The third Ethics and Compliance Switzerland (ECS) conference, held on October 21 and 22 in Zurich, focused less on new rules and more on the question of how rules begin to take root within an organization. In short: two days, 117 compliance professionals, one common thread.
Compliance is most effective not where most of the rules are, but where functions interact. For insurers and brokers, this presents a regulatory lever that requires no additional budget.
A Room Full of Practice
Welcome coffee in the foyer. Name tags from corporations, law firms, hospitals, universities, and the Office of the Attorney General. Those who sat in the auditorium during these two days knew compliance not from a textbook, but from investigations, supply chains, and boardrooms where things got tense. The mix was the highlight. A professor of criminal law sitting next to a heart surgeon. A strategist with nearly two decades of diplomatic experience sitting next to the chief legal counsel of a whistleblower platform.
Compliance officers from Sika, Hilti, Georg Fischer, Landis+Gyr, and Maersk, alongside a whistleblower who shared what it costs when a reporting channel fails. Compliance from real-world experience for real-world application, without any gloss. Artificial intelligence had its place, and on the first afternoon, it even featured twice: two AI presentations ran concurrently. AI played a part in the orchestra. But the score was titled: “Living Compliance in the Organization.” That is precisely what makes this conference valuable for decision-makers.
More Rules Are No Shield
Mark Pieth opened with a question that immediately captured the audience’s attention: Does more regulation reduce economic crime? His answer is matter-of-fact: “Deterrence comes from enforcement and the likelihood of detection, not from regulations on paper.”
Over the past 35 years, the five FATF basic principles from 1990 have evolved into a regulatory framework that Mark Pieth calls a “regulatory monster.” Yet money laundering still exists. Officially, the risk-based approach applies; in practice, however, it is the rule-based approach, because sanctions are imposed for anything that can be measured against a rule. And the very same industry that complains about overregulation demands precise rules in court. It’s a paradox familiar to every compliance officer.
Crucial for Switzerland is Mark Pieth’s link to criminal law. Article 102(2) of the Swiss Criminal Code (StGB) makes a company liable to prosecution if it has not taken all necessary and reasonable organizational measures to prevent bribery, money laundering, or terrorist financing. Through this organizational shortfall, compliance standards flow directly into judicial practice. In the case of bribery, this even occurs without the involvement of a regulatory authority, via international guidelines as “soft law.”
For insurers and brokers, this means: The compliance program is not just an internal policy document. In the event of a crisis, it serves as evidence. A manual sitting on a shelf proves very little. A program that is actively implemented in day-to-day operations proves a great deal. Those who have it but do not apply it are merely engaging in “paperwork-based compliance.” Effectiveness comes from application, not from the sheer volume of rules.
Integrity Needs a Solid Foundation
The most powerful statement of the first morning came from Nancy Wayland, former CEO and now an independent board member: “Bad news only travels as far as trust extends.”
The path to integrity under pressure consists of four steps: first, a shared purpose; second, psychological safety; third, mutual trust; and fourth, a culture of open communication. Obedience is no substitute for any of these steps. A culture built solely on obedience results in fragile ethics.
Veronique Haller applied her experience in diplomacy to compliance. Where control ends, trust begins. Her slide showed a caricatured judge sitting behind a sign that read “Expansion of Presidential Powers.” The question behind it struck a chord with everyone in the room: Do the rules apply to those at the top as well?
Guido Palazzo of HEC Lausanne demonstrated that corporate scandals follow a recurring pattern consisting of nine phenomena, from Volkswagen to Boeing to Wells Fargo.
The good news lies in the word “pattern”: What recurs can be identified early on!
And Thierry Carrel. A heart surgeon at a compliance conference. Suddenly, ethics became as tangible as a scalpel. Be honest. Listen instead of talking. Admit uncertainty; own up to mistakes. AI, yes, but human behavior and judgment remain crucial.
Not a single one of these statements appears in a memo, an instruction, or a set of rules.
Whistleblower Yasmine Motarjemi highlighted the cost of doing the opposite: internal reporting, retaliation, legal proceedings, and personal consequences. To this day, Switzerland has no general whistleblower protection law. Protection is based on the Swiss Code of Obligations and case law, and those who report violations are expected to report them internally first.
For insurers and brokers, the implication is clear and positive: The internal reporting channel is the only one that the company itself designs. Those who build it in a way that inspires trust will be the first to hear the bad news.
Chess and poker at the same table
Robert Greco, SpeakUp’s chief legal counsel, found the picture of the day. The legal department plays poker: it calculates probabilities. Compliance plays chess: it thinks several moves ahead. Same goal, two games. The problem isn’t competence. The problem is that two players are sitting at the same table, and no one is bringing the boards together.
Every organization knows the consequences. Investigations stall, issues are escalated too soon, the business receives conflicting signals, and trust erodes.
Here’s an example from the insurance industry: The claims team suspects fraud. The legal department asks about litigation risk; compliance asks about reporting requirements and the customer relationship; risk assesses materiality; and IT is tasked with backing up data that may already have been overwritten. Every question is valid, but asking them one after another takes days. The account manager receives three instructions and often chooses the most convenient one.
The Second Day
The panel discussions on the second day provided the answer, without actually calling it that. No organizational chart can make compliance effective on its own. What matters is not the reporting line to the CEO or the general counsel, but independence, authority, and a seat at the table.
During the panel discussion moderated by Matt Kuo (Case IQ), Katja Böttcher (Beyondlegal) and Sebastian Goebel (Georg Fischer) painted a clear picture: The skill set is shifting from that of a subject-matter expert to that of a bridge-builder with business acumen, interpersonal skills, and a basic understanding of technology. Compliance should not be an approval body, but rather should provide tools that enable the business to, for example, audit third parties on its own or get involved early in transformation projects.
