At the Small Banks Symposium on 7 September 2026, FINMA made an important point clear: proportionality does not mean that material risks can be taken less seriously. Especially when it comes to cyber risks, outsourcing, cloud providers and artificial intelligence, responsibility remains with the supervised institution.

Smaller banks can benefit significantly from sourcing technology or services externally. They do not need to build the same internal structures as large institutions. But they still need to know and effectively manage their material risks. This is exactly where outsourcing becomes a GRC topic.

Key Takeaways

FINMA emphasises that smaller institutions can benefit from proportionate supervision. At the same time, outsourcing may reduce internal effort, but it does not reduce responsibility for risk management, controls and evidence.

Cyber risks, cloud dependencies, concentration risks and the use of AI are particularly in focus. External providers can make processes more efficient, but they also create new dependencies.

For financial institutions, this means that outsourcing must not only be regulated contractually. It needs to be managed as an ongoing governance process. This includes risk analysis, responsibilities, controls, vendor oversight, exit planning and audit-ready evidence.

Proportionality Does Not Remove Responsibility

Proportionality is important for smaller banks and financial institutions. Requirements should be implemented in a way that reflects size, complexity, business model and risk profile. This is reasonable, because smaller institutions do not have the same resources as large banks.

However, FINMA makes clear that proportionality does not mean that key risks can be ignored or weakly managed. For topics such as money laundering, sanctions, cyber risks or outsourcing, the size of the institution can only be a limited argument for reduced expectations.

The decisive point is responsibility. A financial institution can outsource an IT service, a cloud platform, an operational function or a security capability. But responsibility towards customers, supervisors and management remains internal.

Why Outsourcing Is Becoming More Critical in Finance

Outsourcing has long been part of everyday operations in financial institutions. IT operations, cloud infrastructure, payment processes, core banking systems, data analytics, cybersecurity, customer communication and compliance-related services are increasingly provided by external vendors.

This creates clear benefits. Institutions can access specialist expertise, reduce costs, gain scalability and adopt modern technologies faster. Smaller banks in particular benefit because they do not need to build complex capabilities fully in-house.

At the same time, new risks emerge. When important processes are handled by external providers, dependencies arise. When many institutions use the same cloud or technology providers, concentration risks increase. When vendors provide AI systems, data platforms or security services, oversight becomes more complex.

Outsourcing is therefore not merely a procurement or IT topic. It is a governance topic.

Cloud and Technology Providers: Efficiency Meets Concentration Risk

The increasing use of cloud and technology providers is a double-edged issue for financial institutions. On the one hand, it enables modern, secure and scalable infrastructure. On the other hand, it can create strong dependencies on a small number of large providers.

For GRC leaders, the key task is to make these dependencies visible. Which critical processes run with which provider? Which data is processed? Which subcontractors are involved? Which outage or security risks exist? How quickly could the institution react if a provider failed or suffered a serious security incident?

FINMA’s perspective is clear: smaller institutions may use pragmatic solutions. But they must know and effectively manage their material risks. This requires structured third-party risk management.

AI Changes Both Sides of the Risk

FINMA’s reference to artificial intelligence is particularly interesting. AI can support financial institutions, for example in process automation, fraud detection, customer service, risk analysis or cybersecurity. At the same time, AI can make attacks easier to automate and scale.

This changes both the opportunity side and the threat landscape. An institution may use AI functionality from an external provider without fully understanding the underlying models, data flows or security mechanisms. At the same time, attackers can use AI to make phishing, social engineering, malware or fraud attempts more professional.

For outsourcing, this means that vendor assessments will increasingly need to consider AI governance, data processing, model risks, security controls and transparency. This is especially important where AI is used in critical processes or customer-relevant decisions.

What a Good Outsourcing Framework Needs to Do

An effective outsourcing framework does not start with the contract. It starts with the question of which processes are critical and which risks arise from outsourcing them. Providers then need to be assessed, controls defined and responsibilities clarified.

