## 1cheea2019004

## Source details

**Canonical URL:** [1cheea2019004](https://www.imf.org/-/media/files/publications/cr/2019/1cheea2019004.pdf)

## Other formats

- [Markdown version](/-/media/files/publications/cr/2019/1cheea2019004.pdf.md)
- [Structured JSON version](/-/media/files/publications/cr/2019/1cheea2019004.pdf.json)

---

### Executive summary — overview and context
- Prepared in the context of the FSAP mission to Switzerland from October 29 to November 14, 2018.
- Focus: FSAP findings and recommendations on banking supervision (prudential supervision emphasis; limited discussion of conduct risk).
- Key institutional facts:
  - FINMA established in 2009 as Switzerland’s independent and integrated governmental authority for supervision, licensing, and resolution of banks.
  - FINMA’s legal basis derives from the Swiss Federal Constitution, FINMASA, the Federal Act on Banks and Savings Banks, and related ordinances.
  - FINMA is independent in operations and budgetary matters; funded by fees assessed on the industry and banks’ payment of supervisory auditors and mandataries.
  - The SNB designates SIBs and proposes activation of the countercyclical capital buffer to the Swiss Federal Council.
- Note: not a detailed assessment report and does not revise the 2013 BCP assessment grades.

### Main findings — supervisory effectiveness and resilience since the GFC
- Bank supervision has become more effective under FINMA with a well-conceived supervision program that is evolving in positive directions.
- Since 2009, FINMA has promoted prudent regulatory and supervisory standards; these have not yet been tested in a period of systemic stress.
- Since the GFC:
  - Capital and liquidity requirements have been strengthened.
  - Asset quality has improved.
  - Size of the two global systemically important banks (G-SIB) has been substantially reduced.
  - The Swiss ‘too-big-to-fail’ (TBTF) regime has strengthened requirements beyond minimum international standards for the largest banks.
  - Government support provided during the GFC represented about 12 percent of GDP.
- Swiss regulatory framework is principles-based; FINMA provides and enforces more detailed supervisory expectations.

### Use of external supervisory auditors and on-site supervision
- About two-thirds of the supervision program is carried out by external auditors.
- Observations and concerns:
  - Supervisory audits are overly broad and should be rebalanced to improve effectiveness.
  - Coverage at large banks can be reduced where internal audit should perform much of the work under the bank board’s responsibility.
  - Supervisory audits should focus on key areas and provide ‘positive audit-level opinions’ on critical risk management and control practices rather than the lower standard of ‘critical assessment’.
  - Current arrangements—where banks contract and pay supervisory auditors who also provide consultancy and financial audit services—raise conflict of interest concerns that affect supervisory objectivity.
- Recommendations:
  - FINMA—rather than banks—should contract and pay for external auditors’ supervisory work.
  - FINMA should itself conduct more risk-based on-site inspections.

### Risk management, corporate governance, and supervisory constraints
- FINMA’s expectations for risk management and corporate governance clarified; guidance strengthened for supervisory auditors and firms, with refinements introduced in January 2019.
- Material weaknesses and constraints:
  - Lack of an explicit legal basis for a thorough assessment of bank boards and senior management constrains FINMA in holding responsible parties accountable.
  - Pillar 2 add-ons used to incentivize largest banks to address control weaknesses, but cannot replace rapid remedial action by banks.
- Recommendation:
  - FINMA should assess bank boards and senior management effectiveness against corporate governance responsibilities and have governance assessments inform supervisory ratings to enable imposition of restrictions (such as on capital distributions).

### Regulatory toolkit and capital measures
- Recommendation: consider a ‘post-stress’ leverage ratio requirement:
  - Rationale: combined use of internal models for RWAs and a leverage ratio as a non-risk-sensitive backstop can incentivize underestimation of risks.
  - A ‘post-stress’ leverage ratio would introduce risk sensitivity under stress into the leverage ratio while maintaining total assets as the denominator.
- Enhance use of stress testing and capital planning reviews in the supervisory process to assess key risk management and control practices.

### Proportionality and resource allocation
- Implementation of a new regulatory ‘regime for small banks’ and greater risk focus by supervisory auditors at large banks will enhance FINMA’s proportional approach.
- FINMA’s Banks Division responsibilities and oversight of five SIBs require access to skilled resources and flexible deployment.
- FINMA must focus available resources on issues presenting the greatest sources of risk and on banks’ key risk management and control functions.

### Main recommendations (timing and priority preserved)
- 1. Preserve the primacy of FINMA’s prudential mandate, and its authority to issue binding prudential requirements (FINMA ordinances) and codify supervisory practices and interpretations (FINMA circulars) (¶11, ¶12). Timing: C. Priority: H.
- 2. Implement revised Circular 2013/3 on auditing, as planned, with a focus on rationalizing the use of resources for regular supervisory audits, while ensuring the effectiveness of banking supervision and increasing FINMA’s risk-based on-site inspections (¶27–29, ¶36–38). Timing: ST. Priority: H.
- 3. For category 1-3 banks, reduce the use of the broad annual supervisory audits and increase the emphasis on risk-focused, in-depth, and forward-looking supervision (¶29). Timing: ST. Priority: H.
- 4. Heighten the focus of internal audit in providing banks’ boards and senior management with a clear view of the strengths and weaknesses in critical risk management and control processes (¶30). Timing: ST. Priority: H.
- 5. For category 1-3 banks, ensure a timely escalation to boards and senior management of concerns around key risk management and internal control practices that support effective liquidity and capital planning (¶39, ¶58). Timing: ST. Priority: H.
- 6. Ensure that FINMA—rather than banks—contracts and pays directly for supervisory audits (¶26). Timing: MT. Priority: H.
- 7. Require supervisory auditors to provide assessments using ‘audit-level’ practices in critical areas of the supervision of the largest banks (¶31). Timing: MT. Priority: H.
- 8. Provide an explicit assessment to banks of the effectiveness of board and senior management in maintaining a strong risk management framework and internal controls (¶65-6). Timing: MT. Priority: H.
- 9. Enhance the use of stress testing and capital planning reviews in the supervisory process as a means to assess key risk management and control practices (¶42). Timing: MT. Priority: M.
- 10. Continue to enhance FINMA’s offsite risk analytical capabilities to support efforts to further risk-based supervision, implementing formal requirements for consistent and granular risk position information from large banks (¶15, ¶45). Timing: MT. Priority: M.
- 11. Consider authorizing FINMA to require SIBs to meet minimum ‘post-stress’ capital thresholds and to restrict capital distributions to banks’ shareholders, such as dividends and share buybacks, when those are not met. (¶50). Timing: MT. Priority: M.
- 12. Strengthen the relationship between risk control and governance assessments, as articulated in supervisory ratings (including the effectiveness of the board and senior management) and FINMA’s authority to restrict banks’ activities or otherwise require early remedial action. (¶58) Timing: MT. Priority: M.
- 13. Codify key FINMA’s internal supervisory practices to protect their execution over time (¶19). Timing: MT. Priority: L.

_Italic: Source: EXECUTIVE SUMMARY, 1cheea2019004._

### Switzerland banking sector structure and key statistics
- Total banking assets of CHF 3,300 billion are equivalent to about five times Swiss GDP.
- Switzerland is a global leader in private wealth management with a market share of more than a quarter of all global cross-border private banking.
- Banking industry supervisory categories:
  - Category 1: the two large and complex Swiss G-SIBs (Credit Suisse and UBS), which together represent 52 percent of total Swiss market share in terms of deposits and combined total global assets of 260 percent of GDP.
  - Category 2: three banks designated as domestic SIBs (Raiffeisen Swiss cooperative bank, Zurich Cantonal Bank, and PostFinance); their total assets in aggregate are CHF 513 billion, about 80 percent of Swiss GDP.
  - Category 3: middle-size cantonal banks and larger regional commercial banks; there are 24 category 3 banks.
  - Categories 4 and 5: 259 small regional banks focusing on traditional retail activities, mostly mortgage finance, within specific geographical regions, as well as private banking and wealth management activities.

