FINMA, the Swiss Financial Market Supervisory Authority, devoted its supervisory guidance 08/2024, dated 18 December 2024, to artificial intelligence (AI). Its title: "Governance and risk management when using artificial intelligence". Like all guidance of this kind, it is aimed at a defined group of authorised institutions. It is not a new rule: according to FINMA, its supervisory guidance "is not intended to have any legal effect". No special AI law applies to these institutions in the sources consulted.
This page deals with a single question: what the use of AI changes for an institution supervised by FINMA. The general framework, which applies to all companies, is set out in our page on AI regulation in Switzerland. It notes in particular that data protection law already applies directly to AI.
FINMA is an independent authority based in Bern. According to its own presentation, reported by 2clics.com on 22 October 2026, it protects creditors, investors and policyholders. It has three tools at its disposal: authorisation, supervision and enforcement.
Key figures
- 18 December 2024: date of FINMA supervisory guidance 08/2024, devoted to AI.
- 59 pieces of supervisory guidance listed by FINMA on its dedicated page in October 2026.
- 5 September 2024: opening for signature of the Council of Europe Framework Convention on AI, signed by Switzerland.
- Early 2027: deadline for a preliminary draft of AI regulation, according to the SME portal of the State Secretariat for Economic Affairs (SECO).
- 15 October 2026: publication by the Financial Stability Board (FSB) of its final good practices for the adoption of AI in finance.
- More than 300 AI use cases launched by UBS in 2025, according to the bank.
- Fewer than one company in five has a person validate all of its generative AI content, according to the swissVR Monitor.
What has FINMA published on artificial intelligence?
The reference text is supervisory guidance 08/2024. Its supervisory guidance page dates it 18 December 2024, as last modified, and offers it in German, French, Italian and English. Its title announces two themes: governance and risk management related to the use of AI. This article does not detail its content, which can be read in the document itself.
It belongs to a series of related texts, published in the same form:
- 03/2024, on insights from cyber risk supervision, dated 7 June 2024;
- 05/2025, on the operational resilience of banks, securities firms and financial market infrastructures, dated 10 November 2025;
- 02/2026, on digital fraud risks for banks, dated 9 April 2026;
- 05/2026, on quantum computing, dated 9 July 2026.
The authority's general method is also documented. For cryptocurrencies, FINMA summed up its approach in two phrases in a press release of 11 September 2019. "Substance over form": only the economic function counts. "Same risks, same rules": a comparable risk calls for the same requirements.
In the practice described for cryptocurrencies, technology therefore does not change the rule. Our analysis: nothing in the sources consulted indicates that FINMA would apply a different method to AI. An AI tool that advises a client, assesses a loan or monitors transactions would then be judged on the activity it performs, not on its technology.
Supervisory expectation or rule: what is the difference?
The distinction lies in who issues the text and its nature. A law is adopted by Parliament. FINMA, for its part, can regulate "at a lower level", according to its own presentation. Parliament and the government cannot give it instructions on its supervisory activity.
Its "Documentation" section separates several families of texts: legal basis, circulars, FINMA supervisory guidance and position papers. FINMA itself defines the place of guidance. "Unlike FINMA ordinances and circulars, FINMA supervisory guidance is not a regulatory instrument, but aims at a better application of the provisions." It "concerns conduct and is not intended to have any legal effect".
According to the same page, this guidance is aimed at a clearly defined group of licence holders. It points to ongoing developments or current risks, drawn from FINMA's observations. The authority says it uses it "with restraint".
The 2019 travel rule shows the practical reach of such a text. Guidance 02/2019 applied the existing payment transaction provisions to blockchain, according to FINMA's 2019 annual report. It nonetheless limited crypto transfers by supervised institutions to the wallets of their own identified clients.
Our analysis: guidance 08/2024 falls into this category. It does not create any new obligation, but indicates how FINMA intends existing provisions to be applied to AI. A binding rule specific to AI would go through a law, an ordinance or a circular.
What does FINMA supervise when an institution uses AI?
FINMA highlights three principles on its home page, which apply whatever the technology:
- client protection: "FINMA protects the clients of the financial market";
- risk and resilience: it "identifies risks proactively and carries out preventive supervision";
- proportionality: supervision that is "risk-based and technology-neutral".
