This motion weakens information security and thus Switzerland as a digital location
B. Wildhaber
Motion and justification
22.3004 Motion “Facilitate digital accounting”.
An assessment from an industry perspective
Initial situation
On 02.03.2022, the National Council passed a motion. It is entitled “Facilitating digital accounting”. It was submitted by the Commission for Legal Affairs under the chairmanship of Christa Markwalder. The speaker was Daniela Schneeberger. Here is the link to the original motion.
Link: https://www.parlament.ch/de/ratsbetrieb/suche-curia-vista/geschaeft?AffairId=20223004
The motion has the following wording:
“The Federal Council is instructed to amend the Business Records Ordinance (GeBüV) and other necessary decrees in order to facilitate the digitalization of accounting. Documents should be able to be stored on modifiable data carriers without a digital signature or similar procedures, provided that proof of origin and unalteredness can be provided via the principles of proper accounting in accordance with OR 957ff. A digital signature of documents or the use of similar procedures shall be voluntary.”
The motion is justified as follows
– The GeBüV requires in Art. 9 para. 1 lit. b in connection with para. 2 complicated procedures for digital storage of documents that are not suitable for SMEs: documents are to be provided with a digital signature and a time stamp so that they may be archived on commercially available storage media. The required process is too expensive, too complex and too risky for most SMEs. The implementation costs several tens of thousands of francs. Very few SMEs are financially, organizationally or technically capable of operating such a process according to these requirements.
– The GeBüV presupposes much higher requirements than the CO for a practicable digital archiving. The CO does not require a digital signature for digital archiving of accounting documents and only the principles of proper accounting have to be complied with. A qualified electronic signature is only mandatory where the handwritten signature is equated with the written form (e.g. OR 14 IIbis).
– In practice (https://www.estv.admin.ch/estv/de/home/mehrwertsteuer/fachinformationen/elektronischer-geschaeftsverkehr.html), the FTA has equated the paper invoice with the scanned paper invoice and the electronic invoice. The FTA does not require a digital signature in its checks. The proof of origin and unalterability shall be deemed to have been furnished if the principles of proper accounting pursuant to Article 957 et seq. of the Swiss Code of Obligations have been complied with. Other authorities, also at the cantonal level, continue to follow the GeBüV.
– The contradictions between the GeBüV and the practice of individual authorities create uncertainty. Therefore, on the advice of their trustees, most SMEs take the pragmatic route and continue to keep 100% of their accounts in paper form, because according to GeBüV Art. 9 para. 1 lit. a is possible without hesitation and without complicated procedures.
– Digital accounting would open up considerable potential for SMEs and thus strengthen Switzerland as a business location:
O If receipts were exchanged digitally, much more could become automatic in accounting. This significantly reduces administrative costs and makes SMEs more competitive.
O Financial information can be prepared more easily, quickly and accurately using digital documents. The financial transparency thus created allows important decisions about the future of the SME to be made on a more solid basis of figures.
O Paper consumption is reduced and the environment is less polluted.
The Federal Council is instructed to amend the Business Records Ordinance (GeBüV) and other necessary decrees in order to facilitate the digitization of accounting. Documents should be able to be stored on modifiable data carriers without digital signature or similar procedures, provided that proof of origin and unalteredness can be provided via the principles of proper accounting in accordance with OR 957ff. A digital signature of documents or the use of similar procedures should be voluntary.
– The GeBüV requires in Art. 9 para. 1 lit. b in connection with para. 2 complicated procedures for digital storage of documents that are not suitable for SMEs: documents are to be provided with a digital signature and a time stamp so that they may be archived on commercially available storage media. The required process is too expensive, too complex and too risky for most SMEs. The implementation costs several tens of thousands of francs. Very few SMEs are financially, organizationally or technically capable of operating such a process according to these requirements.
– The GeBüV presupposes much higher requirements than the CO for a practicable digital archiving. The CO does not require a digital signature for digital archiving of accounting documents and only the principles of proper accounting have to be complied with. A qualified electronic signature is only mandatory where the handwritten signature is equated with the written form (e.g. OR 14 IIbis).
– In practice (https://www.estv.admin.ch/estv/de/home/mehrwertsteuer/fachinformationen/elektronischer-geschaeftsverkehr.html), the FTA has equated the paper invoice with the scanned paper invoice and the electronic invoice. The FTA does not require a digital signature in its checks. The proof of origin and unalterability shall be deemed to have been furnished if the principles of proper accounting pursuant to Article 957 et seq. of the Swiss Code of Obligations have been complied with. Other authorities, also at the cantonal level, continue to follow the GeBüV.
– The contradictions between the GeBüV and the practice of individual authorities create uncertainty. Therefore, on the advice of their trustees, most SMEs take the pragmatic route and continue to keep 100% of their accounts in paper form, because according to GeBüV Art. 9 para. 1 lit. a is possible without hesitation and without complicated procedures.
– Digital accounting would open up considerable potential for SMEs and thus strengthen Switzerland as a business location:
O If receipts were exchanged digitally, much more could become automatic in accounting. This significantly reduces administrative costs and makes SMEs more competitive.