### Proportionality, TBTF regime, and small banks pilot
- FINMA follows a proportionality approach to bank regulation and supervision, underpinned by a risk-based approach.
- TBTF regime developed for banks in categories 1 and 2; simplified pilot regime launched for small banks in categories 4 and 5.
- Box 1 — small banks pilot summary:
  - About 250 banks are in supervisory categories 4 and mostly 5.
  - Category 4 banks have a balance sheet of at most CHF 15bn; category 5 banks up to CHF 1bn.
  - Small banks' pilot: about 60 small banks currently participating (text also references a pilot phase with about 70 qualifying and volunteering small banks).
  - Well-capitalized banks in the pilot identified via an easy to compute leverage ratio, broadly comparable to the Basel III leverage ratio, of at least 8 percent for both categories.
  - A liquidity buffer of 20 percent has to be maintained on top of the 100 percent LCR Basel III requirements.
  - To qualify for the pilot there must not be relevant conduct risks.
  - Under the final regime, additional reliefs foreseen: simplified capital planning requirements, no implementation of the Basel III NSFR, focused simplifications in corporate governance, outsourcing and operational risk management requirements, and no regulatory disclosures beyond publication of a few key metrics.
  - The final small banks' regime is expected to enter into force in 2020.
  - The Federal Department of Finance plans to open a public consultation on a revision to the Capital Adequacy Ordinance in spring 2019.

### Supervisory reporting, accounting, and disclosure
- Supervisory reporting comprehensive under FINMA Circular 2008/14: on-/off-balance sheet assets and liabilities, profit and loss, asset quality and loan loss provisioning.
- Other reporting: capital adequacy and liquidity (Basel III), large exposures, risk concentrations, credit and market risk capital adequacy inputs (including information based on internal modeling), interest rate risk, and share ownership.
- FINMA requests major banks to submit ad-hoc individual information used for management purposes.
- Recommendation: FINMA would benefit from further granularity and consistency on risk exposures at the largest banks to enable cross-firm comparisons and inform risk-focusing practices.
- Accounting framework:
  - FINMA and the government are the accounting standard setters for banks.
  - FINMA rules tend to be more conservative than International Financial Reporting Standards except for some immaterial exceptions.
  - Bank accounting governed by arts. 6–6b of the Banking Law, arts. 25–42 of the Banking Ordinance, and FINMA-Circular 2015/01 (‘Swiss rules’).
  - At consolidated level, banking groups may apply International Financial Reporting Standards or US GAAP (without any carve out or deviation) instead of FINMA's rules.
  - Regulatory disclosure governed by FINMA-Circular 2016/1, which implements Basel III Pillar 3.

### Supervisory methodology, organization, and resources
- Supervisory engagement determined by supervisory category and CAMELS-based internal supervisory rating.
- Rating system enhanced in 2018, including additional scoring using qualitative data from supervisory audit firms and work by FINMA’s Key Account Managers (KAMs) and Risk Experts.
- Pillar 2 capital add-ons can be used by FINMA when banks’ risk management and control practices assessed as weak.
- FINMA reorganizing Banks Division to reallocate resources to categories 1 to 3 and to make supervision of categories 4 and 5 more ‘data-driven’.
- Recommendation: FINMA should identify and codify its key internal supervisory practices to ensure continuity and support the evolving risk-based approach.
- SNB role: designates SIBs and their systemically important functions after consulting FINMA; so far designated five SIBs, of which two are G-SIBs.

### Enforcement, early intervention, and remedial powers
- Revised enforcement policy adopted in 2014: remedy shortcomings, restore compliance, and exert deterrent effect by imposing sanctions.
- FINMA intensified enforcement actions against individuals since the 2014 FSAP and started in 2015 to publish a yearly enforcement report.
- Observations:
  - Legal process may delay remedial actions to address prudential concerns.
  - No explicit early intervention framework related to material supervisory concerns regarding qualitative weaknesses that can undermine effective risk management.
- Recommendation: strengthen authority to enforce rapid remediation of prudential concerns.

### Use of supervisory audit firms — benefits and concerns
- Benefits:
  - Extends FINMA’s reach and resources.
  - Leverages flexibility, global coverage, and expertise of external auditors.
- Concerns:
  - Depth of some regulatory and supplemental audits may be insufficient.
  - Accountability of supervisory auditors needs strengthening.
  - Conflicted interests when large audit firms provide consulting and other services to the same banks.
- Recommendation: FINMA should optimize and reduce supervisory audit work in ways that serve the public interest rather than those of interest groups.

### Differences in mindset and skills between external auditors and supervisors
- External auditing: generally backward-looking and verification-based.
- Supervisors: expected to be forward-looking and integrated, focusing on selected risks and broad knowledge of banks’ activities and strategies.
- Evidence: very few, if any, instances where external auditors proactively contacted supervisors to report matters of material significance during the GFC.
- FINMA actions: issued detailed guidance to assist supervisory auditors, reviews supervisory audit reports, discusses differences of opinion, and can require replacement of a supervisory auditor if work insufficiently rigorous.

### Governance, objectivity, and rotation
- FINMA should have power to contract supervisory audits directly to reinforce objectivity and command over its extended supervisory arm.
- Greater FINMA control over audit firm work needed to manage interdependency between audit firms and supervised banks.
- Rotation guidance: Swiss Code of Obligations — lead financial and supervisory auditors may exercise their mandate for seven years at most and may only accept the same mandate again after an interruption of three years.

### Circular 2013/3 revision and transition to risk-focused audits
- Evolution: shift from compliance-oriented audits to work supporting FINMA’s increasing forward-looking analysis.
- 2014 FSAP: required audit firms to produce an annual risk analysis for each bank to base an audit program approved by FINMA.
- 2017 reassessment: room to improve effectiveness and efficiency; Board approved revision of Circular 2013/3.
- Circular 2013/3 revision (entered into force January 2019):
  - Allows FINMA to refocus commissioning of in-depth investigations by mandataries and carry out its own inspections.
  - Targets reducing expenses on supervisory auditors by 30 percent by narrowing scope of routine audits.
  - Provides greater explicit and formal direction to external auditors, particularly mandataries.
- Implementation challenge: must balance core in-house supervisory work and complementary supervisory audits, particularly for categories 1 to 3 banks.

### Audit depth standards and accountability
- Two audit depth levels per Circular 2013/3:
  - ‘Audit level’ — requires auditor to provide ‘positive assurance’ of compliance with prudential requirements (higher rigor, higher cost).
  - ‘Critical assessment’ — provides ‘negative assurance’ indicating whether anything in the audit leads to conclude non-compliance (less rigorous on-site verification).
- Current practice: regular supervisory audits normally conducted under ‘critical assessment’; mandatary work conducted at “audit level.”
- Recommendation: require ‘audit level’ practices in critical areas of supervision of the largest banks to enhance accountability and reliability.

### Supervisory resources, on-site supervision, and staffing
- FINMA is relatively small with budgetary independence anchored in law; strategic goals include maintaining cost stability of supervision.
- Workforce estimates (FINMA estimates):
  - Total workforce for banking supervision approximately 400 full-time equivalents (FTEs) including supervisory auditors.
  - FINMA estimates on-site work conducted directly by FINMA is the equivalent of 15 FTEs, while supervisory auditors represent some 300 FTEs.
- Progress and challenges:
  - Human-resources policies lowered high staff turnover noted in previous FSAP.
  - FINMA increased direct on-site work by about 44 percent during 2014–17 in a risk-oriented manner.
  - Tension: banks pay for supervisory auditors and may resist proposed supervisory activities that increase costs.
- Recommendation: rebalance responsibilities between FINMA staff and supervisory auditors to improve effectiveness of on-site supervision and streamline routine supervisory audits without compromising effectiveness.