Cyber risks are one of FINMA's dossiers. Our analysis: its guidance 03/2024 on cyber risks and 05/2025 on operational resilience may also concern AI tools, which rely on the institution's IT systems.
Governance and risk management appear in the title of guidance 08/2024. Explainability does not appear in the FINMA pages consulted for this article. Other texts provide pointers. The Council of Europe convention thus requires that enough information be provided to challenge a decision made by means of an AI system. It places obligations on states, not directly on banks.
What other rules already apply to a bank that uses AI?
Several texts govern the use of AI by a bank, with very different scopes.
| Text or body | What it provides for AI | Scope |
|---|---|---|
| FINMA | Supervisory guidance 08/2024 on governance and risk management related to AI (18 December 2024) | Supervisory expectation, not intended to have legal effect |
| Federal Data Protection and Information Commissioner (FDPIC) | Data protection law applies directly to AI (note of 24 September 2025) | Rule in force |
| Federal Office for Cybersecurity (NCSC) | Entering confidential information into an AI can expose it (warning of 16 October 2026) | Recommendation |
| Council of Europe Framework Convention | Transparency, accountability, reliability, remedies | Signed by Switzerland, obligations for states |
| Federal Office of Justice (FOJ) | Legislative project to implement the convention, included in the Digital Switzerland action plan | Project |
| Financial Stability Board (FSB) | Good practices for the adoption of AI in finance (15 October 2026) | International reference, content not consulted |
The Council of Europe AI convention leaves each Party the choice between two approaches for the private sector. According to SECO's SME portal, Switzerland has committed to adapting its law accordingly. In parallel, the Confederation is preparing its own use of AI, described in our page on AI in the federal administration.
How are banks already using AI?
Use is already widespread at Switzerland's largest bank. UBS says it launched more than 300 AI use cases in 2025. The bank ranks sixth worldwide in the Evident AI Index 2026, which also rates transparency and the responsible use of AI.
Clients' AI raises another question. According to Axios, on 22 October 2026, Morgan Stanley, JPMorgan, Bank of America and Citi are blocking or restricting the AI agents that their clients connect to their accounts. These agents log in with the client's password, without the bank being able to tell them apart from the client.
Human oversight remains uneven. According to the swissVR Monitor, cited by the magazine PME, many companies report having a governance framework for generative AI. Yet fewer than one in five has all content validated by a person.
What it changes for a client in Switzerland
For a client, FINMA's mandate puts the protection of creditors, investors and policyholders first. The sources consulted mention no exception for a decision prepared by an AI. Our analysis: the bank or insurer remains the client's point of contact, whatever tool is used.
Personal data entrusted to a bank remain protected by the Data Protection Act, AI included. A complaint or information can be passed on to FINMA through its "Report information or submit a complaint" section. Data questions fall under the FDPIC.
What we don't know yet
- The detailed content of guidance 08/2024: this article only covers its title and nature. The document can be consulted on FINMA's guidance page.
- Whether FINMA plans to supplement this text, or to incorporate part of it into a circular.
- The scope of the FOJ's legislative project and its effect on financial institutions.
- The approach Switzerland would adopt to apply the convention to the private sector.
- The details of the FSB good practices and whether they might be taken up in Switzerland.
Other texts on the legal framework for AI are gathered in our section.
Sources
- FINMA, finma.ch home page, consulted in October 2026
- FINMA, "FINMA supervisory guidance", page consulted on 29 October 2026, including guidance 08/2024 of 18 December 2024
- FINMA, presentation "an independent supervisory authority", reported by 2clics.com on 22 October 2026
- FINMA, press release of 11 September 2019 on stablecoins and 2019 annual report, reported by 2clics.com
- Council of Europe, Framework Convention on Artificial Intelligence, reported by 2clics.com
- SECO SME portal and swissVR Monitor, cited by 2clics.com on 28 October 2026
- Swiss Confederation, Digital Switzerland action plan, consulted on 28 October 2026
- FDPIC, note "AI and data protection", 24 September 2025; NCSC, warning of 16 October 2026
- Fintechnews Switzerland, Evident AI Index 2026 ranking, reported by 2clics.com
- Axios, 22 October 2026, and Journal du Coin, 24 October 2026, reported by 2clics.com
- Journal du Coin, on the work of the G7 and the FSB, reported by 2clics.com on 18 October 2026
