IMF Country Report No. 19/184

SWITZERLAND FINANCIAL SECTOR ASSESSMENT PROGRAM

June 2019

TECHNICAL NOTE—SELECTED ISSUES ON BANKING SUPERVISION

This Technical Note on Selected Issues on Banking Supervision for the Switzerland FSAP was prepared by a staff team of the International Monetary Fund as background documentation for the periodic consultation with the member country. It is based on the information available at the time it was completed in May 2019.

Copies of this report are available to the public from

International Monetary Fund  Publication Services

PO Box 92780  Washington, D.C. 20090

Telephone: (202) 623-7430  Fax: (202) 623-7201

E-mail: [email protected] Web: Price: $18.00 per printed copy

International Monetary Fund Washington, D.C.

© 2019 International Monetary Fund

SWITZERLAND FINANCIAL SECTOR ASSESSMENT PROGRAM

June 12, 2019

TECHNICAL NOTE

This Technical Note was prepared by IMF staff in the context of the Financial Sector Assessment Program (FSAP) in Switzerland. It contains technical analysis and detailed information underpinning the FSAP's findings and recommendations. Further information on the FSAP can be found at

Prepared By

Monetary and Capital Markets

Department

CONTENTS

Glossary 3 EXECUTIVE SUMMARY 4 INTRODUCTION 7 A. Scope and Approach 7 B. Institutional Framework 7 C. Banking Sector Structure 9 MAIN FINDINGS AND RECOMMENDATIONS 10 A. The Framework for Banking Supervision 10 B. The Use of Supervisory Audit Firms 14 C. Supervisory Resources and On-site Supervision 17 D. Supervision of Systemically Important Banks 19 E. Swiss 'Too-Big-To-Fail' Regulatory Regime 21 F. Supervision of Risk Management in the Banking Sector 22 G. Supervision of Corporate Governance 26 

BOX

1. Proportional Approach to the Regulation and Supervision of Small Banks 12

TABLE

1. Main Recommandations 6

APPENDIX

I. 2014 FSAP: Actions Taken to Improve Compliance with the BCPs 28

BCP

Basel Core Principles for Effective Banking Supervision

CEO

Chief Executive Officer

D-SIB

Domestic systemically important bank

CET1

Common Equity Tier 1

CHF

Swiss francs

FDF

Swiss Federal Department of Finance

FINMA

Swiss Financial Market Supervisory Authority

FINMASA

Financial Market Supervision Act

GFC

Global Financial Crisis

GDP

Gross domestic product

G-SIB

Global systemically important bank

FAOA

Swiss Federal Audit Oversight Board

FSAP

Financial Sector Assessment Program

FSB

Financial Stability Board

FTE

Full-time equivalent

IRRBB

Interest Rate Risk in the Banking Book

IMF

International Monetary Fund

KAM

Key Account Manager

LCR

Liquidity-Coverage Ratio

LPA

Loss Potential Analysis

MOU

Memorandum of Understanding

NSFR

Net Stable Funding Ratio

RWA

Risk-weighted asset

SIB

Systemically Important Bank

SNB

Swiss National Bank

TBTF

Too-big-to-fail

TLAC

Total loss-absorbing capacity

Bank supervision has become more effective under the stewardship of the Swiss Financial Market Supervisory Authority (FINMA) with a well-conceived supervision program that is evolving in positive directions. Since its inception in 2009, FINMA has promoted prudent regulatory and supervisory standards and enhanced supervision practices, although this has yet to be tested in a period of systemic stress. As memories of the global financial crisis (GFC) fade, it is in Switzerland's interest that FINMA be a strong, competent, and independent bank supervisor. This is critical for the Swiss financial system's stability, reputation, and global competitiveness. FINMA should continue to strengthen its supervisory capacity and the exercise of its powers. Its authority to set binding prudential requirements (FINMA ordinances) and to codify supervisory practices (FINMA circulars) in line with the principles outlined in laws and ordinances should not be weakened.

Since the GFC, the Swiss authorities have strengthened capital and liquidity requirements. Asset quality has improved and the size of the two global systemically important banks (G-SIB) has been substantially reduced. The Swiss 'too-big-too-fail' (TBTF) regime has further strengthened requirements beyond minimum international standards for the largest banks. These steps are critical given the size of Swiss G-SIBs relative to the economy and the extent of government support provided during the GFC, which represented about 12 percent of GDP.

While a small supervisor responsible for a large and diverse sector can benefit from external supervisory audits, a more robust FINMA-led supervision is needed. About two-thirds of the supervision program is carried out by external auditors. Progress has been made in the use of the forward-looking and risk-focused approach; however, the supervisory audits are overly broad and more can be done to rebalance and improve the effectiveness of the supervisory audit system. Coverage at large banks can be reduced where internal audit should do much of the work under the bank board's responsibility. Supervisory audits should focus on key areas, resulting in 'positive audit-level opinions' on critical risk management and control practices, rather than the lower standard of 'critical assessment'. Moreover, the current arrangements, under which the banks contract and pay the supervisory auditors, who typically also provide consultancy and financial audit services, raise conflict of interest concerns that affect supervisory objectivity. FINMA—rather than banks—should contract and pay for the external auditors' supervisory work. FINMA should itself conduct more risk-based on-site inspections.

Further measures are needed to address material risk management and control weaknesses. Although FINMA has taken steps to improve its supervision of corporate governance, the lack of an explicit legal basis for a thorough assessment of bank boards and senior management constrains FINMA in holding responsible parties accountable. FINMA requires Pillar 2 add-ons to incentivize the largest banks to address control weaknesses. However, while these add-ons can be a useful tool, they cannot replace rapid remedial action by banks to address the risk management and control weaknesses that necessitate the add-on in the first place. FINMA should assess bank boards and senior management effectiveness against their corporate governance responsibilities. The FSAP also recommends that such governance assessments of bank boards and senior management inform supervisory ratings, which in turn should directly enable FINMA to impose restrictions (such as, on capital distributions). All of this would aim to incentivize banks to take the appropriate remedial action to address material risk management and control weaknesses.

A 'post-stress' leverage ratio requirement should be considered to strengthen the regulatory toolkit. It is commonly accepted that the combined use of an internal models-based approach for calculating RWAs and a leverage ratio serving as a non-risk-sensitive backstop incentivizes banks to underestimate their risks. This puts a premium on strong oversight of bank's internal models for calculating risk-based capital requirements and the use of other methods, such as stress testing and scenario analysis, to ensure comprehensive capture of risk exposures, particularly risks that may not be well captured by internal modeling approaches. Consistent with the authorities' prudent regulatory approach, a 'post-stress' leverage ratio requirement would introduce risk sensitivity under stress into the leverage ratio while maintaining total assets as the denominator.

Supervision of risk management is increasingly using onsite reviews carried out by FINMA staff; for the G-SIBs this is often done in coordination with host country supervisors. However, it still also relies on the broad annual supervisory audits and associated risk analyses carried out by external supervisory auditors. FINMA should continue to build its internal risk identification, analysis and assessment capacity and, through more active engagement with, and direction of, supervisory auditors, increasingly focus its attention on key risks and risk management practices.

FINMA's heightened risk focus will place increasing importance on the role of banks' internal audit functions and boards in ensuring that banks are meeting prudential standards. It will be incumbent that bank boards of directors ensure internal audit functions have the capacity and stature needed to provide them with confidence that all prudential and conduct standards are being met. As articulated in Circular 2017/1, it is the responsibility of the board and senior management to ensure effective frameworks and practices are in place for the prudent operation of the firm.

The implementation of a new regulatory 'regime for small banks' and greater risk focus by supervisory auditors at large banks will enhance the effectiveness of FINMA's proportional approach to supervision. The breadth of responsibilities of FINMA's Banks Division, and the oversight of the five systemically important banks (SIBs), makes it imperative to not only have access to skilled resources, but also to flexibly deploy those resources efficiently and effectively. This requires focusing available resources on the issues FINMA determines present the greatest sources of risk and on banks' key risk management and control functions.

Table 1. Switzerland: Main Recommandations

Recommendation

*

**

1. Preserve the primacy of FINMA's prudential mandate, and its authority to issue binding prudential requirements (FINMA ordinances) and codify supervisory practices and interpretations (FINMA circulars) (¶11, ¶12).

C

H

2. Implement revised Circular 2013/3 on auditing, as planned, with a focus on rationalizing the use of resources for regular supervisory audits, while ensuring the effectiveness of banking supervision and increasing FINMA's risk-based on-site inspections (¶27–29, ¶36–38).

ST

H

3. For category 1-3 banks, reduce the use of the broad annual supervisory audits and increase the emphasis on risk-focused, in-depth, and forward-looking supervision (¶29).

ST

H

4. Heighten the focus of internal audit in providing banks' boards and senior management with a clear view of the strengths and weaknesses in critical risk management and control processes (¶30).

ST

H

5. For category 1-3 banks, ensure a timely escalation to boards and senior management of concerns around key risk management and internal control practices that support effective liquidity and capital planning (¶39, ¶58).

ST

H

6. Ensure that FINMA—rather than banks—contracts and pays directly for supervisory audits (¶26).

MT

H

7. Require supervisory auditors to provide assessments using 'audit-level' practices in critical areas of the supervision of the largest banks (¶31).

MT

H

8. Provide an explicit assessment to banks of the effectiveness of board and senior management in maintaining a strong risk management framework and internal controls (¶65-6).

MT

H

9. Enhance the use of stress testing and capital planning reviews in the supervisory process as a means to assess key risk management and control practices (¶42).

MT

M

10. Continue to enhance FINMA's offsite risk analytical capabilities to support efforts to further risk-based supervision, implementing formal requirements for consistent and granular risk position information from large banks (¶15, ¶45)

MT

M

11. Consider authorizing FINMA to require SIBs to meet minimum 'post-stress' capital thresholds and to restrict capital distributions to banks' shareholders, such as dividends and share buybacks, when those are not met. (¶50).

MT

M

12. Strengthen the relationship between risk control and governance assessments, as articulated in supervisory ratings (including the effectiveness of the board and senior management) and FINMA's authority to restrict banks' activities or otherwise require early remedial action. (¶58)

MT

M

13. Codify key FINMA's internal supervisory practices to protect their execution over time (¶19).

MT

L

* Timing: C: Continuous; I: Immediate (<1 year); ST: Short Term (1–2 years); MT: Medium Term (3–5 years)

** Priority: H: High; M: Medium; L: Low

1. This note was prepared in the context of the FSAP mission to Switzerland from October 29 to November 14, 2018. It presents the FSAP findings and recommendations on topics on banking supervision, which were selected primarily according to the findings of the Basel Core Principles (BCP) assessment conducted in 2013, the IMF's policy on the matter, and the Swiss authorities' views. This note is not a detailed assessment report and does not give grades on compliance or revise the grades given in the 2013 BCP assessment. This note focuses on prudential supervision, with only a short discussion of FINMA's supervision of conduct risk.

3. The FSAP findings and recommendations should be understood in the context of the Swiss authorities' own high standards, and the global and national importance of the banking system under FINMA's supervision. Swiss financial authorities are committed to high standards of regulation and supervision. The Swiss regulatory framework embodies strict prudential quantitative rules, and in particular establishes capital and liquidity requirements that are relatively strict compared to other jurisdictions. In its strategic goals, which are approved by the Swiss Government, FINMA has publicly committed to strong and credible standards, and that they will work to raise the credibility of the Swiss solvency regime inside and outside Switzerland, with a particular focus on the use of internal models to weight banks' risks.

4. FINMA is the sole financial supervisor in Switzerland, with responsibility for both prudential and conduct-related supervision. FINMA was established in 2009 as Switzerland's independent and integrated governmental authority responsible for the supervision of the Swiss financial system. It took over the responsibility for banking supervision in 2009 from the former Federal Banking Commission. FINMA is also the bank licensing and the resolution authority.

5. FINMA's legal basis as a supervisory authority is well enshrined in law and derives from the Swiss Federal Constitution, Federal acts and ordinances. The legal framework for regulation and supervision of the Swiss banking system is principles-based, where FINMA has the responsibility to provide and enforce more detailed supervisory expectations. The Financial Market Supervision Act (FINMASA) is the umbrella law for other laws governing bank regulation and supervision. FINMASA sets out FINMA's organization and defines principles for regulation, supervisory instruments, and available sanctions. The Federal Act on Banks and Savings Banks complements FINMASA. The complete legal and regulatory framework, including the Federal

Ordinance on Capital Adequacy and Risk Diversification for Banks and Securities Dealers, the Federal

Ordinance on Liquidity for Banks, and the Ordinance of FINMA on the Insolvency of Banks and Securities Dealers, are available through FINMA's website. Swiss authorities have been updating the regulatory framework since the past FSAP in line with international developments.

6. FINMA is conceived by law as an independent authority in all relevant operational aspects. Neither Parliament nor the Federal Council has the right to tell FINMA how to supervise the banks or what detailed guidelines it should issue for banks to comply with the principle-based proportionate legal framework. FINMA also has budgetary independence and is funded by fees assessed on the industry and banks payment of supervisory auditors and mandataries.

7. FINMA cooperates with the Federal Department of Finance (FDF) and the Swiss National Bank (SNB) on banking sector oversight. The SNB has a financial stability mandate while the Federal Department of Finance (FDF) is responsible for financial market policies and financial regulation. While FINMA acts independently as a supervisory authority, it often cooperates with the FDF on regulatory issues. Where legally authorized to do so, FINMA may enact its own legallybinding ordinances to spell out technical details and corresponding implementation provisions in FINMA circulars that are in accordance with the principles spelled out in laws and ordinances passed by Parliament or the Federal Council. Together, the three agencies are responsible for macroprudential policies. Since 2011, a tripartite Memorandum of Understanding (MOU) is in place, focusing on information sharing and cooperation during a crisis. The SNB is responsible for the designation of SIBs and for proposing the activation of the countercyclical capital buffer to the Swiss Federal Council. The Federal Council approves FINMA's strategic goals, which are defined every four years. The Federal Council also appoints the Chair and members of the Board of Directors and approves the appointment of the CEO. No significant changes are planned to the institutional structure of banking sector oversight.

8. Switzerland has a large and diverse banking sector and hosts two G-SIBs. Total banking assets of CHF 3,300 billion are equivalent to about five times Swiss GDP. Switzerland is a global leader in private wealth management with a market share of more than a quarter of all global cross-border private banking. The banking industry is divided into five supervisory categories, which facilitates proportionality in its supervision.

• Category 1 comprises the two large and complex Swiss G-SIBs (Credit Suisse and UBS), which together represent 52 percent of total Swiss market share in terms of deposits and combined total global assets of 260 percent of GDP.

• Category 2 comprises three banks designated as domestic SIBs (Raiffeisen Swiss cooperative bank, Zurich Cantonal Bank, and PostFinance) with business models that focus almost exclusively on activities within Switzerland. Their total assets in aggregate are CHF 513 billion, about 80 percent of Swiss GDP.

• Category 3 comprises middle-size cantonal banks and larger regional commercial banks. There are 24 category 3 banks, which are significant although not individually systemically important.

• Finally, Categories 4 and 5 comprise 259 small regional banks focusing on traditional retail activities, mostly mortgage finance, within specific geographical regions, as well as private banking and wealth management activities.

9. Since FINMA's inception, the Swiss banking system has been operating under relatively benign economic and financial conditions. In this context, FINMA has been effective in providing regulatory discipline to the banking sector throughout a period absent of systemic stress. The post-crisis regime, however, has yet to be tested through a period of severely adverse systemic conditions. To be prepared to react promptly when the banking sector faces a more challenging operating environment, it remains important that FINMA be allowed to further build on and improve the effectiveness of its banking supervision. In particular, it remains critical to minimize the likelihood that the largest banks might need to be resolved—given the substantial work that remains to be done on resolvability—by requiring them to meet high standards on capital and liquidity, as well as key risk management and controls practices that support effective assessments of capital and liquidity needs.

10. Overall, FINMA continues to be an effective supervisor and there are a number of sound and thoughtful initiatives underway to increase effectiveness. The rest of this note highlights areas where the FSAP believes attention is necessary to ensure effective implementation of these initiatives and to further enhance FINMA's effectiveness in providing supervisory discipline to the Swiss banking sector.

12. The authorities should ensure that FINMA's powers and responsibilities, assigned to it by the FINMASA, to issue binding prudential requirements and to codify its supervisory interpretations and practices are preserved. Under Swiss banking laws, the regulatory framework is required to be proportional and principles-based, with FINMA given the possibility to set additional technical requirements (FINMA ordinances and circulars) that detail supervisory expectations in support of the overarching principles. Recent procedural requests by the Parliament ask for a stricter delimitation of authority between the FDF and FINMA, and enhanced political oversight over FINMA in general. The Federal Council proposed that the Parliament reject these requests,10 except for one. Any moves to reduce FINMA's authority to issue technical requirements and supervisory expectations would constitute a threat to its effectiveness and credibility.

13. As noted above, by law and by practice, FINMA follows a proportionality approach to bank regulation and supervision, further underpinned by its risk-based approach. FINMA's commitment to the principle of proportionality is well demonstrated by the substantial attention it focuses on the G-SIBs and D-SIBs relative to smaller banks. The Swiss authorities continue to develop the TBTF regime for banks in categories 1 and 2, and at the same time have launched a simplified pilot regime for small banks that comprise categories 4 and 5 (see Box 1) to ease regulatory burdens on these banks. Nevertheless, FINMA is conscious that the regime for small banks should not reduce requirements below prudential minima. FINMA most intensive supervision is applied to the largest banks where the greatest risks are and the need for pre-emptive disciplinary measures in cases of excessive risk accumulation or weaknesses in critical risk management and internal controls practices is vital. FINMA does not apply proportionality for conduct supervision where risk is considered equally important regardless of the size of the institution.

14. FINMA has strengthened the articulation of its supervisory expectations since the prior FSAP through the issuance of a number of 'Circulars.' This has provided further details on expectations for supervisory auditors' coverage of risks and associated risk management practices in annual supervisory audit reviews. This is an important positive development. The previous FSAP highlighted a lack of comprehensive and detailed prudential guidelines, especially with respect to qualitative risk management and internal controls expectations.

15. Supervisory reporting of Swiss banks is comprehensive, although FINMA would benefit from further granularity and consistency on risk exposures at the largest banks. FINMA Circular 2008/14 governs supervisory reporting of on-/off-balance sheet assets and liabilities, profit and loss, asset quality and loan loss provisioning. Other reporting obligations cover capital adequacy and liquidity (in the context of Basel III), large exposures, risk concentrations, details of credit and market risk capital adequacy inputs (including information based on internal modeling by the firms), interest rate risk, as well as share ownership. FINMA also requests major banks to submit some ad-hoc individual information used for management purposes. To improve risk assessment and risk-focusing practices, FINMA would benefit from getting more granular information on risk exposures from the banks in a manner that ensures consistency across the firms to allow for cross-firm comparisons. Not only would this inform risk-focusing process for large banks, but it would also generate useful information with which to assess the buildup of risks across the system.

16. The regulatory framework for bank accounting and financial disclosure has been enhanced since the 2014 FSAP to promote banks' financial transparency. Together with the government, FINMA is the accounting standard setter for the banking industry. In this regard, FINMA rules tend to be more conservative than International Financial Reporting Standards except for some immaterial exceptions.

Box 1. Proportional Approach to the Regulation and Supervision of Small Banks

The vast majority of banks and securities firms in Switzerland are either small or very small institutions, and about 250 banks are in supervisory categories 4 and mostly 5. These banks have a balance sheet of at most CHF 15bn (category 4 banks) or up to CHF 1bn (category 5 banks). These small banks, which often report high levels of capitalization, have been conveying to the authorities increasing difficulties to keep pace with implementing the various standards of new regulations, such as the Basel III reform package.

Whilst there is already proportionate regulation in Switzerland, also via reduced or simplified rules for category 4 and 5 banks, the authorities consider that with a more substantial change in regulation and supervision for banks in these two categories a more efficient framework could be achieved. To this end, FINMA launched the small banks' pilot regime, with about 60 small banks currently participating. The basic philosophy of the regime is that well-capitalized banks will no longer have to compute risk-weighted assets (RWA), which computation has become increasingly complex under Basel III.

For the current pilot phase with about 70 qualifying and volunteering small banks, well-capitalized banks are identified via an easy to compute leverage ratio, broadly comparable to the Basel III leverage ratio, of at least 8 percent for both categories. Furthermore, a liquidity buffer of 20 percent has to be maintained on top of the 100 percent LCR Basel III requirements. Last but not least, in order to qualify for the small banks' pilot regime there must not be relevant conduct risks. Under the final regime, the following additional reliefs are foreseen: simplified capital planning requirements, no implementation of the Basel III NSFR, some focused simplifications in the area of corporate governance, outsourcing and operational risk management requirements, and no regulatory disclosures beyond publication of a few key metrics.

These reliefs are expected to deliver significant savings (money and human resources) for well-capitalized small institutions in the medium term, both in terms of compliance to regulation and corresponding supervision. The freed-up resources can be used, for example, in the daily risk management of the banks.

As a complement to the small banks' regime, FINMA is developing a more data-intensive supervisory approach to small institutions in categories 4 and 5.

In order to implement the final small banks' regime, the Federal Department of Finance plans to open a public consultation on a revision to the Capital Adequacy Ordinance in spring 2019. The admission criteria of the final regime might slightly deviate from the current criteria applicable for the pilot regime. At the same time, FINMA will consult on certain corresponding changes to its existing circulars. The small banks' regime is expected to enter into force in 2020.

17. The Banks Division continues refining its methodology for its risk-based, proportionate approach to supervision. FINMA determines its level of supervisory engagement by a combination of the banks' supervisory category (discussed above) and the risk rating assigned by its CAMELS-based internal supervisory rating. The rating system was enhanced in 2018, including an additional scoring that uses qualitative data derived from risk analyses provided by supervisory audit firms as well as through work carried out by FINMA's Key Account Managers (KAMs) and Risk Experts. Based on the bank category and net risk rating, the intensity of supervisory engagement is defined by 'Standard Operating Procedures,' which have also been recently revised with new internal procedures expected to be applied beginning in 2019. Bank categorization and risk rating also define the choice of supervisory instruments and the level of direct supervision by FINMA versus supervisory auditors. As discussed below, Pillar 2 capital add-ons can be used by FINMA when banks' risk management and control practices are assessed as being weak.

18. FINMA is reorganizing its Banks Division to reallocate resources to the supervision of banks in categories 1 to 3 and to streamline and make more 'data-driven' the supervision of category 4 and 5 banks. FINMA is currently in the process of making adjustments to its internal structure and supervision practices. This will further increase proportionality and should result in more in-depth reviews of key risk areas in the G-SIBs and category 2 and 3 banks. Within this reorganization, evolving supervisory practices and programs would benefit from close consideration of which practices they should use to assess banks, and on what bank processes they should focus, to achieve the most effective supervisory outcomes.

19. To enhance the effectiveness of progress in the ongoing reorganization, FINMA should identify and codify its key internal supervisory practices that are intended to play a central role in its evolving risk-based approach. This codification will help ensure the continuity of such key practices in the event of pressures to deviate from agreed-upon areas of primary focus. It would also serve as an internal self-disciplining mechanism to ensure the agreed-upon practices remain key areas of the execution of FINMA's supervision activities. This identification and codification process should be thoughtful, comprehensive, and revisited periodically, which is why the FSAP sees it as a medium-term objective. Care should be taken that it does not lead to an overly-rigid supervisory process.

20. FINMA should continue to increase its understanding of the two G-SIB's large foreign operations in the U.S., the U.K., and Asia. The U.S. intermediate holding companies' capital and liquidity requirements, as well as the supervisory regime, should provide FINMA with some confidence that activities there are being covered. FINMA has significantly increased its cooperation with U.S. and U.K. supervisors. Additionally, by hosting supervisory colleges it has regular formal discussions with host-country supervisors. The two G-SIBs' large foreign operations increase the importance of, and challenges for, FINMA's understanding of these operations and their risks. FINMA should allocate adequate resources to the supervision of the G-SIBs' consolidated operations.

21. FINMA raises supervisory concerns with the banks at an early stage, although its authority to enforce rapid remediation of prudential concerns should be strengthened. FINMA adopted a revised enforcement policy in 2014. According to this policy, FINMA takes enforcement actions as a visible means of achieving its supervisory objectives. Enforcement aims to remedy shortcomings, restore compliance with the law and exert a deterrent effect by imposing sanctions for violations of the law. FINMA has intensified its enforcement actions against individuals since the 2014 FSAP. FINMA started in 2015 to publish a yearly report on its enforcement activities in an enforcement report. However, legal process may delay remedial actions to address prudential concerns and there is not an explicit early intervention framework related to material supervisory concerns regarding qualitative weaknesses that can undermine effective risk management.

