What must a Swiss private bank check before an AI assistant supports its relationship managers? FinSA and FINMA Guidance 08/2024 as controls

FINMA expects governance and controls that are aligned to how a bank uses AI, and the FinSA duties in Art. 8, 9, 12, 15 and 16 stay with the financial services provider, not with the tool (our reading). In practice, that means you map each relationship manager (RM) task to a duty, a control and an artefact you can show an auditor before the first pilot starts.

Last updated: 30 October 2026

The table below is the starting point. It covers four RM tasks. Client-facing messages are outside its scope: an assistant that writes directly to clients needs a separate assessment.

The FinSA text on Fedlex is binding in its German version, so check each article there: the Finanzdienstleistungsgesetz (FIDLEG), SR 950.1 is the reference. Translations help in internal discussions but should not be the basis of a control design.

Key Takeaways

• Treat the assistant as a tool inside the RM’s workflow. The duties under FinSA remain with the bank, so each task needs a named duty, a control and a stored artefact.
• Draft call reports and draft recommendations are where documentation and suitability duties meet the tool most directly. Review, edit history and visible reasoning matter most there.
• A go/no-go decision with a tested fallback is part of the control framework, not an afterthought.
• When comparing options, ask how each one supports your controls: audit trail, Swiss data hosting, CRM integration and human review. Feature lists are secondary.
• Check Annex III of the EU AI Act against the use case before you assume any classification.

Table of Contents

• What an AI assistant does for a private-banking RM
• What FINMA expects, and how to turn it into controls
• Four options, compared on the criteria that matter
• Draft call reports and recommendations: where controls bite hardest
• The EU AI Act, if you also serve EU clients
• Who can build it
• From pilot to a go/no-go decision
• How to assess whether an assistant suits your bank
• Where S-PRO fits
• How S-PRO helps banks and financial institutions
• FAQ
• Sources

What an AI assistant does for a private-banking RM

An assistant for relationship managers supports the work around the client conversation rather than the conversation itself. Deloitte’s analysis of agentic AI in wealth management describes such systems as able to monitor portfolios, generate reports and draft personalized client communications for RMs. In a Swiss private bank, the practical tasks cluster into three groups.

• Preparation: pulling together the client file, recent portfolio movements, open actions and relevant research into a briefing the RM can read in a few minutes.
• Documentation: turning meeting notes or a call transcript into a structured call report, with follow-up tasks proposed.
• Advice support: proposing the elements of a recommendation, such as product fit against the client profile, for the RM to accept, change or reject.

Onboarding and reporting are adjacent. KYC document collection and periodic reviews can be supported by agents, but they carry their own duties and controls, so we treat them separately from RM advisory work.

The same Deloitte piece makes the point that matters most for controls: RMs remain responsible for client advice, and the safeguards are targeted human controls, data security, explainability and auditability. That is a useful design principle, and it lines up with what FINMA expects.

What FINMA expects, and how to turn it into controls

FINMA Guidance 08/2024 on governance and risk management when using AI sets out expectations for supervised institutions. It does not create a separate AI licence. It expects that existing governance, risk management and internal control reflect how AI is actually used. For a private bank, we find it helpful to read the guidance as a list of questions the board and the control functions should be able to answer:

1. Who owns the use case? One named person is accountable for the assistant’s use in RM work, and the inventory of AI applications lists it.
2. What can go wrong? The risk assessment covers data quality, model errors, misleading wording in drafts, dependency on a third-party model provider and data leaving the bank’s control.
3. How is it tested? Test cases use realistic client files and check accuracy, completeness and behavior at the edges, before and after each model or prompt change.
4. How is it explained? An RM or a reviewer can see which sources and which inputs led to a draft.
5. What is documented? The bank retains what it needs to reconstruct a call report or a recommendation later.
6. What happens when it fails? A fallback exists, and it has been rehearsed.

The section references in the table (s. 2.2, 2.5, 2.6, 2.7) show where each control belongs in the guidance. Use the current text published by FINMA when you build your own control matrix, and have compliance confirm the mapping.

Four options, compared on the criteria that matter

Most private banks choose among four types of option. We describe them by type, because the right comparison is against your controls, not against a brand.

No option removes the bank’s duties. What changes is how much of the control work you receive ready-made and how much you design yourself. For a bank with a mixed system landscape and a strict control framework, we recommend the custom route: it lets you start from the table at the top of this article and build the artefacts into the workflow, rather than fitting your controls around someone else’s product.

When you request proposals, ask every provider the same ten questions:

1. Where are prompts, outputs and logs stored and processed?
2. Which subprocessors and model providers are involved?
3. Is client data used to train any model?
4. How does the system show the source of each statement?
5. Which RM actions are logged, and for how long can the bank retain them?
6. How are model or prompt changes tested and released?
7. Can RMs edit every draft before it enters the client file?
8. How does the system fail, and how can the bank switch it off?
9. Which systems does it integrate with today, and which would be new work?
10. What do pilot and production support look like, and who runs it?

Pricing for these options is mostly quoted per project or per seat and is rarely published, so ask for a written scope and a full cost view that includes integration, hosting and operations. Compare the three-year total, not the pilot fee.

Draft call reports and recommendations: where controls bite hardest

Call reports

A call report is evidence of what was discussed and what was advised. The risk with a generated draft is that it reads smoothly but records something that was not said. Three controls address this:

• The RM reviews the draft against their own notes before it is filed.
• The system stores the draft, the final text and the differences, so a reviewer can see what the RM changed.
• Statements about the client’s wishes or risk appetite are linked back to a source: a transcript segment or a client file entry.

