FINMA Circular 2023/1 ‘Operational risks and resilience – banks’ comes into force today, setting the Swiss Financial Market Supervisory Authority’s expectations for banks and securities firms.
Key points
- ICT risk management and cyber risk management across identify, protect, detect, respond and recover.
- Critical data management and business continuity management.
- Operational resilience of critical functions, with tolerances and full implementation by 2026.
- Cyber attacks on critical assets are reported to FINMA within 24 hours, with a full report within 72 hours.
UK technology and outsourcing providers to Swiss banks should expect stronger requirements on resilience, testing and incident reporting in their contracts.
Source: FINMA Circular 2023/1 Operational risks and resilience – banks (FINMA)
Need help understanding what this change means for your organisation? Get in touch for a pragmatic, no-obligation conversation.
