FINMA Guidance 02/2026 Explained: What Swiss Banks Must Do to Prevent Digital Fraud

Last reviewed: 26 October 2026

FINMA digital fraud guidance Switzerland has moved to the top of every bank’s compliance agenda in 2026, following the publication of FINMA Guidance 02/2026 on 12 January 2026. The supervisory communication responds to a sustained rise in digital-fraud incidents affecting Swiss financial institutions and sets out clear expectations for prevention, detection, incident response, governance and third-party oversight. This article translates that guidance into operational actions, checklists, vendor clause examples, incident-response triggers and board-reporting workflows, so compliance officers, in-house counsel, risk teams and fintech partners can act quickly. The goal is practical: to help institutions demonstrate supervisory accountability before the next examination cycle and to align fraud controls with existing anti-money-laundering and cybersecurity obligations.

Quick summary, what FINMA Guidance 02/2026 says

FINMA Guidance 02/2026 is a supervisory communication (Aufsichtsmitteilung), not a new statute. It clarifies how FINMA expects supervised institutions to address the growing threat of digital fraud. According to the Guidance, FINMA has observed a steady increase in cases of digital fraud at banks since the end of 2022, prompting a sharper supervisory focus on operational resilience. The document frames digital fraud as a cross-cutting risk that touches governance, IT security, client protection and anti-money-laundering duties simultaneously.

The Swiss National Bank’s Financial Stability Report 2026 reinforces the wider picture of operational and cyber risks facing the Swiss banking sector. Read alongside Switzerland’s broader security-policy context, the regulatory environment this year treats digital-fraud resilience as a significant supervisory priority, not merely an internal control matter.

Who must act (institutions in scope)

The Guidance is addressed to FINMA-supervised institutions, principally banks. In practice, any institution that offers digital banking channels, holds client funds, or relies on third-party technology providers for payment, onboarding or fraud-detection services should treat its expectations as directly relevant. Smaller institutions and fintech-linked providers should not assume the expectations apply only to large banks; the supervisory logic is risk-based, and exposure to digital channels is the trigger, not institutional size.

Key supervisory messages

• Prevention. Institutions must deploy proportionate preventive controls across digital channels, including strong customer authentication and client-communication safeguards.
• Detection. Transaction monitoring and behavioural analytics should be calibrated specifically to detect fraud patterns, not only money-laundering typologies.
• Response. Institutions need tested incident-response plans with clear escalation thresholds and defined notification pathways.
• Governance. Boards and senior management are expected to own digital-fraud risk, with defined accountability and regular reporting.
• Vendor oversight. Third-party providers must be subject to robust due diligence, audit rights and continuity planning.

These messages reflect the core of the FINMA digital fraud guidance Switzerland framework: fraud risk must be managed as an integrated discipline rather than a siloed control. For the practice-area context, see the Banking & Finance, Switzerland practice area.

How FINMA’s expectations map to existing obligations

FINMA Guidance 02/2026 does not operate in isolation. It sits on top of the existing Swiss regulatory architecture, the Banking Act (Bundesgesetz über die Banken und Sparkassen), anti-money-laundering legislation and FINMA’s circulars on operational risks and resilience. Understanding how the Guidance overlaps with these duties is essential to avoid building parallel, duplicative control frameworks. The most efficient response integrates digital-fraud controls into existing compliance and risk structures.

Overlap with AML / GwG duties

The Guidance stresses coordination between fraud controls and anti-money-laundering obligations under the Anti-Money Laundering Act (GwG). Where a digital-fraud event also indicates potential money laundering, for example, where defrauded funds are layered through mule accounts, the statutory reporting obligations to the Money Laundering Reporting Office Switzerland (MROS) remain fully in force. Fraud-monitoring and AML-monitoring teams should therefore share intelligence. A fraud alert that reveals laundering indicators must be routed to the money-laundering reporting function without delay, and the statutory reporting duties under the GwG apply in parallel.

