protect persecuted minorities — including Jewish families — from asset seizure by hostile governments. The banking secrecy legal framework predated the modern global tax compliance architecture by decades.

However, by the 1990s and 2000s, banking secrecy had become, in practice, the primary enabler of large-scale cross-border tax evasion. The OECD estimated that trillions of dollars of unreported wealth were held in offshore accounts shielded from their owners' home-country tax authorities.

The Dismantling: A Timeline

2000s: FATF and AML pressure: The Financial Action Task Force's anti-money-laundering and counter-terrorism financing standards began requiring that banking secrecy be overridden for AML/CTF purposes. Most jurisdictions complied, creating a legal framework for disclosure in criminal investigations while maintaining civil tax confidentiality.

2008: UBS case: The US Department of Justice's case against UBS for facilitating US tax evasion was a watershed. Under a deferred prosecution agreement, UBS disclosed approximately 4,500 US client account details to US authorities — a dramatic breach of the Swiss banking secrecy principle. US authorities subsequently pursued numerous Swiss and offshore banks.

2010: FATCA: The Foreign Account Tax Compliance Act (FATCA) required all non-US financial institutions worldwide to either report accounts held by US persons to the IRS or face a 30% withholding tax on US-source income. This effectively made US persons' overseas accounts transparent to the IRS. Switzerland, after initial resistance, signed an intergovernmental agreement with the US implementing FATCA in 2014.

2014: Common Reporting Standard: The OECD published the Common Reporting Standard (CRS) — a multilateral automatic exchange of information framework modelled partly on FATCA. Under CRS, participating jurisdictions' financial institutions automatically report financial account information on non-resident account holders to their tax authorities, which then automatically exchange this information with the account holders' home tax authorities.

CRS adoption: By 2026, over 100 jurisdictions have committed to CRS, including Switzerland, the Channel Islands, Cayman Islands, British Virgin Islands, Gibraltar, Singapore, Hong Kong, UAE (from 2023 for some exchange partners), and virtually all significant financial centres. The exceptions — notably the United States, which has its own FATCA regime but has not adopted CRS — are themselves subject to separate bilateral information exchange requirements.

2018–2022: Swiss domestic law changes: Switzerland revised its banking secrecy laws progressively, expanding the circumstances in which information can be exchanged. Administrative assistance in tax matters (not just criminal cases) is now available under numerous bilateral agreements. The era of Switzerland protecting civil tax evaders through domestic law has effectively ended.

What Banking Secrecy Still Provides

Despite the significant erosion of secrecy, banking confidentiality has not disappeared entirely. Several legitimate protections remain:

Confidentiality from private parties: Your banker cannot lawfully discuss your account details with your business partner, your ex-spouse (absent a court order), your competitor, or a journalist. Confidentiality from private third parties — as distinct from government authorities — remains robust in all regulated jurisdictions.

Due process requirements for government access: Even in jurisdictions that participate in CRS and FATCA, government authorities in most cases cannot access individual banking information without a legal process. In Switzerland, a formal request under an applicable treaty must be made, and administrative assistance requests must meet specific threshold requirements. Emergency access for law enforcement requires judicial authorisation in most jurisdictions.

Jurisdictions outside CRS: Several jurisdictions remain outside the CRS framework as of 2026. While this is changing, some jurisdictions — particularly those not OECD members — have not yet implemented CRS. However, accounts in these jurisdictions may be harder to access legally and can create their own compliance risks for account holders who must still self-report in their home countries.

Practical informational security: Good banks maintain genuine operational security for client information — protection from data breaches, cyber attacks, and unauthorised access by employees. This is distinct from legal banking secrecy but is genuinely valuable.

CRS in Practice: What Gets Reported

Under CRS (and the jurisdiction-specific implementing legislation), financial institutions report the following information annually:

• Account holder's name, address, and tax identification number(s)
• Account number
• Account balance or value at year-end (or at closure)
• Gross interest, dividends, and other income credited to the account
• Gross proceeds from sale or redemption of financial assets

This covers bank accounts, custodial accounts (investment accounts holding securities), certain insurance products, and annuities.