### Supervision of systemically important banks (G-SIBs and D-SIBs)
- Organizational approach:
  - New organizational structure to allow effective oversight of systemically important banks.
  - FINMA assigns relatively small teams (5–6 team members each) dedicated to each G-SIB under a Key Account Manager (KAM).
  - Uses risk experts from Risk Management area for thematic and supervisory reviews.
- Practices:
  - Emphasis on capital and liquidity resiliency and on strengthening recovery and resolution preparedness.
  - Reviews capital and liquidity planning at the two G-SIBs on a semiannual basis.
  - G-SIB capital requirements: G-SIBs required to undertake two FINMA-defined stress tests (LPA) twice a year.
  - Liquidity focus: regular review of Liquidity Coverage Ratio (LCR) data, review of internal liquidity frameworks including internal stress testing; dedicated liquidity risk specialists; required daily LCR reporting and NSFR-related reporting.
  - Conducted a ‘fire-drill’ liquidity exercise at the G-SIBs with external audit firm coordination.
- Recommendations:
  - Increase intensity of supervision of the largest banks despite possible resistance.
  - Raise accountability of boards and senior managers for prudent management and effective risk management and control functions.
  - Ensure appropriate allocation of resources for consolidated supervision of G-SIBs’ global operations.

### Balancing internal audit, bank responsibilities, and supervisory reliance on external audits
- Concern: banks may be using annual supervisory audits as a backstop to their internal audit function.
- Expectations:
  - Banks responsible for assessing their compliance and ensuring internal audit functions proactively report weaknesses to boards and require remediation.
- Recommendation:
  - Increase coverage by internal audit and have FINMA use supervisory auditors to review specific material risk areas.
  - Requiring risk-focused supervisory audits will increase confidence in completeness and depth of assessments, possibly increasing expenditures at some banks.

### Changes to FINMA’s formal rating process and forward-looking focus
- Revised process rolled out in 2018; assessment of benefits will take time.
- FINMA guidance to supervisory auditors: annual risk assessments and reviews for the largest firms; FINMA reviews and discusses prior to signing off on supervisory audit plans.
- FINMA uses internal risk assessment processes for risk focusing, supervisory planning, and informing the ‘risk to future’ element of supervisory assessment/rating.
- Recommendation: consider formalizing more intensive required reporting about risk positions to improve consistency and deepen coverage of risk exposures.

### Swiss TBTF capital and TLAC/GLAC framework and timing
- Swiss capital requirements consistent with Basel III and minimum requirements are higher than Basel minima.
- 2016 amendment to the Capital Adequacy Ordinance introduced higher capital requirements for systemically important banks and a new ‘gone concern’ requirement for G-SIBs.
- Minimum going concern capital requirements for the 2 G-SIBs:
  - 10 percent Common Equity Tier 1 (CET) plus an additional 4.3 percent of tier 1 capital.
- Gone concern loss-absorbing capacity (GLAC) capital requirement for G-SIBs: 14.3 percent (before rebate).
- Total loss-absorbing capacity (TLAC) requirement currently: roughly 26 percent (including rebates associated with structural improvements for single point of entry resolution strategy).
- Transition and phase-in timing:
  - Transition period applicable to G-SIBs (going and gone-concern) ends on January 1, 2020.
  - For the D-SIBs, January 1, 2020 applies for their going-concern requirements; gone-concern requirements have an extended phase-in period which ends on January 1, 2026.
  - For the 3 D-SIBs the RWA-requirement is between 12.86 and 13.22 percent.
  - For the 3 D-SIBs the LR-requirement is between 4.5 and 4.62 percent.
  - For the 3 D-SIBs the buffer is 1.5 to 1.62 percent.

### Interaction of internal models-based RWAs and the leverage ratio; supervisory implications
- The Swiss G-SIBs total asset to RWA density is roughly 30 percent, at the lower end of the range for G-SIBs.
- Complementary leverage requirement: Swiss TBTF regulation requires the Swiss G-SIBs to meet a total leverage ratio of 5 percent of core capital, which includes a 2 percent leverage ratio buffer.
- Identified incentive effects:
  - Use of the leverage ratio as a backstop to an internal ratings-based approach creates incentives for banks to increase holdings of risky assets to maximize returns relative to the leverage ratio while minimizing RWA contributions via internal models.
- Supervisory tool recommendation: consider inclusion of a required post-stress measure of capital based on the leverage ratio (a ‘post-stress minimum leverage ratio requirement’) for use in reviews of capital planning and stress testing.
  - Note: There are currently no explicit ‘post-stress’ capital requirements in the Swiss capital regime.
  - FINMA should consider working with other Swiss authorities to create a legal basis for minimum ‘post-stress’ requirements and the authority to restrict banks’ capital distributions when they fall short.
- Current supervisory actions:
  - FINMA can require Pillar 1 adjustments to increase RWAs and uses Pillar 2 add-ons where concerns driven by qualitative challenges.

### Supervision of risk areas and controls
- Operational risk, cybersecurity, and liquidity:
  - Operational risk priority areas: outsourcing to third parties, cyber security, and business continuity.
  - FINMA created a special team for technology infrastructure, cybersecurity, business continuity management, and oversight of banks’ outsourcing arrangements.
  - Operational Risk circular and guidance updated; CAMELS rating includes a section for qualitative operational risk management.
  - Liquidity supervision: SIBs held to higher liquidity standards; FINMA requires internal stress testing, strong LCR requirements and NSFR reporting; authority to apply supervisory measures imposing add-ons to quantitative liquidity buffer requirements.
- Credit risk, large exposures, conduct, and market risk:
  - Credit risk: covered by FINMA risk specialists and annual supervisory audits; guidance in Circular 2017/1 and “Newsletter 22”.
  - Large exposure rules: large exposure = 10 percent or more of adjusted eligible capital; individual large exposure must not exceed 25 percent of adjusted eligible capital (exception if covered by sufficient ‘free eligible excess capital’). Banks must monitor ten largest borrowers and report to FINMA at least annually; internal quarterly reporting to boards and supervisory audit firms.
  - Conduct risk supervision: specialist teams created; identification through supervisory audits, onsite work, and offsite analysis using the ‘risk analysis and evaluation model’. All firms held to same standards.
  - Market risk and IRRBB: combination of FINMA risk experts and supervisory auditors; emphasis on controls around ‘high risk’ areas and IRRBB given low interest rate environment.

### Corporate governance requirements (Circular 2017/1) and supervision
- Circular 2017/1 clarified governance expectations and board structure requirements:
  - All category 1–3 banks must have a board level audit committee and risk committee; category 3 banks may merge both into one committee.
  - Category 1 and 2 banks must also have compensation and board nominating committees.
  - Audit committee members required to be ‘substantially independent’ (not worked at the bank or as a lead auditor of the bank’s audit firm for at least two years and no commercial ties).
  - SIBs must have a separate risk committee; category 3 banks must have a separate audit and risk committee.
  - Banks in categories 1–3 must have a dedicated CRO; the CRO must be part of the executive board for banks in categories 1–2.
  - A third of the board members required to be independent.
- Supervision and accountability:
  - FINMA does not provide an explicit written assessment of board and senior management effectiveness; raises governance concerns in yearly assessment letters when material.
  - Lack of explicit assessment can undermine accountability for effective risk management, internal controls, and internal audit.
  - Recommendation: more direct attention from FINMA or through use of mandataries for corporate governance assessments.

