FINMA's supervisory expectations

Read the PDF edition (2 pages)

The Swiss Financial Market Supervisory Authority has addressed artificial intelligence without a dedicated statute, using its existing powers over governance, risk management and operational resilience. Its Risk Monitor 2023 named the use of artificial intelligence as a trend that would shape supervision and set out four areas of particular attention: governance and responsibility, robustness and reliability, transparency and explainability, and equal treatment.¹ FINMA Guidance 08/2024, published in December 2024, developed these expectations on the basis of supervisory reviews and on-site inspections. It reported that many institutions still had weaknesses in recording their AI applications and in classifying them by risk, and that responsibilities were often unclear when models came from external providers.²

The guidance describes what FINMA expects in practice. Institutions should maintain an inventory of their AI applications, classify them according to their materiality and risk, and assign clear responsibility for their development, implementation, monitoring and use. They should test models for accuracy, robustness and stability before deployment and monitor them during use, because the performance of a model can deteriorate when the data it encounters change. Where results cannot be explained in sufficient detail, the institution should assess whether their use is justified for the purpose in question.³ The guidance also emphasises data quality, documentation and independent review, together with the management of risks from outsourcing when institutions rely on external models.

This approach fits the principles-based tradition of Swiss financial supervision that Part E, Chapter II described. FINMA's circular on operational risks and resilience, in force since 2024, already required banks to identify their critical functions and to manage risks from information and communication technology and from third parties. The outsourcing circular of 2018 governs the delegation of significant functions to service providers, including cloud providers. Artificial intelligence therefore enters a framework that was largely in place before the technology became a public topic.⁴ The advantage of this approach is flexibility. Its limit is that the expectations remain general, so that institutions must interpret them for each application and may find that FINMA's view becomes clear only in the course of an inspection.

Notes

1. FINMA, Risk Monitor 2023, November 2023, section on artificial intelligence. To be verified. ↩
2. FINMA Guidance 08/2024, Governance and risk management when using artificial intelligence, 18 December 2024. Status to be verified. ↩
3. FINMA Guidance 08/2024, sections on inventory, risk classification, data quality, testing, monitoring, documentation, explainability and independent review. To be verified. ↩
4. FINMA Circular 2023/1 Operational risks and resilience – banks, in force since 1 January 2024; FINMA Circular 2018/3 Outsourcing. See Part E, Chapter II, section on innovation, outsourcing and operational resilience. Status to be verified. ↩

For general information only. This article does not constitute legal or tax advice, does not replace advice on an individual case and creates no lawyer-client relationship. It reflects the legal position as of August 2025.