Ongoing monitoring is equally important. A provider that is acceptable today may have a different risk profile tomorrow because of new subcontractors, changed services, security incidents or regulatory expectations. Outsourcing risks are dynamic.

Financial institutions should therefore not only maintain a list of vendors. They need a central view of criticality, contracts, controls, risk acceptances, findings, actions, dependencies and exit scenarios.

Conclusion: Outsourcing Needs Internal Control

FINMA makes clear that outsourcing can be useful and efficient for smaller banks. But it does not transfer responsibility to the service provider. Cyber risks, cloud dependencies, concentration risks and AI use must be understood and managed internally.

For GRC leaders, the message is clear: outsourcing requires transparency. Which providers are critical? Which risks exist? Which controls are in place? Which evidence is available? And how quickly can the institution react if a provider fails or suffers a security incident?

Zazoon supports financial institutions in centrally managing outsourcing, vendor risk, cyber risks, controls and evidence. This turns outsourcing from a blind spot into a controlled component of modern governance.

FAQ

What did FINMA say about outsourcing?

FINMA emphasises that smaller institutions can outsource technology and services, but responsibility for appropriate risk management remains with the supervised institution.

Why is outsourcing a GRC topic?

Outsourcing connects vendor risk, cybersecurity, operational resilience, compliance, internal controls, audit and management responsibility. It is not only about contracts, but about ongoing oversight.

Which risks are most relevant?

Cyber risks, cloud dependencies, concentration risks, subcontractors, data risks, outage risks and new risks from AI use are particularly relevant.

What does proportionality mean?

Proportionality means that requirements can be implemented in a way that reflects size, complexity and risk profile. It does not mean that material risks can be taken less seriously.

What should financial institutions review now?

Institutions should review their critical service providers, cloud dependencies, subcontractors, controls, exit scenarios, risk acceptances and evidence in a structured way.

How does Zazoon help?

Zazoon helps connect service providers, risks, controls, responsibilities, assessments, findings and evidence in one central GRC system. This makes outsourcing manageable, traceable and audit-ready.

On 9 July 2026, FINMA published Supervisory Communication 05/2026 on quantum computing. This is not a research paper or a distant future scenario. It is a clear message to all supervised Swiss financial institutions: the time for simply observing developments is over. Organisations that do not start preparing a strategy for quantum-safe encryption today risk facing a compliance problem tomorrow.

FINMA based its assessment on a survey conducted between November 2025 and January 2026 among 60 banks, insurance companies, asset managers and financial market infrastructures. The results are sobering: the risks are widely recognised, but concrete measures are still missing in most organisations.

This article looks at what FINMA found, what it now expects from supervised institutions and how governance structures and GRC software can support the transition to post-quantum cryptography.

Key Takeaways

FINMA published its Guidance 05/2026 on quantum computing in July 2026 and expects supervised institutions to actively integrate the topic into their risk management.

According to the survey, 72 percent of respondents have not yet planned or implemented measures for quantum-safe encryption, while only 8 percent have a concrete migration plan. Around two thirds expect that a sufficiently powerful quantum computer could become capable of breaking common RSA-2048 encryption within ten years.

One of the most immediate concerns is the so-called “harvest now, decrypt later” scenario, in which encrypted data is intercepted today and stored until future quantum computers are able to decrypt it.

FINMA recommends action in five areas: strategy and roadmap, risk analysis and inventory, protection of critical data, crypto-agility and management of external service providers. A concrete PQC migration plan should be in place by mid-2027.

Why Quantum Computing Is Already a Compliance Topic

Quantum computers do not yet exist at a scale that threatens today’s commonly used encryption methods. That is true, but it is also a dangerous reason to delay action.

Many widely used public-key cryptographic methods, including RSA, ECDSA and EC-DH, rely on mathematical problems that are extremely difficult for classical computers to solve. A sufficiently powerful quantum computer could fundamentally change this.

