Outsourcing, operational resilience and cybersecurity

FINMA Circular 2018/3 on outsourcing

Most artificial intelligence used by Lugano financial institutions is supplied by third parties, and much of it runs in the cloud. Its use is therefore governed by FINMA Circular 2018/3 "Outsourcing", which applies to banks, securities firms and insurance companies. Portfolio managers and trustees are subject to comparable rules on the delegation of tasks in the Financial Institutions Ordinance, which prohibit the delegation of decisions reserved to the management bodies and require the institution to keep the personnel, expertise and rights of instruction and control needed to select, instruct and monitor the third party.¹ The circular was issued on 21 September 2017 and entered into force on 1 April 2018. It defines outsourcing as the mandating of a service provider to perform independently and on a permanent basis a significant function of the institution, and it sets out the requirements that the institution must meet when it outsources such a function.² A function is significant if it has a material effect on compliance with the objectives and rules of financial market supervision. Transaction monitoring, client screening, risk management and the management of client data are significant functions in this sense, and so in most cases are the IT systems on which they run. The requirements of the circular can be summarized in six points. The institution must keep an inventory of outsourced functions. It must select the provider carefully, taking into account its professional capacity, financial and human resources and the risks of the arrangement. The outsourcing must be governed by a written contract that defines the services, responsibilities, security requirements and rights of termination. The institution remains responsible for the outsourced function and must integrate it into its internal control system. The institution, its audit firm and FINMA must be able to examine the provider's activities and must have access to the relevant information, a requirement that applies with particular force to providers abroad. Finally, outsourcing must not impair the institution's restructuring or resolution: in the case of a bank, critical services must remain available in a crisis.³ Outsourcing abroad is permitted provided that these conditions are met and that the institution can demonstrate that access by its audit firm and FINMA, and in the case of systemically important functions the ability to restructure, are ensured.

For artificial intelligence the circular raises specific questions. A provider of a language model may itself rely on further subcontractors, such as data centre operators and model developers, and the institution must know and control this chain. The provider may update its model without notice, changing its behaviour in ways that affect the institution's results, which conflicts with FINMA's expectations on testing and monitoring. Contractual rights of audit are difficult to exercise against a large technology company, and the institutions concerned typically rely on certifications and audit reports. FINMA's AI survey found that small institutions relied exclusively on external providers, which concentrates these issues in exactly the type of institution that dominates the Lugano market.⁴

Notes

1. FINMA Circular 2018/3 "Outsourcing" of 21 September 2017, as amended (scope and dates of the circular); Financial Institutions Ordinance of 6 November 2019 (FinIO), SR 954.11, Art. 15–17 ("Übertragung von Aufgaben"), in particular Art. 16 paras. 1–3, text at https://www.droit-bilingue.ch/de-fr/9/95/954.11-16-19.html. ↩
2. FINMA Circular 2018/3 (above), margin nos. 2–5 (definition of outsourcing and significant function). ↩
3. FINMA Circular 2018/3 (above), margin nos. 13–35 (inventory, selection, responsibility, security, audit and supervision, outsourcing abroad, restructuring and resolution, contract). ↩
4. FINMA survey (April 2025, above). ↩

For general information only. This article does not constitute legal or tax advice, does not replace advice on an individual case and creates no lawyer-client relationship. It reflects the legal position as of August 2025.