Why a Zurich private bank quietly funds private LLMs.

The banking secrecy constraint that makes public models untenable

The legal architecture that governs Hardenberg's decision is not complicated, but it is absolute. Article 47 of the Swiss Banking Act — Bankengesetz — imposes criminal liability on any person employed by or acting on behalf of a bank who discloses client information to a third party without client consent. The provision has survived successive rounds of international pressure on Swiss banking transparency; it has been narrowed in its application to cross-border tax matters, but within Switzerland, for domestic private banking relationships, it remains operative. Routing a client query — any query containing a client's name, portfolio composition, estate structure, or succession preference — through an external AI inference API constitutes, in the view of every Swiss banking counsel this reporter has spoken to, a disclosure to a third party. The enterprise privacy contract does not eliminate the exposure. The API call exists. The log of that call exists. The legal analysis is that the log is a disclosure.

Hardenberg's general counsel, a Zurich-trained attorney named Claudia Huber who joined the bank in 2019 from a leading commercial law firm with a financial institutions practice, documented this analysis in a memorandum to the executive committee in August 2022. The memo ran to fourteen pages. Its conclusion was not a recommendation to avoid AI; it was a recommendation that any AI system used in client-facing workflows must run on infrastructure the bank owned or exclusively leased, under a legal framework that kept inference computation within Swiss jurisdiction. The memo identified four qualified Swiss colocation providers that could meet that specification. The compute market at the time was not well-equipped for the requirement; the bank's infrastructure team spent six weeks in late 2022 negotiating a single-tenant GPU cluster arrangement that did not yet exist as a standard product. The arrangement was finalised in January 2023. The build began in February.

The FINMA dialogue proceeded in parallel. Hardenberg's supervisory relationship with FINMA sits under the banking license, which means its regulatory conversations carry more formal weight than those of the family offices and multi-family structures that have built comparable systems in Geneva and Singapore. Huber and the bank's head of compliance opened an informal inquiry with FINMA's technology risk division in March 2023 — framed, as most of these dialogues are framed, as a general supervisory question rather than a disclosure of a specific project. FINMA's response, which arrived in nine weeks, addressed three questions: whether a self-hosted LLM used in client service workflows constituted an outsourced function under FINMA circular 2018/3, whether the model's outputs required treatment under the bank's model risk management framework, and whether the use of client data in fine-tuning the model created a consent obligation under Swiss data protection law. The answers were, respectively: not if inference runs on exclusively leased domestic infrastructure and human judgment remains final; yes, with the same audit trail requirements applied to quantitative models; and yes, with consent obtainable through an addendum to the bank's standard client advisory agreement.

The relationship-manager thesis that drove the build specification

The use case Hardenberg's executive committee approved in October 2022 was not the use case that eventually shipped. The original proposal, drafted by the bank's chief digital officer, Thomas Kiefer, assumed a model that would sit behind a query interface for internal research analysts — effectively a document retrieval and synthesis tool for the bank's investment strategy function. By the time the build specification was finalised in February 2023, the use case had changed. The primary deployment target was the relationship manager.

Hardenberg employs 84 relationship managers serving approximately 1,200 clients across its Zurich, Geneva, and Lugano offices. The average relationship manager at the bank manages CHF 450 million in client assets and maintains active advisory relationships with between 12 and 18 clients. The information load those relationships require — portfolio history, family structure, prior investment committee decisions, relevant estate documentation, the client's stated risk preferences and their actual revealed risk behaviour over time — is substantial and largely unstructured. It sits in a combination of the bank's CRM system, its document management platform, handwritten notes from client meetings that have been partially digitised, and the relationship manager's own memory. The last item is the one the model was built to supplement.

Kiefer's revised proposal, which he presented to the executive committee in January 2023, argued that the relationship manager's informational disadvantage — the gap between what they theoretically have access to and what they can actually recall and synthesise in a live client conversation — was the most consequential operational problem the bank faced. A private model trained on the bank's full client and investment archive, accessible through a secure interface on the relationship manager's terminal, would close that gap. It would not replace the relationship manager's judgment. It would replace the relationship manager's need to remember everything at once. The executive committee approved the revised specification the same afternoon it was presented. Kiefer describes the approval as the shortest deliberation he has witnessed in nine years at the bank.

