Cloud migration in Swiss banking after the revised FADP

Every Swiss financial institution we speak to, from a 25-person asset manager to a 300-person regional bank, has the same two beliefs about cloud migration: that it is now permitted, and that it is now complicated. Both are true, but not for the reasons usually given.

The revised Federal Act on Data Protection did not introduce a data-residency requirement. What it sharpened, together with FINMA's rules on outsourcing and operational resilience, is accountability. You must be able to demonstrate, on request, where client-identifying data sits, who can reach it, on what legal basis it leaves Switzerland, and how you would leave the provider.

The move itself is no longer unusual. FINMA reported that by 2024 one in five banks and insurers was already outsourcing significant data or functions to public cloud providers, according to its review of cyber risks and outsourcing.

What actually blocks a migration

Three things, in this order.

• Client-identifying data spread across systems nobody mapped. The migration cannot be scoped because the data cannot be located.
• Outsourcing arrangements that predate the current rules. Contracts exist, but not the evidence trail the rules now expect.
• Access paths through third parties. Support vendors with standing production access are the finding that most often stops a programme.

None of these are cloud problems. They are inventory problems that the cloud makes visible, and the supervisor sees them too. When FINMA inspected asset managers that had outsourced key activities in 2025, it found a need for improvement in the outsourcing inventory itself, along with control activities, reporting and internal escalation, according to its annual report.

The third item is the one with teeth. In FINMA's 2024 review, attacks on external service providers accounted for roughly 30% of the cyber attacks reported to it, and the supervisor flagged a growing concentration of critical services at a few providers.

Does the revised FADP require Swiss data residency?

No. The revised FADP does not mandate that personal data remain in Switzerland. Transfers abroad are permitted where the destination provides adequate protection or where appropriate safeguards are in place. Residency is frequently adopted as an internal policy or in response to supervisory expectations, which is a different thing from a legal requirement and should be argued on its own merits.

The rules are in Article 16 of the Federal Act on Data Protection, and the list of countries with adequate protection in Annex 1 of the Data Protection Ordinance. It covers the EU and EEA states and the United Kingdom, and since 15 September 2024 US companies certified under the Swiss-US Data Privacy Framework, as the Commissioner announced. Elsewhere, recognised standard contractual clauses do the job, and using them does not have to be reported, according to the Commissioner's guidance on cross-border transfers.

Three practical points follow. Clients must be told which countries their data goes to, so the privacy notice changes with the migration. Remote support access from another country can amount to disclosure abroad, so the provider's support model matters as much as its region. And bank-client confidentiality is a separate constraint from data protection, which is why many institutions encrypt client-identifying data with keys they hold themselves and limit which provider staff can ever see it in clear.

Which FINMA rules apply to a cloud move?

For banks, securities firms and insurers, two circulars do most of the work. Circular 2018/3 on outsourcing sets the conditions for handing significant functions to a provider, including one abroad. Circular 2023/1 on operational risks and resilience adds requirements on technology, critical data, cyber risk and keeping critical functions running. FINMA's cyber guidance then sets the incident reporting deadlines.

FINMA designed the outsourcing circular to be principle-based and technology-neutral, so it neither blesses nor forbids the cloud. What it insists on is that institutions make allowance for the higher risk of outsourcing outside Switzerland, and that restructuring and resolution here remain possible. The operational resilience circular came into force on 1 January 2024 with a two-year transition for the resilience requirements, which has now run its course.

For asset managers the picture is less tidy. FINMA used the outsourcing circular's general requirements as its yardstick in the 2025 inspections mentioned above. If you are a smaller portfolio manager supervised through a supervisory organisation, expect the same questions from it and from your auditors, and build the evidence pack either way.

Internationally, the Basel Committee's principles for third-party risk cover the whole life cycle, from risk assessment and due diligence to contracting, monitoring and termination. They are meant to be applied proportionately to the bank's size, which is the honest frame for a small institution: the same questions, shorter answers.

What has to be documented before a migration?

At minimum, a data inventory that identifies client-identifying data by system, a record of processing activities, the legal basis for any cross-border transfer, a demonstrable access model showing who can reach production data and how that access is granted, reviewed and revoked, and an exit plan that would survive the provider failing.

Smaller institutions often assume this pack is disproportionate at their size. It is not. It is shorter, because the estate is smaller. What does not scale down is the requirement to have it. In a 40-person firm the "who signs it" column often holds two names, and that is fine, provided the person who signs the access model is not the only person who administers it.

The exit plan is the artefact most often missing. The Basel principles ask for exit plans for a planned termination and exit strategies for an unplanned one, and the difference matters: a planned exit is a project, while an unplanned one is a weekend. Write down where the data would go, in what format, and who would do it.

Who has to be told when the provider has an incident?

FINMA, within 24 hours of discovering a material cyber attack, with a full report within 72 hours, counted in bank working days except for severe attacks. The clock starts when your provider identifies the incident, not when it tells you, because outsourcing does not transfer your responsibility. A breach of personal data likely to cause high risk also goes to the Commissioner as quickly as possible.

