FINMA has published guidance and survey results on AI, but we did not find an AI circular. Responsibility for how AI is used stays with the institution.
That answer shapes every project a Swiss bank starts. There is no stamp to obtain and no list of approved tools to pick from. There is a supervisory reference point, a set of existing rules that apply to AI as they apply to any other technology, and a number of decisions that your board, your management and your control functions have to take and document. This article separates the three, so a CIO, COO or Head of Compliance can see where FINMA’s text ends and the bank’s own judgment begins.
Key Takeaways
- FINMA’s AI document is Guidance 08/2024, published in December 2024. We did not find an AI-specific FINMA circular.
- Swiss financial market rules are technology-neutral, so existing governance, risk and outsourcing duties cover AI.
- The guidance is less binding than a circular, but it interprets binding organizational requirements and examiners use it as a reference.
- We did not find a FINMA certification or approval scheme for AI. The bank decides what is critical, what is high risk and what controls are enough.
- A Federal Council consultation draft on AI regulation is planned by the end of 2026. Its content is not yet public.
Table of Contents
- What FINMA has published on AI
- Press releases of 18 December 2024 and 24 April 2025
- How binding is the guidance?
- Which existing rules apply
- What a bank still has to decide itself
- What comes next from Swiss policymakers
- Is there a FINMA certification for AI?
- Our perspective
- How S-PRO helps banks and financial institutions
- FAQ
- Sources
What FINMA has published on AI
FINMA has published Guidance 08/2024 on governance and risk management when using artificial intelligence, and it has communicated on AI supervision through press releases. It has not, as far as we found, issued an AI circular or an ordinance.
The guidance was released in December 2024 for supervised financial institutions. It follows an earlier signal: FINMA had already set out in 2023 that it expects institutions to manage AI risks and ensure governance, reliability and transparency. The 2024 text turns that expectation into more specific observations.
Two document types are worth keeping apart, because they carry different weight:
- Guidance sets out how FINMA reads existing requirements and what it expects to see in supervision.
- Survey results and press releases report what FINMA learned from institutions and what it recommends. They are not rules.
Guidance 08/2024: technology-neutral rules cover AI risks
The guidance starts from the position that Switzerland has no AI-specific legislation and that technology-neutral, principle-based rules already cover the risks AI creates. Law firm commentary on the guidance summarizes the same reading: existing requirements on governance and risk management apply to AI, and institutions need to address AI specifically in their processes, then identify, weigh, assess and manage the risks they face.
In practice, the guidance does not introduce a new body of law. Legal 500 (12 May 2026) describes it as operationalizing existing governance, risk management and outsourcing duties along seven dimensions: governance, inventory, data quality, testing, documentation, explainability and independent review. The organizing idea is “same business, same risks, same rules.”
The legal basis matters for how you read it. According to Pestalozzi (17 January 2025), the guidance rests on FINMA’s authority to issue interpretative guidance under Article 7 para. 1 let. b of the Financial Market Supervisory Act (FINMASA) and on the proper-organization provisions of the Banking Act and the Financial Institutions Act. It is also closely related to FINMA Circular 2023/1 on operational risks and resilience.
The risks FINMA names
The guidance concentrates on operational risks. BPS Legal (23 January 2025) points to lack of robustness, correctness, bias and explainability, plus the risks that come with third-party providers. Institutions are expected to identify, assess, monitor, manage and control them.
The same law firm commentary and others point to a recurring set of themes: central management and accountability, independent review by skilled personnel, contractual and liability management with third parties, and training. None of these is new to a bank. What changes is that AI has to be visible in each of them.
Press releases of 18 December 2024 and 24 April 2025
FINMA’s press release of 18 December 2024 accompanied the guidance, and its release of 24 April 2025 reported on its AI supervisory work. In the later one, FINMA recommends early contact for critical processes, and the bank decides what counts as critical.
That last point is easy to misread. A recommendation to get in touch early is an invitation to a supervisory dialogue, not a definition of which processes are critical, and not an approval step. The classification sits with you. If a bank treats client advice, onboarding decisions or transaction monitoring as critical, it should be able to explain why, in its own documentation, using its own risk criteria.
We do not quote survey figures here. A percentage from a supervisory survey is only meaningful with its sample and its period, and a figure lifted out of context is how a statement about a group of institutions turns into a false statement about your bank. When you cite a figure internally, take it from FINMA’s release together with the sample and the period it states.
How binding is the guidance?
The guidance is not binding in the way a circular or an ordinance is, but it interprets requirements that are binding, and supervisors use it as a reference point. Treat it as the standard you will be measured against.