### Implementation progress and supervisory resourcing (selected items)
- FINMA direct on-site work increased by about 44 percent during 2014–17.
- CP implementations (selected):
  - CP8 (Supervisory approach): Implemented via Circular 2017/1 and 2018 rating system revision.
  - CP9 (Supervisory techniques): Implemented via revised Circular 2013/3 effective 1 January 2019 and FAOA oversight since 2015.
  - CP14 (Corporate governance): Implemented via Circular 2017/1.
  - CP15 (Risk management): Implemented; SIBs discuss capital planning at least annually; semi-annual enterprise-wide stress testing with G-SIBs.
  - CP24 (Liquidity risk): Implemented; qualitative and quantitative requirements updated in January 2018.
  - CP25 (Operational risk): Implemented; separate operational risk team established.
- Partially implemented or not implemented areas:
  - CP1: Partially Implemented.
  - CP2: Partially Implemented.
  - CP6: Not Implemented.
  - CP19: Not Implemented.
  - CP20: Partially Implemented.
  - CP12: Implemented (recovery and bankruptcy jurisdiction extended to group parent companies and group companies performing significant functions — Article 2 bis BA; in force since 2016).

_Italic: Source: 1cheea2019004._

### EXECUTIVE SUMMARY ___________________________________________________________________________ 4

### EXECUTIVE SUMMARY

### Overview and context
- Prepared in the context of the FSAP mission to Switzerland from October 29 to November 14, 2018.
- Focus: FSAP findings and recommendations on banking supervision (prudential supervision emphasis; limited discussion of conduct risk).
- Key institutional facts:
  - FINMA established in 2009 as Switzerland’s independent and integrated governmental authority for supervision, licensing, and resolution of banks.
  - FINMA’s legal basis derives from the Swiss Federal Constitution, FINMASA, the Federal Act on Banks and Savings Banks, and related ordinances.
  - FINMA is independent in operations and budgetary matters; funded by fees assessed on the industry and banks’ payment of supervisory auditors and mandataries.
  - The SNB designates SIBs and proposes activation of the countercyclical capital buffer to the Swiss Federal Council.
- The note is not a detailed assessment report and does not revise the 2013 BCP assessment grades.

### Main findings — supervisory effectiveness and resilience since the GFC
- Bank supervision has become more effective under FINMA with a well-conceived supervision program that is evolving in positive directions.
- Since 2009, FINMA has promoted prudent regulatory and supervisory standards; these have not yet been tested in a period of systemic stress.
- Since the GFC:
  - Capital and liquidity requirements have been strengthened.
  - Asset quality has improved.
  - Size of the two global systemically important banks (G-SIB) has been substantially reduced.
  - The Swiss ‘too-big-to-fail’ (TBTF) regime has strengthened requirements beyond minimum international standards for the largest banks.
  - Government support provided during the GFC represented about 12 percent of GDP.
- Swiss regulatory framework is principles-based; FINMA provides and enforces more detailed supervisory expectations.

### Use of external supervisory auditors and on-site supervision
- About two-thirds of the supervision program is carried out by external auditors.
- Progress toward a forward-looking, risk-focused approach has been made; however:
  - Supervisory audits are overly broad and should be rebalanced to improve effectiveness.
  - Coverage at large banks can be reduced where internal audit should perform much of the work under the bank board’s responsibility.
  - Supervisory audits should focus on key areas and provide ‘positive audit-level opinions’ on critical risk management and control practices rather than the lower standard of ‘critical assessment’.
  - Current arrangements—where banks contract and pay supervisory auditors who also provide consultancy and financial audit services—raise conflict of interest concerns that affect supervisory objectivity.
  - Recommendation: FINMA—rather than banks—should contract and pay for external auditors’ supervisory work.
  - FINMA should itself conduct more risk-based on-site inspections.

### Risk management, corporate governance, and supervisory constraints
- FINMA’s expectations for risk management and corporate governance have been clarified, including roles and responsibilities of boards and senior management.
- Guidance strengthened for supervisory auditors and firms in a number of risk areas; refinements introduced in January 2019 are welcome (including a more focused regime for supervisory auditors).
- Further measures needed to address material risk management and control weaknesses:
  - Lack of an explicit legal basis for a thorough assessment of bank boards and senior management constrains FINMA in holding responsible parties accountable.
  - FINMA requires Pillar 2 add-ons to incentivize largest banks to address control weaknesses, but add-ons cannot replace rapid remedial action by banks.
  - FSAP recommends FINMA assess bank boards and senior management effectiveness against corporate governance responsibilities and that governance assessments inform supervisory ratings, which should enable FINMA to impose restrictions (such as on capital distributions).
- Supervision increasingly uses on-site reviews by FINMA staff, often coordinated with host country supervisors for G-SIBs, but still relies on broad annual supervisory audits by external auditors.
- FINMA should continue to build internal risk identification, analysis, and assessment capacity and actively direct supervisory auditors to focus on key risks and risk management practices.
- FINMA’s heightened risk focus increases importance of boards ensuring internal audit functions have capacity and stature to provide assurance on prudential and conduct standards.

### Regulatory toolkit and capital measures
- A ‘post-stress’ leverage ratio requirement should be considered to strengthen the regulatory toolkit:
  - Rationale: combined use of internal models for RWAs and a leverage ratio as a non-risk-sensitive backstop can incentivize underestimation of risks.
  - A ‘post-stress’ leverage ratio would introduce risk sensitivity under stress into the leverage ratio while maintaining total assets as the denominator.
- Enhance use of stress testing and capital planning reviews in the supervisory process to assess key risk management and control practices.

### Proportionality and resource allocation
- Implementation of a new regulatory ‘regime for small banks’ and greater risk focus by supervisory auditors at large banks will enhance FINMA’s proportional approach.
- The Breadth of FINMA’s Banks Division responsibilities and oversight of five SIBs requires access to skilled resources and flexible deployment.
- FINMA must focus available resources on issues presenting the greatest sources of risk and on banks’ key risk management and control functions.

### Main recommendations (excerpted from Table 1; Timing and Priority preserved)
- 1. Preserve the primacy of FINMA’s prudential mandate, and its authority to issue binding prudential requirements (FINMA ordinances) and codify supervisory practices and interpretations (FINMA circulars) (¶11, ¶12). Timing: C. Priority: H.
- 2. Implement revised Circular 2013/3 on auditing, as planned, with a focus on rationalizing the use of resources for regular supervisory audits, while ensuring the effectiveness of banking supervision and increasing FINMA’s risk-based on-site inspections (¶27–29, ¶36–38). Timing: ST. Priority: H.
- 3. For category 1-3 banks, reduce the use of the broad annual supervisory audits and increase the emphasis on risk-focused, in-depth, and forward-looking supervision (¶29). Timing: ST. Priority: H.
- 4. Heighten the focus of internal audit in providing banks’ boards and senior management with a clear view of the strengths and weaknesses in critical risk management and control processes (¶30). Timing: ST. Priority: H.
- 5. For category 1-3 banks, ensure a timely escalation to boards and senior management of concerns around key risk management and internal control practices that support effective liquidity and capital planning (¶39, ¶58). Timing: ST. Priority: H.
- 6. Ensure that FINMA—rather than banks—contracts and pays directly for supervisory audits (¶26). Timing: MT. Priority: H.
- 7. Require supervisory auditors to provide assessments using ‘audit-level’ practices in critical areas of the supervision of the largest banks (¶31). Timing: MT. Priority: H.
- 8. Provide an explicit assessment to banks of the effectiveness of board and senior management in maintaining a strong risk management framework and internal controls (¶65-6). Timing: MT. Priority: H.
- 9. Enhance the use of stress testing and capital planning reviews in the supervisory process as a means to assess key risk management and control practices (¶42). Timing: MT. Priority: M.
- 10. Continue to enhance FINMA’s offsite risk analytical capabilities to support efforts to further risk-based supervision, implementing formal requirements for consistent and granular risk position information from large banks (¶15, ¶45). Timing: MT. Priority: M.
- 11. Consider authorizing FINMA to require SIBs to meet minimum ‘post-stress’ capital thresholds and to restrict capital distributions to banks’ shareholders, such as dividends and share buybacks, when those are not met. (¶50). Timing: MT. Priority: M.
- 12. Strengthen the relationship between risk control and governance assessments, as articulated in supervisory ratings (including the effectiveness of the board and senior management) and FINMA’s authority to restrict banks’ activities or otherwise require early remedial action. (¶58) Timing: MT. Priority: M.
- 13. Codify key FINMA’s internal supervisory practices to protect their execution over time (¶19). Timing: MT. Priority: L.

