Guide · Accounts Ordinance
GeBüV explained simply: what the Accounts Ordinance requires
The GeBüV sets out how Swiss companies keep and retain their accounting records and accounting vouchers. It is short and technology-neutral, and it calls for less specialist technology than is often claimed. Instead, it calls for more organisation.
Last updated: 10/11/2026. General information, not legal advice.
What it is about
The Ordinance on the Keeping and Retention of Accounting Records (Accounts Ordinance, GeBüV, SR 221.431) sets out in detail the accounting rules in Art. 957 to 958f of the Code of Obligations (OR). It has only twelve articles. If your business is required to keep accounts and you want to keep your records electronically, you must comply with it. For record keeping, VAT law also refers to the OR and the GeBüV.
The core is Art. 3. Records must be kept and retained in such a way
“that they cannot be altered without this being detectable.”
So the law does not require a change to be technically impossible. It requires every change to be noticed. It does not prescribe any particular technology.
Unalterable and alterable data carriers
Art. 9 distinguishes two kinds of information carrier. As unalterable, the ordinance names “in particular paper, image carriers and unalterable data carriers” (Art. 9 para. 1 let. a). Information carriers count as alterable if the information stored on them can be changed or deleted without the change or deletion being detectable on the data carrier; as examples, the ordinance names magnetic tapes, floppy disks, fixed or removable disks and solid-state storage (Art. 9 para. 2).
For cloud storage, the federal government’s SME Portal states that it does not meet the condition “unalterable” and is subject to the stricter requirements for alterable data carriers. If you archive in the cloud, you should therefore comply with Art. 9 para. 1 let. b. It requires four things:
- Integrity: technical procedures ensure the integrity of the stored information (no. 1). In practice this means a cryptographic checksum for each document, which is itself protected against silent changes.
- Time: the time of storage can be proven in a way that cannot be falsified, for example with timestamps (no. 2).
- Rules of the procedure: the rules for the procedure used that apply at the time of storage are followed (no. 3).
- Documentation and journals: processes and procedures are defined and documented, and supplementary information such as journals and log files is kept as well (no. 4).
What else the GeBüV requires
| Article | Requirement |
|---|---|
| Art. 4 | Organisation, responsibilities, processes and infrastructure are documented in working instructions (procedure documentation), in line with the type and size of the business. |
| Art. 5 | Records are kept carefully, in good order and protected from harmful influences. |
| Art. 6 | Authorised persons can inspect and examine the records within a reasonable time. On request, the records must also be made readable without aids. |
| Art. 7 | Archived information is kept separate from current information or marked as archived. Responsibility for the archive is assigned and documented. |
| Art. 8 | The information is inventoried systematically and protected from unauthorised access. Access is recorded, and these records must be kept for the same length of time. |
| Art. 10 | Integrity and readability are checked regularly. Anyone who transfers data to another data carrier keeps a journal of the transfer and retains it with the data. |
What the GeBüV does not require
- No digital signature. Art. 9 mentions signature procedures only as an example. In its opinion on motion 22.3004, the Federal Council stated that the GeBüV contains no obligation to use a digital signature, not even a qualified one. The former special VAT ordinance (ElDI-V) was repealed with effect from 1 January 2018.
- No qualified timestamp. What matters is that the time source is independent. In 2018, in an answer to an individual enquiry, the Federal Tax Administration (FTA) stated that a timestamp from your own computer’s clock would probably not be enough.
- No certification. The GeBüV provides for neither certification nor an approval body. “GeBüV-compliant” is always a self-assessment, which an auditor can check.
- No Swiss data location required. The OR and the GeBüV contain no rule on where data is stored. Storing it in Switzerland does, however, spare you the data protection questions that come with disclosing data abroad.
What stays with you
A large part of the GeBüV is organisation, and that is up to the company: the procedure documentation under Art. 4, clear responsibility for the archive under Art. 7, filing the receipts completely and promptly, and the bookkeeping itself. All software can do is make this easy. The annual report and the audit report must also be kept in writing and signed (Art. 958f para. 2 OR); the digital copy does not replace the original.
How Magic Heidi Archiv meets the requirements
Magic Heidi Archiv is built to the rules for alterable data carriers. When a document arrives, the server calculates a SHA-256 checksum for it and records it in a journal whose entries are chained together. After every archiving, and at least once a day, it obtains an RFC 3161 timestamp for the latest journal entry from an independent time-stamping authority. In addition, every document sits in storage with a retention lock until the end of its retention period. Every night all documents are checked against their checksums, every access is recorded in the journal, and the export can be verified without our software.
The article-by-article mapping is in the procedure documentation. How long you have to keep records is explained in the guide on the retention duty.