--- title: "Choosing a Development Partner for FINMA-Compliant Banking AI - S-PRO" url: https://s-pro.io/blog/finma-compliant-ai-solutions-banking lang: en description: "FINMA has no AI-specific law. Learn how Guidance 08/2024 applies and what to ask a development partner across its seven supervision areas before you sign." updated: 2026-10-25T01:51:23+00:00 source: S-PRO (https://s-pro.io) --- [Back to insights](https://s-pro.io/blog) Article # Choosing a Development Partner for FINMA‑Compliant Banking AI Author [Igor Izraylevych](https://s-pro.io/author/sproadmin) CEO and Co-founder of S-PRO Published October 25, 2026 Time to read 13 min Table of content - TL;DR - Table of Contents - What does FINMA expect when a bank uses AI? - What does FINMA Guidance 08/2024 expect, area by area? - What should a partner show you per area? - How do you keep humans in control of AI agents? - What does a bank need to move from pilot to production? - How does the EU AI Act affect a Swiss bank’s AI plans? - Our perspective - How S-PRO supports AI in banking - FAQ - How S-PRO helps - Sources Share FINMA has no AI-specific law. [Guidance 08/2024 (18 December 2024)](https://www.mll-news.com/finma-guidance-08-2024-governance-and-risk-management-when-using-artificial-intelligence/?lang=en) applies existing, technology-neutral governance and risk rules to AI, so you should judge a development partner against the seven supervision areas the guidance covers: governance, inventory and risk classification, data quality, tests and monitoring, documentation, explainability, and independent review. This article turns those areas into questions you can put to a vendor before you sign. Last updated: 25 October 2026 S-PRO Bring Banking AI Into Production S-PRO builds AI agents for financial services and supports production deployment with FINMA requirements in view. [Explore S-PRO’s banking AI](https://s-pro.io) ## TL;DR - FINMA supervises AI under its “same business, same risks, same rules” approach. There is no separate AI rulebook for Swiss banks to certify against. - FINMA does not approve or certify vendors. Your bank stays accountable, so the partner has to help you evidence each control yourself. - Ask each partner the same seven questions, one per supervision area, and compare the answers on specifics: artifacts, owners, thresholds, logs. - Check data hosting, outsourcing terms and audit rights early. They decide whether a pilot can ever reach production. - If an AI system touches the EU, name the EU AI Act in your plan and check Annex III against the use case. ## Table of Contents - Our perspective - How S-PRO supports AI in banking - FAQ - How S-PRO helps - Sources ## What does FINMA expect when a bank uses AI? FINMA’s stated approach is [“same business, same risks, same rules”](https://report.finma.ch/2025/en/finmas-core-tasks/finmas-digital-strategy-data-driven-supervision-and-digitalisation-in-the-financial-sector): supervision is transparent and technology-neutral, and new technologies must be used in line with the existing regulatory framework. In practice, an AI agent that supports KYC onboarding is held to the same standards of governance, risk management and internal control as any other process that does the same work. Guidance 08/2024 makes that concrete. According to [a law firm summary of the guidance](https://www.mll-news.com/finma-guidance-08-2024-governance-and-risk-management-when-using-artificial-intelligence/?lang=en), supervised institutions are expected to build AI risk awareness into their compliance, risk management and internal control system. That means identifying, weighting, assessing and managing the specific risks of each AI application, with central management and accountability, independent review by skilled people, and clear handling of third-party contracts and liability. Two consequences matter when you pick a partner: 1. **Accountability does not transfer.** You can outsource development. You cannot outsource responsibility for the outcome. 2. **“FINMA-compliant” describes your bank’s use of a solution, not a product feature.