22. FINMA uses a banking supervision approach that relies on external supervisory auditors as its 'extended supervisory arm. Since 1934, bank supervision has relied on the use of external auditors to review banks' compliance with banking laws as well as supervisory expectations and guidelines. In addition to the annual supervisory audits, FINMA can use 'supplementary reviews' or reviews by mandataries. The latter two are deeper reviews directed by FINMA and carried out by the supervisory auditor (supplemental reviews) or specialized mandataries. As opposed to annual supervisory audits and supplemental reviews, mandataries are not commissioned for recurring tasks, but for specific issues related to supervision and enforcement. Mandataries must be carried out by auditors that are not part of the firm that does a bank's regulatory and financial audits. The costs of supervisory audits, supplemental reviews and mandataries are borne by the supervised institutions.

23. Historically, the Swiss model for banking supervision focused on compliance and delegating on-site verification to supervisory auditors. Supervisory authorities enforced compliance through off-site work based on supervisory auditors' reports and regulatory submissions by banks. A gradual shift from compliance-based to risk-based supervision was initiated and took further impetus after the GFC with the creation of FINMA. The division of labor between FINMA and supervisory auditors continues to evolve to a more risk sensitive approach and an increasing role and presence for FINMA in direct on-site responsibilities.

24. The FSAP shares FINMA's view that there are benefits to this approach, although it also raises concerns. Benefits include extending FINMA's reach and resources, and taking advantage of the flexibility, global coverage, and expertise that external auditors can bring to supervisory work. However, the FSAP also has concerns about this approach, including those related to the depth of some regulatory and supplemental audits, as well as the accountability of the supervisory auditors and how to effectively manage the risks associated with the conflicted interests of the large audit firms, who provide consulting and other services to the same banks.

25. Different 'mindsets' and skills between external auditors and in-house trained supervisors need to be considered when commissioning supervisory work to supervisory auditors. Sound auditing work is generally based on backward-looking verification and ongoing concerns are projected out for one year, while supervisors are expected to develop a forwardlooking and integrated perspective based on selected risk-focusing and a broad knowledge of the activities and strategies of the banks. A forward-looking mindset may not be predominant in auditing work. In fact, experience gained during the GFC provides 'very few, if any, instances where external auditors proactively contacted supervisors to report matters of material significance even though some may have been present. Switzerland's principles-based approach for banking regulation has led FINMA to issue detailed guidance to assist supervisory auditors to perform their duties more effectively. In addition, FINMA reviews supervisory audit reports and discusses with auditors where there are differences of opinion. In extreme cases, FINMA could require the replacement of the supervisory auditor if it finds the work insufficiently rigorous or not well conducted.

26. It is important that FINMA have the power to contract supervisory audits directly, rather than via the banks, to reinforce objectivity and keep closer command over its extended supervisory arm. Ensuring objectivity in supervisory auditors' work demands greater control by FINMA over the work carried out by audit firms. The interdependency between audit firms and supervised banks is a particularly sensitive area given the critical importance of external auditors' maintaining maximum objectivity. The Financial Stability Board (FSB) has observed that third parties commissioned to do work on behalf of supervisors are often naturally more aligned with their larger potential customer base than they are with supervisors. Attention should be given to the rotation of lead regulatory and financial auditors within the bank's single regulatory and financial audit firm to promote objectivity. In the case of Switzerland, regulatory and financial auditing are typically carried out by the same audit firm.

27. External auditing for supervisory purposes is in the process of transitioning from a historical approach based on compliance with supervisory expectations to work that will better support FINMA's increasing use of forward-looking analysis. An initial revision of the supervisory audit system was finalized at the time of the 2014 FSAP, introducing the need for audit firms to produce an annual risk analysis for each bank on which to base an audit program approved by FINMA and performed by the external auditor. In 2017, FINMA reassessed the supervisory audit system and found that its effectiveness and efficiency could be further improved. Based on this, FINMA's Board approved a revision of the Circular 2013/3, on auditing, which is discussed below.

28. FINMA has taken initial steps in the right direction to optimize the use of supervisory audits through the revision of its Circular 2013/3 on auditing that entered into force in January 2019. Changes to supervisory audits, if well implemented, should lead to increased effectiveness in FINMA's bank supervision, and better risk-focusing. The new approach will allow FINMA to refocus in commissioning in-depth investigations by third parties (mandataries) and carry out its own inspections. The reform targets reducing expenses on supervisory auditors by 30 percent by narrowing the scope of routine audits, which may allow for some increase in FINMA's resources dedicated to direct bank supervision, including on-site inspections. At the same time, FINMA will be providing a greater amount of explicit and formal direction to the external auditors in their prudential work, and particularly for mandataries. The FSAP recommends that optimizing and reducing supervisory audit work seek what best serves the public interest rather than those of interest groups.

29. The effective implementation of the revision of the supervisory audit system is a significant challenge for FINMA moving forward. Implementing as planned the revised Circular 2013/3 on auditing, should aim to reach the right balance between core in-house supervisory work and complementary supervisory audits, particularly for categories 1 to 3 banks. Otherwise some of the benefits in terms of cost efficiency and deepening of FINMA's knowledge of banks may be lost.

30. The shift to a more risk-focused approach in the use of external auditors will raise the importance of banks' boards and senior management ensuring strong risk management and internal controls processes. The reduction in scope of coverage by external auditors will require the banks themselves to take the steps necessary to ensure they are operating in a prudent manner and in line with supervisory expectations. At least some of these areas will have to be picked up by the banks themselves. This is wholly appropriate and consistent with expectations as outlined in FINMA Circular 2017/1. In this regard, an important challenge for FINMA will be creating strong incentives to ensure the banks do not reduce spending on risk management and control functions and that they ensure their internal audit functions have the capacity and stature to identify and require remediation of weaknesses in risk management and control frameworks and practices.

the same audit firm is the financial and supervisory auditor. Lead financial and supervisory auditors differ in the case of the largest banks. When FINMA contracts independent mandataries, the financial-supervisory audit firm cannot be hired.

31. It is important that supervisory auditors be required to provide assessments using 'audit level' practices in critical areas of the supervision of the largest banks. This is needed to enhance external auditors' accountability. Circular 2013/3, on auditing, establishes two levels of audit depth: 'audit level,' requiring the auditor to provide 'positive assurance' of compliance with the prudential requirements; and 'critical assessment,' where the auditor indicates whether anything in the course of its audit work leads to conclude non-compliance with prudential requirements. This 'negative assurance' provides less rigorous on-site verification. Applying 'audit level' increases the reliability of the audit work and the auditors' accountability, and should be required for critical areas of the supervision of the largest banks. At the same time, it increases the audit cost. Regular supervisory audits are normally conducted under 'critical assessment,' while mandatary work is conducted at "audit level."

32. FINMA is a relatively small authority in line with the Swiss political model of small and efficient government that promotes legal certainty, economic freedom, and social wellbeing. FINMA operates in a political environment where the minimum amount of government intervention is expected to ensure a safe and sound banking system. FINMA's budgetary independence is anchored in law. FINMA can require banks to provide additional financial resources if supervisory needs warrant; however, FINMA's strategic goals include maintaining stability of the cost of supervision with an increase coming only if FINMA's remit is expanded, while other cost efficiency gains are achieved. The FSAP commends the authorities' attention to cost-efficiency concerns, but any cost reductions must not compromise the effectiveness of supervision.

33. FINMA's relatively small staff notwithstanding, the banking supervision-related workforce is larger when including FINMA's 'extended arm—i.e., the use of external auditors to perform annual supervisory audits and follow-up 'supplemental' reviews. The total workforce for banking supervision in Switzerland—FINMA's estimates of approximately 400 full-time equivalents (FTEs) including supervisory auditors—is generally in line with resources used in other jurisdictions with FINMA's broad scope of coverage and two large G-SIBs and three domestic systemically important banks (D-SIBs).

34. FINMA has shown progress in its ability to attract and retain staff and future human resources efforts should advance and consolidate this progress. FINMA's human-resources policies show positive results in lowering the high staff turnover for bank supervision noted by the previous FSAP. These positive results, if maintained, will allow FINMA to build sufficient in-house expertise and experience, which are primarily acquired on the job. It will also support the building a critical mass of skilled staff to undertake advanced supervisory projects.

35. FINMA is continuing to look for ways to maximize the cost-effectiveness of its supervisory work. This is increasingly important given plans to reduce costs that accrue to the banks from paying for their own supervision, including the use of external supervisory auditors. Although making the banks pay these costs is an appropriate model, it can make life more difficult for the supervisors as proposing activities that increase costs are likely to meet stiff resistance by the banks, even when clearly needed, given their attempts to reduce expenses. This will be an important possible area of tension in FINMA's plans.