The real challenge is that a migration to quantum-safe encryption will take years. It affects ICT systems, applications, infrastructure, digital signatures, authentication mechanisms and external interfaces. Organisations that wait until cryptographically relevant quantum computers are available may simply have too little time left to migrate safely.

There is also the “harvest now, decrypt later” risk. Attackers can intercept encrypted data today and store it with the intention of decrypting it in the future. Long-lived sensitive information such as customer data, contracts, transaction histories or identity information may therefore already be exposed to a future risk.

What the FINMA Survey Shows: Awareness Without Action

The survey results reveal a clear gap between risk awareness and operational readiness.

72 percent of the surveyed institutions have not yet planned or implemented any measures for the transition to quantum-safe encryption. 28 percent have at least made a strategic decision at executive management or board level, and 20 percent have an active project underway.

However, only 8 percent currently have a concrete migration plan with target dates. Those organisations generally expect a complete migration to take around four to five years.

At the same time, 43 percent of respondents have not yet made any decision on a future migration plan. FINMA therefore sees a growing need for action, especially given ongoing technological progress, long migration timelines and uncertainty around when cryptographically relevant quantum computers will become available.

The surveyed institutions also see opportunities in quantum computing, particularly in areas such as risk and portfolio analysis, transaction monitoring and algorithmic trading. However, almost two thirds expect that they will only use quantum computing applications themselves in eight years or more.

What FINMA Recommends: Five Priority Areas

FINMA Guidance 05/2026 outlines five areas that supervised institutions should integrate into their internal risk management.

Strategy and Roadmap

FINMA expects institutions to develop a board-supported strategy for the transition to quantum-safe encryption. This should be translated into a concrete implementation plan with milestones and target dates for the overall migration as well as for particularly critical business processes and data.

A PQC migration plan should be available by mid-2027 at the latest. It can form part of an existing cybersecurity strategy, but it should contain clear and specific objectives for the post-quantum transition.

Risk Analysis and Cryptographic Inventory

Before migrating anything, organisations need a clear picture of their current environment.

FINMA recommends analysing business processes and identifying all encryption, signature and authentication methods currently in use. The result should be a comprehensive cryptographic inventory covering ICT systems, applications, infrastructure and external interfaces, regardless of whether they are operated internally, outsourced or consumed as a service.

This inventory should make it possible to identify which algorithms are vulnerable to quantum attacks and where migration is required. It also needs to be kept continuously up to date.

Protection of Critical Data

FINMA recommends paying particular attention to information that requires long-term protection.

The “harvest now, decrypt later” risk should explicitly be included in risk assessments. Data that must remain confidential for ten, twenty or more years should be prioritised when preparing for post-quantum cryptography.

Because there is still limited long-term operational experience with PQC algorithms, many organisations are considering hybrid approaches that combine classical cryptography with post-quantum algorithms during the transition period.

Crypto-Agility

Crypto-agility is the ability of an ICT system to replace cryptographic algorithms quickly and flexibly without requiring major changes to the underlying software architecture.

FINMA recommends including crypto-agility as a requirement in new ICT developments and procurement processes.

The goal is straightforward: if an algorithm becomes insecure or a new standard is introduced, organisations should be able to switch without triggering another multi-year migration project. Crypto-agility is therefore not only a technical capability, but also a governance principle for resilient IT infrastructures.

External Service Providers

Outsourcing does not remove responsibility from the supervised institution. This also applies to the transition to post-quantum cryptography.

If an external provider operates systems, applications or infrastructure for a financial institution, that provider will also need to support the transition to quantum-safe cryptography.

FINMA therefore recommends including crypto-agility and future cryptographic requirements in new outsourcing agreements for software and data services and addressing existing contracts as early as possible.

What This Means for Compliance and Risk Teams

FINMA Guidance 05/2026 is not a new standalone legal obligation in the narrow sense. However, it makes clear that existing technology-neutral requirements for governance and risk management also apply to quantum risks.

