FINMA operational resilience: test your mobile banking app and its APIs, release after release.
FINMA Circular 2023/1 asks banks to run vulnerability assessments and penetration tests regularly, covering every internet-facing system, to protect critical data and to report significant cyber attacks within 24 hours and 72 hours. FINMA's digital fraud guidance adds technical controls against phishing and account takeover, and the revised FADP sets data security and breach duties. Ostorlab tests your app and the APIs behind it, behind login, on every release.
- Assesses the mobile app and the APIs it calls, on the build your customers download
- Tests login, one-time codes, step-up checks and session handling with your test accounts
- Lists the SDKs and native libraries in each release and maps them to known vulnerabilities
- Proves each finding with a replayable exploit or request and response evidence
- Who it applies to
- Banks, persons under Article 1b of the Banking Act, securities firms and financial groups supervised by FINMA
- Key dates
- Circular 2023/1 in force since 1 January 2024, resilience requirements phased in by 1 January 2026; digital fraud guidance of 9 April 2026
- Focus
- Vulnerability assessments and penetration tests of internet-facing assets, critical data, cyber exercises and reporting
- Main reference
- FINMA Circular 2023/1 "Operational risks and resilience - banks"
The Swiss texts behind your mobile channel
The circular sets the supervisory practice for operational, ICT and cyber risk; the guidance and the data protection act sit around it. The dates below are for the texts cited on this page.
- 7 May 2020
Duty to report cyber attacks
FINMA Guidance 05/2020 sets out how institutions report significant cyber attacks on critical functions under Article 29 paragraph 2 FINMASA: an initial report within 24 hours and a full report within 72 hours.
- 7 December 2022
Circular 2023/1
FINMA publishes the fully revised circular on operational risks and resilience. It replaces the former Circular 08/21 on operational risk and adds explicit requirements for ICT risk, cyber risk, critical data and operational resilience.
- 1 September 2023
Revised FADP in force
The revised Federal Act on Data Protection and its ordinance apply. Privacy by design and by default, risk-appropriate data security, impact assessments and breach notification become explicit duties.
- 1 January 2024
Circular in force
The circular applies to banks, securities firms and financial groups. The operational resilience requirements follow transitional periods of one and two years.
- 7 June 2024
Cyber supervision findings
Guidance 03/2024 reports findings from FINMA's on-site cyber reviews, clarifies the 24-hour and 72-hour reports and sets out its expectations for scenario-based cyber exercises.
- 11 June 2025
FIDO2 for transactions
The Swiss Bankers Association and the Swiss FS-CSC support extending FIDO2 so that authenticators can securely display and confirm transaction data, not only logins.
- 9 April 2026
Digital fraud guidance
Guidance 02/2026, based on a survey of 19 banks, sets expectations for governance, detection and technical controls against digital fraud, online account opening abuse and account takeover.
The Swiss rules, applied to your mobile app
For each rule: what the text says, what it means for a mobile banking app, how Ostorlab helps, and what stays with your team. Quotes from Circular 2023/1 use the English version published by FINMA.
- FINMA Circular 2023/1, Chapter IV.C (cyber risk management), margin nos. 61 to 70
Run vulnerability assessments and penetration tests on internet-facing systems
What the text says
The executive board shall arrange for vulnerability assessments and penetration tests to be conducted regularly. They must be performed by qualified staff with adequate resources. All inventoried ICT assets that are accessible over the internet must be taken into account, together with assets that are not accessible over the internet but are necessary for critical processes or contain critical data. Cyber risk management must also cover the institution-specific threat landscape, protective measures, logging and detection, rapid containment and remediation, and recovery.
Source:FINMA Circular 2023/1, Chapter IV.C (cyber risk management), margin nos. 61 to 70
What it means for your mobile app
Your mobile banking app, its backend APIs and the build in the stores are internet-facing ICT assets. They belong in the scope of the regular assessments, next to servers and network equipment.
How Ostorlab helps
Ostorlab pentests the app and the APIs behind it, behind login, on the build your customers download, and runs Mobile SAST and DAST on every build in CI/CD. Each AI-agent finding comes with a working exploit you can replay.
