According to FINMA’s definition, critical functions include:

• the activities, processes and services – including the underlying resources necessary for their provision – whose disruption would jeopardise the organisation’s continuation or its role in the financial market and thus the proper functioning of the financial markets; and
• the systemically important functions under article 8 in the Swiss Federal Act on Banks and Savings Banks (Banking Act; BA).

Our assumption is that FINMA does not expect organisations to identify a large number of critical functions. The primary goal of the exercise will be to focus on the critical end-to-end value chains absolutely required to ensure that a minimum tolerable level of critical services and business outputs can be delivered at any point in time – even when facing a ‘severe but plausible’ disruption scenario (a major crisis).

Some examples of the typical candidates that may also qualify as critical functions for select organisations include the domestic deposit and lending business, as well as payment transactions. However, to identify the critical functions is a task that each organisation needs to tackle individually and that is highly dependent on the organisation’s business model. Whilst an asset manager may likely include portfolio management as a critical function, while a retail bank on the other hand might rather identify serving client credits as a critical function of their business.

To evaluate if a function in an organisation is deemed ‘critical’, a qualitative assessment approach should take primacy. The following outlines some examples of a comprehensive ‘aide memoire’ to be individually developed by organisations that supports the qualitative assessment process:

Whether a function is deemed as ‘critical’ within the organisation is ultimately an executive management and board decision. Diligently preparing and documenting the rationale based on which a critical function was identified and to then support the rationale with additional data evidence will help a) to receive the required senior management endorsement, and b) to ensure defensibility and auditability at a later stage.

Traditional Business Continuity Management (BCM) activities focus on identifying recovery time objectives (RTOs) for the critical processes of an organisation. RTOs define the desired recovery time, i.e., by when a process should be fully back to normal operations. Even with the new operational resilience requirements, BCM remains important and required by the regulator (refer also to FINMA circular 2023/1 – chapter IV E).

However, past crises have demonstrated that in severe but plausible disruption scenarios such as a large-scale cyber-attack and complete loss of ICT, multiple processes will typically fail in parallel, rendering traditional BCM measures ineffective since they address isolated failures. Therefore, achieving the desired recovery times for all processes to be back to normal operations within defined RTOs will be unlikely. The organisation will need to prioritise in such scenarios and successfully navigate the crisis.

This is where the newly introduced tolerances for disruption of critical functions will come into play. The tolerance for disruption is the extent – the duration or expected damage – of the disruption of a critical function that the organisation is willing to accept. The tolerances will therefore need to define the minimum level of service and outputs required from a critical function to operate during a crisis, whilst normal operations cannot be achieved for a longer period.

When defining tolerances for disruption of critical functions, organisations should consider the following steps:

1. Formulate the minimum service and outputs of the function required to avoid any intolerable harm for the organisation, its clients and the wider financial market.
   
   To note: As an initial starting point, the organisation may leverage the rationales previously developed defining why the function is deemed ‘critical’. In addition, the already defined RTO targets of the underlying processes from a BCM perspective can provide orientation.
   
   
2. Gather additional data/evidence to back up and rationalise the minimum service and outputs defined.
3. Document the tolerance for disruption in the form of an outcome-based objective statement. In addition, document the rationales and additional data/evidence why the respective tolerance for disruption was chosen.