Commentators describe it with care. Lyzr summarizes the view that the term “supervisory expectations” can suggest a formal character, while the document does not come from a supervisory communication or a circular and is therefore less binding, so institutions can in principle deal with the subject differently. The Romandy CTO blog (13 April 2026) adds the practical reading: non-binding in the strict legal sense, but treated as binding by firms that want to stay authorized.
Both statements hold at once. If you choose a different approach, the burden is on you to show that it meets the same underlying organizational requirements. The table below sets out who decides what.
| Topic | What has been published | What your bank still decides |
|---|---|---|
| Legal basis | Technology-neutral rules apply to AI; no AI-specific Swiss law | Which existing duties (organization, risk, outsourcing) a given AI use touches |
| Governance | Clear responsibilities and accountabilities for development, implementation, monitoring and use | Who owns each AI application, and who sits on the review body |
| Inventory | A centrally managed inventory with risk classification | What counts as an AI application, and how you grade risk |
| Critical processes | FINMA recommends early contact | Which processes are critical for your institution |
| Third parties | Attention to providers and outsourcing | Due diligence, contract terms, audit rights, exit |
| Testing and monitoring | Regular testing and constant monitoring | Metrics, thresholds, frequency, escalation |
| Certification | We did not find a FINMA certification of AI | Your own evidence file for audit and supervision |
Which existing rules apply
The existing rules that apply to AI are the proper-organization provisions of the Banking Act and the Financial Institutions Act, FINMA Circular 2023/1 on operational risks and resilience, and, where cloud or providers are involved, the outsourcing and cloud requirements.
For cloud and third-party hosting, the Swiss Banking Association Cloud Guidelines (November 2025) state that the decision to procure cloud services should rest on a structured process and a prior risk analysis. That analysis should take into account the significance of the services for the purposes of FINMA Circular 18/3 and the categorization of the data, in particular bank client data.
PwC Switzerland (3 February 2025) reports that supervised institutions sometimes found it hard to establish whether AI is built into externally purchased applications, which data and methods are used and whether due diligence is sufficient. It also notes difficulties with additional tests, controls and contract clauses on responsibility and liability in outsourcing. These are the questions to settle before any AI agent or copilot touches client data.
What a bank still has to decide itself
A bank has to decide who is accountable, what its inventory contains, how it grades risk, what it tests, how humans stay in control and what evidence it keeps. FINMA gives direction on each, not the answers.
As CDBF (2025) puts it, governance has to be considered holistically: risk management, internal and external skills, allocation of responsibilities, and the legal and contractual framework, with regular testing and constant monitoring to confirm the system works as intended. EY Switzerland (4 May 2026) makes the same point from the market side: Switzerland regulates AI through existing laws, so robust governance frameworks are the institution’s job.
A decision plan in six steps
Use these steps as an internal sequence. They are decisions for your institution, not requirements we are attributing to FINMA.
- Assign accountability. Name an owner for each AI application and for the overall AI framework. Lenz & Staehelin describe clear responsibilities for development, implementation, monitoring and use as the core of the governance framework.
- Build the inventory. Keep one central list of AI applications, including those embedded in purchased software, with a risk classification and the measures taken for each.
- Decide what is critical. Document which processes you treat as critical and why. This is the basis for any early dialogue with your supervisor.
- Define testing and monitoring. Set what you test before go-live, what you monitor in production, and who is told when a threshold is crossed.
- Set the human role. For each agent or copilot, state which actions it may prepare and which a person must approve.
- Close the third-party file. Record due diligence, contract terms, audit rights, sub-processors and exit options for every provider.
One practitioner view is useful as a working discipline rather than a rule. Lynn Raebsamen (22 May 2026) advises narrowing the use case before broadening it, building the inventory before the use case, separating the builder from the reviewer and treating the cloud contract as a regulatory artifact.
Documentation, testing and human oversight
Documentation is the part that most often decides how a review goes. Write each file as if a supervisor or an audit firm will read it without you in the room: purpose, data used, known limits, test results, approvals, changes and incidents.
For agents that act on workflows, a concrete pattern from the market is to limit each agent to one task with least-privilege access and require human approval for critical actions. QA Financial (9 September 2026) describes this approach at a Swiss bank, where the agent can propose and prepare but cannot authorize or execute. It is one design among several, and each bank sets its own boundaries.
When you apply this to specific use cases, check Annex III against the use case before you assume how it is treated under EU rules, if your business reaches EU clients. For Swiss-only activity, the starting point stays the technology-neutral Swiss framework above.
Talk to our engineers about your AI governance plan if you are turning these decisions into a pilot and need to see what a documented path looks like.