What the corpus contains, and why the specification was conservative

The model that entered production in November 2023 is a fine-tuned Mistral 7B base, running on a dedicated cluster of 32 NVIDIA H100 SXM nodes at a Zurich colocation facility whose name the bank does not disclose. The corpus assembled for fine-tuning covers 23 years of the bank's internal archive: investment committee minutes, client meeting notes, portfolio review documents, product suitability assessments, estate planning correspondence, and a structured archive of the bank's proprietary market research. The corpus runs to approximately 290 million tokens. It does not include any client-identifying information in the standard query interface; the architecture implements a tokenisation layer that replaces client names and account numbers with internal reference identifiers before any document enters the model's accessible retrieval layer. A relationship manager querying the model for context on a specific client receives outputs that are drawn from documents associated with that client's internal identifier — not from documents in which the client's name appears as a raw string. Huber considers this the most important technical decision in the build. It is also the decision that took longest to reach.

The engineering team assembled for the build was small by the standards of institutions that have attempted comparable deployments. Kiefer hired four people: a head of model infrastructure recruited from a quantitative hedge fund in Zug, an ML engineer from ETH Zürich's computational finance laboratory, a data engineer with prior experience digitising archival documents at a Swiss cantonal bank, and a specialist in financial NLP whose prior role was at a Zurich-based credit risk modelling firm. The team built and fine-tuned the model entirely in-house. No external fine-tuning API was used. The fine-tuning cycle took eleven weeks. The model has been re-tuned quarterly since deployment, each cycle incorporating three months of new documents added to the corpus.

The build cost totalled CHF 34.8 million — CHF 800,000 over the approved budget, attributable almost entirely to the tokenisation architecture work that Huber's legal requirement for client identifier separation added to the specification. The ongoing operating cost runs CHF 4.1 million annually: CHF 1.6 million for the compute lease, CHF 2.1 million for the four-person engineering team at loaded compensation, and CHF 400,000 for the quarterly re-tuning compute and oversight. At CHF 38 billion AUM, this represents approximately 1.1 basis points annually. Kiefer presents the number to the executive committee in those terms. He has noted that 1.1 basis points is lower than the loaded cost of two additional relationship managers, and that two additional relationship managers would serve roughly 30 clients between them. The model serves all 1,200.

The institutional gap to the family office and why it is widening

Hardenberg's deployment sits in a different risk category than the private LLM projects running at Geneva multi-family offices and Singapore VCC structures. The distinction is not technical — the base models, the fine-tuning approaches, and the compute arrangements are structurally similar across this tier of deployment. The distinction is institutional. A private bank operating under a FINMA banking license faces supervisory expectations, audit trail requirements, and client consent obligations that a family office operating under a lighter-touch discretionary mandate does not. Hardenberg's FINMA compliance architecture — the model risk classification, the client identifier tokenisation, the consent addendum in the advisory agreement — required eight months of legal and engineering work before the system could go live. A comparable Geneva multi-family office deploying the same underlying technology spent three months in regulatory preparation. The institutional overhead is the moat in both directions: it raises the cost of entry for a regulated bank, and it makes the regulated bank's deployment more durable once complete.

The family office gap — the difference in deployment friction between a private bank and an unregulated or lightly regulated family office structure — is visible in the adoption curve. The Geneva and Singapore single-family and multi-family office deployments that have entered production over the past 18 months share a common profile: small engineering teams, conservative base model choices, corpus-driven fine-tuning, and a FINMA or MAS regulatory dialogue that was resolved relatively quickly because the office's lighter licensing status put it outside the most demanding supervisory frameworks. Hardenberg's deployment required the same underlying engineering effort plus a legal and compliance layer that the family offices did not. The result is a deployment that arrived later but carries a more defensible regulatory position — one that has been explicitly tested against the banking license framework rather than inferred from analogy to lighter-touch guidance.

The competitive implication is not that private banks are ahead of family offices in deploying private AI — they are not. The implication is that when private banks do deploy, the deployment is structurally harder to replicate and legally more durable. A family office that sends client queries through a private LLM has resolved a privacy question. A bank that does the same has resolved a privacy question, a banking secrecy question, a model risk question, a client consent question, and a supervisory classification question. Each of those resolutions is a form of institutional capital that the bank built through the build process. Hardenberg now holds that capital. Its nearest competitor, by Kiefer's assessment, is fourteen months behind.

Sixteen months of usage data and what the pattern shows

Hardenberg's model entered production in November 2023. Sixteen months of usage data have accumulated. Kiefer's engineering team produces a monthly usage report for the executive committee; this reporter has reviewed a summary of findings from the report covering the period through February 2025. The picture that emerges is more qualified than the build rationale suggested and more encouraging than the bank's more cautious relationship managers predicted.

