Operational resilience in Switzerland: implementing FINMA Circular 2023/1

Short answer: FINMA Circular 2023/1 "Operational risks and resilience – banks" has applied since 1 January 2024 to banks, persons under Art. 1b of the Swiss Banking Act (BankG), securities firms and financial groups and conglomerates, replacing Circular 2008/21. It requires a framework for operational risk covering ICT, cyber, critical data and business continuity, and it requires institutions to ensure operational resilience: identify critical functions, set tolerances for disruption, have both approved by the board at least once a year, and test them regularly. The last transitional periods expired on 1 January 2026.

This guide is written for chief risk officers, heads of compliance, legal counsel and operational risk managers at Swiss banks and securities firms. It sets out what FINMA Circular 2023/1 requires, which deadlines applied, which workstreams follow from it, and which roles an institution needs when its own team is stretched.

What does FINMA Circular 2023/1 cover?

FINMA Circular 2023/1 sets out FINMA's supervisory practice on segregation of duties, risk management and internal control under Art. 12 and 14e of the Banking Ordinance (BankV) and Art. 12 and 68 of the Financial Institutions Ordinance (FINIV). FINMA issued it on 7 December 2022. It reflects the Basel Committee's March 2021 principles on operational risk and operational resilience. The German text is published by FINMA as FINMA Circular 2023/1 (PDF). It has three parts:

• Managing operational risk (margin nos. 22–100): an overarching framework with an annually approved risk tolerance, ICT risk (47–60), cyber risk (61–70), critical data (71–82), business continuity management (83–96) and risks from cross-border business (97–100).
• Ensuring operational resilience (margin nos. 101–111): critical functions, tolerances for disruption, inventory, testing, coordination and reporting.
• Systemically important banks (margin no. 112): continuity of critical services in resolution and recovery.

Three concepts carry the circular

• Critical functions: activities, processes and services, including the resources needed to deliver them, whose disruption would endanger the institution's continued operation or its role in the financial market, plus systemically important functions under Art. 8 BankG.
• Tolerance for disruption: the extent of disruption, such as duration or expected loss, that the institution is willing to accept under severe but plausible scenarios. It must be set for each critical function.
• Operational resilience: the ability to restore critical functions within their tolerance for disruption.

Proportionality

The circular applies to all addressees, but implementation depends on size, complexity, structure and risk profile. Banks and securities firms in FINMA supervisory categories 4 and 5 are exempt from a list of margin numbers, including the annual approval (103), coordination (104) and testing (110). Institutions in the small banks regime under Art. 47a–47e of the Capital Adequacy Ordinance (ERV), persons under Art. 1b BankG and non-account-keeping securities firms are additionally exempt from, among others, margin nos. 105–109. FINMA may grant relief or tighten requirements case by case.

Deadlines and transition: what has applied since 1 January 2026

Since 1 January 2026, FINMA Circular 2023/1 must be implemented in full. The transitional provision (margin no. 113) phased in the resilience requirements in three steps:

What FINMA has found in practice

FINMA Guidance 05/2025 of 10 November 2025 analyses a survey of 267 banks, securities firms, financial groups and financial market infrastructures as at 31 December 2024. The key findings:

• Half of the institutions defined no more than 3 critical functions; the range was 1 to 36. Around two thirds of some 300 free-text entries were not critical functions at all but processes or resources, such as IT operations or back office.
• 71% of the critical functions named depend directly or indirectly on third parties.
• The middle half of tolerances for disruption lay between 24 and 72 hours. Tolerances above 240 hours (10 days) should be reviewed by the board. Tolerances derived from existing recovery capability ("reverse engineering") do not meet the requirements.
• 85% of institutions in supervisory categories 1 to 3 had not yet run any tests at the reference date.
• Only 12–15% of category 1 to 3 institutions had coordinated operational risk, BCM, third-party management and recovery planning.

Since 1 January 2026, all institutions, whatever their supervisory category, must take measures to ensure operational resilience under severe but plausible scenarios. FINMA has announced that it will step up institution-specific supervision and expand scenario analysis.

Which workstreams follow from the circular?

FINMA Circular 2023/1 translates into ten workstreams, from identifying critical functions to reporting to the board. The table maps each requirement to a workstream and a typical role.

The inventory and third-party work usually take the most effort. FINMA's Risk Monitor 2025 notes that almost half of reported cyber incidents involved third parties and calls for more robust controls over critical outsourcing. For outsourcing itself, the circular refers to FINMA Circular 2018/3 "Outsourcing", which is in force according to FINMA's list of current circulars. Groups with EU entities should align this work with the DORA legal and compliance workstreams.

