How to read a FINMA circular
Someone has sent you a forty-page PDF from the Swiss financial regulator and asked whether it applies to you. The good news is that every one of these documents is built the same way, so the skill transfers. The bad news is that the answer is almost never in the part you would naturally start reading.
What a circular actually is
FINMA is the Swiss financial market regulator. A circular is how it explains, in detail, what it expects from the firms it supervises on a particular topic. Circular 2023/1 opens by saying it relates to specific rules in the Banking Ordinance and the Financial Institutions Ordinance and sets out the corresponding supervisory practice. That sentence is a fair description of the genre: the circular is not itself the law, it is the regulator setting out how it applies the law.
Exactly what that means legally is a longer question and a separate one. Practically, it is the document your auditor will hold you to, which is usually why it has landed on your desk.
Every circular is laid out the same way
Six parts, always in this order:
A cover block of about eight lines, then a grid of institution types. An index. A chapter of definitions. The requirements themselves, which is the bulk of it. Transitional provisions at the end. And, if the circular has ever been amended, a list of the changes on the very last page.
The small numbers running down the right-hand margin are how a circular is cited. They are Randziffern, abbreviated Rz, and that is the form you will hear in conversation long before you see it written down. They matter because nobody refers to a circular by page or by section. They run in a single sequence from 1 to the end of the document, straight through the chapter breaks, so Rz 84 locates one sentence exactly, without needing a chapter reference attached to it.
The rest of this is how to read those six parts, in an order that is not front to back.
Start with the cover page
It looks like a title page and it is not. Four of the things you most need are on it, before the first Randziffer.
Whether you are an addressee. What the circular replaced, if anything. Which laws it hangs off. And, most easily missed, when it starts to apply, because the cover carries two dates and they are not the same. There is the date FINMA adopted the circular and, separately, the date it entered into force. Circular 2023/1 was adopted on 7 December 2022 and came into force on 1 January 2024, thirteen months apart. Circular 2018/3 had a gap of six months. That gap is your implementation runway and you only see it if you read both fields.
The year in the circular's number is not a third date, and this is the trap. 2023/1 was adopted in 2022 and came into force in 2024, so the 2023 in its name matches neither. Most circulars are numbered for the year they commence. This one is the reminder not to assume it.
Do not settle scope from the grid
Below the cover block is a wide table of institution types, banks, insurers, portfolio managers, fund management companies and so on, with an X under each one the circular is aimed at. It is genuinely useful and it answers in two seconds whether to keep reading.
It is not the answer to whether the circular applies to you, and the newest circulars now say so on the table itself. Circular 2026/1 heads its grid "Addressees (indicative)". Its own text shows why the qualifier is there: the grid ticks banks and insurers and their groups, but the scope chapter also brings in Swiss branches of foreign banks and of foreign insurers, and there is no column for either. The table understates the scope of the circular printed above it.
FINMA-RS 2026/1, Rz 3 and 4.
The real statement of scope is always the first chapter. Use the grid to triage and the chapter to decide.
One more thing that chapter can do: narrow the scope again, part by part. In 2026/1 one chapter applies only to banks and another only to insurers. If you are a bank, a fifth of that circular is simply not addressed to you, and the only place that is stated is a single Randziffer near the front.
FINMA-RS 2026/1, Rz 5.
Read the definitions before the requirements
Skipping the definitions chapter feels efficient and is the most expensive shortcut available.
Circular 2018/3 defines three terms in total. One of them says that significant functions are those with a material effect on compliance with the aims and regulations of financial market legislation. Nearly every obligation in that circular applies only to significant functions. So one sentence, on page three, decides how much of the document is yours, and if you and your auditor read that sentence differently, nothing further down will settle the disagreement.
Definitions also send you elsewhere. Some are defined by pointing at an article in another instrument rather than by being spelled out, so the vocabulary chapter is partly a reading list.
Proportionality will not be where you expect it
Circulars apply differently to a large bank and a small one, and the mechanism for that is called proportionality. There is no fixed place for it.
Circular 2023/1 gives it a chapter of its own near the front. Circular 2018/3 has no such chapter at all and spreads the same idea across three unrelated spots, including one near the very end. Search the document for the idea rather than looking for a heading.