What is NOT automatically reported under CRS:

• Information about trust structures (though beneficial owners of trusts are reported)
• Unlisted company ownership (though company accounts may be reported)
• Real property ownership (no automatic reporting, though some jurisdictions are extending reporting to real estate)
• Cryptocurrency (currently outside most CRS reporting, though OECD's Crypto-Asset Reporting Framework (CARF) addresses this from 2027 in participating jurisdictions)

FATCA: The Parallel US Regime

The US operates its own reporting system (FATCA) for US persons. Key differences from CRS:

• FATCA is triggered by US person status, not residence in a reporting jurisdiction. A US citizen living in the UK must comply regardless of where accounts are held.
• US persons are required to file FinCEN 114 (FBAR) annually if they have foreign financial accounts exceeding $10,000 in aggregate at any point during the year.
• FORM 8938 (FACTA form) is filed with the US tax return for specified foreign financial assets above thresholds.
• Penalties for non-compliance are substantial — FBAR penalties can exceed the account balance in egregious cases.

The US has been criticised for its extraterritorial reach through FATCA — essentially requiring the rest of the world's financial institutions to act as IRS information gatherers — while itself declining to join CRS and become a full reciprocal information exchange partner.

The Panama Papers, Pandora Papers, and Information Leaks

Beyond formal government-to-government information exchange, massive leaks of financial data have exposed offshore structures that even FATCA and CRS might not have reached immediately.

The Panama Papers (2016), Paradise Papers (2017), and Pandora Papers (2021) involved leaked data from offshore law firms and service providers, revealing the beneficial ownership of thousands of shell companies, trusts, and offshore structures. While much of what was revealed was technically legal, the reputational consequences for individuals exposed were severe, and the political pressure these leaks generated accelerated beneficial ownership register requirements globally.

The lesson for international clients is that the practical protection offered by even fully legal offshore structures is now much less reliable than it was — not because the legal structures are invalid, but because the operational security of the advisers and intermediaries who administer them has proved fallible.

UBO Registers and Beneficial Ownership Transparency

The EU's Fifth and Sixth Anti-Money-Laundering Directives (5AMLD/6AMLD) require member states to maintain public beneficial ownership registers for companies and, in some cases, trusts. The UK introduced its People with Significant Control (PSC) register, which is publicly accessible, as part of Companies House.

The European Court of Justice ruled in November 2022 that public access to beneficial ownership registers violated EU privacy rights, leading to restrictions on general public access in some EU member states. However, access for competent authorities (tax authorities, law enforcement, FIUs) and certain other parties (journalists, civil society) remains.

The trajectory is clearly towards greater beneficial ownership transparency over time, despite ongoing legal challenges to public accessibility.

What Legitimate Financial Privacy Looks Like in 2026

Against this landscape, legitimate financial privacy for internationally mobile HNW clients consists of:

Compliance-based privacy: Structuring affairs fully compliantly — reporting all required information to all relevant tax authorities, maintaining proper corporate governance of structures — while relying on the confidentiality protections that remain: confidentiality from private parties, due process requirements for law enforcement access, and operational information security.

Jurisdictional selection for confidentiality quality: Some CRS-participating jurisdictions maintain higher operational standards for client confidentiality from private parties than others. Professional relationships with high-quality private banks in Switzerland, Singapore, or the Channel Islands still provide meaningful confidentiality from private parties and commercial competitors.

Legal professional privilege: Advice from lawyers is protected by legal professional privilege in most jurisdictions and is generally not reportable under CRS or accessible without specific legal process. Structuring affairs with appropriate involvement of legal professionals ensures that some information remains privileged.

Data minimisation: Not concentrating sensitive financial information in a single location or with a single intermediary reduces the risk of comprehensive data exposure in any single breach or investigation.

How Global Investments Can Help

Global Investments works with internationally mobile HNW clients to structure their financial affairs in a fully compliant manner, maintaining the legitimate confidentiality protections that remain while ensuring that all required disclosures and reporting obligations are met across relevant jurisdictions.

We provide guidance on understanding your specific reporting obligations under CRS, FATCA, FBAR, and domestic disclosure rules; on structuring trusts, companies, and investment vehicles appropriately; and on working with private banks and legal advisers whose operational confidentiality standards meet the legitimate expectations of HNW clients.

Contact us for a confidential consultation on your international financial structure.

Information is provided for educational purposes as of 2026. Tax law, information exchange agreements, and reporting requirements change frequently. This guide does not constitute tax advice. Seek specialist tax and legal counsel in all relevant jurisdictions. Attempting to evade tax through financial secrecy is a serious criminal offence in most jurisdictions — this guide concerns legitimate financial privacy only.