Switzerland

Regulations

• Can financial institutions use AWS?

  Yes. Financial institutions in Switzerland are permitted to use cloud services, provided that they comply with applicable legal and regulatory requirements, such as those described below. 

• Who is the financial regulator?

  The Swiss Financial Market Supervisory Authority (Eidgenössische Finanzmarktaufsicht) (“FINMA”) is Switzerland’s key financial supervisory authority. FINMA supervises persons and entities that under the Swiss financial market acts are required to be licensed, recognized or registered by FINMA (including, inter alia, banks, securities dealers, stock exchanges, multilateral trading facilities, central counterparties, central securities depositories, trade repositories, payment systems, insurance companies, collective investment schemes and collective capital investments, fund management companies, fund distributors, and directly supervised financial intermediaries).
  

• What regulations apply to financial institutions using AWS?

  The AWS Swiss Financial Services Addendum provides Swiss regulated customers with specific contractual terms (in addition to those provided in the AWS Customer Agreement) to assist them in meeting their regulatory requirements. Please reach out to your AWS account team for details.
  

  Financial institutions in Switzerland may be subject to a number of different legal and regulatory requirements, including on outsourcing arrangements, when they use cloud services.
  

  Where AWS performs all or part of a function that is significant to the financial institution’s business activities independently and on an ongoing basis, the following relevant FINMA regulations for outsourcing and management of operational risks apply. The regulations set out requirements regarding, among others, the selection, instruction and monitoring of a service provider, the rules on the segregation of duties, risk management and internal controls, and provide that financial institutions must maintain an inventory of outsourced functions.

  • Circular 2023/1 - Managing operational risks and ensuring operational resilience - banks
    
  • Circular 2018/3 - Outsourcing – banks and insurers
  • Circular 2008/21 - Operational risks at Banks, in particular Principle 4 and Appendix 3

  Other applicable legal and regulatory requirements include, for example: recommendations issued by the Swiss Bankers Association, in particular the Cloud Guidelines and the Recommendations for Business Continuity Management (BCM); legislation in relation to the Banking Law (breach of banking secrecy); the Financial Market Infrastructure Act; the Federal Act on Financial Institutions; the Federal Act on Data Protection ("FADP") (breach of professional confidentiality); and the blocking statutes in the Criminal Code (unlawful activity on behalf of a foreign state and industrial espionage).

  Regulations are changing rapidly in this space, and AWS is working to help customers proactively respond to new rules and guidelines. AWS encourages its financial institutions customers to obtain appropriate advice on their compliance with all regulatory and legal requirements that are relevant to their business, including the FINMA circulars, relevant guidelines (for example, from the Swiss Bankers Association and the Federal Data Protection and Information Commissioner), and laws. 

• Key considerations for financial institutions using AWS

  AWS is committed to offering customers a strong compliance framework and advanced tools and security measures that customers can use to evaluate meet, and demonstrate compliance with applicable legal and regulatory requirements.

  Financial institutions who are using or planning to use AWS services can take the following steps to better understand their compliance needs:

  1. Consider the purpose of the workload(s) under consideration and the relevant categories of data in order to anticipate which legal and regulatory requirements may apply.

  2. Assess the materiality or criticality of the relevant workload(s) in light of local requirements. 

  3. Review the AWS Shared Responsibility Model and map AWS responsibilities and customer responsibilities according to each AWS service that will be used. Customers can also use AWS Artifact to access AWS’s audit reports and conduct their assessment of the control responsibilities. In particular, the ISAE 3000 Type 2 report verifies that AWS’s control environment is appropriately designed and implemented to align with certain FINMA requirements applicable to regulated financial services customers in Switzerland.
  

  4. Customers who have further questions about how AWS services can enable their security and compliance needs, or who would like more information, can contact their account representative.

• Key data privacy and protection considerations for financial institutions using AWS

  Financial institutions in Switzerland using AWS services should also consider applicable privacy requirements, including the FADP and its Ordinance, as amended from time to time, and, where applicable, the General Data Protection Regulation (“GDPR”).
  

  If customers process or are planning to process the personal data of data subjects in the European Union (EU), they should visit AWS’s General Data Protection Regulation (GDPR) Center. More information on these requirements are included in the AWS whitepaper, Navigating GDPR Compliance on AWS.

  The AWS Region in Switzerland is now open and allows customers to store data within Switzerland, and reduce latency to their Swiss customers. Visit the AWS Global Infrastructure page or read the press release for more information.
  

Resources