Generative AI in Swiss Banking: Use Cases, Regulation and Governance

01 / MARKET CONTEXT

How widely are Swiss financial institutions adopting AI?

AI is moving beyond isolated experimentation, but adoption is uneven. FINMA’s survey of approximately 400 Swiss financial institutions, conducted between late November 2024 and mid-January 2025, found that around half used AI or had initial applications in development. A further quarter intended to use AI within three years. Among institutions already using AI, 91% reported using generative AI. FINMA also found that only around half had incorporated AI into an explicit strategy. [FINMA, 2025]

These are institution-level survey results across banks, securities firms, insurers, fund managers, asset managers, and financial-market infrastructures—not a survey of bank employees alone. The SBA’s 2025 report separately cites an Accenture estimate that six in ten bank employees were already using GenAI in day-to-day work in 2024. The two figures measure different things and should not be treated as interchangeable. [SBA, 2025]

Why the Swiss banking sector matters

Banking is economically significant, but it is important to use the correct denominator. The SBA’s 2025 summary reports approximately 160,000 full-time-equivalent employees in banking and around CHF 43 billion in annual gross value added—approximately 5.5% of Swiss GDP. The broader financial sector, which includes insurance and other financial services, is larger. The often-quoted 9%–9.4% contribution refers to the wider financial sector, not banking alone. [SBA, 2025]

The implementation gap: pilots are not production systems

A December 2025 study led by Swiss FinTech Innovations (SFTI) and the Institute for Finance and Law at the Eastern Switzerland University of Applied Sciences (OST) examined why AI projects in Swiss financial services struggle to move from proof of concept to production. In its member survey and expert interviews, approximately 40% of initiatives remained in ideation or feasibility analysis, 17% had reached deployment, and 11% were in scaling. The study reported that 65% of production cases met or exceeded expectations. These figures are from the study’s participating institutions, not a census of the entire Swiss financial sector. [SFTI / OST, 2025]

The practical lesson is straightforward: banks need a defined business problem, reliable data, operational ownership, compliance involvement, and measurable acceptance criteria before they scale. A successful demonstration is not evidence that an application is ready to handle customer data or influence a regulated decision.

02 / BANKING APPLICATIONS

Where can Swiss banks use generative AI?

The SBA groups banking use cases into four areas: employee productivity, operational efficiency, customer experience, and enhancement of existing products and services. The distinction between GenAI and other forms of AI matters. KYC document extraction, transaction anomaly detection, watchlist screening, and credit scoring often rely on OCR, rules, statistical models, or conventional machine learning. GenAI can assist the people who investigate, interpret, and document those processes; it should not be credited with every AI capability in the workflow.

Match the technology to the task

03 / LEGAL FRAMEWORK

What laws and regulations apply to GenAI in Swiss banking?

Switzerland does not yet have an overarching statute dedicated to AI. That does not mean banks operate in a regulatory vacuum. Existing data-protection, banking, confidentiality, outsourcing, operational-risk, consumer-protection, and financial-market requirements apply according to the activity and the institution concerned.

Federal Act on Data Protection (FADP)

The FADP applies when a bank processes personal data relating to natural persons. Relevant principles include lawfulness, good faith, proportionality, purpose limitation, transparency, accuracy, and data security. Banks should identify what personal data an AI application receives, why it is processed, whether the use is compatible with the original purpose, who can access it, how long it is retained, and whether it is disclosed to another party.

Data protection impact assessments: Article 22 requires a DPIA before processing that is likely to result in a high risk to a person’s personality or fundamental rights. The assessment should describe the planned processing, evaluate the risks, and identify protective measures. The use of new technology is relevant to the risk assessment, but not every GenAI pilot automatically requires a DPIA. The bank must assess the nature, extent, circumstances, purpose, and likely impact of the particular processing. [FADP, Arts. 6 and 22]

Automated individual decisions — FADP Article 21

Article 21 applies to a decision based exclusively on automated processing that has legal consequences for the data subject or significantly affects them. The controller must inform the person that such a decision has been made. On request, the person may express a point of view and request review by a natural person. The Act provides exceptions, including certain contract-related decisions where the person’s request is granted and cases of explicit consent.