** Be wary of any vendor that claims FINMA approval or certification. FINMA does not give either to vendors. ## What does FINMA Guidance 08/2024 expect, area by area? The guidance reflects what FINMA assessed in its supervisory work on AI. The table below sets out the seven areas, what FINMA looked at, and a question that separates a partner who has thought it through from one who has a slide deck. | Area | What FINMA assessed | Question to ask a partner | | --- | --- | --- | | Governance | Who is accountable for AI, central management of AI applications, clear roles across business, risk and IT | Who on your side and ours owns each model and agent after go-live, and how is that written into the contract? | | Inventory and risk classification | A complete inventory of AI applications, including those from third parties, with risk classification | What metadata do you deliver for our AI inventory, and how do you support the risk classification of each agent? | | Data quality | Suitability, correctness and completeness of the data used, and who controls it | Which data sources does the solution use, where is the data processed, and how do you test for gaps and bias? | | Tests and monitoring | Pre-deployment testing, plus ongoing monitoring of performance and drift | What is tested before release, what is monitored in production, and what triggers a rollback? | | Documentation | Purpose, design, data, limitations and decisions are recorded in a form others can review | Which documents do you hand over, and are they usable by our internal audit and second line? | | Explainability | Whether results can be understood, reproduced and challenged | How can a relationship manager or compliance officer see why the agent produced a given output? | | Independent review | Review by skilled people who are independent of development | What do you provide so our independent reviewers or external auditors can test the solution without you in the room? | Treat the right-hand column as a starting point. A good answer names an artifact (an inventory entry, a test report, a log schema) and an owner. A weak answer promises “full compliance”. ## What should a partner show you per area? ### Governance and accountability The Swiss Bankers Association’s [guidance on generative AI in banking](https://www.swissbanking.ch/_Resources/Persistent/2/0/3/b/203b937e175f25819ea271c883a095fe1dfa1ee0/SBA_Generative-AI-in-Banking_EN.pdf) points to clear senior leadership accountability and a centrally managed AI inventory with risk classification. A partner should be comfortable with that structure. Ask for a responsibility matrix covering design, release approval, operation and incident handling, and check that it names roles on both sides. ### Inventory and risk classification An agent that summarizes adverse media for an analyst carries different risks from one that drafts client communication. Your inventory has to record that difference. A partner should supply the information you need to classify each component: purpose, inputs, model used, whether a human reviews the output, and what happens if it fails. For systems with EU exposure, the classification question is also legal. The EU AI Act sets different obligations by risk level, and you should check Annex III against the use case rather than assume a category. Your legal and compliance teams make that call. The partner should make it easy by documenting what the system does. ### Data quality and Swiss data hosting AI in banking is only as reliable as the data it reads. Ask where each data set comes from, who may access it, and where processing takes place. The Swiss data protection authority [explains](https://www.edoeb.admin.ch/en/outsourcing-of-data-processing) that when personal-data processing is outsourced, the institution remains responsible, must ensure the processor follows its instructions and protects confidentiality and security, and must check that any cross-border disclosure has an appropriate level of protection. Put these points into your vendor questions: - Where are models hosted and where are prompts, outputs and logs stored? - Does any client data leave Switzerland, even for inference or support? - Who at the partner can access production data, and how is that access logged? - What happens to your data when the engagement ends? Banks with cloud concentration concerns should also note that the SBA guidance cites FINMA’s observation that [roughly one in five Swiss banks](https://www.swissbanking.ch/_Resources/Persistent/2/0/3/b/203b937e175f25819ea271c883a095fe1dfa1ee0/SBA_Generative-AI-in-Banking_EN.pdf) used public cloud for significant functions as of 2024, which raises concentration and operational resilience questions. A partner should be able to deploy in the environment you choose, not only in its own. ### Tests and monitoring A pilot that works on a demo data set proves little. The SBA guidance advises [MLOps for ongoing monitoring](https://www.swissbanking.ch/_Resources/Persistent/2/0/3/b/203b937e175f25819ea271c883a095fe1dfa1ee0/SBA_Generative-AI-in-Banking_EN.pdf) to