*Source: EXECUTIVE SUMMARY, 1cheea2019004.*

### 8.      Switzerland has a large and diverse banking sector and hosts two G-SIBs.

### 8.      Switzerland has a large and diverse banking sector and hosts two G-SIBs.

### Banking sector structure and key statistics
- Total banking assets of CHF 3,300 billion are equivalent to about five times Swiss GDP.
- Switzerland is a global leader in private wealth management with a market share of more than a quarter of all global cross-border private banking.
- The banking industry is divided into five supervisory categories to facilitate proportionality in supervision.
- Category 1 comprises the two large and complex Swiss G-SIBs (Credit Suisse and UBS), which together represent 52 percent of total Swiss market share in terms of deposits and combined total global assets of 260 percent of GDP.
- Category 2 comprises three banks designated as domestic SIBs (Raiffeisen Swiss cooperative bank, Zurich Cantonal Bank, and PostFinance). Their total assets in aggregate are CHF 513 billion, about 80 percent of Swiss GDP.
- Category 3 comprises middle-size cantonal banks and larger regional commercial banks; there are 24 category 3 banks.
- Categories 4 and 5 comprise 259 small regional banks focusing on traditional retail activities, mostly mortgage finance, within specific geographical regions, as well as private banking and wealth management activities.

### FINMA effectiveness, mandate, and supervisory priorities
- Since FINMA’s inception, the Swiss banking system has been operating under relatively benign economic and financial conditions; FINMA has been effective in providing regulatory discipline through a period absent of systemic stress.
- The post-crisis regime has yet to be tested through a period of severely adverse systemic conditions.
- It remains important that FINMA be allowed to further build on and improve the effectiveness of its banking supervision to minimize the likelihood that the largest banks might need to be resolved.
- Authorities should ensure that the safety and soundness of the Swiss banking system remains the top priority of FINMA’s mandate. FINMASA establishes FINMA’s objectives: to protect creditors, investors, and insured persons as well as ensuring the proper functioning of the financial market (cf. art. 4).
- The authorities should preserve the primacy of the prudential mandate and ensure FINMA’s powers to issue binding prudential requirements and codify supervisory interpretations and practices are preserved.
- Recent procedural requests by Parliament ask for a stricter delimitation of authority between the FDF and FINMA, and enhanced political oversight; the Federal Council proposed that the Parliament reject these requests, except for one.

### Proportionality, TBTF regime, and small banks pilot
- By law and practice, FINMA follows a proportionality approach to bank regulation and supervision, underpinned by a risk-based approach.
- The Swiss authorities continue to develop the TBTF regime for banks in categories 1 and 2 and have launched a simplified pilot regime for small banks in categories 4 and 5.
- FINMA applies the most intensive supervision to the largest banks; FINMA does not apply proportionality for conduct supervision where risk is considered equally important regardless of the size of the institution.

Box 1 — Proportional Approach to the Regulation and Supervision of Small Banks (summary)
- About 250 banks are in supervisory categories 4 and mostly 5.
- Category 4 banks have a balance sheet of at most CHF 15bn; category 5 banks up to CHF 1bn.
- FINMA launched the small banks' pilot regime, with about 60 small banks currently participating (text also references a pilot phase with about 70 qualifying and volunteering small banks).
- Well-capitalized banks in the pilot are identified via an easy to compute leverage ratio, broadly comparable to the Basel III leverage ratio, of at least 8 percent for both categories.
- A liquidity buffer of 20 percent has to be maintained on top of the 100 percent LCR Basel III requirements.
- To qualify for the small banks' pilot regime there must not be relevant conduct risks.
- Under the final regime, additional reliefs are foreseen: simplified capital planning requirements, no implementation of the Basel III NSFR, focused simplifications in corporate governance, outsourcing and operational risk management requirements, and no regulatory disclosures beyond publication of a few key metrics.
- The final small banks' regime is expected to enter into force in 2020.
- The Federal Department of Finance plans to open a public consultation on a revision to the Capital Adequacy Ordinance in spring 2019.

### Supervisory reporting, accounting, and disclosure
- Supervisory reporting is comprehensive under FINMA Circular 2008/14, covering on-/off-balance sheet assets and liabilities, profit and loss, asset quality and loan loss provisioning.
- Other reporting covers capital adequacy and liquidity (Basel III), large exposures, risk concentrations, details of credit and market risk capital adequacy inputs (including information based on internal modeling), interest rate risk, and share ownership.
- FINMA requests major banks to submit ad-hoc individual information used for management purposes.
- FINMA would benefit from further granularity and consistency on risk exposures at the largest banks to enable cross-firm comparisons and to inform risk-focusing practices.
- The regulatory framework for bank accounting and financial disclosure has been enhanced since the 2014 FSAP. Together with the government, FINMA is the accounting standard setter for the banking industry.
- FINMA rules tend to be more conservative than International Financial Reporting Standards except for some immaterial exceptions.
- Bank accounting is governed by arts. 6–6b of the Banking Law, arts. 25–42 of the Banking Ordinance, and FINMA-Circular 2015/01 (‘Swiss rules’).
- At the consolidated level, banking groups may apply International Financial Reporting Standards or US GAAP (without any carve out or deviation) instead of FINMA's rules.
- Regulatory disclosure is governed by FINMA-Circular 2016/1, which implements Basel III Pillar 3.

### Supervisory methodology, organization, and resources
- The Banks Division determines supervisory engagement by a combination of banks’ supervisory category and the CAMELS-based internal supervisory rating.
- The rating system was enhanced in 2018, including additional scoring using qualitative data from supervisory audit firms and work by FINMA’s Key Account Managers (KAMs) and Risk Experts.
- New internal procedures are expected to be applied beginning in 2019.
- Bank categorization and risk rating define the intensity of supervisory engagement via ‘Standard Operating Procedures’ and the choice of supervisory instruments and the level of direct supervision by FINMA versus supervisory auditors.
- Pillar 2 capital add-ons can be used by FINMA when banks’ risk management and control practices are assessed as weak.
- FINMA is reorganizing its Banks Division to reallocate resources to supervision of banks in categories 1 to 3 and to streamline and make more ‘data-driven’ the supervision of category 4 and 5 banks.
- FINMA should identify and codify its key internal supervisory practices intended to play a central role in its evolving risk-based approach; this codification is seen as a medium-term objective to ensure continuity and self-discipline, while avoiding overly-rigid processes.
- FINMA should continue to increase its understanding of the two G-SIBs’ large foreign operations in the U.S., the U.K., and Asia, and allocate adequate resources to the supervision of the G-SIBs’ consolidated operations.
- The Swiss National Bank is tasked with designating SIBs and their systemically important functions (after consulting FINMA). So far, the Swiss National Bank designated five SIBs, of which two are G-SIBs.

### Enforcement, early intervention, and remedial powers
- FINMA adopted a revised enforcement policy in 2014; enforcement aims to remedy shortcomings, restore compliance with the law and exert a deterrent effect by imposing sanctions.
- FINMA has intensified its enforcement actions against individuals since the 2014 FSAP and started in 2015 to publish a yearly enforcement report.
- Legal process may delay remedial actions to address prudential concerns and there is not an explicit early intervention framework related to material supervisory concerns regarding qualitative weaknesses that can undermine effective risk management.
- FINMA raises supervisory concerns with banks at an early stage, although its authority to enforce rapid remediation of prudential concerns should be strengthened.