This is not a rule that every AI-assisted recommendation must receive human review under Article 21. The statutory test is whether the decision is exclusively automated and has the specified effect. A bank should nevertheless design meaningful human challenge where the risk, customer impact, or other applicable obligations require it. A nominal approval click is not a substitute for a reviewer who has relevant information and authority. [FADP, Art. 21]

Cross-border data transfers and data residency

The FADP does not impose a blanket rule that all personal data processed by a Swiss private bank must remain physically in Switzerland. Article 16 permits cross-border disclosure where the destination has an adequate level of protection or where appropriate safeguards—such as recognised contractual clauses or binding corporate rules—are in place. The controller remains responsible for ensuring that the transfer is lawful and that the safeguards are effective. [FDPIC, Cross-border transfer of personal data]

That does not make location irrelevant. FINMA Circular 2023/1 requires increased risks to be mitigated and monitored where critical data are stored outside Switzerland or can be accessed from abroad. A bank must also consider banking secrecy, outsourcing, contractual rights, government-access exposure, support access, backups, subcontractors, and the ability to retrieve or delete data. Data residency is one part of the analysis, not the whole control environment. [FINMA Circular 2023/1]

Banking secrecy — Banking Act Article 47

Article 47 protects confidential information entrusted to people in specified bank-related roles and attaches criminal consequences to unlawful disclosure. Client information can remain protected when a bank uses an external technology provider. The fact that a service is delivered through an API or hosted in a cloud environment does not remove the bank’s confidentiality obligations.

The SBA’s 2025 report recommends that employees should not use client-identifying data in GenAI prompts or for model training. This is a sound default for public or unapproved AI tools. It should not be misrepresented as a standalone statutory sentence that categorically prohibits every controlled external processing arrangement. For an approved provider, the bank must assess whether the disclosure and processing are permissible and ensure appropriate confidentiality, contractual, technical, and organisational safeguards. [Banking Act, Art. 47] [SBA, 2025]

Practical default: do not paste identifiable customer records, account details, credentials, internal investigation material, or confidential business information into a public consumer GenAI service. Use only approved environments with defined data permissions, retention and deletion terms, access restrictions, no unauthorised model training, logging, and a documented supplier assessment.

Unfair Competition Act (UCA)

The UCA prohibits misleading business practices and incorrect or misleading information about a company’s services, prices, or commercial relationships. It can therefore be relevant when a bank uses a chatbot or generated marketing content that misrepresents a product, creates a false impression, or presents inaccurate claims. The UCA does not establish a general rule that every Swiss chatbot must identify itself as AI. Any disclosure duty should be traced to the actual applicable provision, processing context, and jurisdiction—not inferred from the general prohibition on misleading conduct. [UCA, Arts. 2–3]

FINMA Guidance 08/2024

FINMA published Guidance 08/2024 on December 18, 2024. It states that Switzerland had no AI-specific legislation at that time and that technology-neutral, principle-based financial-market requirements already cover risks arising from AI. FINMA expects supervised institutions to consider how AI changes their risk profile and to adjust governance, risk management, and controls proportionately to the institution and the materiality of each application. [FINMA Guidance 08/2024]

The guidance is a supervisory communication describing FINMA’s observations; it is not a standalone AI act or a circular that creates a separate list of statutory AI obligations. FINMA’s circulars, by contrast, explain how it applies financial-market legislation in its supervisory work. [FINMA, Supervisory practice]

Outsourcing and operational resilience

FINMA Circular 2018/3, Outsourcing, addresses outsourcing arrangements within its scope. The bank must assess the service, provider, data, access, audit rights, subcontracting, location, and ability to continue or recover the outsourced activity. Not every purchase of software automatically constitutes a material outsourcing arrangement; the bank must assess the substance and significance of the service.

FINMA Circular 2023/1, Operational risks and resilience – banks, entered into force on January 1, 2024. It covers operational risk, ICT risk, cyber risk, critical data, business continuity, and operational resilience for the institutions within its scope. It requires proportionate implementation and addresses the ability to continue critical functions during disruption. These requirements are directly relevant when a GenAI application supports a critical banking process or depends on external ICT services. [FINMA Circular 2018/3] [FINMA Circular 2023/1]

EU AI Act — when does it apply to a Swiss bank?