O Financial information can be prepared more easily, quickly and accurately using digital documents. The financial transparency thus created allows important decisions about the future of the SME to be made on a more solid basis of figures.
O Paper consumption is reduced and the environment is less polluted.
This motion text is brimming with content-related errors and misinformation. It is simply superfluous. The Federal Council has already aptly commented on this.
The opinion of the Federal Council:
Swiss companies are not required to digitize their accounting (incl. receipts). If a company maintains digital accounting, it must comply with Art. 957 – 958f of the Code of Obligations (OR; SR 220) and the Business Records Ordinance of April 24, 2002 (GeBüV; SR 221.431).
The GeBüV is formulated in a technology-neutral way. This means that the open wording of the ordinance provisions is not closed to technical innovations and further developments. This can be seen in particular in the Art. 9 para. 1 Bst. b item. 1 and 2 GeBüV.
Art. 9 par. 1 Bst. a GeBüV permits electronic information carriers without additional requirements if they are unchangeable, i.e. a change or deletion cannot be made without the process being recognizable on the data carrier itself. In contrast, Art. 9 para. 1 Bst. b GeBüV for the admissibility of modifiable information carriers, among other things, a technical procedure that guarantees the integrity of the stored information (item 1) and that the time of storage of the information is verifiable without falsification (item 2).
The text of the regulation explicitly mentions digital signature procedures and time stamps as examples. Thus, the text of the regulation clarifies that the use of digital signature procedures is only a possibility, but not a mandatory requirement for the creation of digital accounting data.
Federal Council
There is thus no obligation in the GeBüV to use a digital signature or even a regulated or qualified electronic signature within the meaning of the Federal Electronic Signature Act of March 18, 2016 (SR 943.03). Furthermore, it is also possible to archive data on unchangeable information carriers (Art. 9 para. 1 let. a GeBüV). For example, data carriers such as WORM media (Write Once, Read Many) or CD-Rom are considered unchangeable.
The legal basis for the praised practice of the FTA mentioned in the motion can be found in Art. 122 of the Value Added Tax Ordinance of 27 November 2009 (SR 641.201). This provision refers to Art. 957 – 958f OR and the GeBüV for the storage of paperless documents. However, it is precisely the GeBüV that generally allows electronic accounting documents not to have a digital signature in order to be accepted by the tax authorities as the basis for taxation of a legal entity.
In view of the clear wording of Art. 9 para. 1 Bst. b GeBüV, the objective of the motion is already fulfilled and an adjustment of the legal basis is unnecessary.
Federal Council
Comment by Bruno Wildhaber
“Modernize SMEs – digitize accounting!” was the original petition title. As was to be expected, all politicians fell for this labeling hoax; unfortunately, this also applies to trade associations, which quite obviously did not bother to look into the contents.
At this point, I address in detail the arguments in the petition and set them straight:
1 The GeBüV was deliberately formulated in a technology-neutral way by the expert group (the writer was a member of the Swico and federal expert group that drafted the GeBüV). At its core is the protection of accounting data and its integrity, and thus its security and traceability. This is undisputed and is explicitly required by the laws, the auditing and fiduciary companies as well as the tax authorities.
2. digital signatures (DS) are only one way to ensure the integrity of accounting data. Data can also be written to WORM (Write Once, Read Many) media (yes, even CD ROM). The petitioner gives the impression that DS are the only solution, which has been disproved by practice x times.
3. there are a variety of products that meet the security requirements of GeBüV. We have tested and certified part of it ourselves(https://informationgovernance.ch/zertifizierungen/). So the solutions are there and are by no means difficult to implement. In addition, modern cloud services offer WORM functions (e.g. AWS Object Lock), which can be integrated into standard products. There are also CH cloud archive systems tested by us that meet the GeBüV requirements. Very many SW vendors were able to build such solutions. Why the initiator should not be able to do this is a mystery to us.
The GeBüV is the central basis for proper archiving in Switzerland; it applies to large international corporations, the administration as well as SMEs. Compared to all other countries, we have managed to create a uniform legal basis and PRACTICE, which applies to both the private sector and the administration! Special treatment for SMEs makes absolutely no sense (besides, how does SME define itself in the context of data management?). Furthermore, small businesses are exempt from the obligation to keep accounts (and thus also from the GeBüV).
5. removal of the protective measures, as requested in the petition, significantly reduces the security of the companies. Digital invoice fraud in particular is a very lucrative part of cybercrime, which is hardly ever made transparent by the victims (out of shame). Properly set up integrity protection also prevents successful ransomware attacks.
6 The VAT tax authority has dropped the requirement to secure the transactions (which, incidentally, has nothing to do with archiving the data) through DS, but explicitly refers to the requirements of the GeBüV, which must be met by the taxpayer. Here, the petitioner simply did not understand the context.
Conclusion:
- The content requirements of the GeBüV have already been implemented in practice for years.
- The necessary processes have long been established and available.
- It is certainly possible to simplify digitization by dispensing with security measures such as integrity protection. We know the result from the daily reports of successful cyberattacks.
All basics and requirements as well as practice on the mentioned issues can be found on this website or in our publications.
Bruno Wildhaber
0 Comments