Which roles and how much capacity does implementation need?

Responsibility for operational resilience sits with the board, which approves critical functions and tolerances; the work is shared between the first line, risk control, compliance, legal and IT.

• Board and executive management: approve, oversee and decide on risk tolerance.
• First line (business, operations, IT): knows processes and dependencies, delivers business impact analyses and takes part in tests.
• Risk control and operational risk: methodology, inventory, indicators, reporting.
• Compliance and legal: outsourcing contracts, reporting duties, governance documents, cross-border business.
• Internal audit: independent assessment of the framework and the tests.

When temporary support makes sense

• Tests or the inventory must be caught up quickly after findings by the audit firm or FINMA.
• Many outsourcing and service contracts need reviewing for RTO/RPO, audit and exit rights.
• A role in operational risk, BCM or compliance is vacant.
• Parallel projects tie up the team, for example further work on the internal control system.

Alpinum Solutions provides risk, compliance and legal professionals to banks and securities firms in Switzerland through staff leasing (Personalverleih) or freelancing, part time or full time, as individuals or teams. In staff leasing, the professional is integrated into the organisation and the institution gives the professional instructions; in freelancing, the professional works independently within the agreed mandate. Typical assignments in financial services are described in interim legal and compliance for banks and financial institutions.

Example (assumption)

A category 3 bank has approved its critical functions but has not yet run any tests. Around 40 service contracts have not been reviewed for RTO/RPO and exit terms. A temporary team of one experienced operational resilience professional (full time, six months) and one legal counsel for outsourcing contracts (50%, four months) plans the tests, completes the inventory and prepares contract amendments. The bank steers the work through its risk control function. All figures are assumptions for illustration.

Limits and risks

• Responsibility stays with the institution: board approvals cannot be delegated. Temporary professionals prepare and implement.
• No legal advice: Alpinum is not a law firm. Questions of supervisory interpretation are for the institution to resolve with its audit firm, external counsel or FINMA.
• Access to critical data: the circular requires internal and external people with access to critical data to be selected carefully, monitored and trained. This applies to temporary professionals too; see confidentiality and access for interim staff.
• Outsourcing boundary: outsourcing under FINMA Circular 2018/3 requires a provider to perform a significant function independently and on a permanent basis. A professional on staff leasing works integrated into the institution and under its instructions (Art. 26 AVV), so this is generally not outsourcing. For a freelance mandate or a work package handed to a provider, the classification should be clarified up front.
• Retain knowledge: the inventory, test reports and the reasoning behind tolerances belong in the institution's records, not in personal files.

Frequently asked questions about FINMA Circular 2023/1

Does the circular apply to all banks?

Yes. FINMA Circular 2023/1 applies to all banks under Art. 1a BankG, persons under Art. 1b BankG, securities firms and financial groups and conglomerates. Its scope is proportionate: institutions in supervisory categories 4 and 5 are exempt from certain margin numbers, such as testing under margin no. 110. Since 1 January 2026, however, every institution must take measures to ensure operational resilience.

What are critical functions?

Critical functions are activities, processes and services whose disruption would endanger the institution's continued operation or its role in the financial market (margin no. 14). In FINMA's survey, payments were the most frequently named critical function (73%). According to FINMA, IT operations, the core banking system or regulatory reporting are not critical functions but resources or processes.

How often must the board approve?

The board approves critical functions and their tolerances for disruption at least once a year (margin no. 103). It also approves the risk tolerance for operational risk at least annually. The board and executive management receive a report on operational resilience at least once a year, and additionally after material control weaknesses or incidents (margin no. 105).

Does the circular apply to insurers?

No. The addressees of FINMA Circular 2023/1 are banks, persons under Art. 1b BankG, securities firms and financial groups and conglomerates. In Guidance 05/2025, FINMA states that it is following international developments and examining whether extending the resilience requirements to other supervised institutions would be appropriate. Insurers should keep this under review.

How does the circular relate to DORA?

DORA has applied directly to financial entities in the EU since 17 January 2025 (Art. 64 DORA); FINMA Circular 2023/1 applies to Swiss institutions. The two overlap on ICT risk, third-party providers, incident reporting and testing. Groups with entities in Switzerland and the EU should therefore plan inventories, contracts and tests together.

Next step

If tests, the inventory or contract reviews under FINMA Circular 2023/1 exceed your team's capacity, Alpinum provides risk, compliance and legal professionals. Selected profiles are usually available within 48 hours; the start date of the assignment is agreed between the client and Alpinum.

• Risk management, internal controls and governance
• DORA: legal and compliance workstreams
• Building and testing an internal control system
• Discuss your requirements

Last updated: 30 October 2026.