FINMA’s Cyber Expectations: A Status Check

Summary

FINMA has raised the bar on cyber resilience, and Swiss financial institutions are now expected to demonstrate real operational maturity rather than simply meeting compliance requirements.

This chapter event takes stock of where the sector stands. Tobias Schumacher, Senior Cyber Risk Management Specialist at FINMA, presents the regulatory perspective: what FINMA expects, how it supervises, and what gaps it continues to observe. Martin Weder, CISO at Zürcher Kantonalbank, offers the practitioner’s view — the realities of embedding FINMA’s cyber expectations into day-to-day operations at a systemically important financial institution. Together, they explore what genuine cyber resilience looks like in practice, and what it takes to get there.

Presenters

• Tobias Schumacher, Senior Cyber Risk Management Specialist, FINMA  
  Tobias Schumacher is Senior Cyber Risk Management Specialist at the Swiss Financial Market Supervisory Authority (FINMA), where he leads supervisory work on cyber risk across the Swiss financial sector. He is responsible for assessing the cyber resilience posture of supervised institutions and translating FINMA’s regulatory expectations into practical supervisory guidance. With deep expertise in cyber risk management and financial sector regulation, Tobias plays a central role in shaping how FINMA evaluates and responds to cyber threats targeting banks, insurers, and other regulated entities. 
• Martin Weder, Chief Information Security Officer (CISO), Zürcher Kantonalbank (ZKB)  
  Martin Weder is Chief Information Security Officer (CISO) at Zürcher Kantonalbank (ZKB), Switzerland’s largest cantonal bank and a domestically systemically important financial institution. In this role, he leads ZKB’s information security strategy and the bank’s comprehensive cyber resilience programme, encompassing governance, risk management, and operational response capabilities. With extensive experience in financial sector cybersecurity, Martin brings a hands-on perspective on what it takes to implement regulatory requirements at scale and how to build genuine resilience in a complex banking environment. 

Introduced and moderated by Maya Bundt, Chapter Chair of Cyber Resilience at Swiss Risk Association and Multiple Board Member.

Agenda

17:45 Arrival & Name Tag Collection
18:00 Welcome and Introduction (Maya Bundt)
18:05 Keynote Presentations (Tobias Schumacher, Martin Weder)
19:00 Q&A
19:20 Conclusion (Maya Bundt)
19:30 Networking Drinks (all)
20:30 End

Chapter Event

In our chapter events – access for members only – we present one or more speakers to share knowledge, updates and best practices on a specific risk topic. In small groups of risk professionals you can exchange thoughts and test ideas. More on SRA chapters. This event is hosted by the chapter Cyber Resilience.