{"id":55589,"date":"2025-11-26T12:36:36","date_gmt":"2025-11-26T11:36:36","guid":{"rendered":"https:\/\/swissgrc.com\/en\/?p=55589"},"modified":"2025-11-26T12:36:36","modified_gmt":"2025-11-26T11:36:36","slug":"finma-signal-alarme-resilience-conception","status":"publish","type":"post","link":"https:\/\/swissgrc.com\/fr\/finma-signal-alarme-resilience-conception\/","title":{"rendered":"La communication de surveillance 05\/2025 de la FINMA, un signal d’alarme pour la r\u00e9silience par conception"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

<\/strong><\/p>\n

FINMA is tightening its expectations regarding operational resilience. Starting in 2026, institutions must demonstrably define and implement their critical functions, disruption tolerances, and testing procedures.<\/strong><\/p>\n

With Supervisory Notice 05\/2025<\/a>, FINMA places operational resilience at the center of its supervisory practice.
From 1 January 2026, all institutions, regardless of their size or supervisory category, must have implemented concrete measures to ensure their ability to withstand disruptions.
FINMA\u2019s analysis of 267 institutions shows significant differences in maturity, with notable gaps in the definition of critical functions, disruption tolerances, and the integration of existing frameworks.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Critical functions: focus instead of fragmentation<\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

According to FINMA, the average number of identified critical functions is 3.5. While larger institutions define more, some exceed a reasonable scope with up to 36 critical functions. FINMA calls for clarity: a critical function is not every process but an activity whose failure has immediate effects on clients or the stability of the financial market.
Many institutions confuse processes (e.g., back office, IT operations) or resources (e.g., core banking system) with critical functions. What matters is a top-down perspective that considers strategic relevance and dependencies within the supply chain.<\/p>\n

Practical recommendation:<\/strong>
A robust inventory of critical functions forms the foundation for a holistic \u00abfront-to-back\u00bb perspective, as required by FINMA. This inventory should map functions, processes, resources, and interdependencies in a transparent manner.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

<\/strong><\/p>\n

Disruption tolerances: from technical limits to the board\u2019s tolerance level<\/p>\n

<\/strong><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

FINMA criticises that many institutions define their disruption tolerances \u00abbackwards\u00bb \u2013 starting from technical recovery capability (\u00abreverse engineering\u00bb) instead of from the tolerance level set by the governing body. As a result, the resilience question is viewed too operationally instead of strategically.
Most institutions define disruption tolerances between 24 and 72 hours. Values that are too low indicate a confusion with BCM metrics (RTO\/RPO), while values that are too high suggest an uncritical definition of functions.<\/p>\n

Practical recommendation:<\/strong>
A well-designed governance process supported by traceable data, visualisations, and clear decision logic helps to anchor disruption tolerances at a strategic level. Combining a clear methodology, structured documentation, and suitable tools creates transparency and strengthens executive involvement.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

<\/strong><\/p>\n

Testing: from cyber defence to end-to-end resilience<\/p>\n

<\/strong><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

According to FINMA, 85% of institutions in supervisory categories 1 to 3 have not yet carried out any testing. Frequently mentioned scenarios include \u00absuccessful cyberattack\u00bb or \u00absupply chain disruption\u00bb \u2013 yet non-cyber-related threats often remain untested.<\/p>\n

Practical recommendation:<\/strong>
Regular, scenario-based testing forms the backbone of a learning organisation. Using structured test frameworks and suitable platforms simplifies planning, execution, and evaluation, ensuring that results can be directly translated into improvement measures \u2013 a crucial step toward continuous advancement.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

<\/strong><\/p>\n

Operational resilience framework: time for integration<\/p>\n

<\/strong><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

According to FINMA, only 12\u201315% of institutions have established an integrated framework that coordinates risk management, ICT and cyber risks, BCM, emergency planning, and third-party management. As a result, most institutions still lack the organisational foundation for a consistent \u00abresilience-by-design\u00bb approach.
With regard to European developments such as DORA and the NIS2 Directive (EU) 2022\/2555<\/a>, this integration is essential. Both regulatory frameworks require tightly interconnected oversight of cyber, IT, and operational risks \u2013 marking a shift from silo thinking to risk-based end-to-end management.<\/p>\n

