Supply Chain Archive | Pragmatica AG Ihre Boutique Managementberatung seit über 25 Jahren. Thu, 21 May 2026 18:57:35 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 FINMA Risk Monitor 2025 https://www.pragmatica.ch/en/finma-risk-monitor-2025/ Mon, 16 Mar 2026 15:28:56 +0000 https://www.pragmatica.ch/?p=7165 Analysis of the FINMA Risk Monitor 2025. Learn how new enforcement powers, outsourcing risks, and cyber threats affect Swiss banks and financial institutions.

Der Beitrag FINMA Risk Monitor 2025 erschien zuerst auf Pragmatica AG.

]]>

FINMA Risikomonitor 2025

  • FOCUS TOPIC

FINMA has published their Risk Monitor in November 2025.
Here's What That Means for You.

The FINMA Risk Monitor 2025 marks a turning point, because Switzerland’s financial regulator is no longer just setting requirements, it is enforcing them. The window between “we should” and “we must prove we did” has closed.
 
At Pragmatica, our Security and Regulatory experts have analyzed the Risk Monitor and distilled 5 Focus Areas that demand immediate attention from CISOs, risk officers, and board-level stakeholders.
Disclaimer:

The FINMA Risk Monitor 2025 covers a broad range of risk areas. In this article, we focus specifically on the topics related to cybersecurity, ICT risk, and operational resilience, as these reflect our core consulting expertise.

1. Extension of Jurisdiction:
Accountability Doesn't Stop at Your Front Door

FINMA expects full governance, accountability, and audit-ready evidence wherever outsourcing touches critical functions. Nine out of ten banks outsource critical functions, yet the duty of care and responsibility cannot be delegated.

The question for your organization:

Can you demonstrate that you hold full accountability and an adequate 3rd party risk management for all outsourced critical functions?

How we can help

We've helped banks (FINMA categories 2 to 5) to build and implement 3rd party risk management frameworks.

In this process, we develop the required regulatory evidence to help you achieve an audit-ready state.

The institutions that act before the auditor arrives have significantly more control over the outcome.

Want the Full Picture?
Download Our Report or Schedule a Call with us!

Our comprehensive slide deck goes deeper into each focus area, covering our frameworks, our service offering, and our proven audit methodology.
Download Report
Schedule Call

2. Supervisory Focus:
From Circulars to Consequences

This is a sea-change: FINMA has begun auditing third parties directly, using its own personnel and mandated auditors. Existing circulars are no longer guidance, they are considered audit criteria.

The question for your organization:

Are your risk tolerances, reporting thresholds, and escalation processes ready to withstand a supervisory review?

How we can help

Our pragmatic approach includes pre-audit gap analysis, coached dry runs, and targeted mock interviews.

We identify and address your individual regulatory challenges and improve not only your operational resilience but systematically improve and mature your audit lifecycle.

3. Third-Party Risk:
From "Outsourcing" to "Supply Chain"

FINMA is broadening its scope from traditional outsourcing to the full supply chain, including your partners’ subcontractors. The outsourcing party is legally responsible for its entire downstream chain.

The question for your organization:
Do you have a structured Third Party Risk Management (TPRM) framework with provider tiering, concentration risk assessment, and ongoing assurance?

How we can help

We've built and operationalized TPRM frameworks for institutions from Category 3 to 5 banks to large financial services providers, with clear tasks, authorities, and responsibilities across all stakeholders.

4. Insider Threats:
Formally Elevated, Broader Than You Think

Insider threats are now a distinct, formally recognized risk category. FINMA’s emphasis: deliberate malicious acts over simple human error. And the scope extends to third-party personnel, not just your own employees.
The question for your organization:

Does your insider threat program go beyond DLP?
Does it cover third parties, and does it address digital, physical, and personnel attack surfaces?

How we can help

Our Insider Threat and Risk Management (ITRM) framework, anchored in ASIS ESRM 2019, has helped a systemic bank close its regulatory findings and receive formal approval from the regulator's appointed auditors.

All our Frameworks are based on industry standards and best practices, fully customizable to your needs and preferences.

5. Cyber & ICT Risks:
The Trend Is Upward

Cyber and ICT risks continue to increase. FINMA expects a shift from perimeter defense to integrated operational resilience across the entire supply chain.

The question for your organization:

Are your vulnerability management, detection capabilities, and incident response processes aligned with current regulatory expectations?

How we can help

From vulnerability management roadmaps to threat-led tabletop exercises, we combine deep technical expertise with regulatory fluency to deliver proportionate, business-sensitive solutions.

Let's Talk About Your FINMA Readiness​

Whether you're preparing for an audit, closing findings, or proactively assessing your position against the Risk Monitor:

We're ready when you are.

Download our full FINMA Risk Monitor 2025 Report:

Download Report

Or, get in touch with our experts now to learn more:

schedule call
Name
What areas would you like us to focus on?

