Regulatory hub
The rules banks are measured against, summarised for executives.
What each regulation requires, what it means for the board and executive management, and where to find the official text.
Corporate governance – banks
FINMA Circular 2017/1 sets FINMA’s requirements for corporate governance, risk management, the internal control system and internal audit at Swiss banks and securities firms: board duties and independence, committees, the risk policy, and independent risk control and compliance functions.
Read the summary →
Operational risks and resilience – banks
FINMA Circular 2023/1 sets FINMA’s practice for managing operational risk at banks and securities firms – ICT, cyber, critical data, business continuity and cross-border risks – and requires critical functions to stay within board-approved tolerances for disruption. In force since 1 January 2024.
Read the summary →
AI governance & risk management
FINMA Guidance 08/2024 sets out what FINMA assessed in supervising the use of AI, in seven areas: governance, inventory and risk classification, data quality, testing and monitoring, documentation, explainability and independent review. It creates no new legal obligations.
Read the summary →
DORA – digital resilience
DORA is directly applicable EU law on ICT risk in the financial sector. Since 17 January 2025, financial entities must run an ICT risk management framework owned by the management body, classify and report major ICT incidents, test their digital resilience and control ICT third-party risk.
Read the summary →
EU AI Act (EU) 2024/1689
The AI Act regulates AI systems by risk. For banks, AI systems that evaluate the creditworthiness of natural persons or establish their credit score are high-risk (Annex III, point 5(b)). Since the 2026 Digital Omnibus, those high-risk obligations apply from 2 December 2027.
Read the summary →
MaRisk (Circular 06/2026)
MaRisk is Bafin’s circular specifying the risk management requirements of § 25a KWG. The 9th amendment, Circular 06/2026 (BA), in force since 30 June 2026, is more principles-based, removes ECB-supervised banks from its scope and grants defined relief to small and very small institutions.
Read the summary →
SS1/23 – Model risk management principles for banks
SS1/23 sets the PRA’s expectation that banks treat model risk as a risk in its own right. Five principles cover model identification and tiering, board-led governance with an accountable SMF, model development, independent validation and model risk mitigants. In effect since 17 May 2024.
Read the summary →
Executive summary for orientation, not legal advice. The official text prevails.
The terms behind the rules
Plain-language definitions of the terms that shape model risk management, internal control and governance in banking.
Audit trailCompliance by designControl testingCritical functionsGovernance bodyInternal control systemModel inventoryModel risk management
Open the glossary →Too good to be true? Then we should talk.
30 minutes. Your use case, maximum impact.
info@mrm-solution.com