Board members today want to spend significantly more time with their compliance officers. Why? Well, many of them understand the responsibility that comes with it. In practical terms, that means breaking down silos.
For insurers, the framework is clear: Article 716a of the Swiss Code of Obligations (OR) establishes that overall supervision is a non-delegable responsibility of the board of directors. FINMA Circular 2017/2 on corporate governance for insurers requires an independent compliance function in this regard.
The question “Should compliance be outsourced or managed on a part-time basis?” has also arisen. The panel’s answer: the lower the risk profile, the more so. However, responsibility always remains in-house.
The key lies in bringing Legal, Compliance, Risk, and IT onto the same playing field.
| Key Takeaways from the Conference | What This Means for Insurers and Brokers |
| Effectiveness comes from application, not from the number of rules | The program must be demonstrably in operation in everyday practice. Section 102 of the Swiss Criminal Code evaluates the organization, not the manual. |
| Bad news travels only as far as trust extends | Measure reporting channels and escalation times—don’t just document them. |
| The legal department and compliance play different games | Joint risk assessment, clear roles according to the three lines of defense. |
| AI is already part of compliance | AI inventory, risk classification, and traceable decisions in accordance with FINMA Supervisory Circular 08/2024. |
| Budgets are stagnating, while regulation is increasing | Prioritization independent of specific issues and organizational structures that translate risk appetite into limits. |
AI: From Guidelines to Evidence
Anyone thinking about AI got substance instead of hype. Gerben Schreurs of Forensic Risk Alliance demonstrated how AI is shifting its role: from supporting and recommending to actually making decisions.
AI-powered transaction monitoring has revealed where risk is seeping in. If customers from certain countries or professions are flagged at a disproportionately high rate, a simple question arises: Does the model identify risk, or is it simply repeating historical assumptions?
For insurers, this isn’t just a banking issue. The same logic applies to fraud detection in claims processing and to risk assessment during underwriting.
The answer is a defensibility test with six checkpoints:
| Checkpoint | The question behind it |
| Purpose | What is the system intended for? |
| Data and Model Version | What data and version were used to generate the result? |
| Justification | Why did the system arrive at this result? |
| Tester | Who critically reviewed the result? |
| Final Decision | Who made the decision, and under what authority? |
| Evidence | What records have been retained to reconstruct the decision? |
Accuracy alone is not enough. A decision must be traceable to the supervisory body, the audit, and the court. A result may be correct and yet still indefensible. In that case, the process by which it was reached is missing. Gerben Schreurs refers to this difference as “governance theater” and “practiced governance.”
An AI policy on the intranet is just for show. Qualified reviewers with the authority to override results are what governance is all about. Responsible AI is demonstrated through evidence, not through principles.
The most endearing presentation came from a colleague who wasn’t even in the room: “Dee Diligence.” Pascale Schwerzmann from Microsoft demonstrated a compliance agent named “Dee Diligence.” The query: “The son of a member of executive management is joining the company and will be handling key accounts.” Instead of responding immediately, the agent asked four follow-up questions: about the reporting line, approval authorities, disclosure requirements, and the hiring decision. Only then did it generate a draft ready for review, with a reference to the guidelines, for human approval (HITL). The machine asks the questions; the human takes responsibility.
FINMA has already established this policy for the financial sector. Its Supervisory Circular 08/2024 requires an inventory of AI applications with risk classification, clear lines of responsibility, testing, and documentation. Responsibility cannot be delegated to either an AI system or a service provider. Those who implement the six checkpoints meet these expectations not merely as a formality, but as a mark of quality.
Three loads, one direction
The panel discussion on the effectiveness of the compliance department described the situation in the absence of litigation. Three pressures are at play simultaneously: AI, where compliance serves as both arbiter and early adopter; regulation, which is expanding and evolving, even into the areas of food safety and packaging; and budgets that are stagnating.
The practical solutions are unspectacular, and that is precisely what makes them so powerful: a topic-agnostic methodology for prioritizing new regulations; joint risk assessments with the business or business unit; and clear accountability based on the three lines of defense model.
And when management is willing to take on significant risk: disclose conflicting objectives, document decisions, and escalate matters to the board of directors. Authority guidelines translate risk appetite into binding limits.
Martijn de Kiewit of Gate Group summed up this approach in a phrase worth remembering: “Compliance should say ‘yes’ more often.” When it comes to non-sensitive data, this means: no bans, but rather secure tools of your own. A “yes” with guidelines offers more protection than a “no” that gets circumvented.
Sanctions and geopolitics followed the same pattern. Conflicts with regimes cannot be resolved by the compliance department alone. They require business decisions.
Compliance provides the foundation; management makes the decisions; and the board of directors oversees the process. When these three roles work together, regulation transforms from a hindrance into a compass.
Connection is the solution
Compliance, ethics, technology, leadership: The ECS Conference presented four perspectives side by side, each of which was clear on its own. But they only become effective when combined. Not with yet another program, not with slide-based presentations, but with an organization where the legal department, compliance, risk, and IT are all on the same page. It’s doable. The building blocks are already in place.
We owe the ECS our thanks for two days that gave us more energy than they took.
One question, however, remained unanswered: How long does it take for bad news from your claims team to reach the board of directors?
TURNING REGULATION INTO VALUE!
Thomas Schubert, Mr. #DeedsCountMore
See also: Quantum Computing in the Insurance Industry: Governance, GRC Transformation, and Resilience
Search:
Sponsors:
