SwitzerlandFINMA Guidance 05/2020: Duty to Report Cyber Attacks
FINMA-Aufsichtsmitteilung 05/2020: Meldepflicht von Cyber-Attacken gemäss Art. 29 Abs. 2 FINMAG
Guidance, not a law: the Swiss Financial Market Supervisory Authority FINMA's reading of Duty of Supervised Financial Institutions to Report Events of Substantial Importance. It binds nobody by itself; the law it reads does.
Guidance on a vulnerability and incident reporting rule, addressed to private bodies.
- Instrument type
- guidance published by a regulator
- Obligation class
- Reporting
As of .
What the regulator expects
- This Guidance reads Article 29(2) FINMASA, which reaches your organization only if it is supervised by FINMA (reached by declaring that you provide financial services).
- FINMA says that an immediate report means giving FINMA advance notice through your account manager within 24 hours of identifying a critical cyber attack and a first assessment of its criticality (section 3).
- FINMA says the report itself should follow within 72 hours through its web-based survey and application platform (section 3).
Who enforces it
Enforcement body
The Swiss Financial Market Supervisory Authority FINMA, which published the Guidance.
Settledness
- As of
What this law does
FINMA Guidance 05/2020 reminds all supervised institutions of the statutory requirement under Article 29(2) FINMASA to report without delay events of substantial importance for supervision. The Guidance states that an immediate report means advance notice to FINMA within 24 hours of identifying such a cyber attack and a first assessment of its criticality. The Guidance states that the report itself is to follow within 72 hours through FINMA's web-based survey and application platform.