Disclaimer

The FINMA Risk Monitor 2025 covers a broad range of risk areas. In this article, we focus specifically on the topics related to cybersecurity, ICT risk, and operational resilience, as these reflect our core consulting expertise.

Meet the Team

André Bussmann berät als Senior Partner bei Pragmatica AG zu Operational Resilience, BCM, GRC und Data Privacy. CISM, PMP, OneTrust Certified Privacy Professional.

André Bussmann

Senior Partner, Head Information/Cyber Security, GRC & Privacy

+41 41 749 10 15 | +41 76 563 20 00
andre.bussmann@pragmatica.ch

Beratungsschwerpunkte / Expertise

  • Projekt- und Programm Management für Business und IT
  • Business und IT Transformations- und Change-Management
  • Beratung und Implementierung regulatorischer Anforderungen für Banken und Versicherungen
  • Spezielle Fachgebiete sind Operational Resilience/BCM, Information/Cyber Security, GRC (Governance, Risk & Compliance) und Data Privacy (GDPR & CH DSG)


Relevante Berufserfahrung, Abschlüsse und Ausbildungen

  • > 25 Jahre Projekt- und Programm Management nationale und internationale Projekte in der Finanzdienstleistungsbranche
  • > 20 Jahre Business- und IT-Projekte in der Umsetzung regulatorischer Anforderungen in der Finanzdienstleistungsbranche
  • > 10 Jahre Outsourcing (Near- und Offshoring) von Business & IT Services
  • Zertifizierungen: Certified Information Security Manager (CISM) von ISACA, Project Management Professional (PMP) von PMI, Prince 2 Practioner
  • Ausbildungen in Lean Management, Design Thinking, PROSCI Change Management, OneTrust Certified Privacy Professional
Linkedin Xing
Tarik Kayapinar – Information Security & Risk Management | Pragmatica AG

Tarik Kayapinar

Motto:
“Positive thinking and belief in yourself, are the way to success.”

Why Pragmatica:
Pragmatica allows me to develop in an exciting environment in customer projects or in internal fields of activity. Here, I can further deepen my strengths as well as learn new skills that strongly promote my further development. The collegial and familiar environment at Pragmatica is important to me, so I feel at home.

Consulting focus/ Expertise

  • Information security management (ISMS) in banking and insurance industry
  • Risk management e.g. in banking sector (CH) and in mobility and transport group (DE)
  • 3rd party security and contract management in the insurance industry
  • Identity & Access Architecture and Data Compliance in the banking sector
  • Internal auditing in the financial services sector
  • Business Continuity Management System (ISO 22301)
  • Data Protection Management (GDPR): Implementation and internal training
  • ISMS focus areas: Leadership, risk management, supplier management, physical security, incident management, BCM, compliance, and asset management


Relevant work experience, qualifications and training

  • 9 years information security management / ISMS
  • 7 years IT and business process management
  • 5 years data management
  • 4 years data protection management (GDPR) and DPIA
  • 4 years Security Awareness
  • 5 years project management, Prince2 Practitioner certified
  • 6 years risk and quality management
  • 4 years Identity & Access Management
Linkedin Xing
Salvatore Profilbild

Salvatore Arcidiacona

Motto:
“At the end of the day, the goals are simple: safety and security.”

Why Pragmatica:
 At Pragmatica, I value the long-standing partnerships based on trust, which is the result of client satisfaction. I am convinced that the high quality of consulting services and the implementation of pragmatic solutions pay off for our clients, especially in view of the current cost pressure and the pressure to innovate.

My Expertise

  • Cyber Defense & Security Operations (SOC/CDC)
  • Cyber Threat Intelligence
  • Security Incident Management
  • Regulatory Compliance (FINMA, DORA)

 

Relevant Professional Experience, Degrees and Training

  • 20+ years of experience in cybersecurity and IT security
  • Founder and Head of a global Cyber Defence Center (international fintech)
  • Experience in cross sector crisis coordination (FS-CSC, BACS/NCSC)
  • Master of Advanced Studies in Information Systems Management
  • Active member of DefCon Chapter Switzerland
Linkedin

Further topics

,

Process Mining and AI: Webinar I & II

to the article ➞

Self-services in digital banking

to the article ➞

, ,

FINMA Risk Monitor 2025

to the article ➞

, ,

Generative AI

to the article ➞

, ,

From cost pressure to the efficiency revolution

to the article ➞

,

Do I really need AI?

to the article ➞

,

Switzerland in the crosshairs of foreign intelligence services

to the article ➞

, ,

Resilience in our supply chains: How the shifting threatscape demands comprehensive security risk management

to the article ➞

,

UBS Data Leak via Chain IQ: Third Party Risk & Supply Chain Security Lessons

to the article ➞

,

Third Country Intercept: How secure is your data in the cloud?

to the article ➞

Der Beitrag FINMA Risk Monitor 2025 erschien zuerst auf Pragmatica AG.

]]>