TL;DRFINMA's operational-risk-and-resilience circular has been in force since January 2024, and its transition periods for the resilience requirements are now closing. Banks must identify their critical functions, set a tolerance for disruption, and prove they can keep those functions running through a crisis. Describing resilience is no longer enough — supervisors expect evidence.
FINMA Circular 2023/1, "Operational risks and resilience – banks," raised the bar from managing operational risk to demonstrating operational resilience. In practice, that means identifying the critical functions your institution must protect, mapping the people, processes, technology, and third parties they depend on, defining a tolerance for how much disruption is acceptable, and showing you can restore those functions within that tolerance. (Editors: confirm the current transition-period end dates on finma.ch; the resilience requirements are phased in over roughly two years from January 2024.)
Many banks point to a business-continuity plan and consider resilience handled. Supervisors are looking for something more rigorous: a living, evidenced link between your critical functions and the controls that keep them available — tested, monitored, and current. A binder that's updated once a year is not resilience; it's documentation.
This is the practical problem 6clicks was built to solve. Its operational resilience capability lets Swiss institutions map critical functions to controls, capture evidence continuously, track issues and remediation, and give leadership a real-time view of where resilience is strong and where it's stale. Rather than assembling proof in a scramble before a FINMA review, the evidence is already there. And with Sovereign GRC Infrastructure, that oversight extends into restricted and on-premise environments that Swiss banks often can't expose to a cloud-only tool — without sacrificing data residency.
See how leading institutions evidence resilience continuously — book a strategy call with 6clicks.