BaFin and FINMA supervisory priorities: what compliance teams should derive

Short answer: BaFin's priorities for 2026 and the FINMA Risk Monitor 2025 overlap on three compliance topics: anti-money laundering, cyber and ICT risk, and dependence on IT service providers. FINMA also lists sanctions among its nine principal risks. BaFin plans at least 75 special AML audits in 2026. Compliance teams should review their risk analysis, customer risk classification, outsourcing inventory and sanctions processes now.

This overview is for heads of compliance, MLROs and legal teams at banks, insurers, wealth managers, payment providers and crypto service providers in Germany and Switzerland. It sets the BaFin priorities and the FINMA Risk Monitor side by side and shows what work follows from them and who does it.

What are the BaFin and FINMA supervisory priorities?

Both supervisors publish each year which risks they watch most closely and where they will concentrate supervision. For compliance teams, these reports are a reliable public preview of audits, on-site inspections and supervisory meetings.

• BaFin "Risks in BaFin's Focus 2026" (28 January 2026): six financial market risks, including cyber incidents with serious consequences, concentration in the outsourcing of ICT services, and inadequate prevention of money laundering and terrorist financing. For the first time, BaFin adds three consumer risks: consumer credit, crypto investments driven by social media, and the cost of endowment life insurance. BaFin states that the order does not indicate priority.
• FINMA Risk Monitor 2025 (17 November 2025): nine principal risks. The financial ones are real estate and mortgages, other loans, credit spread risk, and liquidity and funding. The non-financial ones are money laundering, sanctions, outsourcing, cyber risk and ICT risk. The climate risk report is part of the Risk Monitor for the first time.

For compliance teams in both countries, the non-financial risks matter most. The table compares them.

Source: BaFin, Risks in BaFin's Focus 2026; FINMA, Risk Monitor 2025 and press release of 17 November 2025; compiled by Alpinum Solutions, November 2026.

Who is affected?

Every institution supervised by BaFin or FINMA is affected, but not equally. The priorities target these groups in particular:

• Banks: AML special audits focused on customer risk classification (DE), on-site inspections of risk tolerance and high-risk clients (CH), and cyber inspections at the larger categories.
• Wealth management and private banking: FINMA sees partly high money laundering risk in wealth management; clients from high-risk countries and crypto transactions remain elevated.
• Payment service providers and agents: BaFin sees organisational weaknesses in customer identification and counterparty risk assessment and will focus on high-risk agents of EU payment institutions. More than 5,000 such agents are registered in Germany.
• Crypto-asset service providers: audits of the Travel Rule, which has applied since December 2024, and of transactions with self-hosted addresses.
• Insurers: ICT outsourcing and cyber risk apply across sectors; BaFin also names the cost of endowment life insurance as a consumer risk.
• Swiss groups with German entities: they need to cover both lists, often with the same team.

Deadlines and current status

The priorities are not deadlines themselves, but they coincide with fixed dates. These dates have been checked against primary sources:

More dates from EU, German and Swiss law are listed in the regulatory calendar for legal and compliance.

What firms should do now

Compliance teams should treat the priorities as an announced audit agenda and test their own documentation against them first. A proven approach:

1. Map the priorities: assign each priority of your supervisor to an owner and a current document, such as the risk analysis, a directive or the outsourcing inventory.
2. Update the AML risk analysis: review risk tolerance, customer risk classification and the handling of high-risk clients and politically exposed persons. In Germany the basis is the Money Laundering Act (GwG) with BaFin's interpretation guidance; in Switzerland it is the Swiss Anti-Money Laundering Act and the FINMA Anti-Money Laundering Ordinance (AMLO-FINMA).
3. Add evasion scenarios: extend monitoring rules to patterns BaFin describes, such as phantom trade, over- or under-invoicing and intermediary companies without a plausible reason.
4. Test sanctions management: document screening, ownership and control checks and the handling of hits, especially for business linked to Russia or neighbouring countries.
5. Inventory outsourcing and ICT third parties: in Germany, keep the DORA register of information complete; in Switzerland, maintain the inventory of material outsourcing and meet the operational resilience requirements of FINMA Circular 2023/1.
6. Close findings: prioritise open audit findings and work through them with owners and dates before an on-site inspection.