### Use of supervisory audit firms
- FINMA uses external supervisory auditors as its “extended supervisory arm.”
- Since 1934, bank supervision has relied on external auditors to review banks’ compliance with banking laws and supervisory expectations and guidelines.
- In addition to annual supervisory audits, FINMA can use ‘supplementary reviews’ or reviews by mandataries (deeper reviews directed by FINMA and carried out by supervisory auditors or specialized mandataries).
- Mandataries must be carried out by auditors that are not part of the firm that does a bank’s regulatory and financial audits.
- Costs of supervisory audits, supplemental reviews and mandataries are borne by the supervised institutions.
- The Swiss model has shifted from compliance-based to a more risk-based supervision with an increasing role and presence for FINMA in direct on-site responsibilities.

*Source: 1cheea2019004 - 8.      Switzerland has a large and diverse banking sector and hosts two G-SIBs.*

### 24.      The FSAP shares FINMA’s view that there are benefits to this approach, although it

### 1cheea2019004 - 24.      The FSAP shares FINMA’s view that there are benefits to this approach, although it

### Use of external auditors for supervisory work: benefits and concerns
- Benefits identified:
  - Extends FINMA’s reach and resources.
  - Leverages the flexibility, global coverage, and expertise of external auditors.
- Concerns identified:
  - Depth of some regulatory and supplemental audits may be insufficient.
  - Accountability of supervisory auditors needs strengthening.
  - Risks associated with conflicted interests of large audit firms that provide consulting and other services to the same banks.
- Recommendation:
  - FINMA should optimize and reduce supervisory audit work in ways that serve the public interest rather than those of interest groups.

### Differences in mindset and skills between external auditors and supervisors
- Finding:
  - External auditing is generally backward-looking and verification-based; supervisors are expected to be forward-looking and integrated, focusing on selected risks and broad knowledge of banks’ activities and strategies.
- Evidence:
  - Experience during the GFC provides “very few, if any, instances where external auditors proactively contacted supervisors to report matters of material significance.”
- FINMA measures:
  - Issued detailed guidance to assist supervisory auditors.
  - Reviews supervisory audit reports and discusses differences of opinion with auditors.
  - Can require replacement of a supervisory auditor if work is insufficiently rigorous.

### Governance, objectivity, and rotation
- Important powers and controls:
  - FINMA should have the power to contract supervisory audits directly, rather than via the banks, to reinforce objectivity and command over its extended supervisory arm.
  - Greater FINMA control over audit firm work is needed to ensure objectivity and manage interdependency between audit firms and supervised banks.
- Rotation guidance:
  - Attention should be given to rotation of lead regulatory and financial auditors within the bank’s single regulatory and financial audit firm to promote objectivity.
  - Swiss Code of Obligations: lead financial and supervisory auditors may exercise their mandate for seven years at most and may only accept the same mandate again after an interruption of three years.

### Transition to risk-focused supervisory audits and Circular 2013/3 revisions
- Evolution:
  - Shift from compliance-oriented audits to work supporting FINMA’s increasing use of forward-looking analysis.
  - 2014 FSAP introduced requirement for audit firms to produce an annual risk analysis for each bank to base an audit program approved by FINMA.
  - 2017 FINMA reassessment found room to improve effectiveness and efficiency; Board approved revision of Circular 2013/3 on auditing.
- Circular 2013/3 revision (entered into force January 2019):
  - Allows FINMA to refocus commissioning of in-depth investigations by mandataries and carry out its own inspections.
  - Targets reducing expenses on supervisory auditors by 30 percent by narrowing scope of routine audits.
  - Will provide greater explicit and formal direction to external auditors, particularly mandataries.
- Implementation challenge:
  - Effective implementation is significant; must balance core in-house supervisory work and complementary supervisory audits, particularly for categories 1 to 3 banks, to avoid losing cost-efficiency and knowledge gains.

### Audit depth standards and accountability
- Two audit depth levels per Circular 2013/3:
  - ‘Audit level’ — requires auditor to provide ‘positive assurance’ of compliance with prudential requirements (higher rigor, higher cost).
  - ‘Critical assessment’ — provides ‘negative assurance’ indicating whether anything in the audit leads to conclude non-compliance (less rigorous on-site verification).
- Current practice:
  - Regular supervisory audits normally conducted under ‘critical assessment’.
  - Mandatary work is conducted at “audit level.”
- Recommendation:
  - Require ‘audit level’ practices in critical areas of supervision of the largest banks to enhance accountability and reliability.

### Supervisory resources, on-site supervision, and staffing
- Institutional profile:
  - FINMA is relatively small, with budgetary independence anchored in law; strategic goals include maintaining cost stability of supervision.
  - FINMA can require banks to provide additional financial resources if supervisory needs warrant.
- Workforce estimates:
  - Total workforce for banking supervision (FINMA estimates) approximately 400 full-time equivalents (FTEs) including supervisory auditors.
  - At time of writing: FINMA estimates on-site work conducted directly by FINMA is the equivalent of 15 FTEs, while supervisory auditors represent some 300 FTEs.
- Progress and challenges:
  - Human-resources policies have lowered high staff turnover noted in previous FSAP; continued progress should consolidate in-house expertise.
  - FINMA has been increasing direct on-site work by about 44 percent during 2014–17 in a risk-oriented manner.
  - Use of external supervisory auditors to perform annual supervisory audits and supplemental reviews makes up FINMA’s “extended arm.”
  - Tension exists because banks pay for supervisory auditors and may resist proposed supervisory activities that increase costs.
- Recommendation:
  - Rebalance responsibilities between FINMA staff and supervisory auditors to improve effectiveness of on-site supervision.
  - Streamline routine supervisory audits without compromising effectiveness; use revision of Circular 2013/3 to reassess and adjust on-site supervision and supervisory audit mix.

### Supervision of systemically important banks (G-SIBs and D-SIBs)
- Organizational approach:
  - New organizational structure will allow effective oversight of systemically important banks.
  - FINMA assigns relatively small teams (5–6 team members each) dedicated to each G-SIB under a Key Account Manager (KAM).
  - Uses risk experts from Risk Management area for thematic and supervisory reviews (operational, credit, liquidity risk specialists; dedicated team for investment banking; teams for stress testing and capital/liquidity planning).
- Focus areas and practices:
  - Emphasis on capital and liquidity resiliency and on strengthening recovery and resolution preparedness.
  - Reviews capital and liquidity planning at the two G-SIBs on a semiannual basis.
  - G-SIB capital requirements: G-SIBs required to undertake two FINMA-defined stress tests (LPA) twice a year.
  - FINMA reviews stress test results, modeling, and meets with bank management to discuss capital plans.
  - Liquidity focus: regular review of Liquidity Coverage Ratio (LCR) data, review of internal liquidity frameworks including internal stress testing.
  - Conducted a ‘fire-drill’ liquidity exercise at the G-SIBs with external audit firm coordination; firms were assessed and provided with expectations for improvements.
- Recommendations:
  - Increase intensity of supervision of the largest banks despite possible resistance.
  - Raise accountability of boards and senior managers for prudent management and effective risk management and control functions.
  - Ensure appropriate allocation of resources for consolidated supervision of G-SIBs’ global operations.

### Balancing internal audit, bank responsibilities, and supervisory reliance on external audits
- Concern:
  - Banks may be using annual supervisory audits as a backstop to their internal audit function — not a good practice.
- Expectations and recommendation:
  - Banks are responsible for assessing their compliance and ensuring internal audit functions proactively report weaknesses to boards and require remediation.
  - A better balance: increased coverage by internal audit and FINMA increasing use of supervisory auditors to review specific areas defined as presenting material risks.
  - Requiring risk-focused supervisory audits will increase confidence in completeness and depth of assessments, possibly increasing expenditures at some banks.

