- - The core problem: treating IT as a commodity
- - Mistake 1: No knowledge of regulatory requirements
- - Mistake 2: Lack of client segregation
- - Mistake 3: No understanding of ICT logging and traceability
- - Mistake 4: Reactive instead of proactive
- - Mistake 5: No documented accountability
- - What sets a specialised IT partner apart
- - Frequently asked questions (FAQ)
Independent asset managers have been FINMA-supervised institutions since 2020 and are subject to FinIA, FADP and FinSA. A generalist IT provider running the same infrastructure for a carpentry business and an asset manager usually does not know the regulatory requirements and therefore cannot meet them. The five most common weaknesses are:
-
lack of knowledge of the regulation
-
inadequate client segregation
-
incomplete ICT logging
-
reactive rather than proactive work
-
lack of documented accountability
Whatever the provider fails to set up will be identified as a deficiency at the next audit, and responsibility for this lies with the institution, not the provider. Choosing an industry-specialised IT partner is therefore a regulatory decision.
Imagine your supervisory organisation asks: «Can you show me the access log for Mr. Müller's client file from last quarter?» Your IT provider replies: «Log? We'll need to check first whether that's even activated.»
This is not a made-up scenario. It is the reality we regularly encounter when asset managers switch to us, after an audit finding, a data protection incident, or simply because they have realised that their previous IT partner does not understand the industry.
The market for IT services in Switzerland is large. But the number of providers who truly understand what independent asset managers need is limited. This article shows where the gaps lie and why it makes a difference who you choose as your IT partner.
The fundamental problem: treating IT as a commodity
Many small and medium-sized IT providers are good at what they do: setting up servers, managing networks, offering helpdesk support. These are important services. But wealth management is not a standard SME environment.
Since 2020, independent asset managers have been directly FINMA-supervised institutions under the Financial Institutions Act (FinIA). They are subject to FinIA, the Federal Act on Data Protection (FADP) and the Financial Services Act (FinSA). They are regularly audited by recognised supervisory organisations such as AOOS, SO-FIT or VQF. And they manage highly sensitive client data that, in the event of an incident, can have not only regulatory but also existential consequences.
A generalist IT provider running the same infrastructure for a carpentry business, an architecture firm and an asset manager treats all three the same. That is the problem.Mistake 1: Lack of knowledge of regulatory requirements
ICT governance requirements under FinIA, outsourcing rules with FINMA audit rights, cyber reporting obligations under Art. 29 para. 2 FINMASA, requirements for logging and retention, data protection under the FADP: these are not abstract concepts. They determine, in concrete terms, how an IT environment must be configured, documented and operated.
An IT provider who does not know these requirements cannot meet them. Whatever they fail to set up will be identified as a deficiency at the next audit. And responsibility for that deficiency lies with the asset manager, not their IT provider. FINMA states this clearly: overall responsibility always remains with the institution, even in the case of complete outsourcing.
Error 2: Lack of client separation
Many asset managers work in a shared IT environment: one office, several partners, shared infrastructure. This sounds practical, but is regulatorily delicate if client segregation is not cleanly implemented.
If advisor A can access advisor B's client files (even unintentionally), this violates data protection principles and can lead to serious findings during an audit. Correct, role-based permission structures and regular access reviews are among the basic requirements that FINMA explicitly asks about during audits, but not every IT provider implements them.
Mistake 3: Lack of understanding of ICT logging and traceability
Supervisory organisations and audit firms expect an asset manager to be able to demonstrate at any time: who accessed which data and when? Which configuration changes were made? FINMA Guidance 03/2024 explicitly states that logging and monitoring are incomplete at many supervised institutions: critical log data is not analysed, or is only monitored during office hours.
An IT provider who has not correctly configured the audit log in Microsoft 365 or has no idea about eDiscovery functions leaves behind a dangerous gap that only becomes visible during an audit.
Mistake 4: Reactive rather than proactive
The classic IT provider comes when something is broken. That is no longer enough for regulated companies. Asset managers need a partner who:
-
continuously monitors whether security alerts have occurred
-
proactively flags new regulatory requirements and FINMA publications
-
checks whether Microsoft updates affect compliance-relevant settings
-
delivers regular reports on the security status of the environment
-
documents awareness training for employees (a requirement of supervisory organisations)
That is the difference between a break-fix provider and a genuine managed service provider.
Mistake 5: No documented accountability
In the event of a serious cyber incident, a supervised institution must inform FINMA without delay (in accordance with Art. 29 para. 2 FINMASA and FINMA Guidance 05/2020). Anyone who only starts clarifying at that point exactly what was affected and which systems were involved will not meet the prescribed deadlines.
Many IT providers operate without clear contracts, without SLAs and without defined escalation processes. In the normal case, this goes unnoticed. In a serious case, it is a serious problem, both towards the supervisory authority and towards clients.
Download tip: ICT checklist for asset managers
Developed from practical experience with FINMA-regulated asset managers and family offices: Our checklist provides a concise summary of the key ICT requirements and helps identify gaps in governance, security, and documentation.
What sets a specialist IT partner apart
An IT partner who truly understands asset managers brings more than technical know-how. They know the regulatory requirements from practical experience, have experience with audit preparation, and know which configurations exist at which supervisory organisations.
For over 30 years, Dinotronic has supported financial service providers in Switzerland: independent asset managers, family offices and other FINMA-regulated institutions. As a Microsoft partner with ISO 27001:2022 certification and a 90% recommendation rate, we know the requirements from practical experience.
Our approach is that of a managed service provider: we take responsibility for your IT infrastructure with clear SLAs, defined processes and a team that understands your industry. IT. But for sure.
Would you like to know whether your current IT environment meets the regulatory requirements? Get in touch with us.
No. FINMA states clearly: overall responsibility always remains with the supervised institution, even in the case of complete outsourcing. If your IT provider has not activated the audit log or has not cleanly structured access rights, that is your finding at the audit, not theirs. It is therefore all the more important to choose a partner who knows the regulatory requirements and documents their implementation.
Ask them concrete questions: Can you show me the access log for a specific client file? How long are audit logs retained? What happens in the event of a reportable cyber incident under Art. 29 para. 2 FINMASA? If the answers are hesitant or start with «we'd need to check that», it is a clear warning sign.
Serious cyber incidents must be reported to FINMA without delay under Art. 29 para. 2 FINMASA and FINMA Guidance 05/2020. Anyone who only has to clarify which systems are affected and who is internally responsible when it actually happens will not meet the deadlines. This is why predefined escalation processes, clear SLAs and an IT partner who can provide information immediately in a serious case are essential.