36. The previous FSAP recommended improvements to the intensity and effectiveness of FINMA's on-site work. That FSAP concluded that effectively managing the volume of regulatory and supervisory change requires having sufficient budgetary resources and building and maintaining a skilled, capable, and experienced workforce as discussed above. It also concluded that a main impediment to increasing the intensity and effectiveness of on-site supervision appeared to be a combination of FINMA's own relatively small resource pool and the challenges it faced in improving the effectiveness of its use of external auditors. Although the situation has improved since the past FSAP and the revision of Circular 2013/3, on auditing, provides sound ground for further improvements, the thrust of the evaluation of the 2014 FSAP remains valid.

37. The Banks Division has been increasing on-site supervision in line with the previous

FSAP recommendations. FINMA's direct on-site work has increased by about 44 percent during 2014–17, in a risk-oriented manner. Amendments to supervisory practices include the possibility to give on-site access in Switzerland to host supervisors to increase collaborative efforts, resulting in an increase of FINMA's on-site visits. Specifically, with respect to the five largest banks (two G-SIBs and three D-SIBs), FINMA dedicates a significant share of its resources and 'on-site reviews' to these firms and is in the process of increasing this through requiring the external supervisory auditors to take a more risk-focused approach and to carry out 'deep dive' reviews rather than focusing primarily on annual supervisory audits. This is a welcome development and should enhance supervisory effectiveness if implemented appropriately. Finally, the "Team on Intensive Supervision," that targets onsite work for categories 4 and 5 banks, has also increased its activity.

38. However, the FSAP believes that there is still some scope for improving the overall effectiveness of FINMA's approach to on-site supervision by rebalancing the responsibilities of FINMA staff and supervisory auditors. The fundamental piece of on-site supervisory verification and analysis remains the annual broad reports produced by supervisory auditors based on a supervisory strategy determined by the audit firms and approved by FINMA. At the time of this writing, FINMA estimates that on-site work conducted directly by FINMA is the equivalent of 15 FTEs, while supervisory auditors (whose work can be considered equivalent to on-site supervisory work) represent some 300 FTEs. As noted above, the routine supervisory audits can be streamlined without compromising overall supervisory effectiveness. The revision of Circular 2013/3 on auditing, will also provide sound ground for further improvements to continue reassessing the effectiveness of on-site supervision and supervisory audits and make further adjustments as warranted.

39. FINMA's supervision of systemically important banks continues to evolve and the agency is actively engaged in a number of efforts that should enhance effectiveness. Working in an environment where memories of the GFC appear to be fading quickly, FINMA's need to further increase the intensity of its approach at the largest banks may meet resistance. FINMA's Banks Division should push ahead in the face of this resistance and to specifically increase efforts to raise the bar on the accountability of boards and senior managers with respect to ensuring these firms are run in a prudent manner and are taking steps to ensure effective risk management and control functions are in place. FINMA should ensure the appropriate allocation of resources for effective supervision of systemically important banks, including with respect to the consolidated supervision of the G-SIBs global operations.

40. There is no one single 'best' way to organize the supervision of systemically important banks. FINMA's soon-to-be-implemented new organizational structure will allow for effective oversight of these groups of banks. In addition to relatively small teams (5–6 team members each) dedicated to each G-SIB under a Key Account Manager (KAM), FINMA uses risk experts from its Risk Management area to perform thematic and other supervisory reviews of specific activities and risks. This includes risk specialists in operational, credit, and liquidity risk, a dedicated team looking at the activities of the G-SIBs' investment banking operations (including trading and wholesale lending activities) and teams specializing in assessments of firms' stress testing and capital and liquidity planning practices. These reviews are in part built upon the work of the supervisory auditors for the annual supervisory audit and other supplemental reviews. For example, supervision plans in year T+1 include reviews focusing on areas identified as problematic in supervisory audit reviews in year T.

41. FINMA gives particular focus to key areas of financial resiliency—capital and liquidity— and also emphasizes strengthening recovery and resolution preparedness should the reduction in the probability of default achieved through higher capital and liquidity requirements not be sufficient. FINMA reviews capital and liquidity planning at the two G-SIBs on a semiannual basis.

42. Capital planning reviews are a key area of focus for FINMA and provide a good opportunity to assess a variety of practices that a bank must have in place for this purpose, including stress testing and key supporting risk measurement, management and controls practices. The banks are expected to incorporate stress testing into their internal capital and liquidity planning processes. With respect to capital, the G-SIBs are required to undertake two FINMA-defined stress tests (LPA) twice a year. FINMA staff reviews the results of the stress tests as well as the modeling and other practices used to derive the results. FINMA staff meet with bank management to discuss the capital plans and provide feedback on its assessment of the underlying practices. FINMA increasingly expects the banks to consider the results of the LPA stress tests in their capital planning.

43. FINMA also puts particular emphasis on reviewing liquidity conditions, risk measurement and management issues at the largest firms. Supervisors regularly review the Liquidity Coverage Ratio (LCR)-data from the firms and probe the derivation of LCR numbers. In addition, and appropriately, FINMA specialists review the banks' internal liquidity frameworks which are required to include internal stress testing to assess potential vulnerabilities. FINMA, in coordination with an external audit firm, carried out a 'fire-drill' liquidity exercise at the G-SIBs whereby firms were unexpectedly given a limited period of time to pull together needed information on liquidity positions, which was assessed for speed and accuracy. Firms were assessed and provided with a set of expectations from FINMA with respect to needed improvements. This is a good practice that should be continued and perhaps broadened.

44. To enhance the effectiveness of the supervisory regime's reliance on external audits, FINMA will need to require 'risk-focused' supervisory audits to provide a greater amount of confidence in the completeness and depth of assessments. This may lead to relatively higher expenditures at some banks for supervisory auditors, all things being equal. Bank boards and senior management may be using the annual supervisory audits as a backstop to their own internal audit function—i.e., annual supervisory auditors may serve as a key source of information about the banks' compliance with prudential requirements and standards. (This would not be a good practice). It is the banks responsibility to assess their compliance with requirements and expectations and their internal audit functions should be reporting to boards proactively, so they can address their weaknesses before having them identified by outside parties, including supervisors and supervisory auditors. A better balance would include increased coverage by internal audit and FINMA increasing the use of supervisory auditors to review specific areas defined as presenting material risks.

45. FINMA has revised its process for formally rating systemically-important banks to increase the focus on forward-looking assessments of key areas that warrant supervisory reviews. The roll out of this process occurred in 2018 and it will take some time to assess its benefits. FINMA has provided further guidance to supervisory auditors on their annual risk assessments and for the largest firms reviews and discusses them prior to signing off on the supervisory audit plans for the year. FINMA has a variety of internal risk assessment processes to guide the risk focusing and planning for supervisory exercises and to inform the 'risk to future' element of the supervisory assessment/rating. While these appear to be useful tools for the largest and most complex banks, FINMA should consider formalizing more intensive required reporting about risk positions to improve consistency and deepen coverage of risk exposures. The use of ad hoc reporting and of firms' internal risk reports increases the challenge of identifying issues and potential sources of vulnerability in a consistent manner across banks. Moreover, data integrity issues may be harder to detect and resolve when getting data on an ad hoc basis.

46. Switzerland's regulatory regime for systemically important banks is generally effective. High standards are in place for the large complex firms, although there are challenges created by the combined use of the internal models-based approach and the leverage ratio (see below). In addition, further work remains on Basel lll implementation.

47. Swiss capital requirements are consistent with Basel III measures and minimum requirements are higher than Basel minima. In 2016 the Swiss Federal Council amended the Capital Adequacy Ordinance. This amendment set out the new higher capital requirements for systemically important banks and introduced a new 'gone concern' requirement for G-SIBs in line with G20 standards and the FSB. Minimum going concern capital requirements for the 2 G-SIBs are 10 percent Common Equity Tier 1 (CET) plus an additional 4.3 percent of tier 1 capital. In addition, the gone concern loss-absorbing capacity (GLAC) capital requirement for G-SIBs is 14.3 percent (before rebate). Currently—including rebates associated with structural improvements to facilitate a single point of entry resolution strategy—the total loss-absorbing capacity (TLAC) requirement is roughly 26 percent.

48. The strength of Switzerland's high capital requirements is tempered by the use of the internal models-based approach to risk-weighted asset (RWA) calculation. Combined, the Swiss

G-SIBs total asset to RWA density is roughly 30 percent, which is at the lower end of the range for G-SIBs. As a complement to risk-based measures, Swiss TBTF regulation also requires the Swiss G-SIBs to meet a total leverage ratio of 5 percent of core capital, which includes a 2 percent leverage ratio buffer.