Practical recommendation:<\/strong>
Institutions should view their operational resilience framework as an overarching steering instrument. This includes:
\u2022 Defining suitable metrics (KPIs\/KRIs)
\u2022 Integrating risk management, BCM, ICT, and third-party oversight
\u2022 Automated monitoring of dependencies and interfaces<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

<\/strong><\/p>\n

From compliance to strategic resilience<\/p>\n

<\/strong><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Operational resilience is more than a regulatory obligation \u2013 it is a strategic success factor. <\/b>It not only protects against disruptions but also increases the capability to use crises as opportunities for learning and adaptation. With the mandatory implementation of FINMA\u2019s requirements from 2026 onward and the harmonisation with European standards, institutions gain a unique opportunity: resilience can become a true differentiator.<\/p>\n

Practical recommendation:<\/strong>
A data-driven view of risks and dependencies enables active steering of resilience. Dashboards, metrics, and analyses form the foundation for fact-based decisions \u2013 whether implemented through internal methods or supported by dedicated tools.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

<\/strong><\/p>\n

How technology can help without losing control<\/p>\n

<\/strong><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Implementing the requirements for resilience, critical functions, and tolerance definitions is complex, especially when done through Excel and manual processes. Many institutions recognise that tool-supported approaches<\/strong> create transparency, automation, and traceability. The GRC Toolbox from Swiss GRC enables institutions to systematically record critical functions and dependencies, define disruption tolerances, plan tests, and centrally evaluate results \u2013 all embedded in an overarching framework for operational resilience.
The focus is not on the tool itself but on the added value: an end-to-end perspective, consistent governance, and a sustainable contribution to a resilience-by-design culture.<\/strong><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

<\/strong><\/p>\n

Conclusion<\/p>\n

<\/strong><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Supervisory Notice 05\/2025<\/a> marks a milestone in strengthening the Swiss financial market infrastructure. For institutions, this means: consolidating structures, clarifying responsibilities, and approaching resilience from a strategic perspective.
DORA, NIS2, and international best practices make it clear: resilience is not a project \u2013 it is a guiding principle.<\/strong> Institutions that invest today in an integrated, data-driven, and governance-oriented implementation will, in the long term, not only be compliant with regulations but also commercially robust and future-proof.<\/p>\n

Swiss GRC supports institutions in implementing regulatory requirements for operational resilience \u2013 from the identification of critical functions to holistic management. Our experts combine regulatory know-how with technological implementation capabilities to build a resilience-by-design culture that delivers real impact. Book an appointment now: swissgrc.com\/discoverycall<\/a>.<\/strong><\/em><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"

La communication FINMA 05\/2025 fixe le cap strat\u00e9gique pour renforcer la r\u00e9silience op\u00e9rationnelle du secteur financier suisse. Les nouvelles exigences, applicables \u00e0 partir de 2026, red\u00e9finissent la mani\u00e8re dont les \u00e9tablissements doivent se pr\u00e9parer aux perturbations et garantir leur continuit\u00e9. Ceux qui agissent d\u00e8s maintenant r\u00e9pondront non seulement aux attentes r\u00e9glementaires, mais renforceront \u00e9galement leur stabilit\u00e9 et leur r\u00e9silience \u00e0 long terme.<\/p>\n","protected":false},"author":5,"featured_media":55598,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"_eb_attr":"","_swissgrc_real_author":"Gentian Ajeti","real_author_title":"Chief Customer & Commercial Officer (CCO)","real_author_bio":"Gentian Ajeti est Chief Customer & Commercial Officer (CCO) et membre du comit\u00e9 de direction de Swiss GRC. \u00c0 ce poste, il est responsable de la strat\u00e9gie mondiale de l'entreprise en mati\u00e8re de clients et de ventes. Gr\u00e2ce \u00e0 sa longue exp\u00e9rience dans la mise en \u0153uvre de solutions GRC, il dirige une \u00e9quipe de sp\u00e9cialistes GRC qui accompagnent les clients du conseil jusqu'\u00e0 la mise en \u0153uvre r\u00e9ussie.","real_author_photo":2960,"footnotes":"","_links_to":"","_links_to_target":""},"categories":[66],"tags":[],"class_list":["post-55589","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-regulation"],"acf":[],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t