Usage across the 84 relationship managers is uneven. Seventeen managers — the bank's internal classification identifies them as "fluent adopters" — account for 61 per cent of total query volume. These are, without exception, managers who attended a voluntary two-day internal training session on the model's capabilities in December 2023, within six weeks of deployment. The remaining 67 managers range from occasional users to managers who have logged fewer than ten queries in the full sixteen months. Kiefer's team ran a structured analysis of the correlation between query volume and client retention metrics over the twelve-month period ending December 2024. The finding: relationship managers in the fluent-adopter tier showed a client retention rate 4.3 percentage points higher than the broader population, and a new-asset-capture rate 2.1 percentage points higher. The correlation does not establish causation — fluent adopters may simply be the bank's better managers, independent of the tool. Kiefer acknowledges this. He has proposed a controlled deployment expansion for Q3 2025 that would require a random sample of the non-adopter group to complete the December 2023 training and begin structured use of the model. The executive committee approved the proposal in March 2025.

The task type breakdown from the usage report shows a pattern consistent with what the Geneva family office deployments have reported. Corpus interrogation — open-ended historical queries against the client archive — accounts for 47 per cent of query volume. Pre-meeting briefing preparation — structured summaries of a client's portfolio history, prior conversation notes, and relevant market context before a scheduled client call — accounts for 31 per cent. The remaining 22 per cent is distributed across capital allocation scenario analysis, estate planning context queries, and product suitability checks. The model does not generate client-facing outputs. Every output is reviewed by the relationship manager before use. Kiefer's review of the audit log has identified eleven cases in the sixteen-month period where a relationship manager used model output verbatim in client correspondence without adequate review. Each case was flagged, the manager was counselled, and the governance documentation was updated. None of the eleven cases created a client complaint or a compliance incident. Kiefer does not present this as evidence that the risk is low. He presents it as evidence that the audit trail works.

What to watch

Hardenberg's deployment is sixteen months old and expanding. The signals below will determine whether the private bank tier of the Swiss financial sector moves from isolated build decisions to a structural deployment norm in the next 24 months.

• FINMA guidance specific to AI in banking-licensed wealth management. The informal regulatory dialogue that Hardenberg and comparable firms have conducted since 2022 is not a substitute for a formal supervisory circular. FINMA's technology risk division has indicated to at least two industry associations that dedicated AI guidance for banking-licensed institutions — addressing model risk classification, audit trail requirements, and client consent frameworks — is under review for publication before the end of 2025. If that guidance arrives and is consistent with the positions FINMA has taken informally, it will function as a compliance template that accelerates adoption among the tier of Zurich and Geneva private banks that are currently waiting for regulatory clarity before committing capital. If the guidance is more restrictive, several deployments in planning will be restructured or deferred.
• The outcome of Kiefer's controlled adoption expansion in Q3 2025. If the structured training and mandatory use programme succeeds in moving a meaningful portion of the non-adopter population into the fluent-adopter tier, Hardenberg will have a controlled dataset showing whether the correlation between model use and client retention metrics holds beyond the self-selected early adopter group. That dataset will be the most rigorous evidence in the Swiss private banking sector that the deployment delivers commercial value independent of adopter selection bias. If the controlled expansion confirms the finding, Kiefer has indicated he will take a budget proposal for a full-corpus expansion to the executive committee before year-end. The corpus currently covers 23 years of archive. The expansion proposal covers a further digitisation programme for pre-2001 client and investment records.
• Swiss colocation capacity for single-tenant GPU infrastructure. Hardenberg's compute arrangement was negotiated in January 2023, before the current wave of demand for dedicated GPU clusters in Swiss data centres made such arrangements significantly harder to obtain. Three Zurich private banking institutions known to be in the build evaluation phase as of early 2025 have been told by their infrastructure advisors that equivalent single-tenant H100 or H200 capacity carries a 12-to-16-month lead time at current demand levels. That queue is the practical constraint on the next cohort of Swiss private bank deployments, independent of regulatory clarity or build budget approval.
• The pace at which family office clients of Zurich private banks begin asking whether the bank is running private AI in their service. Hardenberg's client consent addendum — the legal instrument that permits client data to be used in fine-tuning the model — has been added to new advisory agreements since January 2024 and offered as a voluntary addendum to existing clients in renewal conversations. Take-up among existing clients has been 67 per cent as of the February 2025 usage report. The 33 per cent who have not yet signed the addendum are excluded from the corpus. If that population begins to ask about the bank's AI use — rather than simply declining to consent — the conversation shifts from a legal formality to a client relationship dynamic. None of Hardenberg's relationship managers has reported such a conversation yet. Kiefer expects the first ones to arrive when a competing institution makes a public disclosure about its own deployment.
• Hiring pressure on the narrow talent pool that combines ML depth with Swiss private banking discretion. Hardenberg's four-person engineering team was recruited from institutions — a Zug hedge fund, ETH Zürich, a cantonal bank, a credit risk modelling firm — that supply Swiss financial services ML talent in a market that is small by global standards. Two competing private banking institutions are believed to be actively recruiting for comparable roles. If both succeed in hiring teams of comparable capability, Hardenberg's fourteen-month technology lead begins to compress. If either institution turns to the same ETH Zürich and cantonal bank talent pipeline, Kiefer will learn about it through the alumni network before any press announcement.