49. The use of the leverage ratio as a backstop to an internal ratings-based approach creates an incentive for banks to, on the one hand, increase their holdings of risky assets to maximize returns relative to the leverage ratio constraint, while at the same time seeking to minimize the contribution of these positions to RWA calculations using their internal models. This increases the importance of supervisory reviews of firms' modeling approaches, as well as indepth reviews of the risk measurement practices and controls around both the identification of risks and the data used to report those risks. A particular area of focus for supervisors should be risk identification, and the capacity to capture and report all risks across the bank to ensure the comprehensiveness of the risks captured in models used for RWA calculations and for stress testing.

FINMA does focus on the risk identification process through its work on capital planning and is clearly focused on the G-SIBs compliance with the Basel principles for effective data aggregation and risk reporting. FINMA should consider more formal expectations on risk identification, given the importance of capturing all material risks in assessing capital needs.

50. A potentially valuable tool for addressing the challenges created by these incentives can be the inclusion of a required post-stress measure of capital based on the leverage ratio, a measure FINMA could evaluate in its reviews of capital planning and stress testing. Importantly, there are no explicit 'post-stress' capital requirements in place in the Swiss capital regime. FINMA should consider working with other Swiss authorities to create a legal basis for minimum 'post-stress' requirements and the authority to restrict banks' capital distributions when they fall short. Nonetheless, if FINMA is concerned about a firm's regulatory measurement of risks in its RWA calculations, it can and does require Pillar 1 adjustments that increase RWAs to ensure better capture of risks, and also uses Pillar 2 add-ons where concerns are driven by qualitative challenges.

51. SIBs are held to higher liquidity standards than banks in categories 3–5, with the strongest requirements in place for the two G-SIBs. FINMA requires firms to use internal stress testing to test the sufficiency of their liquidity, along with relative strong LCR requirements and the use of net stable funding ratio (NSFR) reporting.

52. FINMA is committed to a risk-focused approach to supervision and is increasingly trying to enhance its capacity to take a more forward-looking perspective. Supervision planning and decisions about where to put scarce resources are informed by a variety of work including those coming from supervisory auditors', the KAM teams, ongoing assessments of 'macro' risks to the banking system such as can be found in the semi-annual FINMA-wide internal publication 'the risk barometer', and information and knowledge developed by risk specialists in FINMA's risk management function through both onsite and offsite work.

53. A starting point for the supervision of risk management is the annual risk assessment and the comprehensive supervisory audit required of every bank and carried out by the external supervisory auditors. Swiss supervisors have traditionally required annual supervisory audits that assess all aspects of compliance with supervisory expectations, including those for risk management and internal controls. For the larger firms the supervisory auditors may cover only certain parts of the review in any given year but over a cycle will cover all aspects of the audit which is quite comprehensive and was designed by FINMA. FINMA supervisors will review these audit reports and use them as one of the inputs for planning future supervisory work. The reports are sent to both FINMA and senior management and Boards of Directors at the banks.

54. Supplementing these reviews for the large firms, as noted above, FINMA carries out onsite supervisory reviews of high-risk areas, can require the banks to have the supervisory auditors do a supplementary review of specific areas, and hire external auditors to carry out mandataries focused on in depth reviews of specific areas and designed by FINMA.

Supplemental reviews use the same external auditors that do the bank's annual supervisory audits, but design of the program and its execution is more closely controlled by FINMA. The execution of mandataries requires a third-party auditor not involved in other aspects of a banks auditing, providing a 'fresh set of eyes' and mitigating concerns about potential conflicts or other negative incentives among supervisory auditors, such as the possible incentive to not identify issues that were missed in earlier supervisory audits to avoid exposing deficiencies in the supervisory audit process.

55. The FSAP's reviews of 'long-form' annual supervisory audits highlighted useful and comprehensive efforts, but also challenges associated with this approach, particularly as relates to assessment of the governance process over risk management and controls. Specifically, while auditors do provide a fairly comprehensive view of many of the fundamental areas of risk management and internal controls, two particular issues raised concerns: (i) many of the areas covered by the auditors were done with a relatively low level of assurance (so called 'critical assessment level'), including some work in particularly important areas for large banks such as liquidity risk management, and (ii) while each specific area included in the review seemed to be mostly on the right practices (as per FINMA's directions on the work of supervisory auditors), the report did not provide the type of integrated view of practices and governance that supervisors and banks would most benefit from. For example, there was no direct and explicit linkage between the assessment of corporate governance and the assessment of the effectiveness of the risk management and controls framework and functions for which the board and senior management are ultimately responsible.

56. Operational risk, including IT and cybersecurity issues, are a key area of focus and rank high on FINMA's list of important risks. Particular areas of current focus noted by FINMA operational risk specialists were outsourcing to third parties, cyber security and business continuity. FINMA has created a special team with expertise in technology infrastructure, cybersecurity, business continuity management and oversight of banks' outsourcing arrangements. FINMA has updated and expanded the Operation Risk circular and operational risk guidance, including enhanced guidance regarding technology infrastructure and cybersecurity. In addition, FINMA's CAMELS rating system now includes a specific section for assessment of qualitative aspects of operational risk management. Supervisory auditors must now fill out a questionnaire that focuses on qualitative aspects of operational risk management as part of their annual supervisory audits.

57. Pillar 2 add-ons are a key tool used by FINMA to provide incentives for the largest banks to address material risk management and internal control weaknesses. Although Pillar 2 add-ons can be a useful tool for these purposes, they should not take the place of requiring rapid remedial action on the part of the banks to address the weaknesses that create the need for the add-ons. It is the responsibility of the board of directors and senior management, as articulated in FINMA Circular 2017/1, to ensure a robust and effective risk management framework and effective internal controls processes. Direct assessments of these parties may increase the incentives for them to take the appropriate steps to ensure they are carrying out these responsibilities effectively. This is largely a corporate governance-related issue and is discussed further below, including in reference to the lack of a specific assessment of senior management in articulation of the supervisory rating.

58. FINMA needs to consider ways in which it can provide stronger incentives for the banks to address risk management and control deficiencies. As a starting point, addressing to boards and senior management the assessments and expectations for rapid remediation of weaknesses in areas FINMA views as of the most critical importance would be a welcome development. Such areas could include those related to supporting financial resiliency and compliance with conduct-related rules. FINMA's rating system is used to determine the level of supervisory intensity and help identify areas that warrant further supervisory attention. However, other than increased scrutiny, there are no binding restrictions driven by the rating process such as exist in other jurisdictions. While this may give FINMA needed flexibility, it undermines the use of the rating to serve as a strong incentive to address banks' failure to meet supervisory expectations, including with respect to key risk management and controls weaknesses.

59. Qualitative aspects of liquidity risk management are covered by expectations set out in the Liquidity Ordinance and in Circular 2015/2. FINMA has a dedicated team of liquidity risk specialists in its risk management functions that carry out onsite reviews, engage in dialogue with banks on liquidity risks and risk management issues and monitor liquidity positions at the banks closely, including through the use of required daily LCR reporting and NSFR-related reporting. In addition to LCR and NSFR liquidity requirements, banks are required to use internal stress testing to assess their liquidity needs and incorporate the results in their liquidity planning and the setting of the size and composition of the liquidity buffer. Similar to the concept of Pillar 2 add-ons for capital, when deficiencies are found in liquidity risk management practices FINMA has the authority to apply a supervisory measure that imposes an add-on to quantitative liquidity buffer requirements.

60. Supervision of credit risk management appears reasonably well covered by a combination of FINMA's risk specialists and extensive coverage in the annual supervisory audits. FINMA guidance and expectations for annual supervisory audits require regular coverage of the usual credit risk management practices, consistent with Basel Core Principles for credit risk management. In addition to the broad requirements for risk management and controls practices outlined in Circular 2017/1 (which includes expectations for credit risk management), FINMA (SFBC) "Newsletter 22" further defines the expectations for credit risk management, specifically internal controls, internal rating systems, stress testing, and other key practices. These aspects are subject to annual supervisory audits by audit firms. Supervisory audit procedures require audit firms to assess and evaluate the internal control systems and risk management practices in general, and credit risk management, in particular. FINMA internal practice provides for the conduct of its own onsite credit risk reviews in the form of 'supervisory reviews' for banks in categories 1–3 and 'deep dive' reviews for banks in all categories.