For compliance and risk teams, this means quantum risks should become part of the existing cyber and operational risk framework rather than being managed in isolation.

Third parties and software suppliers also need to be included early in the planning process. The survey indicates that many institutions have already started contacting software providers or intend to do so, which reflects the strong dependency on external technology partners.

Another important point is timing. Governance preparation can and should move faster than the technical migration itself. A board decision, a strategy, a risk assessment and a cryptographic inventory can be established relatively quickly, while the technical transition may take several years.

GRC Software as the Structural Foundation for PQC Migration

All five FINMA recommendations have one thing in common: they depend on structured, documented and continuously maintained processes.

A cryptographic inventory covering systems, applications and external interfaces becomes difficult to manage without a central system. The same applies to quantum risk assessments, migration plans, responsibilities, milestones and evidence for supervisory reviews.

GRC software provides a structured foundation for this work. It can help integrate quantum risks into the existing risk management framework, connect relevant assets and third parties, assign responsibilities, document migration measures and provide management visibility into progress.

PQC should also not be treated as an isolated project. It forms part of a broader cyber risk environment that can overlap with other regulatory and governance requirements. Managing these topics in one integrated GRC environment can reduce duplication and prevent the creation of parallel documentation structures.

Zazoon: GRC Software for Tomorrow’s Requirements

At Zazoon, we have developed GRC software to translate complex regulatory requirements into structured and manageable processes.

For financial institutions preparing to implement FINMA’s quantum computing guidance, this means there is no need to create another isolated project silo. PQC requirements can instead be integrated into the existing risk management and governance environment.

Quantum risks, responsibilities, third-party dependencies, measures and supporting evidence can be managed centrally and made transparent for management, audit and supervisory discussions.

Conclusion: It Is Not About If, but When

Cryptographically relevant quantum computers do not yet exist. But the transition to quantum-safe encryption is a multi-year undertaking, and FINMA has made clear that preparation should begin now.

Institutions that do not have a PQC migration plan by mid-2027 may face increasing regulatory and technical pressure as migration windows become narrower.

The first step does not need to be a massive technical programme. It starts with governance: strategy, inventory, risk analysis and third-party requirements.

This is exactly where GRC software can provide the greatest value. Organisations that establish the right structures today will be better prepared for the cryptographic transition of tomorrow.

FAQ

What does FINMA require regarding quantum computing?

FINMA expects supervised financial institutions to actively integrate quantum risks into their existing risk and governance frameworks. This includes a clear strategy, a cryptographic inventory, risk assessments, the protection of particularly sensitive data, crypto-agility and the involvement of external service providers.

By when should a PQC migration plan be in place?

FINMA recommends developing a concrete migration plan for Post-Quantum Cryptography by mid-2027 at the latest. The plan should include target dates, milestones and priorities for critical systems, processes and data.

What does “Harvest now, decrypt later” mean?

This attack scenario involves encrypted data being intercepted and stored today so that it can potentially be decrypted once sufficiently powerful quantum computers become available. Data that needs to remain confidential for many years is therefore particularly at risk.

What is crypto-agility?

Crypto-agility describes the ability of IT systems to replace cryptographic methods flexibly and with minimal effort. This allows organisations to react more quickly when existing algorithms become insecure or new standards need to be introduced.

Why are external service providers important for PQC migration?

Many financial institutions rely on external providers for software, infrastructure and data services. However, responsibility for outsourced functions remains with the supervised institution. Suppliers and outsourcing partners therefore also need to be included in the PQC strategy and in requirements for crypto-agility.

What role does GRC software play in preparing for Post-Quantum Cryptography?

GRC software can help organisations centrally manage quantum risks, cryptographic dependencies, third parties, responsibilities and migration measures. This makes it easier to document progress, risks and evidence in a structured way and provide transparency for management, auditors and regulators.