The EU AI Act can apply to providers and deployers established outside the EU. Article 2 includes third-country providers and deployers where the output produced by the AI system is used in the EU, as well as providers placing AI systems or general-purpose AI models on the EU market. A Swiss bank is not automatically subject to the entire Act simply because it has EU customers. It must assess its role, the system, where the output is used, and the relevant business activity. [EU AI Act, Art. 2]

As of October 2026, the Act’s general provisions and prohibited-practice rules have applied since February 2, 2025; general-purpose AI obligations since August 2, 2025; and most remaining provisions, including relevant transparency requirements, since August 2, 2026. Article 50 includes transparency obligations for certain AI interactions and generated or manipulated content. Under the 2026 amendment, Annex III high-risk requirements are scheduled to apply from December 2, 2027, and Annex I product-related high-risk requirements from August 2, 2028. [EU AI Act] [Regulation (EU) 2026/1744]

For banks, certain systems used to evaluate the creditworthiness of natural persons or establish their credit score fall within Annex III’s high-risk category. Systems used for the purpose of detecting financial fraud are excluded from that particular category. This is a specific classification rule, not a general exemption from the Act or other financial-sector obligations.

04 / SUPERVISORY EXPECTATIONS

What does FINMA expect banks to demonstrate?

FINMA Guidance 08/2024 is unusually useful because it describes specific weaknesses observed in supervision rather than relying only on high-level principles. It identifies seven areas: governance; inventory and risk classification; data quality; testing and ongoing monitoring; documentation; explainability; and independent review.

FINMA also stresses proportionality. It notes that AI is not automatically a high-risk application: risk depends on factors such as complexity, adaptability, autonomy, use context, and integration into processes. Applications used for regulatory compliance or critical functions, or those with significant effects on customers or employees, tend to warrant greater attention. [FINMA Guidance 08/2024]

Third-party exposure is not a theoretical issue

FINMA’s Risk Monitor 2025 reports that eight out of ten banks outsource significant parts of their ICT infrastructure and that nine out of ten banks outsource at least part of a critical function. It also reports that approximately 47% of cyber incidents reported to FINMA came through third parties. These are sector-wide outsourcing and cyber findings, not GenAI-specific statistics. They nevertheless show why an AI application cannot be assessed only at the model-provider level. [FINMA Risk Monitor 2025]

A bank should map the entire service chain: the application supplier, model provider, cloud or hosting environment, data sources, retrieval service, identity provider, support access, and subcontractors. The bank remains responsible for managing the risks of outsourced activities within the applicable framework.

05 / TECHNICAL ARCHITECTURE

How should a bank design a secure GenAI architecture?

Architecture decisions should follow the data classification, business purpose, operating model, and consequences of failure. “Cloud versus on-premises” is not a complete risk assessment. A well-controlled cloud service may be more secure than a poorly maintained local deployment; an on-premises model may reduce some data-transfer exposure while creating additional responsibility for patching, infrastructure, monitoring, and specialist staffing.

Cloud, on-premises, or hybrid?

RAG versus fine-tuning

These techniques solve different problems. They should be selected based on what the application needs to know or do.

RAG can make answers more traceable, but it does not guarantee that the model will retrieve the right passage, interpret it correctly, or cite it accurately. Fine-tuning is not a reliable substitute for a maintained knowledge base when policies and facts change frequently. The SBA describes RAG as a practical way to provide company-specific knowledge and notes the ongoing work needed to maintain a robust document pipeline. [SBA, 2025]

Security controls for LLM and RAG applications

The OWASP Top 10 for Large Language Model Applications 2026 includes prompt injection, sensitive-information disclosure, excessive agency, supply-chain risk, data and model poisoning, unbounded consumption, misinformation, hidden-context exposure, vector and embedding weaknesses, and improper output handling. Banks should use the current list as a threat-modelling input, not as a substitute for application-specific testing. [OWASP GenAI Security Project, 2026]

• Identity and access: enforce least privilege across users, models, retrieval services, connectors, and tools. Apply document-level permissions during retrieval, not only at the user interface.
• Data protection: classify and minimise prompt content; redact unnecessary identifiers; restrict sensitive data; control retention, logging, and provider access.
• Prompt injection: treat retrieved documents, emails, websites, and tool outputs as untrusted content. Test direct and indirect injection paths and do not rely on prompt instructions alone as a security boundary.
• RAG integrity: validate sources before ingestion, track document versions, restrict write access to indexes, detect poisoned content, and test retrieval boundaries.
• Output handling: validate model outputs before they are rendered, stored, sent to customers, or passed to another system. Do not execute generated code or instructions without separate controls.
• Monitoring: log relevant prompts, retrieval identifiers, model versions, tool calls, approvals, and outcomes under appropriate access and retention controls.
• Resilience: define rate limits, capacity limits, cost controls, fallback procedures, safe-disable capability, and incident response for provider or model failures.