What stays with you
Scoping and frequency, tests of servers, VPN equipment and other infrastructure, qualified resourcing, and reporting the results to the board.
- FINMA Circular 2023/1, Chapter IV.C(d); FINMA Guidance 03/2024, sections 2.1 and 2.4
Remediate findings quickly and manage the software lifecycle
What the text says
Cyber risk management must include appropriate processes for rapid containment and remediation measures in response to identified vulnerabilities and cyber attacks. FINMA's cyber supervision has found that follow-up is where institutions and their service providers fall short: serious vulnerabilities were often mitigated quickly inside the institution but not at service providers, and some institutions had incomplete response plans or did not review their effectiveness. Findings need an owner, a deadline and proof of closure.
Source:FINMA Circular 2023/1, Chapter IV.C(d); FINMA Guidance 03/2024, sections 2.1 and 2.4
What it means for your mobile app
A finding is closed when a new build fixes it. Libraries and SDKs inside the app need an owner, a patched version and an upgrade path.
How Ostorlab helps
Findings are rated critical, high, medium or low and grouped into tickets in the platform or in Jira and ServiceNow, with retesting once the fix ships. SCA keeps mapping vulnerable components release after release.
What stays with you
Patching servers and infrastructure, chasing service providers, and risk acceptance decisions.
- FINMA Circular 2023/1, Chapter IV.B (ICT risk management), margin nos. 47 to 60, in particular margin no. 53
Keep an inventory of ICT assets and the software in each release
What the text says
The institution shall keep one or more inventories of its ICT assets, including hardware and software assets and the storage locations of critical data, with dependencies inside the institution and interfaces to significant external service providers. The inventory is available in real time and reviewed and updated regularly for completeness and accuracy. Change management must define the procedures, processes and controls for all phases in the development or procurement of ICT.
What it means for your mobile app
Third-party SDKs in the app are software assets that talk to their own backends. You should know their versions, their permissions and what they exchange over the network.
How Ostorlab helps
Ostorlab lists the SDKs and native libraries in each release with their versions and their location in the app bundle, and shows which backends the app and its SDKs talk to.
What stays with you
The asset ledger, database and storage inventories, third-party due diligence and contracts.
- FINMA Circular 2023/1, Chapter IV.D (critical data risk management), margin nos. 71 to 82
Protect critical data on the device, in transit and in test environments
What the text says
The institution identifies its critical data in a systematic and comprehensive way, categorises it by criticality and manages it across its entire life cycle. Critical data must be protected from access and use by unauthorised persons during operations and during the development, change and migration of ICT, including in test environments. Access is restricted on a need-to-know basis, and the authorisation system and its entries are reviewed regularly. If critical data is stored outside Switzerland or can be accessed from abroad, the increased risks must be adequately mitigated, monitored and the data given particular protection.
Source:FINMA Circular 2023/1, Chapter IV.D (critical data risk management), margin nos. 71 to 82
What it means for your mobile app
Tokens, credentials and personal data written by the app to storage, caches and logs are critical data. A test environment that uses production-like data carries the same protection duties.
How Ostorlab helps
Ostorlab looks for session tokens, credentials and personal data in local storage, caches, logs, screenshots and backups, and checks transport protections and misconfigurations that weaken them.
What stays with you
Data classification, key management, access reviews, test data management and monitoring of cross-border access.
- FINMA Circular 2023/1, Chapter IV.B(b) (change management), margin nos. 50 to 52
Build security into every change and test on every release
What the text says
Change management shall define the procedures, processes and controls for all phases in the development or procurement of ICT, considering the impact of the change on ICT risks and focusing on confidentiality, integrity and availability. Development and test environments must be separate from the production environment, with clear responsibilities and access rules. Functional and non-functional requirements, including security requirements, shall be clearly defined, approved, tested and validated based on their criticality.
Source:FINMA Circular 2023/1, Chapter IV.B(b) (change management), margin nos. 50 to 52
What it means for your mobile app
Every app release is a change to an internet-facing channel. Automated security tests belong in the pipeline before the release and on the store build after it.
How Ostorlab helps
Ostorlab runs Mobile SAST and DAST from your CI/CD pipeline on every build and monitors App Store and Google Play releases without manual triggers. Mobile SAST works on the APK, AAB or IPA, with no source code needed.