Cyber risks are among the most significant operational risks in the financial sector. FINMA makes it clear that the threat landscape is not only persistently high but continues to intensify. Attacks are becoming more professional, more complex and more targeted. At the same time, digitalization, cloud adoption and outsourcing are structurally expanding the attack surface of many institutions.

Cyber risk is therefore no longer a purely IT issue. It affects governance, risk management, internal control systems and strategic decision-making processes. FINMA expects supervised institutions to adopt an integrated, risk-based and controllable approach to managing cyber threats.

Key Takeaways

• Cyber risks are among the central operational risks in the financial market.
• The attack surface is expanding due to connectivity, cloud solutions and third-party providers.
• Cyber risks must be firmly embedded in governance and risk management.
• Outsourcing and third-party dependencies are major risk drivers.
• Institutions must report cyber incidents promptly.
• Scenario-based exercises and recovery testing are essential.
• Cyber resilience means protection, detection, response and recovery.

Cyber Risks as a Strategic Issue

FINMA emphasizes that cyber risks must not be treated in isolation but as an integral component of operational risk management. Technical security measures alone are not sufficient. What matters is holistic management across four dimensions:

• Prevention
• Detection
• Response
• Recovery

These elements must be organizationally embedded, documented and regularly tested.

Cyber attacks are increasingly targeted and often exploit weaknesses in outsourced services or external providers. The growing interconnection between financial institutions, IT service providers and platform operators increases systemic risk.

Governance: Responsibility at the Highest Level

A central concern of FINMA is the clear anchoring of cyber risks within governance structures. This means:

• The board of directors and executive management are responsible for the strategic management of cyber risks.
• Cyber risks must be part of the risk strategy.
• Reporting to senior leadership must be structured and risk-oriented.
• Risk tolerances must be clearly defined.

Cyber risk cannot be delegated purely as a technical matter. It is a leadership and oversight responsibility.

Outsourcing and Third-Party Risk

A significant portion of reported cyber incidents is linked to external service providers. Cloud providers, IT vendors, software providers or outsourced support functions expand the risk landscape considerably.

FINMA expects:

• A complete inventory of all critical service providers
• Clear classification of outsourced functions
• Contractually defined security requirements
• Monitoring mechanisms and control rights
• Inclusion of third parties in emergency and crisis exercises

Without transparent management of outsourcing risks, structural vulnerabilities arise.

Detection and Response Capabilities

Many institutions operate technical monitoring systems. However, the challenge often lies in organizational coordination.

Key questions include:

• Who makes decisions during an incident?
• How quickly are escalation procedures triggered?
• What communication channels are defined?
• How are regulatory reporting obligations fulfilled?

FINMA requires clearly defined processes for identifying, analyzing and managing cyber incidents. This extends beyond IT security and involves institutional crisis management capability.

Recovery and Resilience

An often underestimated aspect is recovery capability. Cyber resilience means remaining operational even in the event of a successful attack.

This includes:

• Tested backup strategies
• Realistic recovery plans
• Regular emergency exercises
• Simulation-based testing under realistic conditions

Paper-based contingency plans are not sufficient. What matters is actual functionality under stress conditions.

Reporting Obligations and Transparency

Cyber incidents must be reported to the supervisory authority within defined timeframes. This reporting obligation is not only about regulatory transparency but also about safeguarding overall financial system stability.

Institutions therefore require clear internal processes to:

• Properly classify incidents
• Fulfill reporting obligations on time
• Prepare information consistently

Lack of clarity in internal structures can lead to significant delays.

Conclusion

FINMA makes it clear: cyber risks are a strategic core issue for financial institutions. They affect not only IT departments but governance, risk management, internal controls and executive leadership.

Effective cyber risk management is characterized by:

• Clear responsibilities
• Integrated governance structures
• Systematic third-party oversight
• Strong detection and response mechanisms
• Tested recovery processes

Cyber resilience is not a static condition but a continuous development process. Institutions that actively manage cyber risks and integrate them into their overall strategy strengthen not only regulatory compliance but also long-term stability and trust.