Overlap with cyber resilience and IT risk rules

Digital fraud frequently exploits the same vulnerabilities that cybersecurity programmes are designed to close, credential theft, social engineering, and compromised endpoints. FINMA’s expectations on digital fraud consequently interlock with existing operational-resilience and IT-risk obligations, including FINMA’s circular on operational risks and resilience for banks. Institutions should ensure that fraud telemetry feeds into the security operations centre, and that cyber-incident playbooks explicitly cover fraud scenarios. Treating banking cybersecurity Switzerland obligations and fraud controls as a single resilience programme reduces blind spots and avoids contradictory escalation paths.

Practical compliance checklist for finma digital fraud guidance switzerland, governance, people, processes, tech

The following checklist translates the FINMA digital fraud guidance Switzerland expectations into prioritised, implementable actions. Items are grouped by control domain and ordered broadly by supervisory visibility and ease of execution. Institutions should adapt each item to their size, risk profile and digital footprint.

Board & executive reporting (governance, KPIs)

FINMA expects digital-fraud risk to be owned at the top of the institution. Governance arrangements should make accountability unambiguous and reporting routine rather than exceptional.

• Defined ownership. Assign a named senior executive accountable for digital-fraud risk, with the board retaining oversight responsibility.
• Reporting cadence. Establish regular board reporting, with ad-hoc escalation for significant incidents.
• Core KPIs. Track the number of fraud incidents, gross and net losses, mean time to detect and mean time to respond, and the proportion of incidents detected by automated monitoring versus customer reports.
• Risk appetite. Document a board-approved fraud risk appetite and review it periodically against actual loss experience.

Policies & procedures (AML, fraud, digital channels)

Fragmented policies are a common supervisory finding. The Guidance favours an integrated framework in which fraud, AML and incident-response documents reference one another coherently.

• Update the fraud policy. Refresh the standalone digital-fraud policy to reflect current typologies and the FINMA expectations.
• Unify with AML. Cross-reference the AML/GwG framework so that fraud alerts with laundering indicators trigger the statutory reporting assessment.
• Align incident-response plans. Ensure the fraud policy dovetails with the incident-response plan and the cyber playbook.
• Channel-specific procedures. Document controls for each digital channel, mobile, online, open-banking APIs and card-not-present payments.

Detection & monitoring controls (transaction monitoring, behavioural analytics)

Detection is central to the FINMA digital fraud guidance Switzerland expectations. Monitoring must be tuned to fraud, which behaves differently from classic money-laundering typologies.

• Fraud-specific rules. Deploy rules that detect account takeover, authorised push-payment fraud, unusual device fingerprints and velocity anomalies.
• Behavioural analytics. Use behavioural biometrics and session analytics to flag deviations from normal client behaviour.
• Real-time intervention. Where feasible, enable real-time holds or step-up authentication for high-risk transactions.
• Feedback loops. Feed confirmed-fraud outcomes back into models to reduce false positives and improve detection accuracy.

Preventive controls (authentication, customer communication controls)

Prevention reduces both loss and supervisory exposure. Many digital-fraud losses originate from social engineering, so client-facing controls matter as much as technical ones.

• Strong authentication. Enforce multi-factor authentication and transaction-signing for sensitive operations.
• Communication safeguards. Standardise how the bank contacts clients, and warn clients that the institution will never request credentials or one-time codes.
• Payee verification. Implement confirmation-of-payee style checks to reduce misdirected and authorised-push-payment fraud.
• Customer education. Run ongoing awareness campaigns targeting the most prevalent scam patterns.

Testing & assurance (red-teaming, tabletop exercises)

FINMA expects controls to be tested, not merely designed. Evidence of regular testing is a strong signal of supervisory maturity.

• Red-team exercises. Commission adversarial testing that simulates realistic fraud attack chains across channels.
• Tabletop simulations. Run cross-functional incident simulations periodically involving compliance, legal, IT and senior management.
• Independent assurance. Have internal audit or an external reviewer validate the fraud framework periodically.
• Remediation tracking. Log test findings and track remediation to closure with board visibility.

Consolidated into a single operational tool, these form a 12-point digital-fraud control checklist: (1) named executive owner; (2) board reporting cadence; (3) defined KPIs; (4) documented risk appetite; (5) updated fraud policy; (6) AML integration; (7) aligned incident-response plan; (8) channel-specific procedures; (9) fraud-specific monitoring rules; (10) strong authentication and payee verification; (11) customer communication safeguards; and (12) a tested assurance programme. This checklist gives banks a copy-ready structure for their digital-fraud framework and a direct line of sight to the FINMA digital fraud guidance Switzerland expectations.