*International Monetary Fund — Switzerland FSAP (excerpt).*

### 45.      FINMA has revised its process for formally rating systemically-important banks to

### 45.      FINMA has revised its process for formally rating systemically-important banks to

### Changes to FINMA’s formal rating process and forward-looking focus
- Roll out of the revised process occurred in 2018; assessment of benefits will take time.
- FINMA has provided further guidance to supervisory auditors on:
  - Their annual risk assessments.
  - Reviews for the largest firms, which FINMA reviews and discusses prior to signing off on supervisory audit plans for the year.
- FINMA uses a variety of internal risk assessment processes to guide risk focusing, planning for supervisory exercises, and to inform the ‘risk to future’ element of supervisory assessment/rating.
- Recommendation: FINMA should consider formalizing more intensive required reporting about risk positions to improve consistency and deepen coverage of risk exposures.
  - Rationale: Reliance on ad hoc reporting and firms’ internal risk reports increases the challenge of identifying issues and potential sources of vulnerability consistently across banks and makes data integrity issues harder to detect and resolve.

### Swiss ‘Too-Big-To-Fail’ (TBTF) regulatory regime — capital and TLAC/GLAC framework
- Swiss capital requirements are consistent with Basel III measures and minimum requirements are higher than Basel minima.
- 2016 amendment to the Capital Adequacy Ordinance introduced higher capital requirements for systemically important banks and a new ‘gone concern’ requirement for G-SIBs.
- Minimum going concern capital requirements for the 2 G-SIBs:
  - 10 percent Common Equity Tier 1 (CET) plus an additional 4.3 percent of tier 1 capital.
- Gone concern loss-absorbing capacity (GLAC) capital requirement for G-SIBs: 14.3 percent (before rebate).
- Total loss-absorbing capacity (TLAC) requirement currently: roughly 26 percent (including rebates associated with structural improvements for single point of entry resolution strategy).
- Transition and phase-in timing noted in internal footnotes:
  - Transition period applicable to G-SIBs (going and gone-concern) ends on January 1, 2020.
  - For the D-SIBs, January 1, 2020 applies for their going-concern requirements; gone-concern requirements have an extended phase-in period which ends on January 1, 2026.
  - For the 3 D-SIBs the RWA-requirement is between 12.86 and 13.22 percent.
  - For the 3 D-SIBs the LR-requirement is between 4.5 and 4.62 percent.
  - For the 3 D-SIBs the buffer is 1.5 to 1.62 percent.

### Interaction of internal models-based RWAs and the leverage ratio; supervisory implications
- The Swiss G-SIBs total asset to RWA density is roughly 30 percent, at the lower end of the range for G-SIBs.
- Complementary leverage requirement: Swiss TBTF regulation requires the Swiss G-SIBs to meet a total leverage ratio of 5 percent of core capital, which includes a 2 percent leverage ratio buffer.
- Identified incentive effects and supervisory priorities:
  - Use of the leverage ratio as a backstop to an internal ratings-based approach creates incentives for banks to increase holdings of risky assets to maximize returns relative to the leverage ratio while minimizing RWA contributions via internal models.
  - This increases the importance of supervisory reviews of firms’ modeling approaches and of in-depth reviews of risk measurement practices and controls around risk identification and the data used to report those risks.
  - Supervisory focus should include risk identification and capacity to capture and report all risks across the bank to ensure comprehensiveness in models used for RWA calculations and stress testing.
- Supervisory tool recommendation: Consider inclusion of a required post-stress measure of capital based on the leverage ratio (a ‘post-stress minimum leverage ratio requirement’) for use in reviews of capital planning and stress testing.
  - Note: There are currently no explicit ‘post-stress’ capital requirements in the Swiss capital regime.
  - FINMA should consider working with other Swiss authorities to create a legal basis for minimum ‘post-stress’ requirements and the authority to restrict banks’ capital distributions when they fall short.
- Current supervisory actions:
  - FINMA can and does require Pillar 1 adjustments to increase RWAs when concerned about regulatory measurement of risks in RWA calculations.
  - FINMA uses Pillar 2 add-ons where concerns are driven by qualitative challenges.

### Supervision of risk management — processes, audits, and forward-looking supervision
- FINMA is committed to a risk-focused approach and is increasingly trying to enhance its forward-looking perspective.
  - Supervision planning and resource allocation are informed by supervisory auditors, KAM teams, semi-annual FINMA-wide ‘risk barometer’, and risk specialists’ onsite and offsite work.
- Annual supervisory audits:
  - Required for every bank and carried out by external supervisory auditors.
  - Designed by FINMA; reports are sent to both FINMA and senior management and Boards of Directors at the banks.
  - For larger firms, audits may cover parts of the review in any given year but cover all aspects over a cycle.
- Supplemental supervisory reviews:
  - FINMA carries out onsite supervisory reviews of high-risk areas.
  - FINMA can require supplementary reviews by supervisory auditors or hire external auditors for mandataries focused on in-depth reviews designed by FINMA.
  - Mandataries require a third-party auditor not involved in other aspects of a bank’s auditing to provide a ‘fresh set of eyes’ and mitigate conflict/incentive issues.

### Limitations observed in supervisory audit approach and recommended enhancements
- FSAP reviews of ‘long-form’ annual supervisory audits found:
  - Reports are useful and comprehensive but face challenges assessing governance over risk management and controls.
  - Two issues of concern:
    - Many areas covered by auditors were done with a relatively low level of assurance (“critical assessment level”), including some work in important areas such as liquidity risk management.
    - Reports did not provide an integrated view linking corporate governance assessments to the effectiveness of risk management and controls frameworks and functions.
- Recommendation: FINMA should consider ways to strengthen incentives for banks to address risk management and control deficiencies, including:
  - Addressing assessments and expectations for rapid remediation of weaknesses directly to boards and senior management.
  - Considering direct assessments of boards and senior management to increase incentives for effective performance (noting connection to corporate governance considerations and the lack of a specific assessment of senior management in the supervisory rating).

### Operational risk, cybersecurity, and liquidity supervision
- Operational risk is a key area of focus; priority areas include outsourcing to third parties, cyber security, and business continuity.
- FINMA actions:
  - Created a special team with expertise in technology infrastructure, cybersecurity, business continuity management, and oversight of banks’ outsourcing arrangements.
  - Updated and expanded the Operational Risk circular and operational risk guidance, including enhanced guidance regarding technology infrastructure and cybersecurity.
  - CAMELS rating system now includes a specific section for qualitative aspects of operational risk management; supervisory auditors must fill out a questionnaire focusing on qualitative aspects as part of annual supervisory audits.
- Liquidity supervision:
  - SIBs are held to higher liquidity standards than banks in categories 3–5, with the strongest requirements for the two G-SIBs.
  - FINMA requires firms to use internal stress testing to test sufficiency of liquidity, along with relatively strong LCR requirements and NSFR reporting.
  - FINMA has a dedicated team of liquidity risk specialists; monitoring includes required daily LCR reporting and NSFR-related reporting.
  - When liquidity management deficiencies are found FINMA has authority to apply supervisory measures that impose add-ons to quantitative liquidity buffer requirements.

