The Swiss Financial Market Supervisory Authority (FINMA) publishes a warning list of companies that may be operating without authorisation. Before opening an account on a crypto platform in Switzerland, checking it is a sensible first step. But the list is neither exhaustive nor always up to date: the absence of a name proves nothing.
The stakes are concrete. On 23 October 2026, Journal du Coin reported on Operation Confrontation Ghost, conducted by thirty countries from 1 July to 30 September 2026. Investigators identified $39 billion in funds and cryptocurrencies linked to scams, often powered by artificial intelligence. These sums have been traced, not yet seized.
This page answers a single question: how to use the warning list to check a crypto service provider. The general framework, from token types to authorisations, is set out in our page FINMA and cryptocurrencies.
What is the FINMA warning list?
The warning list is a public warning maintained by FINMA. It targets providers that may be carrying out, without authorisation, an activity that requires a licence and is subject to its supervision. It can be consulted freely on the FINMA website, in the “FINMA Public” section, under “Warnings”.
Several financial activities require authorisation from FINMA. When the authority receives indications that a provider is operating without one, whether deliberately or not, it carries out investigations. If the suspicion is confirmed, it can open enforcement proceedings and order measures up to and including the liquidation of the company.
The crypto sector is directly concerned. According to FINMA, trading in virtual currencies, providing wallets and payment services fall under the Anti-Money Laundering Act (AMLA). The most demanding activities, such as those of a bank, a securities firm or a distributed ledger technology trading facility, require authorisation.
Who is on the warning list and why?
A name is added to the list in two cases, according to FINMA. The first: the company or person has been investigated for unauthorised activity, but the suspicions could not be cleared up. It failed to comply with its duty to provide information to FINMA, or it gave false information.
The second case is more serious. FINMA also lists a provider when its investigations suggest that it exposes investors to an imminent and significant danger.
The list is not final. The companies concerned are removed from it as soon as FINMA has been able to carry out the necessary checks and the resulting adjustments.
What does being on the list mean?
A listing is not a conviction. FINMA points out that a name on the list does not necessarily mean illegal activity. Above all, it signals that the provider does not hold the required authorisation.
For a saver, the signal remains serious: FINMA has been unable to check this provider, for lack of reliable answers or because of a significant danger. FINMA also calls for particular vigilance towards providers targeted by a ruling published under Article 34 of the Financial Market Supervision Act (FINMASA). These publications concern serious breaches of supervisory law.
What does the warning list not guarantee?
The list has limits that FINMA itself sets out. There is no guarantee that it is exhaustive and fully up to date. A company operating without authorisation may therefore not appear on it, or not yet.
The authority’s remit also plays a role. FINMA can only act if it has territorial and subject-matter jurisdiction, and if there are concrete indications of a breach of financial market law. A provider that falls outside this jurisdiction may therefore never appear on the list.
Finally, the list says nothing about the quality of an authorised provider. An authorisation does not remove market risk. FINMA made this point when, on 20 October 2026, it authorised the first Swiss bitcoin ETF open to the public: the capital invested can lose a significant part of its value.
How to check a crypto platform before investing?
FINMA recommends finding out as much as possible before investing and cross-checking several lists. To check a crypto platform, a few checks drawn from its publications complement each other.
- The FINMA warning list: a listed name calls for caution, an absent name is not reassuring on its own.
- The list of supervised institutions: FINMA publishes the companies and persons that hold its authorisation, in its “Authorised institutions” section.
- Anti-money laundering affiliation: a wallet or cryptocurrency trading service subject to the AMLA must be affiliated with a self-regulatory organisation (SRO).
- The scope of a foreign licence: a European MiCA (Markets in Crypto-Assets) authorisation is valid for the European Economic Area, of which Switzerland is not a member.
- Other warning lists: FINMA cites the one from the Zurich cantonal police, on cybercrimepolice.ch, and IOSCO’s I-SCAN (International Securities & Commodities Alerts Network), which brings together market regulators.
- Published rulings: publications under Article 34 FINMASA flag providers already sanctioned for serious breaches.
FINMA also provides a document entitled “Customer protection – How can investors protect themselves from unauthorised financial market providers?”. It was last updated on 19 December 2024. Its website also has a section for submitting a report.
What does Operation Confrontation Ghost show about crypto scams?
Operation Confrontation Ghost illustrates the scale of the phenomenon at a given point in time. It was coordinated by the Ministry of Interior of the United Arab Emirates, with INTERPOL, the Global Anti-Scam Alliance and thirteen private companies, including Meta, Mastercard and the exchange Crypto.com. The results were presented in Vienna, before the Conference of the Parties to the United Nations Convention against Transnational Organized Crime.
Three forms of crime were targeted: AI-powered fraud, digital financial fraud and sextortion. The results include more than 960 arrests, 29 scam centres raided and more than 15,500 victims identified.
The modus operandi described matches the risks that the warning list seeks to flag. In “pig butchering”, the fraudster gains a victim’s trust over several weeks. He then pushes them to invest on a fake trading platform. Checking a platform’s status before sending it money targets precisely this scenario.
The blockchain also leaves usable traces. According to Journal du Coin, a Tron or Ethereum address keeps the history of every movement. Stablecoin issuers can freeze an address within minutes: the T3 Financial Crime Unit, launched in September 2024 by Tether, Tron and TRM Labs, has blocked more than $250 million in USDT linked to scams.
But spotting funds does not mean returning them. Identifying a wallet leads to neither a freeze nor a confiscation until a court ruling has been issued in each jurisdiction concerned. Hence the value of checking a provider before entrusting it with funds.
Key figures
- 2 grounds for inclusion on the warning list: suspicions not cleared up for lack of information, or imminent and significant danger for investors.
- Article 34 FINMASA: the basis for publishing rulings for serious breaches.
- 19 December 2024: last update of the FINMA document on customer protection.
- 30 countries involved in Operation Confrontation Ghost, from 1 July to 30 September 2026.
- $39 billion identified, in fiat currency and cryptocurrencies, with no seizure at this stage.
- More than 960 arrests and 29 scam centres raided.
- At least $9.9 billion: revenue from onchain scams in 2024, according to Chainalysis.
What we don’t know yet
Several points remain open in the sources consulted. The FINMA page does not specify how many names are on the warning list, nor how often it is updated. For Operation Confrontation Ghost, the gap between the $39 billion identified and the sums actually returned to victims remains unresolved. The thirty states and their private partners say they are working to recover these assets, with no timetable announced.
Other articles on the supervision of crypto players in Switzerland are gathered in our section crypto regulation and taxation.