61. Specific requirements for risk concentrations in relation to the bank's capital are defined in the Capital Adequacy Ordinance. A large exposure is defined as the total position for a single counterparty or group of related counterparties of 10 percent or more of the bank's adjusted eligible capital. FINMA requires banks to limit and monitor large exposures. An individual large exposure must not exceed 25 percent of the bank's adjusted eligible capital, although an exception may apply if the excess is covered by sufficient 'free eligible excess capital'. Banks are also required to monitor their ten largest borrowers or groups of related borrowers and report on them to FINMA at least annually. Internally, banks are required to report large exposures to their boards of directors and to the supervisory audit firms on a quarterly basis.

62. Supervision of conduct-related risks has been enhanced since the prior FSAP, including through the creation of additional specialist teams (e.g., a team of suitability risk specialists) that look across supervised firms, and an attempt to make this area of supervision more forward looking. Switzerland's international reputation as a reliable and safe financial center places reputational risk from the abuse of financial services as a high priority. Conduct risk supervision is built on a risk-focused approach with potential areas of concern being identified through supervisory audits, onsite supervisory work carried out by FINMA staff and other analyses performed offsite by FINMA using the 'risk analysis and evaluation model.' While there are efforts underway to increase the use of proportionality in supervision, as noted above, with respect to conduct risks all firms are held to the same standards and FINMA strives for consistency.

63. Supervision of market risk management and interest rate risk in the banking book (IRRBB) is carried out by a combination of FINMA risk experts and supervisory auditors, with the required annual audits covering a broad swath of market and IRRBB risk managementrelated practices and controls. Controls around areas identified as 'high risk' are reviewed more frequently than others. Reviews of supervisory audit reports exhibited a broad coverage of key topics in both areas. For advanced approach banks, the work done around their Pillar 1 measurement of these risks is a key practice through which FINMA observes risk measurement, management and controls. FINMA can use Pillar 2 add-ons for deficiencies in these practices. Given the current low interest rate environment in Switzerland, particularly close attention is being paid to IRRBB, including at the category 2 and 3 banks, for which interest rate risk is a particularly important source of potential vulnerability.

64. As noted above, the issuance of Circular 2017/1 included enhancements to and clarifications on FINMA corporate governance expectations, including with respect to board structure. Specific structural requirements include the requirement that all category 1–3 banks have a board level audit committee and risk committee, although category 3 banks can merge both into one committee. Category 1 and 2 banks must also have compensation and board nominating committees. Members of the audit committee are required to be 'substantially independent', with independence defined as including not having worked at the bank or as a lead auditor of the banks audit firm for at least two years and having no commercial ties to the bank.

65. FINMA's supervision of corporate governance does not provide an explicit written assessment of the effectiveness of banks' boards of directors and senior management, though FINMA does raise corporate governance concerns in its yearly assessment letter to the banks, when material. Although concerns about such effectiveness may be implied by the articulation of weaknesses in specific practices raised by FINMA, the lack of an explicit assessment undermines the importance of the roles of boards of directors and senior management, particularly with respect to their duties to ensure effective risk management, internal controls, and a strong internal audit function. This can make it more difficult to ensure these parties are being held appropriately accountable for their responsibilities. This is surprising given the enhancements to the articulation of corporate governance expectations represented by the recent issuance of FINMA Circular 2017/1, which clearly outlines these expectations.

66. Corporate governance is a specific area that is required to be broadly assessed in the annual supervisory audits, but this work does not always appear to link the assessment directly enough to assessments of the practices for which senior management and boards are responsible. Notably, FINMA's internal process for rating supervised banks relies on substantial input from supervisory auditors who are in almost all cases the same firms that do the banks' financial audits (and in some cases other 'advisory' work for the banks). As noted directly above, supervisory auditors' assessments of corporate governance do not appear to be well informed by the assessments of specific areas of risk management, internal controls, and the banks' internal audit function that are carried out by the external auditors doing the annual supervisory audit. The supervision of corporate governance, and developing an integrated view of how well the bank is being run, is an area that may be among the least well suited to this type of coverage by external auditors, and should be given more attention by FINMA directly or through the use of mandataries.

67. FINMA supervision of corporate governance includes considerable attention to banks' compensation systems. FINMA updated standards for compensation through its 2016 amendment to Circular 2010/1, which covers minimum standards for compensation systems at financial institutions. Standards are consistent with the FSB 'Remuneration Principles' and provide detailed expectations for the appropriateness of incentives; alignment with risk, including reputational risk; long-term orientation; and alignment with capital, liquidity and other issues directly associated with the financial strength of the bank.

68. Through the bank licensing process FINMA reviews proposed board members and senior management as part of its fit and proper assessments, and considers qualifications and expertise. FINMA will also review 'fit and proper' criteria when there are changes in the functions of board members or senior managers or when there is evidence that they are not fulfilling their required duties.

Appendix I. 2014 FSAP—Actions Takento Improve Compliance with the BCPs

Recommended Action

Action Taken

CP1-Responsibilities, objectives and powers: Do not elevate competitiveness objective in FINMA mandate.

Partially Implemented. While FINMA's competitiveness objective has not been formally elevated, at the time of adopting the new fintech regulation in 2018, FINMA's mandate was expanded to include the future viability of the financial center at the same secondary level as competitiveness, arguably enhancing the latter.

CP2-Independence and resources:

Increase FINMA resources, especially for onsite work and risk expertise. Do not limit FINMA Pillar 2 powers.

Partially Implemented. FINMA staffing resources have not increased. It considers the available resources are appropriate to fulfill its mandate. However, FINMA is improving the efficiency of its supervisory processes and reinvests freed up resources in new or increased supervisory activity in line with the authority's risk-based supervisory approach. FINMA also plans to increase its overall resources due to the new tasks that are given to FINMA by financial market acts that were recently adopted, particularly on the supervision of external asset managers.

FINMA Pillar 2 powers have not changed.

CP6-Transfers of Significant ownership: Broaden and clarify definition of qualified participation.

Not Implemented. The framework has not changed since the last FSAP. The authorities consider that existing regulation has proven to be reliable, and FINMA does not foresee any change in the near future.

CP8-Supervisory approach: Improve methodology for risk assessment. Improvements include updating of Circular 2008/24 re qualitative risk management and governance standards and related auditor instructions.

Implemented. The main concerns of the past BCP assessment have been addressed. FINMA Circular 2017/1 'Corporate Governance – Banks' introduced qualitative elements of risk management and risk control, and requirements on boards' riskspecific expertise and independence, and on the CRO function. The risk rating system was revised in 2018 to include forwardlooking evaluations. FINMA still lacks an explicit legal basis for a thorough assessment of banks' boards and senior management.

CP9-Supervisory techniques: Enhance guidance for regulatory auditors' onsite work and improve consistency and quality. Add more in-depth supervisory review by auditors and by FINMA.

Implemented. The main concerns of the past BCP assessment have been addressed. Revised FINMA Circular 2013/3 on auditing became effective on 1 January 2019 and provides additional guidance to auditors in risk assessments, with a specific focus on banks of categories 1 and 2. FINMA has also developed detailed audit instructions. Since 2015, the FAOA is responsible for prudential auditors' performance. External auditors' documents are also subject to review by FINMA.

FINMA's direct on-site work has increased by about 44 percent during 2014–17. FINMA dedicates a significant share of its resources and 'on-site reviews' to the five largest banks and is in the process of requiring the external supervisory auditors to take a more risk-focused approach and to carry out 'deep dive' reviews rather than focusing primarily on annual supervisory audits. The

Recommended Action

Action Taken

'Team on Intensive Supervision,' that targets onsite work for categories 4 and 5 banks, has also increased its activity.

CP12-Consolidated supervision: Extend FINMA authority to issue enforcement decrees to apply to holding companies.

Implemented. The recovery and bankruptcy jurisdiction of FINMA has been extended to group parent companies and group companies which perform significant functions for activities requiring authorization (Article 2 bis BA; in force since 2016).

CP14-Corporate governance: Enhance guidance re boards. Implement separate risk committees at major midsize banks, ensure the CRO role has the adequate stature, and increase requirements for more independent board members.

Implemented. The recommendations were addressed and implemented in FINMA Circular 2017/1. Particularly, SIBs must have a separate risk committee, while category 3 banks must have a separate audit and risk committee. Banks in categories 1–3 must have a dedicated CRO, who must be part of the executive board for banks in categories 1–2. A third of the board members are required to be independent.

CP15-Risk management: Consider high-level guidance on risk management. Conduct thematic reviews by FINMA that relate capital to risk and push for improvements in data aggregation capability at major banks.

Implemented. FINMA Circular 2017/1 includes requirements on risk management. SIBs discuss capital planning at least annually, and midsize banks periodically. FINMA performs semi-annual enterprise-wide stress testing with the G-SIBs and on an ad-hoc basis with D-SIBs and selected mid-size banks. Thematic reviews include risk data, ongoing with G-SIBs and in discussion with DSIBs.

