FINMA Guidance on Quantum Computing: A Call to Action for Swiss Financial Institutions

Quantum ComputingCorporate Strategy & ManagementBanking & Institutions

As the threat of quantum computing looms, Swiss financial institutions must take immediate action to prepare for the transition to post-quantum cryptography.

TL;DR
• FINMA guidance warns Swiss financial institutions of potential risks from quantum computing.
• Institutions must prepare for the transition to post-quantum cryptography.
• FINMA recommends a risk analysis, cryptographic inventory, and migration plan.

Summary
Swiss regulator FINMA released Guidance 05/2026 on quantum computing, urging banks, insurers, asset managers and market infrastructures to prepare for post‑quantum cyber threats. The guidance highlights that quantum‑ready cryptography is not yet mandatory but foreseeable risks demand proactive action. Key recommendations include:
• Develop a quantum‑safe roadmap by mid‑2027.
• Conduct a comprehensive cryptographic inventory.
• Prioritise data requiring long‑term protection. These steps align with a forward‑looking risk framework that balances current operations with emerging technology threats for future security.

The survey of 60 Swiss institutions revealed a gap between awareness and action: two thirds foresee quantum risks within seven years, yet 72% have not planned quantum‑safe measures. Only 8% have a concrete roadmap, and 20% have active projects. Institutions rate crypto‑agility, cryptographic inventories, and vendor engagement as critical for transition. The guidance therefore stresses that governance bodies must approve a strategy, set milestones, and integrate crypto‑agility into new and existing ICT procurements to ensure robust cyber resilience continuously upgraded.

A detailed risk analysis should cover all cryptographic methods—RSA, ECDSA, EdDSA, DH, ECDH—and data needing long‑term confidentiality, integrity, or non‑repudiation. The analysis must map business processes, ICT systems, applications, infrastructure, and emerging technologies such as distributed ledgers, regardless of ownership or service model. Institutions are advised to maintain a living inventory that flags quantum‑vulnerable algorithms and to adopt hybrid solutions where classical and post‑quantum schemes coexist, especially for critical data exposed to “harvest now, decrypt later” scenarios to protect future.

FINMA emphasizes that responsibility for outsourced functions remains with the institution, so outsourcing agreements must embed crypto‑agility requirements and continuous monitoring clauses. The regulator will monitor quantum developments and incorporate the topic into ongoing supervisory activities. Institutions should therefore review cyber and operational resilience frameworks, update cryptographic inventories, identify long‑term protected data, and engage key technology and outsourcing partners early. Structured preparation, clear accountability, and phased implementation will position Swiss financial entities to meet emerging quantum‑related cyber risks in 2027.

The time to act is now. Swiss financial institutions must prioritize the transition to post-quantum cryptography to mitigate the risks of quantum computing.