Decision by Swiss regulator focuses on failure to detect or act on suspicious activity between 2009 and 2019