Skip to content
Glossary

Critical functions

Critical functions are the activities, processes and services, with their underlying resources, whose disruption would threaten a bank’s continuation or its role in the financial market.

Under FINMA Circular 2023/1, critical functions include the activities, processes and services, including the resources needed to provide them, whose disruption would jeopardise the institution’s continuation or its role on the financial market, as well as the systemically important functions under Article 8 of the Banking Act. A tolerance for disruption, for example a maximum duration or an expected damage, must be defined for each one, taking severe but plausible scenarios into account.

DORA uses a related but different concept. A critical or important function is one whose disruption would materially impair the financial performance of the entity, the soundness or continuity of its services, or its compliance with the conditions of its authorisation. The difference matters for groups active in both Switzerland and the EU, because the two lists are not automatically identical.

For the board, the list of critical functions is a strategic decision: FINMA requires the board to approve the functions and their tolerances at least once a year. Pitfalls are lists that mirror the organisation chart instead of the services clients and markets rely on, functions defined so broadly that dependencies cannot be mapped, and inventories that are not updated after outsourcing or system changes.

In practice

  1. 01
    Derives critical functions from the services clients and markets depend on, not from internal departments.
  2. 02
    Keeps an inventory, reviewed at least annually, with tolerances, critical processes, resources and their interdependencies.
  3. 03
    Documents the significant operational risks and key controls for each critical function.
  4. 04
    Covers each critical function with business continuity plans and tests them against its tolerance.
  5. 05
    Maintains the separate DORA classification where EU entities are in scope and reconciles the two views.

Sources

Too good to be true? Then we should talk.

30 minutes. Your use case, maximum impact.

info@mrm-solution.com
Area of interest