Measures for promoting stability

Systemically important institutions were also required to apply stress scenarios prescribed by FINMA with a three-year time horizon and demonstrate the steps they are taking to mitigate negative developments under adverse conditions. At the portfolio level, FINMA carried out mortgage and interest-rate stress tests on selected banks and took action in cases where those tests yielded unsatisfactory results.

In connection with climate-related financial risks, FINMA and the SNB carried out a climate-related scenario analysis at UBS during 2024 and 2025. The data collection facilitated an assessment of the bank’s loss potential stemming from climate-related transition risks under various scenarios up to 2050 (more on this in “Supervision of climate and nature-related risks”).

Swiss Solvency Test at insurers confirms strong capital base

The reports on the Swiss Solvency Test (SST) submitted by the insurance companies showed mostly consistent solvency figures. According to the 2024 figures, the financial markets had been stable overall in a neutral to mildly positive environment, which was reflected in the solvency figures. Among health insurers, updates to the central model assumptions used in the SST standard model – particularly with regard to inflation and cancellation rates – led, in the context of assessing long-term liabilities, to a moderate decline in the SST ratios of less than 10%.

By contrast, the declines in the SST ratios within the reinsurance sector were mainly attributable to individual model adjustments made, inter alia, in connection with the introduction of valuation methods that are compliant with the IFRS reporting standard. In those cases, the fair market valuation method used for the SST is based on the IFRS, although it may, in principle, be carried out independently of the IFRS figures.

Financial institutions also require solid liquidity to ensure their stability. Consequently, FINMA continued to work to ensure that supervised financial institutions across all supervisory areas had adequate liquidity in the year under review.

Funding and liquidity: challenges facing banks

FINMA intensified its supervisory work on the issues of funding and liquidity. In recent years, banks have had to accept higher costs for funding. In particular, a higher demand for funding through covered bonds has led to increased cost surcharges.

The special liquidity requirements for systemically important banks entered into force at the beginning of 2024. The SNB’s heightened minimum reserve requirements for domestic banks led to expanded funding requirements. It is likely that the exit of Credit Suisse from the market further contributed, in a number of ways, to a higher demand for funding. This is because many banks were confronted with an increased level of demand for loans. However, the takeover of Credit Suisse may also have led to a heightened risk perception, particularly in the area of liquidity and funding risks. FINMA has intensified its supervisory work on these issues accordingly. In discussions with the SNB and FINMA, retail and commercial banks emphasised these trends towards higher funding costs but confirmed that demand for loans could still be met on the basis of existing risk principles.

Challenges associated with foreign currency financing

Banks hold assets and liabilities in both Swiss francs and foreign currencies. In general, the liabilities do not correspond fully to the assets recorded in the same currency, which can lead to currency-specific liquidity risks. The risk stems from an insufficient availability of liquid assets in the currency in which outflows from the liabilities arise.

FINMA expects banks to take appropriate measures to manage such liquidity risks. In particular, banks may rely neither on an expectation of unlimited market liquidity being available at any time, nor on an assumption that they will receive assistance measures from the SNB in cases of need.

FINMA has access to currency-specific liquidity reports from banks, enabling it to monitor the development of these risks. In 2025, FINMA carried out in-depth investigations of individual banks that exhibited high exposure to foreign currency risks or played a key role in the foreign exchange market. In doing so, it coordinated closely on this matter with the SNB.

Liquidity of Swiss funds – stress tests

During 2025, FINMA continued its supervisory work aimed at managing the liquidity risks facing investment funds. Conducting numerous in-depth analyses and on-site inspections enabled FINMA to identify the most exposed fund segments, emphasise good market practices and clarify its expectations of supervised institutions.

Inadequate management of liquidity risks and liquidity gaps, i.e. the difference between the liquidity of the assets held by a fund and the redemption conditions offered to investors, may lead to financial stability risks and compromise investor protection.

To meet international requirements and assess the resilience of Swiss investment funds, FINMA carried out its own liquidity stress tests for the first time. These liquidity stress tests targeted funds with valuations above CHF 500 million and an investment strategy focused on equities and bonds, excluding money market funds. In total, 396 funds representing an accumulated net asset value of CHF 681.9 billion were subjected to a stress test with different scenarios. Of the 396 funds, 28 did not meet the requirements. The funds in question are mainly bond funds, many of which are held by a sole investor or a limited circle of investors. FINMA conducted in-depth investigations and analyses of these funds. 
 

