AI for Independent Asset Managers: what FINMA 08/2024 really requires

When an asset manager introduces an AI system, the vendor usually states that the tool is FINMA compliant. That statement has little value, because FINMA supervises financial institutions, not software. Guidance 08/2024 shows how FINMA reads existing duties once AI is involved. For portfolio managers, the decisive question is one the guidance leaves open: whether using an AI system amounts to a delegation of tasks under Art. 14 FinIA. The answer determines the contract, the documentation and the audit.

The guidance interprets existing law; it does not create new duties

In its guidance of 18 December 2024, FINMA notes that Switzerland has no AI-specific legislation. The existing, technology-neutral requirements for governance and risk management therefore apply to AI as well. FINMA describes what it has observed in its supervision and names seven themes: governance, inventory and risk classification, data quality, testing and ongoing monitoring, documentation, explainability, and independent review. These observations are not binding. The underlying law is, and for portfolio managers that means above all Art. 9 para. 2 FinIA and Art. 26 FinIO on risk management and internal control.

Two features set portfolio managers apart from banks. Their ongoing supervision lies with a supervisory organisation, not with FINMA directly. And FINMA Circular 2018/3 on outsourcing does not apply to them. Art. 14 FinIA together with Art. 15 to 17 FinIO does. In contract practice, this distinction is often overlooked, because many vendors use a single contract designed for banks.

Independence decides whether a task is delegated

Under Art. 15 para. 1 FinIO, a delegation exists where a service provider performs a material task independently and on a lasting basis. With AI, two of these three tests are quickly settled. A system in productive use is used on a lasting basis. And for portfolio managers, material tasks are those listed in Art. 19 FinIA, whose para. 3 expressly names portfolio analysis. Using AI for portfolio analysis therefore meets the materiality test.

The line is drawn by independence. Where a qualified person reviews and owns each result before it takes effect, the system does not perform the task independently. Where an agent produces and sends quarterly reports without that step, we consider the task delegated. What counts is the actual intensity of control, not the process description. An approval reduced to a single click, because dozens of documents pass through each day, no longer carries the distinction. The same platform can run in assisted or fully automated mode. The question must therefore be answered and documented separately for each use case.

A delegated task requires a contract with five audit parties

Where a task is delegated, Art. 17 para. 2 FinIO requires an agreement in text form. It must cover competences and responsibilities, sub-delegation, the provider's duty to account and the portfolio manager's control rights. Under para. 4, five parties must be able to inspect and audit the delegated task: the portfolio manager, its internal audit, the audit firm, the supervisory organisation and FINMA. Contracts modelled on banking templates often name only three, because the banking regime has no supervisory organisation.

Under Art. 16 para. 3 FinIO, an organisation is no longer adequate if the financial institution lacks the expertise to select, instruct and monitor the provider. Staff training is therefore part of the organisational duties.

Professional secrecy under Art. 69 FinIA also applies, and it expressly covers agents. Under Art. 9 para. 1 lit. b FADP, a processor may be engaged only where no duty of confidentiality prevents it. A data processing agreement does not resolve the secrecy question.

Proportionality reduces the effort, not the assessment

FINMA stresses that its expectations depend on size, complexity and risk profile, and on the materiality of each application. Art. 26 para. 2 FinIO provides relief for small portfolio managers whose business model carries no increased risk and that have no more than five full-time positions or annual gross revenue below CHF 2 million. These firms need not separate risk management and internal control from revenue-generating activities.

In our view, this relief does not exempt a firm from assessing the system it uses. A small firm that runs the same technology as a major bank carries the same technological risk. Where staff numbers rule out separation, compensating measures are needed, such as a periodic external review.

Three controls carry most of the weight

In our view, three controls deliver the most with limited resources:

1. Analyse rejected and corrected outputs. FINMA expects firms to evaluate cases in which staff ignore or change the output. The analysis reveals systematic weaknesses and shows that approval is a genuine review.
2. Trace every figure to its source. Every figure in a client document must trace back to its source in the portfolio management system. This supports explainability and the documentation duty under Art. 15 FinSA.
3. Keep the inventory per use case. The AI inventory records each use case with its purpose, model, data sources and degree of autonomy, not just the platform as a whole. Only then can the delegation question be answered correctly.

How it works

Unplex is designed around these controls. Every figure carries a source reference, and every approval and correction is logged. Our contract names all five audit parties under Art. 17 para. 4 FinIO and extends to sub-processors. Client data is not used to train models, and our information security management system is certified to ISO/IEC 27001:2022.

Conclusion

FINMA Guidance 08/2024 does not prevent portfolio managers from using AI. It expects them to know every use case, answer the delegation question and evidence their controls. What matters is not a FINMA-compliant tool but complete documentation.

Request a demo

Last reviewed: October 2026. General information, not legal advice.