What stays with you
Security requirements, secure coding standards, environment separation, manual reviews and release approval.
- FINMA Guidance 02/2026, sections 3.1.2, 3.1.3 and 3.2
Use technical controls against digital fraud and account takeover
What the text says
FINMA Guidance 02/2026 summarises a survey of 19 banks at the end of 2025 and states that digital fraud risks, including the risk of unauthorised access to accounts, must be identified, assessed, managed and monitored as part of operational risk management. The survey found that three of the institutions used no technical controls such as geo-blocking, IP risk rating or device fingerprinting to authenticate clients, and that seven either did not analyse fraud indicators at all or did so manually. FINMA recommends technical means to detect deepfakes and manipulated videos, and points to phishing and account takeover among the methods criminals use to gain control of accounts.
Source:FINMA Guidance 02/2026, sections 3.1.2, 3.1.3 and 3.2
What it means for your mobile app
Login, account opening and account changes are where fraud controls meet the app. The controls have to be enforced by the server, not only rendered by the app.
How Ostorlab helps
Authenticated testing covers login and logout, one-time codes, step-up flows, lockout and session invalidation, together with the API calls behind them, including attempts to skip or replay a step.
What stays with you
Fraud monitoring rules, KYC and transaction monitoring, deepfake detection, staff training and fraud response plans.
- FINMA Guidance 05/2020; FINMA Guidance 03/2024, section 3; FINMA Circular 2023/1, Chapter IV.C
Report significant cyber attacks within 24 hours and 72 hours
What the text says
Institutions must report successful or partially successful cyber attacks of material significance for supervision to FINMA without delay. Guidance 05/2020, as clarified by Guidance 03/2024, expects an initial assessment and preliminary notification to the responsible account manager within 24 hours of discovery, the full report via the EHP survey and application platform within 72 hours, and a concluding root cause analysis once the institution has finished processing the case. The deadlines are counted on bank working days, except for attacks of "severe" severity, which are reported within 24 hours even outside bank working days. Institutions that also report under the Information Security Act can send the 24-hour notification through the NCSC reporting form and forward it to FINMA.
Source:FINMA Guidance 05/2020; FINMA Guidance 03/2024, section 3; FINMA Circular 2023/1, Chapter IV.C
What it means for your mobile app
Meeting the deadlines depends on fast detection and on knowing what happened. Reproductions, logs and request and response evidence help with severity and scope.
How Ostorlab helps
Ostorlab does not report to FINMA. Its findings come with reproduction steps, request and response evidence and retest results that support a root cause analysis or a report.
What stays with you
Severity assessment, the 24-hour and 72-hour submissions, crisis communication and the root cause analysis.
- FINMA Circular 2023/1, margin no. 70; FINMA Guidance 03/2024, section 4
Run scenario-based cyber exercises, with red teaming where required
What the text says
Risk-based, threat intelligence-related scenario cyber exercises must be conducted on the basis of the institution-specific threat landscape, and the results must be documented and reported. Guidance 03/2024 adds that FINMA regards red teaming as an essential component of cyber risk exercises for systemically important institutions, while non-systemically important institutions should carry out at least one tabletop exercise every year. Institutions in supervisory categories 4 and 5 can meet the obligation through the exercises run by the Swiss Financial Sector Cyber Security Centre.
Source:FINMA Circular 2023/1, margin no. 70; FINMA Guidance 03/2024, section 4
What it means for your mobile app
Exercises test the whole institution, not only the app. They work best when known app and API weaknesses are already fixed, and their findings should feed back into remediation.
How Ostorlab helps
Ostorlab does not run red teaming or TLPT and does not replace it. It helps you go into an exercise with known app and API issues fixed, and retests those items afterwards.
What stays with you
Scoping and running the exercises, vendor selection, participation, reporting the results and acting on the lessons.
