#
The core operational-resilience instrument is FINMA Circular 2023/1 'Operational risks and resilience – banks', in force since 1 January 2024, which integrates the Basel Committee's 2021 operational-resilience principles and covers governance, ICT/cyber, critical data, business continuity and operational resilience (critical functions, disruption tolerances). It is complemented by Circular 2018/3 on outsourcing. Cyber-incident reporting runs via the FINMA portal (early warning within 24h, detailed report within 72h for severe attacks). FINMA Guidance 05/2025 (10 November 2025) restated expectations against a 267-institution survey with a 1 January 2026 compliance date. The regime is principles-based and converges with, but is less granular than, the EU's DORA.
Kept on Dataprotection.gi, not restated here: data and cloud switching obligations on service providers, including notice periods and charges. Open this jurisdiction's page on Dataprotection.gi →
FINMA published Guidance 05/2025 on 10 November 2025 restating operational-resilience expectations against a 267-institution data survey and setting a 1 January 2026 compliance date, with every supervised bank, securities firm and FMI expected to demonstrate it can withstand and recover from disruptions. Severe-cyberattack reporting requires a 24-hour early warning and a 72-hour detailed report via the FINMA portal. Because the 1 January 2026 compliance date has now passed as of June 2026, supervisory follow-up is the live watch item; the compliance status of the surveyed institutions and any enforcement remains unverified and is flagged as a gap.
Outlook
The passed compliance date shifts attention to supervisory and enforcement follow-up, which is currently unverified and carried as a next-cycle verification item.
Operational Resilience & Critical Infrastructure
Switzerland's real-time CHF settlement infrastructure, SIC5, is approaching full nationwide bank participation. All remaining Swiss banks are required to reach full participation in the SIC5 system by the end of November 2026, a deadline that closes what has been the last remaining gap in nationwide instant-payments coverage. SIC5 was developed jointly by SIX, the operator of Switzerland's core payments infrastructure, and the Swiss National Bank; the platform settles CHF payments in under ten seconds, operating on a continuous 24/7/365 basis. The Swiss National Bank holds primary supervisory authority for the system, reflecting the centrality of SIC5 to Switzerland's national payments infrastructure rather than treating it as a purely commercial scheme.
A specific volume-based threshold refines the general deadline: smaller financial institutions, defined as those processing fewer than half a million payments a year, have until the end of 2026 to comply, slightly later than the general end-November cutover. This threshold-based approach indicates that the SNB and SIX have structured the final onboarding phase to account for the differing operational capacity of smaller institutions relative to the larger banks that have presumably already completed onboarding, rather than imposing a uniform cutover date irrespective of institution size.
The operational-resilience significance of this milestone is that Switzerland will, upon both deadlines passing, have achieved comprehensive real-time settlement coverage across its banking sector, removing a structural dependency on slower settlement rails for the remaining smaller-bank cohort and closing a potential source of settlement-speed fragmentation between larger and smaller institutions.
Outlook
The general SIC5 full-participation deadline is the end of November 2026, with a further extension to the end of 2026 for institutions below the half-million-payment threshold. Once both deadlines pass, nationwide real-time CHF settlement coverage will be complete, at which point the relevant question for operational-resilience monitoring becomes system performance and resilience under full-network load rather than onboarding progress.
1 earlier distinct update(s)
Operational Resilience & Critical Infrastructure
The Swiss National Bank has fixed November 2026 as the deadline by which all remaining Swiss banks must complete their transition to SIC5, the instant-payments standard offering under-10-second, 24/7/365 processing. This is a confirmed development closing the final gap in Switzerland's move to universal real-time bank settlement: the largest banks, together representing roughly 95 to 98 percent of total payment volume, have already been compliant since August 2024, meaning the November 2026 deadline concerns the long tail of smaller institutions rather than the core of the banking system. SIC5's architecture uses redundant, dual-access connectivity specifically to guarantee an uninterrupted 24/7 connection for participants, a resilience design choice built into the system rather than an add-on. The SNB is the primary supervisory authority for SIC5, consistent with its role overseeing Switzerland's core payment-settlement infrastructure.
This operational-resilience development sits squarely on the bank-PSP side of the bank-PSP versus non-bank-PI/EMI distinction: SIC5 is a bank-to-bank real-time settlement rail, distinct in both regulatory ownership and technical mechanism from non-bank instant-payment products layered on top of it. TWINT, the dominant Swiss mobile A2A wallet with roughly 6 million registered users, illustrates that distinction clearly: TWINT transfers remain capped at CHF 5,000 per transfer and settle via a deferred bank promise-of-payment mechanism rather than true real-time SIC settlement, meaning TWINT's consumer-facing speed does not equate to underlying SIC5-grade settlement finality.
Outlook
Completion of the SIC5 rollout by November 2026 will close the resilience gap between large and small Swiss banks entirely. Whether non-bank instant-payment products such as TWINT are subsequently re-architected to settle directly over SIC5 rather than via deferred bank promise-of-payment is the natural next question this infrastructure milestone raises, though no such plan was identified this cycle.
Sources and findings (4)
- T1https://www.finma.ch/en/news/2022/12/20221213-mm-anh-rs-op-risks/retrieved
- T3https://www.sidd.swiss/en/insights/dora-switzerland-finma/retrieved
- T3https://bollwerk.ai/blog/finma-operational-resilience-2026/retrieved
- T3https://cenedril.net/wiki/en/gesetze-und-standards/finma-rundschreiben/retrieved