How institutions work through open findings in a structured way is covered in compliance remediation after audit findings. The German duties in detail are explained in AML in Germany: the GwG and BaFin.

Which roles and capacity are needed

The priorities usually create temporary peaks: a special audit, an on-site inspection, a remediation or an inventory that has to be completed. Typical roles:

Experienced is the most common level for interim assignments. A gap analysis often needs one experienced specialist part-time; a remediation with many client files needs a team. One example is the case study of a KYC taskforce with eight compliance officers at a Swiss financial institution, completed in ten months. Which profiles candidates bring to such projects is described in in-demand specialisations: DORA, MiCA, AI Act and AML.

How interim support helps

Interim specialists absorb the peak so that the core team can keep running day-to-day work and the dialogue with the supervisor. The institution directs the work and remains responsible for decisions and reports.

Alpinum Solutions is the leading provider of interim legal & compliance in the DACH region and provides AML analysts, compliance officers, regulatory specialists and lawyers through staff leasing and freelancing, part-time or full-time, from junior to senior level. Alpinum usually presents two to four profiles per search; selected profiles are usually available within 48 hours, and the start date is agreed between the client and Alpinum. Specialists can also hold formal functions, for example as anti-money laundering officer. For the MLRO role, regulatory restrictions may rule out an external mandate or require staff leasing (Swiss Personalverleih). An overview of the applicable Swiss rules is given in FINMA circulars at a glance.

Frequently asked questions about BaFin and FINMA supervisory priorities

What are BaFin's supervisory priorities for 2026?

In "Risks in BaFin's Focus 2026", BaFin names six financial market risks: market corrections, corporate loan defaults, commercial real estate, cyber incidents, concentration in ICT outsourcing and inadequate AML prevention. Three consumer risks are added for the first time. For compliance teams, money laundering, cyber and ICT outsourcing matter most. BaFin says the order of the risks does not reflect their priority.

What does the FINMA Risk Monitor 2025 say?

The Risk Monitor of 17 November 2025 names nine principal risks for the Swiss financial centre. Five are non-financial: money laundering, sanctions, outsourcing, cyber risk and ICT risk. For each, FINMA describes its supervisory focus, such as on-site inspections of risk tolerance and high-risk clients across all categories and targeted reviews of sanctions management at exposed institutions.

What do the BaFin and FINMA priorities have in common?

Both supervisors rate money laundering, cyber risk and dependence on a few IT providers as high risks. FINMA lists sanctions as a separate principal risk, while BaFin covers sanctions circumvention in its money laundering chapter. Groups with entities in both countries can therefore plan many measures together but must respect the different legal bases.

Are the supervisory priorities legally binding?

No, they create no new obligations. The obligations come from laws, ordinances, circulars and interpretation guidance. The priorities do show where supervisors will inspect and which weaknesses they expect. Firms that cover these topics in advance reduce the risk of findings, measures and additional audits.

How quickly can capacity for a special audit be built?

At Alpinum Solutions, selected profiles are usually available within 48 hours; the start date is agreed between the client and Alpinum. In the KYC taskforce case study, the team started around two weeks after the assignment. It makes sense to define roles and scope as soon as an audit is announced.

Next step

If a special audit, an on-site inspection or a remediation is coming up, discuss roles and scope early. We will show you suitable profiles for Germany and Switzerland.

• Regulatory compliance and regulatory change: specialists for regulatory implementation
• FINMA circulars at a glance
• DORA: workstreams for legal and compliance
• Regulatory radar: all articles on regulatory change
• Discuss your needs

Last updated: 11 November 2026.