Vendor risk and fintech partnerships, due diligence and contract language

Few banks detect and prevent fraud entirely in-house. Monitoring engines, identity-verification tools and payment infrastructure are frequently supplied by fintech partners. The Guidance expects institutions to strengthen vendor due diligence and to retain audit rights in their contracts, consistent with FINMA’s outsourcing requirements. Outsourcing a control does not outsource the regulatory responsibility.

Due diligence, pre-onboarding checklist

• Control assessment. Evaluate the vendor’s own fraud-prevention and cybersecurity controls, including certifications and independent audit reports.
• Data handling. Confirm where client data is stored and processed, and whether sub-processors are involved.
• Financial and continuity resilience. Assess the vendor’s financial stability and business-continuity arrangements.
• Concentration risk. Identify whether reliance on the vendor creates a single point of failure across the institution.

Contract clauses to include

The following are sample clauses for illustration only and do not constitute legal advice; counsel should tailor each to the specific engagement.

• Audit rights. “The Supplier shall, upon reasonable notice, grant the Bank, its internal and external auditors and FINMA access to relevant records, systems and personnel for the purpose of auditing compliance with this Agreement and applicable supervisory requirements.”
• Log access. “The Supplier shall provide the Bank with timely access to transaction, access and security logs necessary for fraud detection, investigation and regulatory reporting.”
• Data-breach notification. “The Supplier shall notify the Bank without undue delay of any actual or suspected security incident or personal-data breach affecting the Bank’s clients, within the timeframe specified in Schedule [X].”
• Service levels. “The Supplier shall meet the fraud-detection availability and response service levels set out in Schedule [X], with defined remedies for breach.”
• Termination and exit. “The Bank may terminate this Agreement on material breach or where required to comply with supervisory requirements, and the Supplier shall provide transition assistance and secure return or deletion of data.”

Supervisory-ready documentation and audits

Institutions should maintain a vendor register that records each provider’s risk tier, the controls assessed, the audit rights secured and the date of the last review. FINMA examiners will expect to see evidence that oversight is ongoing rather than a one-off onboarding exercise. Schedule periodic vendor reviews, retain audit outputs, and document how findings were remediated. Robust third-party vendor due diligence is one of the most scrutinised elements of the FINMA digital fraud guidance Switzerland framework precisely because it is where many control gaps originate.

Incident response, notification and remediation, timelines and triggers

When fraud occurs, the quality of the response determines both client harm and supervisory perception. The Guidance expects institutions to classify incidents, escalate them against defined thresholds, and notify FINMA of significant events. Clear triggers prevent both under-reporting and alert fatigue.

Triage matrix (fraud vs cybersecurity vs data breach)

Not every incident is the same, and the response pathway differs. A single event can be all three at once, for example, a phishing campaign that compromises credentials (cyber), drains client funds (fraud) and exposes personal data (data breach). A triage matrix should classify each incident across these dimensions and route it to the relevant teams simultaneously. Severity should be assessed against the value at risk, the number of clients affected, and whether the incident signals a systemic vulnerability.

Notification to FINMA and authorities

FINMA does not require notification of every fraud incident. It expects timely notification for significant incidents, those that affect client funds materially, disrupt operations, or indicate a wider vulnerability in the institution’s controls. Separately, FINMA operates a cyber-attack reporting obligation for supervised institutions, and institutions should confirm the applicable timelines and channel for reporting cyber incidents. A FINMA notification should typically set out what happened, when it was detected, the estimated impact, the immediate containment measures taken, and the remediation plan. Where money laundering is suspected, the separate reporting obligation to MROS under the GwG applies in parallel and must not be overlooked.

Customer communications and remediation

Remediation combines client protection with evidence preservation. Where personal data is compromised, the Federal Act on Data Protection (FADP/nFADP) may require notification to the Federal Data Protection and Information Commissioner (FDPIC) and, in certain cases, to affected individuals; the FDPIC provides guidance on breach-notification duties. Operationally, institutions should be ready to freeze affected accounts, preserve forensic evidence before systems are restored, and communicate clearly with affected clients, including on any restitution process. Balancing speed, legal duties and evidence integrity is the core challenge of incident-response banks Switzerland planning.