Then check what the relief is, because it takes different forms. Sometimes it is an exemption: 2023/1 simply lists the requirements that smaller institutions do not have to comply with, which is the easiest kind to rely on because you can point at the list. Sometimes it is an exclusion from scope: 2026/1 puts the smallest institutions outside the circular entirely, and then adds, in the same Randziffer, that the circular still serves as a guide for them and that they are expected to take the risks into account. Being outside a circular is not the same as being free of what it expects.
FINMA-RS 2026/1, Rz 7.
Both of those turn on your FINMA supervisory category, a number from 1 to 5. No circular defines it. Not what the categories are, not how you are assigned one, not where to look it up. That is the general pattern and it is worth internalising early: when a requirement depends on a term the circular does not define, the term has come from somewhere else, and the circular will not tell you where. In this case it came from an ordinance annex, and the map says which one.
BankV Art. 2 Abs. 2 and Anhang 3.
The deadline may not be a date
Transitional provisions live in the final chapter, and "when does this bite" does not always have a date as its answer.
It might be a date, or several running at once. Circular 2023/1 has three separate clocks off a single commencement, which is set out in the 2023/1 post. It might be an event: 2018/3 starts the clock for insurers when a particular application is submitted to FINMA rather than on any calendar day. Or it might depend on who you are: 2026/1 phases its requirements by supervisory category across three successive years.
Read that chapter before you build a project plan, not after.
Did you settle whether the circular applies to you from the scope chapter, or only from the grid of ticked boxes?
Do you know both dates on the cover, and which of them is the one that matters?
Have you read the definitions chapter before the requirements?
Do you know where proportionality sits in this particular circular?
Where a requirement depends on a term the circular does not define, do you know where the definition lives?
Do the transitional provisions give you a date, or something you have to do first?
If the cover says the circular has been amended, have you read the list of changes at the back?
Three things that catch experienced readers
Below this point is for people who already cite Randziffern in writing. If you are reading a circular for the first time, the checklist above is the whole job.
A Randziffer is not a permanent address. When FINMA amends a circular it inserts new provisions as decimals, 6.1 or 13.2, so that references already in use keep working. Usually that holds. In Circular 2018/3 it did not: a second round of amendments added a 6.1 when one already existed, and a single line on the modifications page resolves it by saying that the earlier 6.1 is now 6.3. Anything citing 18/3 Rz 6.1 from between those two rounds now points somewhere else, and only the back page records it.
Numbers can also be emptied instead of moved. Circular 2017/1 had five consecutive Randziffern abrogated. The numbers stayed in the document, with the word "Abrogated" printed where the provisions used to be, so a reference to any of them points at nothing at all.
FINMA-RS 2017/1, Rz 100–104.
The requirement is often not in the numbered text. Footnotes carry substance: in 2023/1 it is a footnote, and not the Randziffer above it, that permits tabletop and red team exercises. Cross-references run deep enough that a single obligation can span three circulars, and you cannot satisfy the first by reading only the first.
FINMA-RS 2026/1 Rz 46 → FINMA-RS 2023/1 Rz 39 → FINMA-RS 2017/1 Rz 75 and 76.
Where this trips people up
Common misreading
Treating the numbered requirements as the circular and everything else as packaging. The cover block, the grid, the footnotes and the modifications page are all part of the instrument, and three of those four are where the answers to "does this apply to me, and from when" actually sit. The second misreading is arguing from the English. FINMA publishes English versions and they are still translations: one Randziffer of 2023/1 reads "ICT that its nearing the end of its operational life", which is not a sentence. A document containing that is not the one to litigate a single word against, which is why everything on this site cites the German.
This gets you the answers quickly. It will not settle a reading that someone is disputing. At that point the German text and someone who argues these for a living both start earning their keep, and the ten minutes spent on the cover page is what tells you whether you have reached that point.
Examples checked against the German texts of FINMA-RS 2017/1 "Corporate Governance", 2018/3 "Outsourcing", 2023/1 "Operationelle Risiken und Resilienz" and 2026/1 "Naturbezogene Finanzrisiken", in the versions in force at the review date above. Randziffern refer to those texts, which are the authoritative versions.