The detail is in FINMA Guidance 03/2024, which clarifies the 2020 reporting duty. Institutions are expected to make an initial assessment within the 24 hours, and if they must choose between finishing that assessment and meeting the deadline, the deadline wins; a report can be withdrawn later. Even where a provider is not a material outsourcing partner, you must make sure it tells you about its incidents. Institutions that also fall under the Information Security Act can send the first report through the NCSC form and have it forwarded.

That last point is not theoretical. Since the critical infrastructure reporting duty began in April 2025, banks and insurers have filed 15.7% of the mandatory reports the NCSC received, according to its semi-annual review. For the contract, this means a notification clause measured in hours, a named contact reachable at weekends, and a test of both before go-live. The same incident thinking applies outside banking, as set out in cybersecurity priorities for a Swiss SME.

A sequence that works

1. Inventory client-identifying data before choosing a target architecture. The inventory usually changes the architecture.
2. Fix the access model in the current estate first. Migrating a broken access model reproduces it at scale.
3. Migrate one non-critical workload end to end, including the evidence trail. The first migration is a rehearsal for the audit, not for the technology.
4. Only then plan the core.

Institutions that follow this sequence tend to move faster overall, because the supervisory conversation stops being a blocker and becomes a checklist. The data work in step one has the same traps as any system move, which are set out in ERP data migration: the part that overruns.

Is this different for a 30-person asset manager?

The obligations are the same; the effort is not. A smaller institution has fewer systems, fewer third parties and a shorter access list, so the inventory that takes a large bank a year can take a small one a fortnight. What catches smaller firms out is assuming the rules are aimed at someone else. Supervisory expectations follow the data, not the headcount.

The practical difference is that a small firm cannot absorb a finding discovered during a migration. It has to do the inventory first, because there is no parallel team to fix problems while the programme continues.

There is a second difference. Many small firms have already moved to the cloud without calling it a migration, through email, office software, CRM and portfolio tools bought as services. Across EU enterprises of all sectors in 2025, 49% of small firms bought cloud services, against 85% of large ones, and among cloud users email and office software were the most common, according to Eurostat. Each of those services is outsourcing, and each belongs in the inventory.

For a young firm the same logic applies from day one, and it is easier to build in than to retrofit. The positioning side of that, and why supervisors and clients read the same signals, is in how a new fintech brand gets taken seriously.

The access model is the whole exercise

Everything in the evidence pack except one item is documentation of decisions already made. The access model is different: it is the thing most likely to be wrong today.

Standing production access held by an integrator, a shared administrator account, a support path that bypasses your identity provider: these exist in almost every estate we assess, predate the current rules, and are invisible until someone asks for the list. Produce the list before a regulator or a client's due-diligence questionnaire does. The same review decides what an automated assistant may read once you add one, which is why it comes first in what AI agents can realistically automate.

How long does a migration take?

Budget one to three months for the inventory in an institution of 50 to 300 people, and a few weeks in a firm of 30, and expect it to surface at least one access finding that has to be remediated before anything moves. That finding is the value of the exercise, not a delay to it. These are typical observations, not commitments.

After the inventory, the first non-critical workload usually takes a quarter including its evidence trail, and the core follows on a timetable set by contracts and the supervisory dialogue rather than by engineering. Most of the cost is internal time from people who already have day jobs, which is why the business case should be judged on avoided risk and retired infrastructure, using the structure in how to measure ROI before you fund it.

The wider compliance surface is in our FADP compliance checklist, and the data groundwork is in our guide to data readiness. Our cloud computing work for financial services clients starts with the inventory, and the payment and product side sits with our fintech practice.

Sources

• FINMA — Cyber risks and outsourcing (2024), public cloud use, attacks via service providers, concentration
• FINMA — FINMA publishes outsourcing circular, Circular 2018/3
• FINMA — FINMA publishes Circular "Operational risks and resilience", Circular 2023/1
• FINMA — Guidance 03/2024, cyber incident reporting deadlines and outsourced functions
• FINMA — New cyber supervisory approach and guidance, Guidance 05/2020 on reporting cyber attacks
• FINMA — Annual Report 2025: supervisory activity by sector, outsourcing inspections in asset management
• Federal Office for Cyber Security — Cyberthreat level remains high, mandatory reports by sector
• Bank for International Settlements — Sound management of third-party risk, executive summary, Basel Committee principles
• Eurostat — Cloud computing: statistics on the use by enterprises, 2025 data
• Fedlex — Federal Act on Data Protection (FADP), SR 235.1, Article 16 on disclosure abroad
• Fedlex — Data Protection Ordinance (DPO), SR 235.11, Annex 1: states with adequate protection
• Federal Data Protection and Information Commissioner — New Swiss-US Data Privacy Framework
• Federal Data Protection and Information Commissioner — Cross-border transfer of personal data

Related reading

• The revised FADP: what Swiss companies actually have to do
• Cybersecurity for Swiss SMEs: the five things that actually matter
• How does a new fintech brand get taken seriously in Switzerland?
• Is your data ready for AI? The five foundations an SME actually needs
• Cloud computing consulting