FINMA Guidance 05/2025 · Swiss financial institutions

Find your resilience gapsbefore FINMA or a real disruption exposes them.

The Reliability Rating shows you in minutes where your institution stands across critical functions, disruption tolerances, resilience testing, dependencies, and evidence.

3 or 8 minutesImmediate resultEvidence-focused report

Controlled critical-function failure

Delivered by

Technology partners

Gold Partner

Technology partner

Developed by Swiss Digital Network

Technology for managed observability, periodic and systematic resilience testing, and smart quality gates.

FINMA Guidance 05/2025

FINMA’s own data shows a testing and integration gap.

The regulator examined operational-resilience implementation across 267 institutions. The findings show where documented requirements have not yet become tested, integrated capability.

85%No resilience testing
of institutions in supervisory categories 1–3 had not yet conducted operational-resilience testing.
12–15%Integrated coordination
reported coordinated interaction across the relevant operational-resilience disciplines in categories 1–3.
~60%Institution-specific indicators
used internally developed resilience indicators, with substantial variation across institutions.
267Institutions surveyed
including banks, securities firms, and financial market infrastructures as at 31 December 2024.

Supervisory pressure is rising

FINMA says it will continue and intensify institution-specific supervisory activities. Where supervisory law is breached, it can order remediation and organisational changes or restrict business activities.

See FINMA’s enforcement measures

Source: FINMA Guidance 05/2025, published 10 November 2025 and based on data as at 31 December 2024. The Reliability Rating is a self-assessment, not legal advice, certification, or a compliance determination. Read the FINMA guidance

FINMA-RELEVANT OPERATING CAPABILITY

From critical functionsto tested evidence.

Connect critical functions and disruption tolerances to visibility, controlled resilience testing, recovery evidence, and clear decisions.

OBSERVE

Managed Observability

Faster triage through one trusted service-health view
Clear ownership across SRE, Platform Engineering, IT Operations, and Service Owners
Readiness baseline for one critical application
End-to-end service view across relevant environments
Golden signals, SLO context, and proactive alerts
Integration, setup, and ongoing operational maintenance
Regular health reviews and an improvement backlog

OBSERVE + VERIFY

Managed Resilience Testing

Everything in Managed Observability
Evidence of service behaviour during failure and recovery
Shared ownership across SRE, Business Continuity, Risk, and Service Owners
Periodic and systematic resilience testing covering failures, dependency disruptions, and recovery
Guardrails, stop conditions, and a planned testing cadence
Prioritised reliability roadmap
Structured outcome and evidence packages

OBSERVE + VERIFY + ENFORCE

Managed Smart Quality Gates

Everything in Managed Observability and Managed Resilience Testing
Traceable go/no-go decisions based on current operational evidence
Clear ownership across Engineering Leadership, Risk, Change Management, and Technology Leadership
Reliability signals in the existing delivery pipeline
Explainable release gates and stability reports
Continuous maintenance of decision logic
Powered by AI-SQUARE

The service supports operational-resilience execution and evidence. It does not transfer management responsibility or determine regulatory compliance. Final technical, regulatory, and commercial scope is validated jointly.

Operationalise resilience

Build the evidence internally, or operate the capability with Swiss Digital Network.

FINMA expects governance, critical functions, ICT, cyber, third-party risk, business continuity, and testing to work together. Compare what must remain internally owned with what Swiss Digital Network can operate alongside your team.

Swipe to compare

Dimension

Build internally

Managed Reliability

Capability

Recruit and retain specialists across all three capabilities.

Access all three capabilities through one managed reliability team.

Integration

Connect telemetry, SLOs, tests, delivery evidence, and release controls.

Connect service health, resilience testing, and release decisions in one operating model.

Ongoing operation

Keep dashboards, alerts, tests, gates, and evidence current.

We operate the agreed cadence, track gaps, and retest with your teams.

Coordination

Align SRE, IT Operations, Risk, Change, and vendors.

One managed service partner coordinates the work.

Investment

Carry headcount, licences, integration, enablement, and running costs.

Start with the relevant capability in one clearly scoped engagement.

Best fit

You want to build and sustain a full internal reliability function.

You need the capability without building the full function first.

The Rating shows where critical functions, disruption tolerances, testing, and evidence already connect, and where the chain still breaks.

Why Swiss Digital Network

Built around the Digital Highway.

Swiss Digital Network’s founders created the Digital Highway in 2020 from more than 25 years of experience with business-critical systems. It connects SRE, observability, continuous delivery, MLOps, and continuous verification, and adapts them to each organisation.

Explore the Digital Highway View public references

Trusted by

Public Swiss Digital Network references

FINMA-focused Reliability Rating

Find the gaps before supervision or disruption exposes them.

Answer plain questions across critical functions, disruption tolerances, visibility, resilience testing, dependencies, governance, and evidence. Receive a score, prioritised gaps, and a practical next step.

Free self-assessment · No production access · Evidence-focused report

FAQ

What should you know about the FINMA-focused Rating?

The Rating makes resilience gaps easier to discuss without presenting a self-assessment as an audit, legal opinion, or compliance determination.

Q01Does the Rating determine FINMA compliance?

No. It is a structured self-assessment of current operational-resilience practices. It can surface gaps that may matter in a supervisory discussion, but it is not an audit, certification, legal opinion, or determination of regulatory compliance.

Q02What does the FINMA-focused Rating examine?

It looks at critical-function visibility, disruption tolerances, resilience and recovery testing, dependencies, governance, and the evidence behind current practice. Organisation context tailors the report without changing the numerical score.

Q03Why focus on testing?

FINMA Guidance 05/2025 reported that 85% of institutions in supervisory categories 1–3 had not yet conducted operational-resilience testing. A documented tolerance or recovery objective is not the same as evidence that recovery works under realistic conditions.

Q04Does the Rating require production access?

No. The Rating needs only your questionnaire responses and contact details. If you continue after the report, the minimum evidence and access required for a selected critical function are agreed before anything is connected.

Q05What happens after the Rating?

Use the result internally, or request a free 30-minute discovery call. We review the most material gap and decide whether a deeper technical assessment would help. There is no obligation to continue.

NEXT / MAKE THE GAPS VISIBLE

Know where yourresilience gaps are.

Start with one critical function. Complete the Rating, see the priority resilience and evidence gaps, then decide whether a conversation with Swiss Digital Network would help.

What you receive

01
Readiness scoreA self-assessed view of current operational-resilience practice.
02
Evidence gapsThe operational controls and proof that need attention first.
03
Recommended next stepA focused action, not a generic sales package.