SwitzerlandDuty of Supervised Financial Institutions to Report Events of Substantial Importance
In force.
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Reporting
As of .
What it requires
- Applies to persons that need an authorisation, recognition, admission or registration from FINMA under the financial market acts. Reached by declaring that you provide financial services.
- Report to FINMA without delay events that are of substantial importance for supervision (Article 29(2)).
- Treat a significant successful or partially successful cyber attack as such an event (FINMA Aufsichtsmitteilung 05/2020, section 1).
These lines are LexLint's reading of the law's text, as of . Also read by: FINMA Guidance 05/2020: Duty to Report Cyber Attacks (guidance from the Swiss Financial Market Supervisory Authority FINMA, issued ).
Who enforces it
Settledness
- As of
What this law does
Article 29(2) FINMASA requires supervised persons to report to FINMA without delay events that are of substantial importance for supervision. Article 3 FINMASA places under financial market supervision the persons who need an authorisation, recognition, admission or registration from the supervisory authority under the financial market acts. FINMA states in its guidance of that the duty covers material events arising from successful or partially successful cyber attacks.
Article 48 FINMASA punishes with a fine of up to CHF 100,000 anyone who intentionally fails to comply with a final order of FINMA that refers to the penalty threat of that article.
Guidance on this law
How the bodies that enforce this law read it. Guidance binds nobody by itself, so LexLint never raises a finding from it; the duty is this law's.
- FINMA Guidance 05/2020: Duty to Report Cyber Attacks, the Swiss Financial Market Supervisory Authority FINMA
When LexLint raises it
When your app profile says your app provides financial services.