FINMA recommends that supervised institutions establish a Post-Quantum Cryptography (PQC) roadmap by mid-2027 at the latest. But mid-2027 is not a deadline for completing the PQC migration.

FINMA Guidance 05/2026 addresses how supervised institutions should prepare for risks associated with cryptographically relevant quantum computers, including strategy and migration planning, risk analysis, cryptographic inventory, protection of critical data, crypto-agility and external service providers.

The distinction between planning and migration matters. FINMA's survey indicates that institutions already working with a specific roadmap expect protecting critical assets to take several years.

This article explains what FINMA Guidance 05/2026 says, what the mid-2027 recommendation means, and what institutions can start doing now.

‍

‍

‍

What is FINMA Guidance 05/2026?

FINMA Guidance 05/2026 is supervisory guidance addressing the risks that cryptographically relevant quantum computers could pose to supervised institutions and measures institutions can take to prepare.

It is not a new FINMA circular and does not itself create new law.

Instead, FINMA points to existing technology-neutral and principles-based requirements concerning governance and risk management, which it considers applicable to the risks associated with cryptographically relevant quantum computers.

The guidance is informed by a survey of 60 supervised institutions, conducted between November 2025 and January 2026.

Who does FINMA Guidance 05/2026 apply to?

It covers institutions including:

• banks
• insurance companies
• managers of collective assets
• financial market infrastructures

Quantum key distribution and risks arising from the use of quantum computing itself are outside the scope of the guidance.

So what does FINMA actually recommend?

‍

What does FINMA recommend for post-quantum readiness?

1. Establish a PQC strategy and migration roadmap

FINMA recommends establishing a strategy that is adopted by the institution's most senior governing body.

That strategy should be supported by an implementation plan containing milestones and priorities, including target dates for both:

• migration of critical processes
• completion of the overall migration

The roadmap should be drawn up by mid-2027 at the latest.

The message is therefore not simply “start thinking about PQC.”

Institutions need to turn that awareness into an organised programme with ownership, priorities and dates.

2. Build a cryptographic inventory and risk analysis

Before an institution can establish credible migration dates, it needs to understand what cryptography it actually uses.

FINMA recommends analysing business processes for encryption, signature and authentication technologies and building an inventory across ICT systems, applications and infrastructure.

The scope includes:

• data in transit
• data at rest
• digital signatures
• key management
• authentication mechanisms

And it applies whether those technologies are operated internally, outsourced or consumed as a service.

This goes significantly further than creating a certificate inventory.

It requires visibility into the broader cryptographic landscape.

Related insight: Cryptographic Discovery: Why No Single Tool Can Build Your PQC Inventory →

‍

3. Protect critical data from harvest-now-decrypt-later risks

Not every cryptographic asset carries the same risk.

FINMA recommends considering how long critical data needs to remain protected and accounting for the possibility that encrypted information could be collected today and decrypted later when sufficiently capable quantum computers become available.

This is commonly referred to as “harvest now, decrypt later.”

For critical data, FINMA recommends considering hybrid approaches combining classical and quantum-safe algorithms, while recognising the additional complexity such approaches can introduce.

The practical implication is important:

Migration priority depends not only on when quantum computers arrive, but also on how long today's information needs to remain confidential.

‍

4. Build crypto-agility into systems and applications

PQC is unlikely to be the last cryptographic transition organisations will need to manage.

FINMA therefore also focuses on crypto-agility.

Crypto-agility is the ability to replace cryptographic algorithms without requiring far-reaching changes to the underlying software architecture.

FINMA recommends requiring this capability particularly for newly procured and newly developed ICT systems and applications.

This shifts the objective from simply: “Replace today's vulnerable algorithms.”

to: “Build an environment where cryptography can be changed again when necessary.”

That makes automation, visibility and repeatable cryptographic lifecycle processes strategically important.

‍

5. Include external service providers in the PQC roadmap

PQC migration does not stop at the organisational boundary.

Cloud providers, software vendors, managed services and other external providers may control cryptographic components that institutions depend on.