- Federal Act on Data Protection (FADP), Articles 7, 8, 22 and 24; Data Protection Ordinance (DPO), Articles 1 to 4
Meet the FADP duties: privacy by design, data security and breach notification
What the text says
The revised Federal Act on Data Protection, in force since 1 September 2023, requires controllers to arrange processing so that the data protection principles are respected, from the planning stage, using technical and organisational measures appropriate to the state of the art, the nature and extent of the processing and the risk. A data protection impact assessment is required before processing that is likely to result in a high risk. Controllers must notify the Federal Data Protection and Information Commissioner of any breach of data security that is likely to lead to a high risk as quickly as possible, and processors must guarantee data security and notify the controller of breaches. The Data Protection Ordinance sets the minimum requirements for data security.
What it means for your mobile app
The app is where personal data is collected, stored, displayed and logged. Defaults, permissions, retention and what leaves the device are part of the FADP duties, not only of security policy.
How Ostorlab helps
Ostorlab shows what personal data the app leaves on the device, in caches, logs and screenshots, and tests the APIs for over-sharing and broken object-level authorisation, giving you evidence for your assessment.
What stays with you
The impact assessment, records of processing, processor contracts, breach notification to the FDPIC and customer communication.
Summary of public FINMA and federal texts, checked on 27 September 2026. Quotes from Circular 2023/1 use FINMA's English version; the German, French and Italian texts are the originals. The Fedlex translations of the FADP and DPO have no legal force. This page is not legal advice.
Swiss rules, control by control
The controls the Swiss texts point to, how Ostorlab tests them in your app and its APIs, and the evidence you can keep.
| Control | How Ostorlab helps | Evidence you keep |
|---|---|---|
| Vulnerability assessments and penetration testsCirc. 23/1 IV.C (mn 61-70) | AI-agent pentest of the app and its APIs, behind login, on the build you ship. Details | A working exploit you can replay for each AI-agent finding, and a coverage heatmap |
| APIs and backends behind the mobile channelCirc. 23/1 IV.C | Intercepts traffic even with TLS pinning and tests authorization, token misuse and abuse such as enumeration and replay. Details | Request and response evidence for each API finding |
| Change management and testing before and after releaseCirc. 23/1 IV.B | Mobile SAST and DAST in CI/CD on every build, and monitoring of store releases. Details | Scan results per build and per store release |
| Response to vulnerabilities and remediationCirc. 23/1 IV.C(d) | Groups findings into tickets in the platform or in Jira and ServiceNow, and retests after the fix ships. Details | Ticket history and retest result for each finding |
| Software assets, versions and external interfacesCirc. 23/1 IV.B (mn 53) | Lists the SDKs and native libraries in each release with their versions, and shows which backends the app and its SDKs talk to. Details | Component identity, version and location in the app bundle, per release |
| Access to critical data and credentials in the appCirc. 23/1 IV.D (mn 71-82) | Finds API keys, tokens and credentials in the app package and validates whether they work. Details | Validated secrets, with the permissions and services they expose |
| Authentication, one-time codes and step-up flowsGuidance 02/2026 3.1.3 | Logs in with one-time codes and tests MFA enforcement, step-up flows and lockout, and the API calls behind them. Details | Findings on login and step-up flows, with reproduction steps |
| Device and app protectionsCirc. 23/1 IV.C(b) | Tests root and jailbreak detection, anti-tampering and pinning at runtime. Details | Which protections held and which were bypassed, with bypass evidence |
| Data protection on the device and in transitCirc. 23/1 IV.D; FADP Art. 8 | Looks for tokens and personal data in storage, caches, logs and screenshots, and checks transport protections. Details | File system evidence showing what was written, where and when |
| Preparation for exercises and incident reportingCirc. 23/1 mn 70; Guidance 05/2020 | Retests the app and API items of an exercise or remediation plan, and provides reproduction evidence for root cause analysis. | Retest results and evidence for each app or API item |
Ostorlab tests controls in the app and its APIs. SOC monitoring, incident response, the reports to FINMA and the FDPIC, cyber exercises, red teaming and TLPT, backups and recovery, governance and physical security stay with your teams.
FINMA controls to test in your mobile app
A practical list for security and risk teams, based on FINMA Circular 2023/1, the cyber guidance and the revised FADP.
Scope the app and its APIs
Put the mobile app and the APIs it calls in the scope of your vulnerability assessment and penetration test procedures, as internet-facing ICT assets.
