FINMA Circular 2023/1: Swiss Operational Risk and Resilience Rules

Swiss banks and securities firms must show FINMA that they can manage ICT, cyber and critical data risks and keep critical functions running through severe disruption, and FINMA Circular 2023/1 is where those expectations are written down. The circular, "Operational risks and resilience: banks", is dated 7 December 2022 and entered into force on 1 January 2024. This guide walks through its scope, the ICT, cyber, critical data, business continuity and operational resilience chapters, the transitional periods, how FINMA enforces it, and what it means for service accounts, API keys and AI agents. It is written for CISOs, operational risk managers, IT and identity teams at Swiss institutions and at the service providers that support them. For the wider picture across jurisdictions, see the Financial Services Cyber Regulation Map.

Key takeaways

• It applies to banks, securities firms and groups. The addressees are banks, persons under Art. 1b of the Banking Act, securities firms, and financial groups and conglomerates, with proportionality by size, complexity, structure and risk profile.
• Cyber attacks have a 24 hour clock. The circular expects a preliminary notification to FINMA within 24 hours of an initial assessment and a report within 72 hours, under the reporting duty in the Financial Market Supervision Act (FINMASA).
• Critical data needs least privilege and a privileged user list. Access to critical data must be limited to those who need it, people with increased privileges face increased security requirements, and a list of everyone with privileged access must be kept current.
• Operational resilience is a board decision. The board approves critical functions and their tolerances for disruption at least annually, and the institution must test that it can stay within those tolerances, including long-duration scenarios.
• The transition periods have run. The circular gave one year for some operational resilience requirements and the first tests and two years for others, counted from entry into force on 1 January 2024, so as of November 2026 the full set is expected to be in place.

Scope: who and what is covered

Section I (margin nos. 1 and 2) names the addressees: banks, persons under Art. 1b of the Banking Act, securities firms, and financial groups and conglomerates, collectively called institutions. FINMA's press release of 13 December 2022 describes the circular as a full revision of Circular 2008/21 "Operational risks: banks", with a partial revision of Circular 2013/3 "Auditing". It also replaces the Swiss Bankers Association's recommendations for business continuity management, which FINMA had recognised as a minimum standard.

Proportionality

Section III (margin nos. 19 to 21) applies the requirements case by case according to size, complexity, structure and risk profile. Banks and securities firms in supervisory categories 4 and 5 are exempt from a defined list of margin numbers, including 33 to 38, 41 to 46, 48, 51, 57, 73, 74, 76 to 78, 80, 87, 92, 93, 96, 103, 104 and 110 to 112. Smaller institutions should map each exemption to their control set rather than assume a whole chapter is out of scope.

Structure of the circular

Two definitions drive most of the work. Critical data is data that is crucial to the institution's services or regulatory purposes, assessed for confidentiality, integrity and availability. Critical functions are activities, processes and services whose disruption would endanger the institution or the proper functioning of financial markets, including systemically important functions under Art. 8 of the Banking Act. A tolerance for disruption must be defined for each critical function.

Key obligations

Operational risk management (IV.A)

• Board role: the board of directors approves the risk management principles and the operational risk tolerance at least annually.
• Executive board: ensures risks are identified, assessed, limited and monitored, and key controls are regularly assessed by an independent control body.
• Before change: ad hoc risk and control assessments are required before major changes.
• Reporting: risk control reports to the board annually and to the executive board every six months.

ICT risk management (IV.B)

• Strategy and governance (47 to 49): a board-approved ICT strategy, with the executive board making sure procedures are implemented and resourced.
• Change management (50 to 52): development and test environments separated from production; requirements defined, approved and tested.
• Operations (53 to 57): inventories of hardware and software assets and of the storage locations of critical data (margin no. 53), with dependencies and interfaces to significant external service providers taken into account; confidentiality, integrity and availability controls; tested backup and recovery; handling of end-of-life ICT.
• Incident management (58 to 60): significant ICT incidents handled across their life cycle, coordinated with BCM, and those that significantly disrupt critical processes reported to FINMA without delay.

Cyber risk management (IV.C)

• Coverage: identification of threats, protection, detection, response and recovery. FINMA cites margin no. 62 for governance and no. 63 for identifying the institution-specific threat landscape.
• Testing: regular vulnerability assessments and penetration tests by qualified staff, and scenario-based cyber exercises (margin no. 70). FINMA Guidance 03/2024 of 7 June 2024 adds detail on these exercises, describing red teaming and tabletop exercises as supervisory tools.
• Reporting: after an initial assessment, a preliminary notification to FINMA within 24 hours of a successful or partially successful attack, a report within 72 hours, and a root cause analysis when the matter is closed. FINMA Guidance 05/2020 sets out the duty to report cyber attacks under Art. 29 para. 2 FINMASA, and Guidance 03/2024 clarifies it.

Critical data risk management (IV.D)

• Identify and categorise: systematic identification and categorisation of critical data, managed across its life cycle.
• Access: access to critical data and processing functions restricted to people who need it for their tasks; increased security requirements for people with increased privileges; a list of everyone with privileged access, kept and updated regularly.
• Location: additional risk mitigation where critical data is stored or accessible abroad.
• Service providers: particularly thorough due diligence, requirements defined and checked before contract, and periodic monitoring within the internal control system.
• Incidents: incidents that substantially impair critical data reported to FINMA without delay.

