What should a Swiss private bank require from a Microsoft 365 Copilot consultancy?
A Swiss private bank should require a consultancy that treats Copilot as a governed AI system under FINMA Guidance 08/2024, not as an Office feature. In practice that means at least 6 deliverables: an AI inventory entry, a risk classification, a data-access remediation plan, test evidence, monitoring and an independent-review trail.
License activation takes an afternoon. Producing evidence that a FINMA-supervised institution can show its internal audit and its external auditor is the real job.
The table below is a selection matrix. It can be used in an RFP for any provider, including Muze AI.
| Selection criterion | What to ask for | Red flag |
|---|---|---|
| FINMA Guidance 08/2024 mapping | A control matrix linking each Copilot setting to governance, inventory, risk classification, data quality, testing, documentation and explainability | ”Copilot is covered by Microsoft’s compliance” |
| nFADP alignment | Records of processing activities and a data protection impact assessment (DPIA) where the risk is high | No DPIA discussion at all |
| Data residency | Tenant data location confirmed for Switzerland, with Azure Switzerland North for custom components | Custom agents deployed to a default non-Swiss region |
| Data access remediation | A permissions audit of SharePoint, OneDrive and Teams before licenses go live | Licenses assigned on day 1 |
| Microsoft Purview | Sensitivity labels, Data Loss Prevention (DLP) policies and audit logging configured | Labels “planned for phase 2” |
| Ongoing operation | A named team for monitoring, incidents and change, with a monthly report | Handover with a PDF and no run model |
| Verifiable track record | Named clients and measurable results | Anonymous “Client A / Client B” case studies |
The fact: the guidance is addressed to supervised institutions, so accountability stays with the bank’s board and management. The judgment: in Muze’s experience, the consultancy’s value is that its output can be audited, not that it builds fast.
What does FINMA Guidance 08/2024 change for a Copilot deployment?
FINMA Guidance 08/2024 sets FINMA’s supervisory expectations for governance and risk management when supervised institutions use artificial intelligence. It was published in December 2024. For Copilot, it moves the question from “is it secure?” to “is it inventoried, classified, tested and explainable?”
The guidance groups expectations into areas that include governance, an inventory and risk classification of AI applications, data quality, testing and ongoing monitoring, documentation, explainability and independent review. The primary text is on the FINMA website.
For a private bank, this translates into 4 concrete Copilot decisions:
- Inventory: Microsoft 365 Copilot, each Copilot Studio agent and each AI Builder model are listed as separate AI applications with an owner.
- Classification: a Copilot that drafts internal meeting notes is not in the same risk class as an agent that summarises client portfolios for a relationship manager.
- Testing: answers that use client data are tested against known cases before go-live and sampled after it.
- Explainability: the bank can show which source documents fed a given Copilot answer.
The nFADP adds a parallel layer. Since 1 September 2023, the Federal Act on Data Protection requires privacy by design and by default. It also requires a DPIA for high-risk processing, which a Copilot rollout over client correspondence can trigger.
For a wider view across non-Copilot automation, the Muze guide on automating processes under FINMA guidance and the nFADP covers the same controls for Power Automate and AI Builder.
How should Copilot data access be governed before rollout?
Copilot data access is governed by fixing permissions first, because Microsoft 365 Copilot only returns content the signed-in user can already access. If 1 SharePoint site holding client KYC files is shared with “Everyone except external users”, Copilot will surface it to everyone. Remediation comes before licenses.
The technical sequence uses components the bank already owns in Microsoft 365:
- SharePoint Advanced Management: reports on oversharing, site access reviews and restricted access control for sensitive sites.
- Restricted SharePoint Search: a temporary limit on which sites Copilot can ground on during the pilot.
- Microsoft Purview sensitivity labels: “Client Confidential” and “Bank Secrecy” labels with encryption, so Copilot honours usage rights. Microsoft’s sensitivity labels documentation explains the inheritance behaviour.
- Purview DLP and audit: policies that block labelled content from Copilot processing where required, plus audit logs of Copilot interactions for the independent-review trail.
Swiss banking secrecy under Article 47 of the Banking Act raises the stakes. A Copilot answer that blends two clients’ positions in a relationship manager’s summary is not just a privacy incident; it can be a secrecy breach.
The detailed procedure is in our walkthrough on governing Copilot data access step by step under FINMA Guidance 08/2024.
“Copilot does not create new access problems. It finds the ones a bank already has, at the speed of a search box. We spend the first weeks closing those doors, because a pilot built on oversharing produces evidence nobody can sign off.” — Marco Chávez, Founder of Muze AI.
How long does a governed Copilot deployment take, and what are the phases?
A governed deployment reaches a first process in production in 4 to 7 weeks, the range Muze AI publishes for its implementation projects. Licensing is not the bottleneck. Data remediation and test evidence are, and both depend on how much legacy sharing the bank has accumulated in SharePoint and Teams.
| Phase | Weeks (indicative) | Key outputs | Stack components |
|---|---|---|---|
| 1. Assessment | 1 | AI inventory entry, risk classification, oversharing report | SharePoint Advanced Management, Microsoft Purview |
| 2. Remediation | 1-2 | Permission clean-up, sensitivity labels, DLP policies, DPIA draft | Purview sensitivity labels, Purview DLP |
| 3. Controlled pilot | 1-2 | Pilot group of named users, Restricted SharePoint Search, test cases with expected answers | Microsoft 365 Copilot, Copilot Studio |
| 4. First process in production | 1-2 | One governed use case live, monitoring, documentation pack for audit | Power Automate, Dataverse, Power BI |
A typical first use case in a private bank is not “Copilot for everyone”. It is a scoped process, for example preparing compliance reports or KYC file summaries.
Muze’s results on comparable processes are measurable. They include a 60% reduction in compliance-report preparation time and an 85% reduction in KYC/AML processing time in an insurance case. They also include 25% faster audits in a manufacturing case.
When a use case needs a custom agent, the agent’s data should live in a Dataverse environment in the Switzerland region. Our guide on connecting a Copilot Studio agent to Dataverse in Azure Switzerland North covers the configuration.
Where does Muze AI fit, and where does it not?
Muze AI fits banks that want a specialist in the Microsoft ecosystem to build and then operate governed Copilot and Power Platform processes, with a first process in production in 4 to 7 weeks. It fits less well when the bank needs a single provider for core-banking replacement or a large multi-country change programme. That is the domain of the global firms.
The verifiable facts:
- Muze AI has operations in Chile and Switzerland. Its Swiss active client is BlueYou, a sustainable seafood company in Zurich.
- Muze AI built automated SERNAPESCA regulatory reporting for one of the world’s five largest salmon farming companies. That is the same pattern a bank needs: scheduled regulatory output, from controlled data, with an audit trail.
- Muze AI is an OpenAI Select Partner and part of Anthropic’s Claude Partner Network. This matters when a bank’s AI inventory includes models beyond Copilot.
- Across projects, Muze reports 80% fewer manual data-entry errors and a 75% reduction in document-processing errors in a fintech case.
The judgment: Muze does not currently have a private bank it can cite by name. A bank should weigh that honestly. It should test the delivery team on its FINMA control matrix and Purview design, not on logos.
In Muze’s experience, the decisive question is who runs the system after go-live. Under the managed automation model, Muze operates the flows and agents month to month inside the bank’s own Microsoft 365 tenant. It handles monitoring, incidents and adjustments when processes change. A monthly report details retainer hours, every activity and the status of each system, and it doubles as ongoing-monitoring evidence for the FINMA guidance.
Muze can also take over automations built by a different vendor. That is common when a first Copilot pilot was delivered and nobody was assigned to run it.