Frequently asked

Why does a FINMA banking license create more deployment friction than a family office structure for a private LLM?

A banking-licensed institution in Switzerland operates under FINMA circular 2018/3 on outsourcing, the model risk expectations that FINMA applies to quantitative decision-support tools, and the client consent obligations that arise from using client data in a system that informs advisory outputs. A family office operating under a lighter discretionary mandate — or under no FINMA license at all, as many Geneva-based structures are — faces none of these formal requirements and must navigate only the general Swiss data protection framework and Article 47 banking secrecy considerations. The bank's deployment takes longer to structure legally and costs more to document compliantly. The trade-off is a regulatory position that has been explicitly tested against the most demanding Swiss supervisory framework, rather than inferred from analogy to lighter-touch guidance.

What does the client identifier tokenisation architecture actually do, and why does it matter legally?

The tokenisation layer replaces client names and account numbers with internal reference identifiers before any document enters the model's retrieval layer. When a relationship manager queries the model for context on a specific client, the system maps that client to their internal identifier and retrieves documents associated with that identifier — but the model never processes a raw client name as a query string. The legal significance is that the model's inference computation never involves personally identifying information in the form that Article 47 of the Banking Act protects. The protection applies to client-identifying information; the system is designed to ensure that client-identifying information is resolved at the database layer, not the inference layer. Hardenberg's legal team considers this distinction material. FINMA has not challenged it.

Why is the relationship manager the right deployment target for a private bank's LLM, rather than the investment committee or back office?

The relationship manager's informational load is the largest unstructured information management problem in private banking. An investment committee operates on structured data — portfolio positions, market data, research outputs — that is already systematically organised and queryable. A back-office function operates on transaction records and compliance documents that are similarly structured. The relationship manager operates on 23 years of client correspondence, meeting notes, estate documents, family governance records, and oral history that exists nowhere in structured form. The model's ability to surface relevant historical context from that archive — in the 90 seconds before a client call, or mid-conversation when a client references a decision made seven years earlier by a predecessor manager — is precisely the capability the existing information architecture cannot provide. The investment committee can already query its own data. The relationship manager cannot.

At what AUM does a private bank's LLM deployment make economic sense?

Hardenberg's all-in build cost of CHF 34.8 million, amortized over five years, plus CHF 4.1 million in annual operating cost, represents approximately 1.1 basis points of AUM annually at CHF 38 billion. The economics become harder to defend below CHF 15 billion AUM, where equivalent costs represent roughly 2.5 to 3 basis points — defensible on a strategic case but difficult to justify on pure cost-efficiency grounds against the alternative of additional relationship manager headcount. The practical threshold for a Swiss private bank appears to be CHF 20 billion AUM, where the per-basis-point cost sits comfortably within the range that a banking secrecy compliance argument and a client retention improvement case can jointly support. Below that threshold, a retrieval-augmented generation approach on compliant domestic infrastructure is likely more cost-proportionate than a full fine-tuned deployment.

How does the Swiss private bank deployment differ from comparable family office deployments in Geneva and Singapore?

The underlying technology — fine-tuned open-weights model, dedicated domestic compute, first-party proprietary corpus — is structurally similar across all three contexts. The differences are regulatory overhead and use-case framing. The private bank faces the most demanding regulatory preparation: banking license obligations, model risk classification, client consent addenda, and an explicit FINMA supervisory dialogue. Geneva multi-family offices face a lighter framework requiring primarily internal governance documentation. Singapore VCC structures add the Personal Data Protection Act as a separate consent layer. On use case, the private bank's primary deployment target is the client-facing relationship manager — an operational role with no clean equivalent in a family office structure where the investment team and client relationship function are often held by the same principals. The family office model serves the investment committee and the CIO. The bank's model serves the person on the phone with the client.