Test every release
Run Mobile SAST and DAST in CI/CD on every build, and scan the store release your customers download.
Keep the software inventory
List the SDKs and native libraries in each release with their versions and the backends they call, and keep the list current.
Fix and retest
Track findings as tickets with an owner and a deadline by severity, and retest after the fix ships.
Secrets in the app
Check the app package for API keys, tokens and credentials, and rotate any that work.
Login and sessions
Test login, one-time codes, step-up, lockout and session invalidation with test accounts, including attempts to skip a step.
Data on the device
Review what personal data and tokens the app writes to storage, caches, logs and screenshots, and what the APIs return.
Evidence for reports and exercises
Keep reproduction evidence and retest results for the 24-hour and 72-hour reports, root cause analyses and cyber exercises.
A suggested list, not a FINMA template. This is not legal advice.
The capabilities behind this page
Each one has its own page with the details.
- Mobile Agentic Deep ScanAI agents pentest the store build on every release, with a working exploit you can replay for each AI-agent finding.Learn more
- Authenticated testingTest login, one-time codes and step-up flows with your test accounts.Learn more
- API and backend testingIntercept app traffic even with TLS pinning, then test the APIs and backends behind accounts and payments.Learn more
- Mobile SASTBinary-based static analysis of APK, AAB and IPA files, with taint analysis across the app and its embedded SDKs.Learn more
- SCA and SBOMFind vulnerable dependencies, including statically compiled native libraries, and track their closure release after release.Learn more
- Mobile Shielding ScanTest root and jailbreak detection, anti-tampering and pinning at runtime, and see which protections held and which were bypassed.Learn more
- Bring your own AI keyRun AI-agent scans on your own AI provider key with a spend cap per scan, so usage follows your internal policies.Learn more
- On-premises scanningScan staging apps, APIs and repositories behind your firewall or VPN, on infrastructure you control.Learn more
Trusted by banks and fintechs, including
Sources
The official texts this page is based on, checked on 27 September 2026.
- FINMA Circular 2023/1 "Operational risks and resilience - banks"FINMA, dated 7 December 2022, in force since 1 January 2024, English version published by FINMA. Cyber risk management (IV.C, margin nos. 61 to 70), ICT risk management and inventory (IV.B), critical data (IV.D) and operational resilience (V)
- FINMA Guidance 03/2024 "Findings from FINMA's cyber risk supervision, clarification of FINMA Guidance 05/2020 and scenario-based cyber risk exercises"FINMA, 7 June 2024. Findings from on-site cyber reviews, the clarified 24-hour and 72-hour reporting process, and expectations for red teaming and tabletop exercises
- FINMA Guidance 05/2020 "Duty to report cyber attacks pursuant to Article 29 para. 2 FINMASA"FINMA, 7 May 2020. Reporting significant cyber attacks on critical functions: initial report within 24 hours, full report within 72 hours, root cause analysis
- FINMA Guidance 02/2026 "Digital fraud risks for banks and persons under Article 1b of the Banking Act"FINMA, 9 April 2026. Findings from a survey of 19 banks: governance, detection, technical controls such as device fingerprinting, and fraud around online account opening and unauthorised account access
- Federal Act on Data Protection (FADP), SR 235.1Revised act of 25 September 2020, in force since 1 September 2023. English translation on Fedlex, provided for information only; the German, French and Italian texts are the originals
- Data Protection Ordinance (DPO), SR 235.11Ordinance of 31 August 2022, in force since 1 September 2023. Minimum requirements for data security (Articles 1 to 4). English translation on Fedlex
- SBA guidelines "Handling data in day-to-day business"Swiss Bankers Association, May 2021. Practical guidance for banks on the revised FADP, including technical and organisational measures and biometric authentication. Legally non-binding self-regulation
- SBA and Swiss FS-CSC position on amending FIDO2Swiss Bankers Association, 11 June 2025. Supports extending FIDO2 so authenticators can securely display and confirm transaction data, not only logins
Frequently asked questions
Straight answers on coverage, setup, and how results reach your team.
Can't find your answer? Book a demo or contact us.
Assess your mobile banking app the way FINMA describes it
Start with a free scan of your app from the store, or book a demo to run logged-in tests of your app and APIs with our team.