FINMA Circular 2023/1Switzerland

Operational risks and resilience – banks

FINMA Circular 2023/1 sets FINMA’s practice for managing operational risk at banks and securities firms – ICT, cyber, critical data, business continuity and cross-border risks – and requires critical functions to stay within board-approved tolerances for disruption. In force since 1 January 2024.

Key points

01
In force since 1 January 2024; replaces Circ. 2008/21 and takes account of the Basel Committee’s March 2021 principles on operational risk and operational resilience.
02
The board of directors approves the principles for managing operational risk, at least annually the risk tolerance for operational risk (margin no. 23), and regularly the strategies for ICT, cyber risks, critical data and BCM (margin no. 24).
03
Key controls must be assessed regularly for design and operating effectiveness by an independent control body (margin no. 31).
04
Dedicated chapters cover ICT, cyber risk, critical data, business continuity management and cross-border services; cyber attacks trigger a 24-hour notification and a 72-hour report to FINMA (margin no. 68).
05
Operational resilience: each critical function needs a tolerance for disruption based on severe but plausible scenarios, approved by the board at least annually and tested (margin nos. 101, 103, 110).
06
All transitional periods ended on 1 January 2026; FINMA Guidance 05/2025 sets out FINMA’s survey findings on how institutions implement the resilience requirements.

Status

Issued 7 December 2022, in force since 1 January 2024. It replaced FINMA Circ. 2008/21 “Operational risks – banks” for risk management and the industry recommendations on business continuity management that FINMA had recognised as a minimum standard. The resilience requirements were phased in (margin no. 113): critical functions, tolerances for disruption, first board approvals and first reporting from entry into force; margin nos. 106–109 and first tests within one year; full assurance of operational resilience and framework coordination (margin nos. 102, 104, 111) within two years, i.e. from 1 January 2026. All transitional periods have expired. Capital requirements for operational risk are not set by this circular: until the end of 2024 the capital margin numbers of Circ. 2008/21 continued to apply (margin no. 114); since 1 January 2025 they follow the revised Capital Adequacy Ordinance and the FINMA ordinance on the leverage ratio and operational risks (LROO-FINMA).

What it requires

01
Governance and risk tolerance
The board of directors approves the principles for managing operational risk and, at least annually, the risk tolerance for operational risk (margin no. 23); the executive board ensures that operational risks are identified, assessed, limited and monitored (margin no. 25). Risk control reports on operational risk to the board at least annually and to the executive board at least every six months (margin no. 39).
02
Risk inventory, assessments and key controls
Operational risks are categorised uniformly and kept in an inventory (margin no. 28) and assessed through regular risk and control assessments (margin no. 30). An independent control body regularly tests the design and operating effectiveness of key controls and documents the results (margin no. 31).
03
ICT and cyber risk management
Institutions keep an inventory of ICT assets including the storage locations of critical data (margin no. 53) and report to FINMA without delay ICT incidents that significantly disrupt critical processes and are material for supervision (margin no. 60). Cyber attacks require a preliminary notification within 24 hours and a report via FINMA’s EHP platform within 72 hours (margin no. 68); vulnerability assessments, penetration tests and scenario-based cyber exercises are required.
04
Critical data
Critical data must be identified systematically, categorised by criticality and protected for confidentiality, integrity and availability over their entire life cycle, including in test environments (margin nos. 71–82). Access follows need-to-know principles, storage or access from abroad needs mitigating measures, and service providers handling critical data are subject to particularly thorough due diligence.
05
Business continuity management
Each relevant area identifies its critical processes in a business impact analysis and defines RTO and RPO; BCP and DRP are reviewed at least annually, and a crisis organisation is defined in advance (margin nos. 83–96). The most important BCP and DRP measures and the crisis organisation are tested at least once a year (margin no. 92).
06
Operational resilience
The institution identifies its critical functions and tolerances for disruption, which the board approves at least annually (margin nos. 101, 103), and keeps an inventory of critical functions with their processes, resources and dependencies (margin no. 107). It coordinates operational risk, ICT and cyber, BCM, outsourcing and emergency planning (margin no. 104) and tests its ability to stay within tolerance in severe but plausible scenarios, including disruptions lasting several months (margin no. 110).

What it means for the board and executive management

01
The board carries explicit, recurring approvals: the risk tolerance for operational risk (at least annually, margin no. 23), strategies for ICT, cyber, critical data and BCM (margin no. 24), and the critical functions with their tolerances for disruption (at least annually, margin no. 103).
02
Tolerances for disruption must reflect the board’s own tolerance for shocks, irrespective of the institution’s current recovery capability; FINMA Guidance 05/2025 calls deriving them from recovery capability (reverse engineering) inconsistent with the supervisory requirements.
03
The board receives resilience reporting at least annually and whenever significant control weaknesses or incidents endanger operational resilience (margin no. 105), plus BCM test results with prioritisations and known coverage gaps (margin no. 95).
04
Third parties sit inside the critical path: in FINMA’s survey, 71% of reported critical functions depend directly or indirectly on third-party services, so FINMA expects an end-to-end view of the supply chain when setting and testing tolerances.

In MRM-Solution

How MRM-Solution supports it

01Derive the requirements into each policy’s register, every row with its origin, and count a row only after a person has approved it.
02See per requirement whether policy, process and governance, and controls hold it: three lamps, and the weakest one counts.
03Attach controls to the activities they secure, record tests or import results in your own spreadsheet layout, and track deficiencies to closure.
04Follow supervisory news from 26 regulators and standard setters; gaps become pending rows in the requirements register.

Book a demo

Questions executives ask

Are the transitional periods for operational resilience over?

Yes. Identifying critical functions, defining tolerances, the first board approvals and the first reporting were expected from entry into force on 1 January 2024; the inventory, threat assessment, documentation, BCP coverage and first tests followed within one year; ensuring operational resilience and coordinating the framework had to be in place within two years, i.e. from 1 January 2026 (margin no. 113). Proportionality still applies: institutions in supervisory categories 4 and 5 are exempt from, among others, the annual re-approval, the framework coordination and resilience testing (margin no. 20).

How many critical functions should we define, and how should tolerances be set?

The circular sets no number. In FINMA’s survey of 267 institutions (data as at 31 December 2024, published in Guidance 05/2025), half defined no more than three critical functions and half set tolerances of no more than 48 hours, with the middle half between 24 and 72 hours. FINMA stresses that processes and resources such as IT operations or the core banking system are not critical functions, that tolerances above 120 hours should be questioned and those above 240 hours checked for criticality.

What must we report to FINMA after a cyber attack?

A successful or partially successful cyber attack must be analysed for its materiality; after an initial assessment, FINMA receives a preliminary notification within 24 hours and the report via the EHP platform within 72 hours, followed by a final root-cause analysis once the case is closed (margin no. 68). ICT incidents that significantly disrupt critical processes and are material for supervision (margin no. 60), and incidents that substantially impair critical data, must also be reported to FINMA without delay.

Sources

Executive summary for orientation, not legal advice. The official text prevails.

Reference: FINMA Circular 2023/1
Issued by: Swiss Financial Market Supervisory Authority FINMA
Type: Circular
In force since: 1 January 2024
Applies to: Banks, persons under Article 1b of the Banking Act, securities firms, and financial groups and conglomerates (margin no. 2). The requirements apply proportionately; institutions in FINMA supervisory categories 4 and 5 and in the small-banks regime are exempt from listed margin numbers (margin nos. 20–21).
Last reviewed: 13 October 2026