¹ FINMA enters into a file the data of people who do not have all the guarantees of an irreproachable activity according to the laws on the financial markets and the LFINMA, as well as those whose guarantee must be controlled.

² The purpose of the file is to ensure that only people offering all guarantees of an irreproachable activity:

A.

Assume the management or direction of a taxable person; or

B.

Be among the major investors of a taxable person.

¹ FINMA management enacts a regulation:

A.

Prescribing the technical and organizational measures required to ensure data security;

B.

Which rules the control of data processing; and

C.

Which sets the access and playback rights of FINMA contributors, by categories.

² The FINMA unit responsible for compliance tasks processes the data. It ensures that data can be traced from data collection to destruction or archiving. It maintains a list of employees with access and reading rights.

³ The FINMA IT unit is responsible for the technical operation.

The file contains the following data:

A.

Name, first name;

B.

Date of birth;

C.

Sex;

D.

Place of origin;

E.

Nationality of foreign nationals;

F.

Address;

G.

Mother tongue;

H.

Training;

I.

Profession;

J.

Place of work;

K.

Qualifications;

L.

Heritage status;

M.

Insurance;

N.

Extracts from the Register of Commerce, the Registry of Proceedings and the Bankruptcy Registry;

O.

Criminal, civil or administrative judgments;

P.

Administrative measures, measures under labour law;

Q.

Audit reports, reports from FINMA investigative staff.

¹ Paper data must be kept locked.

² Data security is governed by the Ordinance on the Federal Law of 14 June 1993 on Data Protection ¹ .

³ The FINMA units responsible for compliance and information technology take the technical and organisational measures to ensure data security in their field of activity.

¹ Data collection is carried out as part of the surveillance of FINMA, in accordance with the laws on financial markets and LFINMA.

² FINMA collects data from:

A.

Taxable persons;

B.

Employers;

C.

The person concerned;

D.

Applicants;

E.

National and foreign authorities;

F.

Parties to the proceedings;

G.

FINMA audit and investigative firms;

H.

Third parties that provide data spontaneously.

Any data subject can ask FINMA to be informed about the data in the data file.

FINMA shall immediately rectify or destroy the erroneous, incomplete or derogating data for processing.

FINMA may disclose data to third parties if it has a legal basis or the written consent of the data subject.

¹ Data about a person is retained:

A.

Ten years from the last entry;

B.

For 20 years since the last seizure if it was based on a criminal judgment or a decision entered into force by FINMA concerning the exercise of an activity without obtaining the necessary authorization from FINMA.

² Upon expiry of the retention period, the data are proposed to the Federal Archives for the preservation and erasure of the FINMA systems. The data that the Federal Archives designate as having no archival value is destroyed.

³ The data shall be erased before the time-limits according to para. 1 if the person concerned wishes to assume a position for which they must present all guarantees of irreproachable activity and if the review of FINMA concludes with a positive assessment.

This order shall enter into force on 1 ^Er October 2011.