FAQ

What does FINMA mean by cyber risks?
Cyber risks are operational risks arising from cyber attacks, technical vulnerabilities, third-party dependencies and organizational weaknesses.

Why is cyber risk a governance issue?
Because it affects strategic decisions, risk tolerances, reporting structures and accountability at the highest level.

What role do third parties play?
External service providers significantly expand the attack surface and must be actively integrated into risk analysis, contractual arrangements and contingency planning.

What does cyber resilience mean in practice?
The ability to prevent attacks, detect them early, respond effectively and restore operations quickly.

How should institutions prepare?
By embedding cyber risks into governance structures, defining clear escalation processes, conducting regular exercises, testing recovery plans and fostering a company-wide risk culture.

FINMA has released its Risk Monitor 2025, offering a comprehensive overview of the most critical risks facing the Swiss financial sector over the next three years. Banks, insurers, asset managers and other financial institutions must contend with a mix of traditional financial risks and newly emerging challenges linked to digitalisation, geopolitics and increasingly complex value chains.

The report makes one thing clear: institutions need stronger governance, more effective risk oversight and a more mature compliance culture to remain resilient in a rapidly evolving landscape.

Key Takeaways

• The FINMA Risk Monitor 2025 outlines nine major risks that will be crucial for the Swiss financial industry in the coming years.
• Particularly important are real estate and mortgage risks, credit and market risks, cyber and ICT risks, money laundering threats and outsourcing dependencies.
• Many risks remain at elevated levels or are increasing.
• FINMA formulates concrete supervisory expectations, especially around risk culture, technical resilience, monitoring, outsourcing controls and crisis preparedness.

Why the Risk Monitor 2025 Matters

The Swiss financial centre is highly international, strongly digitalised and significantly exposed in areas such as mortgage financing. Rising interest rates, geopolitical tensions, technological dependencies and new business models increase the pressure on institutions to identify, assess and manage risks proactively.

The Risk Monitor acts as an early warning system. It highlights where vulnerabilities are emerging, where systemic threats may arise and which areas FINMA will scrutinise more closely. For GRC functions, the report provides a clear roadmap of the areas requiring the highest priority.

The Most Important Risks at a Glance

The Risk Monitor 2025 describes several major risk categories. The most relevant include:

Real Estate and Mortgage Risks

The Swiss property market remains tight, with high prices and persistent demand. At the same time, interest rates and leverage ratios have risen, while household debt levels remain high. FINMA expects institutions to apply strict lending standards, conduct realistic stress tests and closely monitor their exposures.

Credit and Market Risks

Volatile markets, geopolitical uncertainties and higher credit spreads increase pressure on institutions. The report emphasises the need for risk-based credit management, adequate value adjustments and close monitoring of concentrated exposures.

Money Laundering and Sanctions Risks

International business models, cross-border activities and new digital financial products increase exposure to financial crime. Institutions must enhance customer risk assessments, strengthen monitoring systems and ensure consistent reporting. A strong risk culture and adequate compliance resources are essential.

Cyber and ICT Risks

With digitalisation accelerating, cyber and ICT risks continue to rise. Attacks on financial infrastructure, failures of IT providers or vulnerabilities in third-party software can have severe consequences. FINMA expects robust systems, effective incident response plans and stringent ICT governance.

Outsourcing and Third-Party Risks

Many institutions rely heavily on outsourced or cloud-based services. This reduces costs but increases vulnerability. FINMA demands clear governance over outsourcing arrangements, monitoring of service providers and the ability to maintain critical functions even during disruptions.

Liquidity and Funding Risks

Even though liquidity conditions appear stable, market stress can quickly lead to funding pressure. Institutions should monitor risk indicators, run scenario analyses and ensure they remain capable of acting in adverse conditions.