What comes next from Swiss policymakers
The Federal Council has chosen a pragmatic, risk-based approach to AI regulation, and a consultation draft is to be prepared by the end of 2026. We have no draft content to report.
Per EY (4 May 2026), that draft is expected to set out legal measures in areas such as transparency, data protection, non-discrimination and supervision. The mandate for the work sits with the Federal Department of Justice and Police (FDJP), with the State Secretariat for International Finance involved. Until the draft is published, planning around its contents would be speculation. What you can do is make sure your inventory, documentation and oversight can absorb new requirements without a rebuild.
Is there a FINMA certification for AI?
We did not find a FINMA certification or approval of AI. For that reason, we do not describe any system as certified or approved by FINMA, and you should be careful with anyone who does. For a related look at how teams frame this question, see our article on FINMA-compliant AI solutions in banking.
What a bank can show instead is a record: an inventory entry, a risk classification, test results, a named owner, a provider file and a review. That record, not a label, is what supervision looks at.
Our perspective
We read the FINMA material as a request for control, not a ban on progress. Banks that put AI into production well tend to start from the control model and then pick the use case, not the other way round.
In our work on AI agents for banks, the questions that matter most are the ones in this article: who owns the agent, what it may do alone, what a person approves, and what evidence is kept. We design with those answers in mind from the first workshop, because retrofitting an audit trail is slower than building one.
This applies to onboarding and monitoring as much as to advisory. For KYC and AML work, the same principles lead to KYC onboarding agents that prepare cases and leave the decision to your staff. For relationship managers, they lead to RM and wealth copilots that draft and summarize while the adviser remains accountable.
S-PRO is a Certified partner in the Claude Partner Network, and our team includes Claude-certified engineers and architects. That helps us on model choices, but the governance decisions stay with the bank, and we say so in every engagement.
The S-PRO team
How S-PRO helps banks and financial institutions
We help banks turn these governance decisions into working systems, with the bank keeping its decisions and its accountability. S-PRO is an international Swiss-American firm with offices in Zurich and Salt Lake City, and global delivery, founded in 2014, with 250+ engineers and ISO 27001 and ISO 27701 certification.
Our work covers AI agents for banks, AML & transaction monitoring, KYC onboarding agents, RM & wealth copilots and AI pilot to production. We build each solution on our own agentic platform, S-PRO Agents, and run it as a service. Solutions are designed with the EU AI Act, FINMA and DORA requirements in mind, and we make no promise of regulatory outcomes: your compliance function decides what meets your obligations.
If you want to map a use case against the six decisions above, see our technology consulting page, or book a discovery call with our engineers.
FAQ
Has FINMA published an AI circular?
We did not find one. FINMA has published Guidance 08/2024 on governance and risk management when using AI, along with press releases and survey results. Existing technology-neutral rules apply to AI, so a bank should check FINMA’s website for any later publication before relying on this answer.
Is FINMA Guidance 08/2024 legally binding?
Not in the way a circular is. It interprets binding organizational requirements under the Banking Act and the Financial Institutions Act, and supervisors use it as a reference. A bank can take a different approach, but it must be able to show that it still meets the underlying requirements.
Does FINMA certify or approve AI systems?
We did not find any FINMA certification or approval of AI systems. Responsibility sits with the institution, which keeps its own evidence: inventory entry, risk classification, testing, ownership, provider due diligence and review. Be wary of any claim that a tool is approved by FINMA.
What is the Swiss AI regulation timeline?
The Federal Council has opted for a risk-based approach, and a consultation draft is to be prepared by the end of 2026. We have no information on its content. Until it is published, banks are best served by building governance that works under the current technology-neutral framework.
Sources
- Lenz & Staehelin: FINMA Issues Guidance on AI Use in Financial Institutions
- MLL: FINMA Guidance 08/2024 Governance and Risk Management when using Artificial Intelligence
- Legal 500: Artificial Intelligence in FinTech, the Swiss regulatory landscape
- Pestalozzi: FINMA guidance on governance and risk management when using AI
- BPS Legal: Swiss FINMA Guidance 08/2024 on AI Governance and Risk Management
- Romandy CTO: Swiss fintech security when AI rewrites the rules
- Swiss Banking Association: Cloud Guidelines (2025)
- PwC Switzerland: AI in the financial industry
- CDBF: FINMA’s expectations in terms of governance and risk management
- EY Switzerland: Generative AI in finance
- Lynn Raebsamen: Why most private banks’ generative AI pilots will fail their first FINMA review
- QA Financial: Sygnum on testing AI
Last updated 7 November 2026
Subscribe
Thank you!
Get ready! You will receive handpicked content right to your inbox.