Agentic AI: keep permissions narrower than capability

The SBA distinguishes a predefined workflow from an agent. A workflow follows a designed sequence of steps; an agent can dynamically choose tools and determine parts of its own execution path. That flexibility can help with open-ended tasks, but it also increases the importance of permissions, testing, and intervention. [SBA, 2025]

For predictable banking processes, start with a controlled workflow. If an agent is justified, constrain it with:

• separate service identities and least-privilege permissions;
• allow-listed tools and narrowly scoped APIs;
• read-only access by default, with explicit approval for write actions;
• transaction and value limits, separation of duties, and human authorisation for consequential actions;
• bounded execution steps, timeouts, rate limits, and safe stopping conditions;
• complete logs of inputs, retrieved context, tool calls, approvals, and resulting changes; and
• tested rollback, manual fallback, and revocation of credentials.

An agent should not be able to approve its own transaction, modify its own permissions, or bypass the bank’s existing segregation-of-duties controls. A human approval step must be placed before the action that matters, not after the agent has already committed it.

06 / IMPLEMENTATION ROADMAP

How should a bank apply the SBA’s four-phase adoption roadmap?

The SBA framework organises implementation across three task streams—strategy, organisation, and technology—and four phases. This is a practical reference rather than a mandatory sequence. Banks can adapt it to their size, maturity, and existing controls. [SBA, 2025]

Use a disciplined method to prioritise projects

The SBA report describes a “3-2-1” approach used by Raiffeisen: narrow three initial ideas to two feasible use cases, then prioritise one implementation project. The value assessment should consider scalability, revenue or cost effects, risk reduction, and customer benefit. Feasibility should consider data availability, technical architecture, employee readiness, regulatory and customer acceptance, reliability, security, and fairness. [SBA, 2025]

For core banking processes, the SBA recommends beginning with passive operation and human oversight. That means the system can produce recommendations or drafts while existing processes continue to make the decision. The bank can compare the AI output with actual results before granting it greater influence.

07 / ASSURANCE AND AUDIT

What controls and evidence should a bank retain?

Auditors need more than a policy stating that GenAI is governed. The bank should be able to show how a particular application was approved, what it can access, how it was tested, which limitations remain, who reviews its outputs, and what happens when it fails or changes. The following is a practical evidence set informed by FINMA’s observations and the SBA framework; it is not a universal regulatory checklist.

Useful performance and risk indicators

Metrics need a baseline and a defined owner. Adoption is not the same as value, and a low error rate in a small test set does not establish safety in production. A bank should record the tested population, sample size, test conditions, model version, and known limitations when reporting results.

What should internal audit examine?

• Is the AI inventory complete enough to include purchased, embedded, employee-accessible, and business-unit-developed tools?
• Do risk classifications reflect customer impact, autonomy, data sensitivity, criticality, and process integration?
• Are the business owner, technical owner, control owner, and approval authority clearly identified?
• Do supplier contracts and technical controls address data use, retention, model training, subcontractors, change notice, audit access, and exit?
• Do evaluation results support the claims made about accuracy, reliability, and suitability for the approved task?
• Can the bank reconstruct an AI-assisted decision from the information available at the time?
• Can the service be disabled and the business process continued safely?
• Are findings, overrides, incidents, and material changes feeding back into reassessment?

Related InfoSecured.ai resources: the Evidence Library, Human Oversight, Vendor AI Risk, Model Risk Support, and the ISO/IEC 42001 implementation guide.

08 / FIRST 30 DAYS

A practical 30-day starter plan for a Swiss bank

A month is enough to establish governance boundaries and launch a controlled proof of concept. It is not enough to validate a complex system for unrestricted production use. The objective is to create a decision-ready pilot with evidence, not to rush a model into a critical workflow.

Production gate: do not move a pilot into a customer-impacting or critical process until the bank has approved the use, verified the relevant controls, documented limitations, tested fallback, and assigned ongoing monitoring and review responsibility.