FINMA makes the responsibility clear:

Responsibility remains with the outsourcing institution.

Crypto-agility should therefore be considered in new outsourcing relationships and addressed in existing ones.

That means supplier questions need to become part of the migration programme:

• What cryptography does the service depend on?
• What is the provider's PQC migration plan?
• What is its expected timeline?
• Which changes require customer action?
• How is crypto-agility addressed?
• Are relevant requirements reflected contractually?

Supplier readiness can become a critical dependency in an institution's own roadmap.

‍

What FINMA's survey tells us

This is where I would use the actual FINMA data as the main visual element of the article.

‍Source: FINMA Guidance 05/2026. Survey of 60 supervised institutions, November 2025–January 2026.

‍

How long could post-quantum migration take?

One survey result deserves particular attention.

Only 8% of institutions surveyed already had a specific roadmap.

Those institutions expected it to take approximately four to five years before their critical assets would be protected.

Now put that next to FINMA's recommendation to have the roadmap in place by mid-2027.

An institution that completes its roadmap around mid-2027 and subsequently requires four to five years to protect its critical assets could be looking at approximately:

2027 → 2031/2032

At the same time, 52% of respondents consider quantum-related risks relevant within four to seven years.

This doesn't mean every institution will follow the same timeline.

But it illustrates why the distinction between roadmap completion and migration completion matters.

The challenge isn't simply reaching mid-2027 with a document.

It's ensuring the organisation has started early enough to execute what that document requires.

‍

‍

What should financial institutions do before mid-2027?

The recommendation is to have the roadmap in place by mid-2027.

That doesn't mean institutions need to wait until then to start.

Several activities can begin now.

1. Establish ownership.

‍Identify the executive sponsor, operational programme owner and relevant technical owners.

2. Start cryptographic discovery.

‍Identify where cryptography is used across systems, applications, infrastructure and third-party services.

3. Build the cryptographic inventory

‍Move from disconnected asset lists towards a structured, maintainable cryptographic inventory.

4. Identify critical assets.‍

Understand which data and systems require the earliest attention.

5. Assess crypto-agility.

‍Determine how easily algorithms, certificates and other cryptographic components can be changed today.

6. Engage suppliers.‍

Understand external migration timelines and dependencies before they become blockers.

7. Turn evidence into the roadmap.‍

Use the resulting visibility to establish priorities, milestones, accountabilities and defensible target dates.

‍

Related insight: Building a PQC Roadmap Your Board Can Actually Approve →

Ultimately:

A roadmap without an inventory contains intentions. A roadmap built on discovery and inventory can contain defensible dates.

‍

-

Frequently asked questions about FINMA Guidance 05/2026

- Is mid-2027 the FINMA deadline for completing PQC migration?

No. FINMA recommends that institutions establish their strategy and roadmap by mid-2027 at the latest. Mid-2027 is not presented as the deadline for completing the migration.

- What should a PQC roadmap include?

The roadmap should translate the institution's strategy into an implementation plan with milestones, priorities and target dates, including dates relating to critical processes and overall migration.

- Does FINMA recommend a cryptographic inventory?

Yes. FINMA addresses institution-specific risk analysis and cryptographic inventory as part of preparing for quantum-related cryptographic risks.

- What is crypto-agility?

Crypto-agility is the ability to replace cryptographic algorithms and mechanisms without requiring far-reaching changes to the underlying software architecture.

- Why does harvest now, decrypt later matter?

Sensitive encrypted information may need to remain confidential for many years. Information collected today could potentially be retained and decrypted later if sufficiently capable quantum computers become available.

- Are external service providers part of the PQC roadmap?

Yes. Dependencies on cloud providers, software vendors, managed services and other external providers should be considered because the supervised institution retains responsibility for outsourced activities.

- Is a certificate inventory enough for PQC readiness?

A certificate inventory is an important component, but the scope described in FINMA's guidance is broader. Institutions need visibility into encryption, signatures, authentication, key management and other cryptographic technologies across systems and services.

‍