Contents
- What Guidance 08/2024 is
- The seven checkpoints and what they mean in practice
- FINMA’s 2025 survey in figures
- Why this matters to providers who are not supervised
- What the guidance offers a fiduciary firm or an SME
- A checklist in plain language
- How Grow Amplified holds itself to this
- Frequently asked questions
Key points
- FINMA Guidance 08/2024 of 18 December 2024 describes what FINMA looks at when supervised institutions use AI. It records what FINMA observed in ongoing supervision. No new law comes with it.
- The seven checkpoints are governance, inventory and risk classification, data quality, tests and ongoing monitoring, documentation, explainability and independent review.
- In a FINMA survey of around 400 institutions, around 50% use AI or have first applications in development, and smaller institutions often rely exclusively on externally developed applications.
- Providers who work for financial institutions are asked about the same points even if they are not supervised themselves: whether AI is involved, which data it uses, who is responsible and how it is tested.
- For fiduciary firms and SMEs the guidance is not an obligation, but it is a useful checklist: an inventory, a named owner per tool, tests on known cases and a log.
What Guidance 08/2024 is
On 18 December 2024, FINMA published Guidance 08/2024 on governance and risk management when using AI. It is addressed to supervised institutions, that is, institutions holding a FINMA licence such as banks and insurers, and the English version runs to seven pages.
The guidance is not a law and not a new rulebook. FINMA notes that at the time there was no AI-specific legislation in Switzerland, and that the existing technology-neutral requirements for governance and risk management already cover the risks arising from AI. It then describes what it observed in supervisory discussions and initial on-site reviews, and what it assessed institutions against. How much a point demands depends on the size, complexity and risk profile of the institution, and on how material an application is.
In short, the guidance shows which questions the supervisor asks. For firms with clients or applications in the EU, the EU AI Act comes on top. What applies there after the omnibus is covered in EU AI Act after the omnibus.
The seven checkpoints and what they mean in practice
FINMA groups its observations into seven points. Each entry starts with what FINMA observed or assessed and ends with what it means in an office.
- Governance
- Who is responsible for what. FINMA observed that institutions focus mainly on data protection and less on model risks such as a lack of correctness or robustness, and that AI is often developed in scattered places across the organisation. It assessed whether responsibilities for development, implementation, monitoring and use are defined, whether there are standards for testing and documentation, and whether staff are trained. In practice: every AI tool has a named owner, and a written rule says who may use it for what.
- Inventory and risk classification
- A complete list of all AI applications, each rated by how much depends on it. FINMA observed that some institutions defined AI narrowly and that inventories had gaps, because generative AI is now accessible to everyone. In practice: the list includes the chatbot in the browser, the AI feature in the accounting software and the translation tool. Anything that touches client data or decisions about clients goes to the top.
- Data quality
- AI learns from data and works with data. According to FINMA, data quality is often more important than the choice of model, and with purchased solutions institutions often do not know the underlying data. In practice: before a tool delivers results, check whether its data is complete, correct and current, and who maintains it.
- Tests and ongoing monitoring
- FINMA assessed whether experts set expectations in advance, whether performance indicators are defined and whether outputs are checked regularly, for example through sampling or predefined test cases. It explicitly mentions cases in which users ignored or changed an output: such corrections reveal weaknesses. In practice: test a tool on cases whose correct result you already know before it handles new ones, and count how often your team corrects a result.
- Documentation
- For material applications, FINMA looked at whether purpose, data selection, assumptions, limitations, tests, controls and fallback solutions are documented, and whether the documentation is detailed enough and written for its readers. In practice: one page per tool is enough to start with: what it is for, which data it uses, where its limits are and what happens if it fails.
- Explainability
- FINMA observed that results often cannot be understood, explained or reproduced, so they cannot be critically assessed either. It looked more closely wherever a decision has to be justified to clients, employees, the supervisor or the audit firm. In practice: every result shows which document and which rule it came from. If nobody can show that, the result carries no decision.
- Independent review
- Whoever builds an application does not sign it off alone. FINMA did not see a clear separation between development and independent review in all cases, and only a few institutions had the entire development process reviewed by qualified staff. In practice: a second person who did not build the tool reviews it and its results, and the findings go into the next version. That is the four-eyes principle applied to the tool itself.
FINMA’s 2025 survey in figures
FINMA measured how far AI has spread in institutions shortly afterwards. Between the end of November 2024 and mid-January 2025, it surveyed around 400 licensed institutions, from banks and securities firms to insurers and fund management companies (FINMA press release). Around 50% use AI or have first applications in development. Of those using AI, 91% also use generative AI such as newer chatbots.