These map to FinSA Art. 15 and to s. 2.5 of the guidance, in our reading.

Recommendations

A draft recommendation touches suitability. We recommend that the assistant never infers client profile data from a conversation and writes it into the record on its own. Suitability inputs come from the client file, the RM confirms any change, and the draft shows how it connects the client’s profile, objectives and the proposed product. The RM decides. The approval is recorded. This reflects Art. 8(2)(a) and Art. 12, and s. 2.6 on explainability, in our reading.

Messages to clients

We leave client-facing messages outside the scope of this article. Once text reaches a client without the RM reading it, the risk profile changes, and the bank should assess it as its own use case.

The EU AI Act, if you also serve EU clients

A Swiss private bank with EU clients or EU group entities should know the timeline. Regulation (EU) 2026/1744 (the AI Omnibus), in force since 27 July 2026, adjusts the dates: stand-alone high-risk (Annex III) obligations apply from 2 December 2027, and high-risk AI embedded in products (Annex I) applies from 2 August 2028. The general application date of 2 August 2026 is not the date for high-risk obligations. The European Commission’s AI Act page is the place to confirm the current schedule.

Whether an RM assistant falls under Annex III depends on what it does. We do not classify use cases in the abstract: check Annex III against the use case, with legal counsel, and record the result in your use case inventory.

Our perspective

We build AI agents for banks, and the most common mistake we see is starting with the model rather than the control. A team picks a capable assistant, runs a good demo and only then asks compliance what it needs. By then the architecture is fixed.

We work the other way round. Start with the RM task. Name the duty. Define the control. Decide which artefact the system must produce. Then build the assistant so that the artefact is a by-product of normal work: the source citation appears with the statement, the edit history is stored as the RM edits, the approval is one click that is logged.

This is why we think a Swiss private bank is better served by an assistant designed around its own control matrix than by one that adds logging at the end. Our solutions are designed with FINMA, DORA and EU AI Act requirements in mind, and we build them on our own agentic platform, S-PRO Agents.

Human review is not a brake on the benefits. An RM who trusts the briefing and can correct the draft in seconds will use it. One who must double-check everything will not.

The S-PRO team

Who can build it

For banks that want an RM assistant designed around their own systems and controls, S-PRO’s work on an AI copilot for relationship managers in Swiss private banking shows how this is approached.

From pilot to a go/no-go decision

A pilot should be set up so that its result is a decision. Before it starts, agree:

• Scope: one or two RM tasks, such as meeting preparation and call report drafts, for a small group of RMs.
• Success criteria: accuracy of the briefing and the draft against the RM’s own judgment, share of drafts accepted with minor edits, and time the RM needs to review.
• Stop criteria: conditions under which the pilot pauses, for example a draft that misstates a client instruction or a data access error.
• Fallback: the manual process, confirmed to work without the assistant.
• Owner and approver: the named person who signs the go/no-go, supported by compliance and IT security.

This maps to s. 2.2 and 2.7 of the guidance. The go/no-go record and the test report belong in the artefact set from the table. Repeat the decision when the model, the data sources or the scope change.

How to assess whether an assistant suits your bank

Use four checks before you sign anything.

1. Clients: Which client segments and booking centers does it serve? Cross-border clients can bring rules beyond Swiss law, so ask your legal team which ones apply.
2. Workflows: Which RM tasks will it support in the first release, and which stay manual? Match each to a row of the control table.
3. Technology: Which systems must it read from, and does it write back to any? Read-only access is simpler to control.
4. Operations: Who runs it after go-live, who monitors quality, and who answers when an RM reports a wrong draft? Under DORA, which applies to EU financial entities, ICT third-party arrangements also need clear ownership, so check whether your group falls within its scope.

Where S-PRO fits

If you are ready to turn the control table into a working assistant, our page on RM & wealth copilots outlines what we build for wealth management teams. We bring the RM tasks, duties, controls and artefacts into one design, so compliance, IT and the front office review the same thing.

We usually start with a short scoping session on one or two RM tasks, your systems and your control framework, and agree what a pilot must prove.

How S-PRO helps banks and financial institutions

S-PRO is a Swiss international firm headquartered in Zurich, founded in 2014, with 250+ engineers. We are ISO 27001 and ISO 27701 certified. S-PRO is a Certified partner in the Claude Partner Network, and our team includes Claude-certified engineers and architects.

For private banks, we offer RM & wealth copilots, KYC onboarding agents, AI agents for banks and AI pilot to production. We build your solution on our own agentic platform, S-PRO Agents, and run it as a service. We design for EU AI Act, FINMA and DORA requirements, and we help you map each RM task to the duty, control and artefact that your compliance team will want to see.

FAQ

Does FINMA require an approval before a bank uses an AI assistant?

We are not aware of a separate approval step for this in Guidance 08/2024. FINMA expects governance and controls that fit how the institution uses AI. Confirm with your compliance function and, where in doubt, with FINMA directly.

Who is responsible for the content of a call report drafted by an assistant?

The bank and the RM who files it. Under our reading of FinSA Art. 15, documentation duties stay with the financial services provider. The RM should review, edit and sign off every draft, and the system should keep the edit history.

Can an assistant write messages to clients?

This article does not cover it. Client-facing messages are outside its scope and need their own assessment of risks, review steps and records before any release.

Is the German version of the FinSA the one that counts?

Yes. The German text on Fedlex is the binding version, so base control design on it and use translations only as an aid.

Sources

• Finanzdienstleistungsgesetz (FIDLEG), SR 950.1, Fedlex
• Deloitte: Agentic AI in wealth management, the augmented relationship manager
• European Commission: AI Act regulatory framework