A licence, and keeping it
You need one, and you have to go on meeting the conditions it was granted on.
FINMA, banking supervisionICT and cyber
Three questions first, in order. Why any of it binds you, how supervision actually arrives, and how much of it applies to your institution. Then every instrument, ordered by how binding it is. Banks only, ICT and cyber only.
FINMA supervises licensed banks and securities firms with two stated aims: protecting creditors, and keeping the financial system working. What supervision watches, day to day, is whether an institution still meets the conditions it was licensed on.
That is the whole hook. Nothing below is aimed at ICT because ICT is interesting. It is aimed at ICT because a bank that cannot run its systems is a bank that no longer satisfies the organisational condition attached to its licence.
You need one, and you have to go on meeting the conditions it was granted on.
FINMA, banking supervisionOne clause in the Banking Act. Most of what follows hangs off it.
BankG Art. 3 Abs. 2 Bst. aOrganisation and risk management, and the definition of operational risk that ICT and cyber risk sit inside.
BankV Art. 12 and 14e · ERV Art. 89Circulars create no law. FINMA is bound by them, and so is the examination that tests you against them.
FINMA-RS 2023/1 and the rest of the stackFINMA does not run most of the fieldwork. Audit firms licensed by the RAB do, to FINMA's specifications.
FINMA, banking supervisionInside the bank the work is usually organised in three lines. That split is a governance model rather than a legal requirement, and it is the vantage point this site is named after.
That last row is the one worth reading twice. The regulatory audit is commissioned and paid for by the institution being audited, on specifications written by FINMA, and the resulting work counts as part of FINMA's own supervision. For most institutions the audit firm is the one that turns up. The regulator may never do so at all.
FINMA sorts every licensed bank and securities firm into one of five supervisory categories, using four measurable criteria: total assets, assets under management, privileged deposits and required capital. The assignment is FINMA's act, not a calculation you perform on yourself.
Category is only half of it. Each institution also carries a rating, and the two together set how intensively it is supervised. Categories 1 and 2 get continuous, close attention. Category 5 is watched largely through numbers and looked at properly when something breaks.
You do not have to infer yours. FINMA publishes the category next to the institution's name in its list of licensed banks and securities firms.
The circulars then use that number to decide how much of themselves apply. FINMA-RS 2023/1 exempts categories 4 and 5 from a named list of margin numbers. FINMA-RS 2026/1 phases its requirements in by category across three successive years. A reader who does not know their category cannot work out which parts of either document are theirs.
Where the numbers live
Art. 2 Abs. 2 BankV names the four criteria and sends you to Anhang 3 for the thresholds. No circular defines the categories, because a circular cannot amend an ordinance annex. FINMA's own categorisation page describes the five categories in words and publishes the institution counts, and still does not print the thresholds. They exist in one place: the annex at the back of the ordinance.
One clause in the Banking Act. Most of what follows hangs off it.
Follows client data wherever it goes, including into a cloud.
Report incidents that matter to supervision, without delay.
Cyber attacks on critical infrastructure. Banks are in scope.
In force April 2025Security of personal data, and a separate duty to report breaches.
The two articles FINMA's main circular says it is interpreting.
The four criteria and the thresholds behind every piece of proportionality relief in the stack.
ICT and cyber risk sit inside this definition, not beside it.
Deadlines and exemptions for the duty above.
In force April 2025Implements the Data Protection Act.
ICT (Rz 47–60), cyber (61–70), critical data (71–82), business continuity (83–96), operational resilience (101–111). If you read one document, read this one.
Inventory, provider selection, audit rights, offshoring, minimum contract terms.
Who on the board owns ICT and cyber risk, and what they sign off.
How your audit firm tests everything above. Replaced the 2013 circular.
The 24- and 72-hour clocks, and the table that grades severity.
Sharpens 05/2020 and adds scenario-based cyber exercises.
June 2024Switzerland has no AI law. FINMA says the existing rules already cover it.
December 2024States plainly that it is not self-regulation. Everyone uses it anyway.
3rd edition, November 2025What FINMA built the 2023/1 circular on.
What a cloud provider will hand you instead of an on-site audit.
The common reference behind most bank control catalogues.
Three different thresholds, three different clocks. Crossing one does not mean you have crossed the others, and none of them triggers the rest automatically. Severe incidents also need evidence on how your crisis organisation performed, and BACS fines have been possible since October 2025.
The trap
FINMA grades an incident against your own recovery time objective. An outage past half your RTO is medium, past your RTO is high, past double is severe. But the RTOs come from a business impact analysis the circular told you to do months earlier. No analysis, no grading, and no way to hit the 24-hour clock.
Not on this page: capital, liquidity, market conduct, anti-money laundering, consumer protection. Banks only. Insurers and securities firms follow overlapping but different rules.