Business continuity and operational resilience (IV.E and V)

FINMA's press release notes that the operational resilience chapter reflects the Basel Committee principles published in March 2021. See the Business Continuity and Disaster Recovery Guide and the Business Impact Analysis Template.

Timeline and current status

As of November 2026 we found no FINMA announcement replacing Circular 2023/1. FINMA updates its circulars and guidance over time, so confirm the current version on finma.ch before relying on margin numbers. Until the revised Capital Adequacy Ordinance takes effect, the circular keeps capital requirements for operational risk under margin nos. 3 to 116 of Circular 2008/21 (margin no. 114).

The NCSC reporting obligation alongside FINMA

Since 1 April 2025, the amended Information Security Act and the Cybersecurity Ordinance require organisations within its scope to report cyber attacks on critical infrastructure to the National Cyber Security Centre (NCSC, which became a federal office within the DDPS) within 24 hours of discovery, with a full report 14 days later, through the NCSC Cyber Security Hub. Failure to report became subject to fines from 1 October 2025. The NCSC states its form can collect the information and forward it to other authorities with reporting duties, such as FINMA. Check with your legal team whether your institution falls within the NCSC scope, and design one incident workflow that meets both clocks. See the Cyber Incident Reporting Requirements Map.

Enforcement and penalties

A FINMA circular sets out how FINMA applies financial market law in supervision. Compliance is checked through ongoing supervision and the regulatory audit carried out by audit firms, which is why the circular came with a partial revision of the auditing circular. Where FINMA finds breaches of supervisory law, its published enforcement tools include orders to restore compliance with the law, declaratory rulings, industry bans, cease and desist orders, publication of final rulings, disgorgement of profits, and withdrawal of authorisation, liquidation and bankruptcy. The reporting duty for cyber attacks rests on Art. 29 para. 2 FINMASA. For NCSC reporting, failure to report has been subject to fines since 1 October 2025. For practical purposes the larger risk for most institutions is supervisory: findings in the regulatory audit, required remediation plans and closer supervision.

What it means for AI agents and non-human identities

The circular does not mention AI agents or non-human identities by name. Its requirements still apply to them, because service accounts, API keys, certificates and agents are the means by which ICT systems reach critical data and run critical processes.

For sector context on agents, see the AI Agents in Financial Services Security Guide.

Compliance steps

1. Confirm scope and proportionality: record your supervisory category and list which margin numbers are exempt for you.
2. Gap assess by chapter: compare current controls with IV.A to IV.F and V, using the margin number ranges above as the index of your control library.
3. Agree critical functions and tolerances: take them to the board for approval and set the annual cycle.
4. Build the inventories: ICT assets, storage locations of critical data, dependencies and interfaces to significant service providers, and machine identities with access to critical data.
5. Fix privileged access: produce the privileged access list for people and machines, apply need-to-know, and set a review cycle (quarterly, our recommendation).
6. Wire up incident reporting: one playbook that meets the FINMA 24 hour and 72 hour expectations and, where applicable, the NCSC 24 hour and 14 day reports.
7. Test: vulnerability assessments, penetration tests, scenario-based cyber exercises, BCP and DRP tests and resilience tests within tolerance, with findings tracked to closure. See the Cyber Incident Exercises Beyond Tabletop Guide.
8. Report and evidence: annual board reporting and evidence packs ready for the regulatory audit.

Framework mapping

Measuring progress (our recommendations)

• Share of critical functions with a board-approved tolerance and a tested scenario in the last 12 months.
• Share of privileged accounts, human and machine, on the privileged access list with a review in the last quarter.
• Time from detection to FINMA preliminary notification in exercises, against the 24 hour target.
• Share of critical data storage locations recorded in the inventory.
• Open findings from penetration tests and cyber exercises past their due date.

Practitioner checklist

• Record your supervisory category and the margin numbers exempt under proportionality.
• Have the board approve operational risk tolerance, critical functions and tolerances for disruption each year.
• Maintain ICT asset and critical data location inventories that include machine identities and agent credentials.
• Keep a current list of all privileged access, covering service accounts and automation as well as people.
• Separate development and test from production and treat agent permission changes as changes.
• Run vulnerability assessments, penetration tests and scenario-based cyber exercises, and track findings.
• Test BCP and DRP measures at least annually and resilience scenarios against tolerances.
• Run a single incident playbook covering FINMA 24 and 72 hour reporting and NCSC reporting where it applies.
• Apply thorough due diligence and periodic monitoring to providers that handle critical data.

Standards and references

• FINMA: Circular 2023/1 Operational risks and resilience: banks
• FINMA: Press release on the revised circular
• FINMA: New cyber supervisory approach and guidance
• FINMA: Cyber risks guidance 03/2024
• FINMA: At a glance: cyber risk
• FINMA: Enforcement tools
• Swiss National Cyber Security Centre: Reporting cyber attacks on critical infrastructure mandatory from 1 April 2025

Related NHI Mgmt Group resources: Financial Services Cyber Regulation Map · DORA Guide · Privileged Access Management Guide · Cyber Incident Reporting Requirements Map. This guide summarises FINMA Circular 2023/1 and related Swiss reporting rules and is not legal advice.