What does FINMA Guidance 08/2024 say about AI in banking?

What are the key points of FINMA Guidance 08/2024?

• Published 18 December 2024; 7 pages. Section 1 states there is no AI-specific legislation in Switzerland and that technology-neutral, principle-based governance and risk-management requirements cover AI risks.
• Section 1 materiality factors (footnote 2) include significance for compliance with financial market legislation, financial impact, legal and reputational risk, number and type of clients affected and consequences of errors; likelihood factors include complexity, data type, degree of autonomy, short calibration cycles and outsourcing.
• Section 2 names the main risks: operational risks (model risk — robustness, correctness, bias, explainability), IT and cyber risks, third-party dependency in a concentrated market, and legal and reputational risks, including unclear allocation of responsibility.
• Section 2.1 Governance: FINMA observed a focus on data protection rather than model risk, decentralised development and difficulty identifying AI in purchased applications; it assessed central inventories, accountabilities, testing requirements, documentation standards, training and, for outsourcing, additional tests, controls and contractual clauses.
• Section 2.2 Inventory and risk classification: FINMA saw AI defined too narrowly and incomplete inventories; it assessed whether a sufficiently broad AI definition (it cites the OECD approach) and risk classification are used, and states that AI is not a high-risk application per se.
• Sections 2.3 and 2.4: data quality requirements and controls (completeness, correctness, integrity, representativeness) and tests and ongoing monitoring (accuracy, robustness, stability, bias, data-drift detection, predefined thresholds, analysis of user overrides).
• Sections 2.5 to 2.7: documentation of purpose, data, model selection, performance, assumptions, limitations, testing, controls and fallback solutions for material applications; explainability where decisions must be justified to clients, investors, employees, supervisors or auditors; and independent review of the whole development process.
• Section 3 outlook: FINMA will refine its expectations in line with international developments and, where necessary, make them transparent in the market, seeking a technology-neutral, proportional approach across sectors.

What did FINMA Guidance 08/2024 change for banks?

The guidance converts FINMA's 2023–2024 on-site and supervisory-dialogue findings into published expectations for AI governance without new legislation. For Swiss banks it clarifies that AI is supervised through existing operational-risk, governance and outsourcing requirements, and it signals what examiners test: a complete inventory, a broad AI definition, central responsibilities, data-quality controls, drift monitoring, explainability and independent review.

What does FINMA Guidance 08/2024 require of banks using AI?

FINMA Guidance 08/2024 expects supervised institutions that use AI to identify, assess, manage and monitor the resulting risks within their existing governance and risk-management framework. FINMA's published observations and assessments cover seven areas: AI governance with central inventory and defined accountabilities, a broad AI definition and risk classification, data quality requirements and controls, tests and ongoing monitoring including data-drift detection, documentation of material applications, explainability sufficient to justify decisions, and independent review of the development process. The guidance is not a new rule, since Switzerland has no AI-specific legislation, but it shows what FINMA examines in supervision. It applies in proportion to the size, complexity and risk profile of the institution and the materiality of each AI application.

Section 2 is framed as observations and assessments rather than commands: 'FINMA observed' deficiencies at some institutions and 'assessed' whether others had measures in place. In practice it is the template FINMA uses in supervisory dialogue and inspections, which its earlier dossier says have included on-site inspections of institutions deploying AI extensively since the fourth quarter of 2023.

FINMA's 24 April 2025 survey of around 400 institutions found that about half use AI or have initial applications in development and that 91% of AI users also use generative AI, with dependence on BigTech providers growing — the same third-party risk the guidance flags.

The guidance cites international work, including the FSB's November 2024 report on the financial stability implications of AI, and the outlook says FINMA will refine expectations in line with international developments.

WHAT THIS MEANS IN PRACTICE

• Build and maintain a firm-wide AI inventory, including AI embedded in purchased software and generative AI used by staff.
• Classify each application by materiality and likelihood of risk, and scale testing, documentation and review accordingly.
• Set data-quality requirements and drift monitoring, and track cases where users override AI outputs.
• Document material applications end to end, including fallback solutions.
• Make sure someone independent of the developers reviews material models, and tighten contracts and controls for outsourced AI.