track performance, identify model drift and keep the system aligned with business and regulatory goals. Ask for a test plan that covers accuracy on your own documents, behavior on edge cases, security testing and failure modes. Then ask what dashboard or alerting your operations team gets after launch. ### Documentation and audit trails Documentation is the area where a good partner saves you the most time. The SBA guidance describes formalized documentation of purpose and data quality as a production requirement. You also want an audit trail for each agent action: what input it received, what it produced, which version of the model and prompt was used, and which human accepted, edited or rejected the result. ### Explainability In a bank, an output nobody can explain is an output nobody can defend to a client, an auditor or a regulator. Explainability for agents is usually practical rather than mathematical: show the source passages the agent used, show the rules it applied, and show the confidence or flags that made it escalate. Ask to see this in the interface your staff will use. ### Independent review Your second line, internal audit and external auditors need to be able to test the solution on their own terms. The contract should therefore give your bank, its auditors and FINMA the access they need, and should support an orderly exit, including usable return of data and knowledge transfer. Outsourcing rules such as FINMA’s outsourcing circular apply when a function is delegated, so involve your outsourcing and legal teams before the vendor shortlist is final. ## How do you keep humans in control of AI agents? Copilots and agents are well suited to document extraction, summarizing unstructured sources for adverse media review, and triaging alerts in KYC and AML. The SBA guidance says they should [support human judgment rather than replace it](https://www.swissbanking.ch/_Resources/Persistent/2/0/3/b/203b937e175f25819ea271c883a095fe1dfa1ee0/SBA_Generative-AI-in-Banking_EN.pdf), with mechanisms for human override and mandatory human validation for decisions with legal consequences. When you review a design, look for three things: - **Defined thresholds.** The system states when it must hand a case to a person, for example low confidence, a sanctions hit or a missing document. - **Real authority to override.** The reviewer can change or reject the output, and the change is logged. - **No silent automation.** Anything with legal consequences for a client needs a named human decision. This is also where AI for compliance fits best: AML, KYC and RegTech use cases in which the agent prepares the evidence and your analyst decides. It works alongside your existing AML systems rather than replacing them. ## What does a bank need to move from pilot to production? Most pilots stall not on model quality but on missing controls. The SBA guidance describes a validated pilot or MVP, a comprehensive risk assessment and defined thresholds for human intervention as entry conditions. After launch it expects robust MLOps, formalized documentation and effectiveness testing of security controls. A workable production checklist looks like this: 1. The pilot has measured results on your own data, signed off by the business owner. 2. The agent appears in your AI inventory with a risk classification. 3. Data flows, hosting location and access rights are reviewed by security and data protection. 4. Human intervention thresholds are defined, built and tested. 5. Logging produces an audit trail that internal audit has tested. 6. Monitoring and drift alerts are live, with a named owner. 7. Exit terms and documentation are agreed before go-live. If the vendor cannot say who does each step, you have found the gap before it became an incident. ## How does the EU AI Act affect a Swiss bank’s AI plans? Switzerland has no AI Act of its own, but Swiss banks that serve EU clients or place AI outputs in the EU should plan for the EU AI Act. Regulation (EU) 2026/1744 (the AI Omnibus) has been in force since 27 July 2026. Under it, stand-alone high-risk obligations (Annex III) apply from 2 December 2027, and high-risk AI embedded in products (Annex I) applies from 2 August 2028. The general application date of the Act is 2 August 2026, with exceptions. The [European Commission’s AI Act page](https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai-act) is the place to confirm the current timeline. Whether a given agent is high-risk depends on its use, so check Annex III against the use