FINMA publishes an annual risk monitor as an overview of the risks that FINMA currently classifies as particularly significant for supervised institutions and the focus of its supervisory activities. It not only identifies the main risks (which are naturally limited to the area of technology and data), but also formulates supervisory expectations. It has published the Risk Monitor 2025 today.
Outsourcing risks
The Outsourcing risks FINMA considers this to be the same as the previous year (i.e. high).
The main risk drivers are
- Increasing concentration on a small number of service providers, particularly for cloud services;
- Identification and assessment of risks along the supply chain (even if outsourcing is not considered material)
- Geopolitical uncertainties
Supervisory focusFINMA monitors outsourcing risk by means of specific on-site inspections – of supervised institutions and their service providers – and by systematically evaluating supervisory and audit data. It compiles an inventory of significant outsourcing in order to identify concentrations on a small number of service providers. The focus is on outsourcing critical functions that are central to operational resilience.
FINMA is particularly concerned about cluster risk among a small number of providers:
The increasing concentration on a small number of service providers, particularly in the area of ICT infrastructure and cloud services, continues to pose a key risk. Numerous institutions use the same providers, which can lead to systemic dependency.
Cyber risks
In contrast, there was a clear increase in Cyber risks.
The main risk drivers are
- Concentration on a few service providers
- Attacks on the supply chains
- DDoS attacks
- E‑mail traffic
- Insider threats
- Incorrect transmission of sensitive information
- Vulnerability management
- Configuration management
- Reporting system
Supervisory focusFINMA monitors cyber risk through targeted on-site inspections and additional audit procedures at banks in supervisory categories 1 and 2. For institutions in categories 3 to 5, it uses a standard audit program for the management of cyber risks and uses questionnaires to assess the maturity of the institutions’ cyber protection arrangements. For fund management companies and managers of collective assets, it has also published checkpoints on the management of cyber risks.
ICT risks
There was also an increase in ICT risks.
The main risk drivers are
- Increasing complexity due to changing requirements, rapid technical progress, large number of integrations with other systems
- Dependence on IT systems
- faulty software components
- improper maintenance or human error
- Inadequate quality of data from external sources (e.g. “non-compliant formatting”)
- Automatic updates
- Misconfiguration in authorization management
- Legacy and end-of-life systems
Supervisory focusFINMA monitors ICT risk by means of specific on-site inspections and the evaluation of supervisory and audit data.