A simplified “when to notify FINMA” decision path reads as follows: confirm the incident is genuine; assess whether client funds, operations or wider control integrity are affected; if the threshold is met, notify FINMA promptly with the core facts; in parallel, assess cyber-incident reporting, GwG reporting duties to MROS and data-protection notification to the FDPIC; then proceed to containment, remediation and client communication. If the threshold is not met, log the incident, apply standard remediation, and monitor for pattern escalation.

Practical governance and audit, documentation and supervisory engagement

Supervisory confidence rests on documentation. An institution may run excellent controls, but if it cannot evidence them, examinations become adversarial. The Guidance implicitly rewards institutions that can demonstrate a complete audit trail from risk assessment through control design, testing and incident handling.

Audit trail and evidence retention

Maintain dated records of risk assessments, policy approvals, monitoring-rule changes, test results and incident reports. Retain forensic evidence from fraud events in a manner that preserves integrity for potential litigation or regulatory review. A clear retention schedule, aligned with statutory record-keeping periods, ensures evidence is available when examiners or law enforcement request it, while respecting data-minimisation principles under the FADP.

Preparing for FINMA on-site or remote reviews

Ahead of a review, assemble a supervisory evidence pack: the fraud framework, the board-reporting KPIs, the vendor register, incident logs and testing outputs. Nominate a single point of contact to coordinate the examination, and rehearse likely questions with the accountable executive. Demonstrating that senior management genuinely owns digital-fraud risk, rather than delegating it entirely to compliance, is one of the strongest signals a bank can send during an engagement on the FINMA digital fraud guidance Switzerland expectations.

Checklist: immediate actions for the next 90 days

The following high-priority plan helps institutions show rapid, credible remediation before the next supervisory cycle.

1. Appoint ownership. Confirm the named senior executive accountable for digital-fraud risk and schedule the first board report.
2. Gap assessment. Run a rapid assessment of current controls against the FINMA digital fraud guidance Switzerland expectations and the 12-point checklist.
3. Policy refresh. Update the fraud policy and align it with AML and incident-response documents.
4. Vendor review. Identify critical fraud-related vendors and verify audit rights and breach-notification clauses.
5. Notification protocol. Finalise the FINMA notification thresholds and template, and brief the teams who will use them.
6. Tabletop exercise. Run a cross-functional incident simulation and capture lessons learned.
7. KPI baseline. Establish the fraud KPIs and a baseline for board reporting.
8. Remediation log. Open a tracked remediation log with owners and deadlines for every identified gap.

Comparison table, FINMA expectations vs AML / cyber / contractual obligations

This table maps each FINMA expectation to its AML, cybersecurity and contractual implications, with a recommended bank action for each. It is designed as a scannable reference for compliance teams building their remediation plan.

Conclusion

The FINMA digital fraud guidance Switzerland framework set out in Guidance 02/2026 raises the operational bar for every supervised institution. It demands integrated controls across prevention, detection, response, governance and vendor oversight, and it rewards banks that can evidence genuine senior-management ownership. The practical path forward is clear: assess current controls against the 12-point checklist, update and unify fraud, AML and incident-response policies, secure audit rights and breach-notification clauses with critical vendors, and define credible FINMA notification thresholds. Institutions that treat digital-fraud resilience as a single, well-documented discipline, rather than a scatter of disconnected controls, will be best placed to satisfy supervisors and protect clients through the 2026 supervisory cycle and beyond.

This article is for general information and does not constitute legal advice. Institutions should verify current thresholds, deadlines and reporting channels directly with FINMA and consult qualified Swiss counsel before acting.

Sources

1. FINMA, Guidance 02/2026 (supervisory communication)
2. FINMA (main site)
3. Swiss National Bank, Financial Stability Report 2026
4. Fedlex, Federal Gazette and consolidated federal law
5. Money Laundering Reporting Office Switzerland (MROS / fedpol)
6. Federal Department of Finance (FDF)
7. Swiss Federal Data Protection and Information Commissioner (FDPIC)
8. Bank for International Settlements (BIS)