### Supervision of credit risk, large exposures, conduct, and market risk
- Credit risk supervision:
  - Covered by FINMA risk specialists and annual supervisory audits; FINMA guidance and expectations set out in Circular 2017/1 and “Newsletter 22” for credit risk management, internal controls, internal rating systems, stress testing.
  - FINMA internal practice provides for onsite credit risk reviews (‘supervisory reviews’ for banks in categories 1–3 and ‘deep dive’ reviews for banks in all categories).
- Large exposure rules (Capital Adequacy Ordinance):
  - A large exposure is defined as total position for a single counterparty or group of related counterparties of 10 percent or more of the bank's adjusted eligible capital.
  - An individual large exposure must not exceed 25 percent of the bank’s adjusted eligible capital, although an exception may apply if excess is covered by sufficient ‘free eligible excess capital’.
  - Banks must monitor their ten largest borrowers or groups of related borrowers and report on them to FINMA at least annually.
  - Internally, banks must report large exposures to their boards of directors and to supervisory audit firms on a quarterly basis.
- Conduct risk supervision:
  - Enhanced since prior FSAP, including creation of specialist teams (e.g., suitability risk specialists).
  - Built on a risk-focused approach with identification through supervisory audits, onsite work, and offsite analysis using the ‘risk analysis and evaluation model’.
  - All firms are held to the same standards with FINMA striving for consistency.
- Market risk and IRRBB supervision:
  - Carried out by combination of FINMA risk experts and supervisory auditors; annual audits cover market and IRRBB practices and controls.
  - Controls around ‘high risk’ areas are reviewed more frequently.
  - For advanced approach banks, Pillar 1 measurement work is key to observing risk measurement, management and controls; FINMA can use Pillar 2 add-ons for deficiencies.
  - Given current low interest rate environment in Switzerland, particular attention is being paid to IRRBB, including at category 2 and 3 banks.

*Source: 1cheea2019004 - 45.      FINMA has revised its process for formally rating systemically-important banks to (PDF).*

### 64.      As noted above, the issuance of Circular 2017/1 included enhancements to and

### 1cheea2019004 - 64.      As noted above, the issuance of Circular 2017/1 included enhancements to and

### Corporate governance requirements under FINMA Circular 2017/1
- Circular 2017/1 clarified FINMA corporate governance expectations, including board structure requirements.
- Structural requirements:
  - All category 1–3 banks must have a board level audit committee and risk committee; category 3 banks may merge both into one committee.
  - Category 1 and 2 banks must also have compensation and board nominating committees.
  - Members of the audit committee are required to be ‘substantially independent’, with independence defined as including not having worked at the bank or as a lead auditor of the bank’s audit firm for at least two years and having no commercial ties to the bank.
- Additional governance requirements in Circular 2017/1:
  - SIBs must have a separate risk committee.
  - Category 3 banks must have a separate audit and risk committee.
  - Banks in categories 1–3 must have a dedicated CRO; the CRO must be part of the executive board for banks in categories 1–2.
  - A third of the board members are required to be independent.

### Supervision, assessments, and accountability
- FINMA does not provide an explicit written assessment of the effectiveness of banks’ boards of directors and senior management.
  - FINMA raises corporate governance concerns in its yearly assessment letter to banks when material, but lacks an explicit assessment of overall board and senior management effectiveness.
  - Consequence: the lack of an explicit assessment can undermine the roles of boards and senior management in ensuring effective risk management, internal controls, and a strong internal audit function, and makes holding them appropriately accountable more difficult.
- Corporate governance is broadly assessed in annual supervisory audits, but these assessments do not always link directly to assessments of practices for which senior management and boards are responsible.
- FINMA still lacks an explicit legal basis for a thorough assessment of banks’ boards and senior management.

### Role of supervisory auditors and external auditors
- FINMA’s internal process for rating supervised banks relies substantially on input from supervisory auditors who are in almost all cases the same firms that perform the banks’ financial audits (and in some cases other ‘advisory’ work).
- Supervisory auditors’ assessments of corporate governance do not appear to be well informed by the external auditors’ assessments of specific areas such as risk management, internal controls, and the banks’ internal audit function carried out during annual supervisory audits.
- The supervision of corporate governance and developing an integrated view of how well the bank is being run is likely among the least well suited areas for coverage primarily by external auditors; this area should receive more direct attention from FINMA or through use of mandataries.
- Enhancements to supervisory audit framework and auditor guidance:
  - Revised FINMA Circular 2013/3 on auditing became effective on 1 January 2019 and provides additional guidance to auditors in risk assessments, focusing on banks of categories 1 and 2.
  - The FAOA has been responsible for prudential auditors’ performance since 2015.
  - External auditors’ documents are subject to review by FINMA.
  - FINMA is requiring external supervisory auditors to adopt a more risk-focused approach and to carry out ‘deep dive’ reviews rather than focusing primarily on annual supervisory audits.

### Compensation systems and related standards
- FINMA’s supervision of corporate governance includes considerable attention to banks’ compensation systems.
- FINMA updated standards for compensation through its 2016 amendment to Circular 2010/1, covering minimum standards for compensation systems at financial institutions.
- The standards are consistent with the FSB ‘Remuneration Principles’ and set detailed expectations for:
  - Appropriateness of incentives;
  - Alignment with risk, including reputational risk;
  - Long-term orientation;
  - Alignment with capital, liquidity and other issues directly associated with the financial strength of the bank.

### Fit and proper assessments, licensing, and senior personnel
- Through the bank licensing process, FINMA reviews proposed board members and senior management as part of its fit and proper assessments, considering qualifications and expertise.
- FINMA reviews ‘fit and proper’ criteria when there are changes in functions of board members or senior managers or when there is evidence they are not fulfilling required duties.

### Implementation progress and supervisory resourcing (Appendix I: 2014 FSAP actions taken)
- FINMA direct on-site work increased by about 44 percent during 2014–17.
- Key implementations and status updates (selected):
  - CP8 (Supervisory approach): Implemented. FINMA Circular 2017/1 introduced qualitative elements of risk management and governance standards, requirements on boards’ risk-specific expertise and independence, and on the CRO function. The risk rating system was revised in 2018 to include forward-looking evaluations.
  - CP9 (Supervisory techniques): Implemented. Revised Circular 2013/3 effective 1 January 2019; FAOA responsible for prudential auditors’ performance since 2015; FINMA increased direct on-site work and is moving auditors to deeper, risk-focused reviews.
  - CP14 (Corporate governance): Implemented. Recommendations addressed in Circular 2017/1, including separate risk committees for SIBs; category 3 audit and risk committee; dedicated CRO for categories 1–2; one-third independent board members.
  - CP15 (Risk management): Implemented. Circular 2017/1 includes risk management requirements; SIBs discuss capital planning at least annually; FINMA performs semi-annual enterprise-wide stress testing with the G-SIBs and ad-hoc with D-SIBs and selected mid-size banks; thematic reviews on risk data ongoing with G-SIBs.
  - CP24 (Liquidity risk): Implemented. Qualitative and quantitative requirements updated in January 2018 in line with the Sound Principles of the Basel Committee; NSFR to enter into force in line with the most important international financial centers.
  - CP25 (Operational risk): Implemented. Qualitative requirements updated; separate team responsible for operational risk, cybersecurity and IT with additional staffing; supervisory rating system includes specific assessment of qualitative operational risk management.
- Areas partially implemented or not implemented:
  - CP1: Partially Implemented. FINMA’s competitiveness objective not formally elevated, but mandate expanded in 2018 to include the future viability of the financial center at the same secondary level as competitiveness.
  - CP2: Partially Implemented. FINMA staffing resources have not increased; FINMA plans to increase overall resources due to new tasks; FINMA Pillar 2 powers unchanged.
  - CP6: Not Implemented. No change to the framework for the definition of qualified participation.
  - CP19: Not Implemented. Onsite prudential audits must include all concentration risks, but FINMA finds existing large exposures regulation detailed and has not added audit instructions; further thematic reviews are needed.
  - CP20: Partially Implemented. FINMA Circular 2015/1 requires presentation in notes of transactions with related parties with attestation they are at market conditions; the definition of related parties transactions has not been updated.
  - CP12: Implemented. Recovery and bankruptcy jurisdiction extended to group parent companies and group companies performing significant functions (Article 2 bis BA; in force since 2016).

*Source: 1cheea2019004 - content as provided*

---


_Source: https://www.imf.org/-/media/files/publications/cr/2019/1cheea2019004.pdf_