The cyber risks facing the financial market remained high during 2025. Consequently, cyber risk management by the supervised institutions was once again a focal point of FINMA’s supervisory activities.

More detailed specification of the cyber incident reporting obligation and supervisory activities

The attacks reported to FINMA by the supervised institutions show that, in 2025, increased numbers of service providers and outsourcing partners were the targets of attacks, with direct consequences for the supervised institutions. Nearly half of all reported cyber incidents fell within that category. Supervised institutions have also increasingly recorded incidents originating within their own organisation, which are known as “insider threats”. These incidents are caused by individuals with authorised access to critical data and systems, such as current employees, service providers or partners, or former employees or third parties whose access rights were not adequately revoked. In addition to malicious actions such as sabotage, theft or extraction of data, unintentional errors are also a serious threat source. This includes sending out sensitive information by mistake or the misconfiguration of systems. Despite the high loss potential, the activities of privileged users are often not monitored systematically, or if checks are performed, they are not fit for purpose.

As part of the annual regulatory reporting by the audit firms for the 2024/2025 reporting period (Q3 2024 to Q1 2025), 107 audits relating to cyber risk management were conducted at banks in accordance with FINMA’s specifications. Weak points were identified across all specialist cyber domains, including governance, risk management and ICT protection measures. Based on these results, FINMA identified supervised institutions with irregularities and initiated targeted measures.

As a partner of the Swiss Financial Sector Cyber Security Centre (Swiss FS-CSC) association, FINMA took part in both tabletop cyber exercises organised by the association to strengthen the resilience of the Swiss financial centre.

Dealing with critical service providers: impacts of outsourcing concentration

In 2025, FINMA evaluated a comprehensive inventory of all significant outsourcing activities by banks and securities firms, insurance companies, managers of collective assets and fund management companies, which it had drawn up at the end of 2024. The evaluation revealed that a high proportion of supervised institutions outsource at least a significant portion of their IT infrastructure to a third party, with the proportion shown to be highest in the case of banks and securities firms. 
 

The evaluation also revealed a significant concentration risk: There was a further increase in the number of supervised institutions outsourcing a significant portion of their business-relevant infrastructure to one of the major public cloud providers. An interruption at one of those service providers could lead to simultaneous outages at multiple financial institutions, which may impair the provision of critical functions. In extreme cases, this concentration would undermine the stability of the financial market.

Supervised institutions are responsible for ensuring that their outsourced activities are also compliant with supervisory requirements. They must ensure that their service providers are given appropriate instructions and subjected to adequate monitoring. Moreover, FINMA is also entitled to perform direct on-site inspections of the service providers, with a view to passing on any findings to the supervised institutions. These reviews enable FINMA to make its own assessment of the current risk situation. They show, for example, that contractually agreed security requirements do not always reflect current supervisory requirements and that certain protective measures may therefore be inadequate. In addition, in some cases the supervised institutions do not recognise these shortcomings at the service provider themselves due to a lack of appropriate controls, which further increases the risk exposure.

Outsourcing by asset management institutions: concentration risk in operational risk management

In the case of fund management companies and managers of collective assets, the findings show that, for many institutions, external service providers play a key role in significant functions. In the area of operational risk management in particular, numerous outsourced activities are concentrated on a few specialist service providers. FINMA is paying greater attention to this risk. It also carried out on-site inspections focused on outsourcing in the year under review.

As at 31 December 2024, the fund management companies and managers of collective assets had notified FINMA of 935 outsourcing agreements. 67% of the activities outsourced by fund management companies and 81% of those outsourced by managers of collective assets involved external service providers. By contrast, fund management companies assigned 33% of their outsourced activities within the group; the proportion is 19% in the case of managers of collective assets.

While fund management companies most frequently outsourced IT infrastructure, legal/compliance was the most outsourced task for managers of collective assets.
 

A large portion of portfolio managers and trustees (approximately 63%) continued to outsource at least one control function in the areas of risk management and compliance.

If we focus on the service providers, we see that a large number of them were handling only one or a few outsourcing arrangements, while a few specialised service providers were responsible for many outsourcing projects.