What GRC Teams Should Do Now

The Risk Monitor’s message is clear: strong governance, rigorous risk management and consistent compliance are essential for financial stability. Institutions should:

• update their enterprise-wide risk assessments based on the FINMA risk categories
• strengthen risk culture through clear responsibilities and open communication
• conduct regular scenario analyses and stress tests
• improve cyber and ICT resilience, including incident and recovery planning
• map and monitor all outsourcing arrangements and third-party dependencies
• enhance AML/KYC processes and reassess monitoring systems
• define transparent reporting and escalation channels
• modernise technological infrastructure to detect risks earlier

Conclusion

The FINMA Risk Monitor 2025 shows that the Swiss financial sector faces a demanding and highly dynamic risk environment. Many risks remain elevated and require active, forward-looking management. For GRC leaders, this means strengthening governance structures, improving risk transparency and promoting a culture in which risk awareness is embedded across the organisation.

Institutions that act early will not only meet regulatory expectations but also build long-term resilience and trust.

FAQ

What is the FINMA Risk Monitor?
An annual report identifying the most important risks to the Swiss financial market and outlining the supervisory expectations associated with them.

Which risks are highlighted in 2025?
Real estate and mortgage risks, credit and market risks, cyber and ICT risks, money laundering risks, outsourcing risks and liquidity risks.

Why are cyber risks so prominent?
Because cyberattacks and ICT failures have increased significantly in frequency and impact, and can cause rapid, widespread disruption.

What does risk culture mean?
A mindset where all employees actively identify, report and manage risks, not only the compliance or risk department.

What should institutions do now?
Reassess risks, strengthen ICT resilience, improve governance and monitoring, ensure transparent reporting and oversee outsourcing arrangements more rigorously.

Switzerland is responding to growing threats in cyberspace. On August 20, 2025, the Federal Council decided to draft legislation on the cyber resilience of digital products. The Federal Office for Cybersecurity (BACS), together with the Federal Office of Communications (BAKOM) and the State Secretariat for Economic Affairs (SECO), has been tasked with preparing a consultation draft by fall 2026. The goal is to establish binding security requirements for products with digital elements and strengthen market surveillance for such products.

Key Takeaways

• The Federal Council intends to enshrine cyber resilience of digital products in law
• BACS, BAKOM, and SECO will draft a consultation template by fall 2026
• Security obligations for the development and marketing of digital products will be defined, including import and sales bans on unsafe devices
• Market surveillance will be enhanced to ensure vulnerabilities are identified and addressed quickly
• Switzerland is aligning itself with EU regulations such as the Cyber Resilience Act and the NIS-2 Directive

Why This Matters

Digital products have become part of every aspect of life – from smart devices to IoT, software, and connected hardware. If vulnerabilities exist in such products, the consequences can be severe for users, businesses, and critical infrastructure. To date, Switzerland has had very few binding regulations on cyber resilience of digital products. With the new initiative, this regulatory gap will finally be closed.

What Will the New Legislation Cover?

The law is expected to include:

• Security requirements for the development and marketing of digital products
• Market surveillance rules to prevent unsafe products from being sold or imported
• Minimum standards for updates, patches, security testing, and disclosure of vulnerabilities
• Enforcement mechanisms and sanctions for non-compliance

Comparison to EU Initiatives

Benefits and Challenges for Switzerland

Potential Benefits

• Stronger protection for consumers and businesses
• Increased trust in digital products and providers
• Legal certainty for manufacturers and importers
• Reduced costs from security incidents through preventive measures

Challenges

• Overly strict requirements may hinder innovation
• Smaller manufacturers may struggle with compliance costs
• Effective enforcement and market surveillance require significant resources
• Harmonization with international supply chains is essential

Conclusion

The planned Swiss cyber resilience law marks an important step toward modern cybersecurity policy. It closes an existing regulatory gap, establishes binding requirements for digital products, and aligns with proven EU initiatives. For companies, now is the time to proactively integrate compliance, governance, and risk processes to avoid costly adjustments later.

