FINMA Risk Monitor 2025: The central risks and what they mean for financial institutions now

1. Real estate and mortgage risks
   Developments in the real estate market remain a central issue. Valuation risks, rising financing costs and possible price corrections place increased demands on lending, risk models and capital backing.
2. Credit risks outside the mortgage business
   Classic corporate loans are also under closer scrutiny. Economic uncertainties and geopolitical tensions can rapidly change the creditworthiness of borrowers.
3. 3. Market price and credit spread risks
   Volatile interest rate markets and widening spreads harbor significant risks for bond portfolios, structured products and financing.
4. Liquidity and refinancing risks
   FINMA emphasizes the importance of robust liquidity management. Institutions must be able to meet their obligations at all times, even under stress conditions.
5. Money laundering risks (AML)
   AML remains a permanent key topic. Expectations for monitoring systems, transaction monitoring, KYC processes and documentation continue to rise.
6. Sanction risks and compliance
   International sanctions and geopolitical conflicts significantly increase the risk of unintentional violations. Institutions must continuously update and sharpen their screening processes.
7. Outsourcing and third-party risks
   The increasing outsourcing of IT, administration, portfolio management or compliance leads to dependencies that must be closely managed from a supervisory perspective.
8. Cyber risks
   Cyber attacks continue to increase, both in their frequency and in their professionalism. Attacks on service providers are increasingly becoming a systemic risk.
9. ICT and technology risks
   Outdated systems, complex IT landscapes and cloud dependencies harbor significant operational risks. FINMA expects resilient security, backup and emergency concepts.

The risk monitor clearly shows; Supervision is looking less at individual theoretical regulations, but increasingly at the concrete implementation in everyday life:

• Functioning governance structures
• Clear responsibilities in the board of directors and management
• Comprehensible risk inventories
• Clean outsourcing structures
• Effective controls and documentation

Not the existence of concepts is decisive, but their actual effectiveness.

Clear fields of action can be derived from the risk monitor:

• Credit, market and liquidity risks must be stress-tested regularly and assessed realistically.
• Outsourcing models must not only be contractually clean, but also actively managed organizationally.
• AML and sanction processes must be technically, organizationally and personnel-wise resilient.
• IT security, cyber resilience and emergency planning belong at the center of corporate management.
• Governance is no longer a formal topic, but a central supervisory criterion.

From our point of view, the FINMA Risk Monitor 2025 marks a further shift from formal compliance to genuine operational resilience. Institutions must not only know the rules, but demonstrably be able to actively manage risks. We currently see the following as particularly critical:

• the increasing requirements for the management of external technology and service partners;
• the increasing expectations for AML and sanction processes;
• the increasing interlinking of financial, technology and reputational risks;
• it is precisely here that the greatest regulatory areas of tension arise in practice.

Velaw AG supports its clients with precisely these issues, in particular with:

• the legal classification of the FINMA risk topics in the existing or planned business model,
• the review of governance, organization and responsibilities,
• the structuring and hedging of outsourcing models,
• the support of supervisory interactions, audits and approval procedures,
• the practical implementation of regulatory requirements in processes and documentation.

Our approach is clearly focused on feasibility, sound judgment and stability in operational operations.

The FINMA Risk Monitor 2025 is not a warning signal for the future, but a working tool for the present. It shows where the supervisory authority sees risks and where institutions should critically question their structures, processes and controls.

Those who actively take up these signals now will not only create regulatory certainty, but also trust, stability and sustainability.