CP19-Concentration risk: Expand guidance or instructions to auditors on assessing risk concentrations. FINMA should conduct thematic reviews of concentration risk other than single name credit exposures.

Not Implemented. Onsite prudential audits must include all concentration risks, and not only single name credit exposures. Since the large exposures regulation is quite detailed, FINMA finds it unnecessary to complement it with audit instructions. FINMA pays attention to concentration risks in its supervisory reviews, while further efforts are needed to conduct thematic reviews.

CP20-Transactions with related parties: Update definition of relatedparties' transactions and ensure they are at market terms.

Partially Implemented. The new FINMA Circular 2015/1 on FINMA accounting rules requires the presentation in the notes the transactions with related parties, with attestation that they have been concluded at market conditions. The definition of related parties transactions have not been updated.

CP24-Liquidity risk: Update qualitative guidance and quantitative metrics. Plan a cross-system review of implementation within two years of implementation.

Implemented. Qualitative and quantitative requirements were updated in January 2018 in line with the Sound Principles of the Basel Committee on Banking Supervision. On quantitative metrics, the NSFR should enter into force in line with the most important international financial centers.

CP25-Operational risk: Update qualitative requirements. Increase FINMA specialist resources to strengthen supervision, thematic reviews, and oversight of auditors' work. Enhance operational risk in the supervisory methodology.

Implemented. Qualitative requirements were updated as part of the FINMA circular on operational risk. A separate team is now responsible for operational risk, cybersecurity and IT, with additional staffing resources. Supervision and thematic reviews are performed as part of FINMA led on-site reviews and deep dives. FINMA's supervisory rating system includes a specific assessment of qualitative operational risk management.

This note was prepared by Tim P. Clark, IMF external expert and former Deputy Director of Banking Supervision at the U.S. FED Board of Governors, and Antonio Pancorbo, senior IMF financial sector expert.

IMF: 'Switzerland: Detailed Assessment of Compliance-Basel Core Principles for Effective Banking Supervision' September 2014. The assessment concluded that FINMA had made major enhancements in the practice of banking supervision and had a high level of compliance with the BCP; however, not all the results of improvement to date were embedded in the system or yet observable. Appendix I details the main recommendations of the 2014 BCP assessment, and the main actions taken by the authorities to address them.

Unofficial English version of FINMASA: https://www.admin.ch/opc/en/classified-compilation/20052624/index.html.

Unofficial English version of the Swiss Federal Act on Banks and Savings Banks: https://assets.kpmg.com/content/dam/kpmg/ch/pdf/ch-banking-act-en.pdf.

See legal basis for banks: https://www.finma.ch/en/documentation/legal-basis/laws-and-ordinances/banks/.

Mandataries are external experts mandated by FINMA to undertake work on its behalf.

FINMA keeps lists of all authorized institutions in its webpage: https://www.finma.ch/en/finma-public/authorisedinstitutions-individuals-and-products/. An overview of the structure of the banking sector in Switzerland can be found in this publication of the SNB: 'Banks in Switzerland 2017.'

See categorization of banks and securities dealers: https://www.finma.ch/en/supervision/banks-and-securitiesdealers/categorisation/.

FINMA Circulars in force can be found on FINMA's webpage: https://www.finma.ch/en/documentation/circulars/ 10 See motions 17.3976 and 18.3612.

See parliamentary motion 17.3317 as of May 4, 2017, and subsequent adoption in the Swiss National Council and the Swiss Council of States.

The Swiss National Bank is tasked with designating SIBs and their systemically important functions (after consulting FINMA). The criteria focus primarily on the role of banks in the domestic economy, their interconnectedness and the extent to which a quick substitution of an institution could prove to be difficult. So far, the Swiss National Bank designated five SIBs, of which two are G-SIBs.

Bank accounting is governed by arts. 6–6b of the Banking Law, arts. 25–42 of the Banking Ordinance, and FINMACircular 2015/01 ('Swiss rules'). At the consolidated level, banking groups may apply International Financial Reporting Standards or US GAAP (without any carve out or deviation) instead of FINMA's rules. Regulatory disclosure is governed by FINMA-Circular 2016/1, which implements Basel III Pillar 3.

FINMA has established the KAMs with a central role for the supervision of individual banks and banking groups. KAMs are the prime sources of information and as such they are key contact persons with FINMA management and other relevant FINMA units, the supervised institutions, and third parties (auditors, foreign authorities, colleges of supervisors, SNB, associations, etc.).

Main supervisory instruments include supervisory reviews and deep-dives as the two forms of FINMA's on-site inspections; capital planning discussions that are an integral component of supervision across bank categories as defined in FINMA Circular 2011/2; crisis planning and loss potential analyses (LPA); and the assessment letters as the means of FINMA to provide a regular evaluation of a supervised institution

An overview of FINMA's organization can be found in its webpage: https://www.finma.ch/en/finma/organisation/

Please see the FSAP Technical Note on "Financial Safety Nets and Crisis Management Arrangements" for further elaboration on FINMA's enforcement action, early intervention, resolution powers and planning, and the legal protection for the supervisor.

Supervisory audit firms and also the persons in charge of auditing activities must be certified by the Federal Audit Oversight Board (FAOA) to perform the so-called 'basic prudential audit' on a recurring manner. To this end, the auditor needs to comply with legal requirements in terms of organization, employee training and independence. FINMA works closely with the FAOA given this role in the licensing and oversight of supervisory auditors and performs internal evaluations of supervisory auditors itself.

See discussion of the use of third parties in Financial Stability Board: Intensity and Effectiveness of SIFI Supervision— Recommendations for enhanced supervision, November 2010.

Ibidem.

According to the Swiss Code of Obligations, lead financial and supervisory auditors may exercise their mandate for seven years at most. They may only accept the same mandate again after an interruption of three years. In practice,

Basel Committee on Banking Supervision: Basel Core Principles for Effective Banking Supervision, 2012: "On-site work is used as a tool to provide independent verification that adequate policies, procedures and controls exist at banks, determine that information reported by banks is reliable, obtain additional information on the bank and its related companies needed for the assessment of the condition of the bank, monitor the bank's follow-up on supervisory concerns, etc."

For example, FINMA will increase its overall resources due to new tasks that will be given to FINMA by financial market acts that were recently adopted by Parliament (namely the Financial Services Act and on the Financial Institutions Act with regard to supervision of external asset managers).

This is complemented by additional reporting based on the work done for financial audits, which in all relevant cases is the same audit firm that produces the supervisory audits.

The TBTF legislation dates back to a revision of the Banking Act (BA, articles 7–10a)) by Parliament in September

and enacted in March 2012. Based on the principles in the BA implementing legislation exists in the (i) Banking

Ordinance (articles 60–66); (ii) Capital Adequacy Ordinance (CAD, articles 124–136); and (iii) Liquidity Ordinance (articles 19–29). The transition period applicable to G-SIBs (going and gone-concern) ends on January 1, 2020. For the D-SIBs, the January 2020 also applies for their going-concern requirements, while the gone-concern requirements have an extended phase-in period which ends on January 1, 2026.

For the 3 D-SIBs the RWA-requirement is between 12.86 and 13.22 percent.

For the 3 D-SIBs the LR-requirement is between 4.5 and 4.62 percent.

For the 3 D-SIBs the buffer is 1.5 to 1.62 percent

Basel Committee: Principles for effective risk data aggregation and risk reporting, January 2013, https://www.bis.org/publ/bcbs239.htm

A 'post-stress minimum leverage ratio requirement', such as is used in the US in DFAST/CCAR, has the benefit of capturing the increased holding of risky assets through the stress loss calculations on those assets, so that a bank with more risky assets relative to another bank will have a lower post stress LR. In this way it provides a check on the use of internal models for calculating RWA because it maintains the use of a total assets denominator but adjusts capital based on the stress loss calculations and associated declines in equity. It maintains the value of the leverage ratio since it is still based on total assets, but adjusts equity in a risk sensitive way through the stress test, providing a more consistent comparative measure of risks across firms and a notion of the resiliency of the banks under stress, while continuing to require capital against total assets in addition to internally modeled RWA.

The supervision of corporate governance is further elaborated in Section G of this note.

A good example of this approach is the U.K. regulations, which include a 'Senior Managers Regime' aimed at increasing personal accountability of senior managers in the financial services industry.

Conduct risk supervision was not a key area of focus of this assessment.