FAQ

What is cyber resilience of digital products?
It refers to the ability of hardware and software with digital elements to remain secure, resist attacks, and quickly fix vulnerabilities.

Why is Switzerland introducing this law?
Because there are currently no binding national rules, despite rising risks from insecure digital products.

When will the draft be ready?
A consultation draft is expected by fall 2026.

What requirements are likely to apply?
Security by design, mandatory updates, vulnerability disclosure, and bans on unsafe devices.

How does this compare to EU laws?
Many elements mirror the Cyber Resilience Act and NIS-2 Directive, which also focus on minimum requirements, reporting duties, and market supervision.

What should companies do now?
Review product portfolios, implement security processes, adjust governance structures, and align with EU standards early.

What is the Mozambique Affair?

The so-called Mozambique Affair involving Credit Suisse is one of the most serious financial scandals in recent years. At its core are hidden loans worth billions of dollars, dubious offshore transactions, and extensive allegations of corruption. This scandal vividly demonstrates how inadequate compliance and governance structures can not only bring banks to their knees but also cause devastating economic and political consequences for an entire country.

The Scandal in Detail: Hidden Loans and Opaque Financing

Between 2013 and 2016, Credit Suisse, together with other financial institutions, arranged loans amounting to approximately USD 2 billion for Mozambique. These funds were officially intended for maritime security projects and the development of the tuna fishing industry. However, large portions of the funds were misappropriated or vanished into opaque channels.

The critical issue: The loans were not recorded in Mozambique’s state budget and were therefore kept secret. Key institutions such as the parliament, the International Monetary Fund (IMF), and donor countries were deliberately kept in the dark. When these “hidden debts” became public, confidence in Mozambique’s government collapsed, plunging the country into a severe debt crisis.

Compliance Failures on Multiple Levels

The Mozambique Affair highlights significant weaknesses in Credit Suisse’s compliance structures. Key compliance failures included:

• Inadequate due diligence: The vetting of loan recipients and verification of loan utilization were insufficient. Politically exposed persons (PEPs) were involved without adequate risk assessments.
• Poor risk management: Despite obvious red flags, the loans were approved. Internal warning signals were ignored or not systematically pursued.
• Failure of internal control systems: Mechanisms designed to scrutinize transactions for legality and transparency either failed or were bypassed.
• Conflicts of interest and lack of independence: Compliance departments lacked sufficient independence from commercial divisions, contributing to a culture of turning a blind eye.

Consequences for Credit Suisse

Credit Suisse faced fines from multiple regulatory bodies and had to settle for millions in penalties. The bank’s reputation suffered significantly. The scandal was a key factor in the erosion of trust in the bank’s leadership and contributed to its eventual acquisition by UBS.

How Effective GRC Can Prevent Such Scandals

Governance, Risk & Compliance (GRC) is not a bureaucratic formality—it is a core component of modern corporate management. An effective GRC framework could have prevented many of the issues exposed by the Mozambique Affair. Key success factors include:

• Strong governance structures: A clearly defined control environment with transparent responsibilities helps prevent abuse of power and lack of transparency.
• Risk-based compliance programs: Integrating risk assessments into decision-making ensures that transactions with high reputational or financial risks are identified early.
• Independent and empowered compliance functions: Compliance teams must operate independently and have direct access to senior management.
• Transparent reporting and communication channels: Internal and external stakeholders must be informed about critical business activities. Whistleblower systems should be protected and actively encouraged.
• Ongoing training and awareness programs: Employees must receive regular training on ethics, integrity, and regulatory requirements.

Conclusion: Lessons from the Mozambique Affair

The Mozambique Affair is a stark reminder of the devastating effects of weak compliance and poor governance. It underscores the importance of viewing GRC not as a checkbox exercise but as a strategic success factor. Only with robust structures, transparent processes, and a true culture of integrity can such scandals be prevented in the future.

A functioning GRC framework not only protects against regulatory penalties—it protects the organization from itself.