case with your legal team. Ask your partner to document intended purpose, data, oversight and logging in a form that serves FINMA expectations and the EU AI Act at once. The same documentation does double duty. ## Our perspective Banks often ask us whether a partner is “FINMA-compliant”. We think the better question is whether the partner makes your bank able to prove its own compliance. That means audit trails by default, human-in-the-loop controls designed into the workflow, and documentation written for the EU AI Act, FINMA, DORA and GDPR/nFADP requirements from the first sprint, not added before the audit. We also believe the choice of partner should follow the work, not the technology. A bank that needs an onboarding agent integrated with its existing KYC stack needs engineering depth in banking systems as much as AI skill. Production is where weak partners show: integration, monitoring, access control and exit terms. Use the seven questions above, ask for artifacts rather than assurances, and walk through a real workflow with each shortlisted team. > *— Igor Izraylevych* ## How S-PRO supports AI in banking If you are moving from pilot to production, our [AI pilot to production and AI for AML, KYC and compliance services](https://s-pro.io/technology-consulting-services) cover the build and the controls around it: testing, monitoring, audit trails and documentation. You can read how we approach AI agent development and how we handle security and compliance for financial institutions. ## FAQ ### Does FINMA certify AI solutions or vendors? No. FINMA supervises institutions, not vendors, and it does not approve or certify AI products. Your bank remains accountable for how it uses AI, so a partner’s job is to help you evidence the controls. ### Is there a Swiss law on AI for banks? Not a dedicated one. FINMA applies its [technology-neutral supervision](https://report.finma.ch/2025/en/finmas-core-tasks/finmas-digital-strategy-data-driven-supervision-and-digitalisation-in-the-financial-sector) to AI, and Guidance 08/2024 sets out how governance and risk management expectations apply. Data protection rules under the FADP still apply to any personal data the AI processes. ### Can a bank use cloud-hosted or foreign-hosted AI? It can, if it meets outsourcing, confidentiality and data protection requirements. The [Swiss data protection authority](https://www.edoeb.admin.ch/en/outsourcing-of-data-processing) says the institution stays responsible and must check that cross-border disclosures have an appropriate level of protection. Many banks therefore ask for Swiss hosting for client data. ### How do you keep a human in the loop for KYC and AML agents? Define thresholds for escalation, give reviewers authority to override, and log every decision. Decisions with legal consequences should always have a named human validator, as the [SBA guidance](https://www.swissbanking.ch/_Resources/Persistent/2/0/3/b/203b937e175f25819ea271c883a095fe1dfa1ee0/SBA_Generative-AI-in-Banking_EN.pdf) recommends. ## How S-PRO helps S-PRO is a Zurich-based software development company for banks, private banks, wealth managers, asset managers and fintechs, headquartered at Löwenstrasse 45, 8001 Zürich, with R&D centers in Zurich and Łódź. We were founded in 2014, have 250+ engineers and are ISO 27001 and ISO 27701 certified. S-PRO is a Certified partner in the Claude Partner Network, and our team includes Claude-certified engineers and architects. You can learn more about [AI agents for banks and financial services](https://s-pro.io/) and talk to us about your use case. ## Sources - [FINMA Annual Report 2025: digital strategy and data-driven supervision](https://report.finma.ch/2025/en/finmas-core-tasks/finmas-digital-strategy-data-driven-supervision-and-digitalisation-in-the-financial-sector) - [FINMA Guidance 08/2024 summary](https://www.mll-news.com/finma-guidance-08-2024-governance-and-risk-management-when-using-artificial-intelligence/?lang=en) - [Swiss Bankers Association: Generative AI in Banking](https://www.swissbanking.ch/_Resources/Persistent/2/0/3/b/203b937e175f25819ea271c883a095fe1dfa1ee0/SBA_Generative-AI-in-Banking_EN.pdf) - [FDPIC: Outsourcing of data processing](https://www.edoeb.admin.ch/en/outsourcing-of-data-processing) - [European Commission: AI Act](https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai-act) Subscribe Get technical insights, and industry news Thank you! Get ready! You will receive handpicked content right to your inbox. --- Link copied to clipboard [Get in touch](https://s-pro.io/get-in-touch)