For service providers, the most important sentence comes further down: most institutions use external providers alongside their own developments, and smaller institutions often rely exclusively on externally developed applications. The institutions rank data quality, data protection and explainability as their highest-priority AI risks. AI often comes from outside.
Why this matters to providers who are not supervised
The guidance is addressed to institutions, yet its questions reach their providers. FINMA reports that, with purchased applications, institutions sometimes struggled to establish whether AI was included at all, which data and methods were used and whether sufficient due diligence existed. For outsourcing, FINMA assessed whether institutions had introduced additional tests, controls and contractual clauses on responsibility and liability, and whether the provider had the necessary skills and experience.
As we understand it, these questions end up with the provider, in the questionnaire before an engagement or in the contract. Anyone working for financial institutions does well to have the answers in writing before anyone asks.
What an institution wants to know
- Whether AI is involved, and at which work step
- Which data it uses and where that data is processed
- Who is responsible when a result is wrong
- How the work is tested and monitored
What a provider has ready in writing
- A list of the work steps in which AI takes part
- The place of processing and a data processing agreement
- A named person at the institution who approves, and the matching clause in the contract
- Test cases with known results and a log of every step
What the guidance offers a fiduciary firm or an SME
A fiduciary firm handling bookkeeping and tax, or an owner-led SME, is generally not supervised by FINMA. For them, the guidance is not an obligation. It is still useful, because it asks the questions a client, an auditor or an insurer will ask when an AI result turns out to be wrong: who was responsible, which data was used and who checked the result. What AI can do in fiduciary work in the first place is explained in AI in the fiduciary office, explained simply.
Data quality is the point most often underestimated. In a pilot at a fiduciary and property management firm, 54% of the 2025 bookkeeping hours were filed under “miscellaneous”. No AI can tell from such a line what was done and for whom. A single pilot, not an average and not a promise. To see how it looks in your office, use the free Flat-Fee Leak Check on one mandate.
A checklist in plain language
The eight points below turn the guidance into work steps. You do not need a new tool for this; a spreadsheet is enough.
- Inventory: write down every AI tool used in your firm, including the free ones in the browser and the AI features inside existing software.
- Rating: mark the tools that receive client data or whose results affect a client directly. These tools come first.
- Ownership: every tool gets a named person.
- Data: check whether the data is complete, correct and current, and who maintains it.
- Test: have the tool process old cases whose correct result you know, and compare.
- Monitoring: count how often your team corrects or discards a result. If the number rises, look into it.
- Documentation and explainability: one page per tool covering purpose, data, limits, what happens if it fails and how a result can be traced back to its source.
- Approval and a second look: a person approves whatever leaves your firm, and a log records who did so and when. At set intervals, someone who did not build the tool reviews it as a whole.
How Grow Amplified holds itself to this
Grow Amplified has aligned its values with principles that Swiss supervisors and lawmakers also work from, including this guidance. That leads to fixed rules: every review lane has a named owner on the client's side, every rule is written in plain language, every step goes into the replay log, and anything that does not fit is flagged and never silently corrected. This is our own commitment, and no authority has checked it.
What documentation and independent review look like across many client files is shown in Making KYC files review-ready. Who is behind Grow Amplified and where the firm's limits lie is set out under Company.
Frequently asked questions
Does FINMA Guidance 08/2024 apply to fiduciary firms?
It is addressed to institutions supervised by FINMA. A fiduciary firm handling bookkeeping and tax is generally not one of them. Whether your firm is subject to other rules for particular activities is a question for your legal adviser. As a checklist, the guidance works for any firm.
Is the guidance a law?
No. It describes what FINMA observed and assessed in ongoing supervision. The institutions' obligations come from the existing requirements for governance and risk management, which FINMA describes as technology-neutral and as covering AI.
What does a financial institution ask a provider about AI?
As we understand it, four topics come up: whether AI is involved and where, which data it uses and where that data is processed, who is responsible for results, and how the work is tested and monitored. For outsourcing, FINMA also mentions contractual clauses on responsibility and liability.
Does Grow Amplified carry out activities that require a licence?
No. Grow Amplified takes on no activity that requires a FINMA licence or membership of a self-regulatory organisation. For financial institutions, it prepares and documents. The decision is taken by the people who are licensed and responsible for it.
If I do only one thing, where do I start?
With the inventory. Write down which AI tools are used in your firm and whether client data goes into them. The other six points build on that list.
15 years in banking and consulting, in transformation and finance operations. Today he builds review lanes with Grow Amplified: agents read and reconcile, a person approves, and a replay log records who decided what.