In July, FINMA published its Guidance 05/2026 on quantum computing, based on a survey of 60 Swiss financial institutions. The headline: FINMA recommends that a PQC roadmap — a board-adopted strategy with milestones and target dates — be drawn up by mid-2027 at the latest. Today, only 8% of the surveyed institutions have one, and 72% have not yet planned or implemented any PQC measures at all.
The deadline logic has nothing to do with when a quantum computer arrives: encrypted data harvested today can be decrypted later, so long-lived confidential data is already exposed — harvest now, decrypt later. And the institutions themselves are not complacent about the horizon: about two-thirds expect a quantum computer to break RSA-2048 within ten years at the latest.
Which points to the most expensive misconception in the market right now: treating PQC as an IT project. The key decisions are business decisions — which data may stay exposed and for how long, which processes change, what gets budget priority. IT can implement any of these, but cannot decide any of them; and a decryption event of archived client data isn't an IT incident — for a bank, confidentiality is the product.
FINMA's recommendations reflect exactly that: a board-adopted strategy and roadmap, risk analysis and cryptographic inventory, protection of critical data, crypto-agility, management of external providers.
Not an IT project with business impact — a business project with a critical IT role.
The good news: the first step is bounded and well-defined — the roadmap itself. That's the ground our PQC Mobilization and PQC Navigator offerings cover: from first stakeholder alignment to a structured readiness assessment — including exactly the board-level strategy and roadmap FINMA now recommends having by mid-2027: qubit-lab.ch/pqc-navigator
Our partner Horn & Company come to the same conclusion in their new analysis of the guidance (Hänggi & Egger, August 2026): awareness is there — what's missing in most institutions is the structured approach, starting with the roadmap.
The one-page summary that went out with this alert: FINMA expects a PQC roadmap by mid-2027 (PNG) — feel free to forward it to whoever owns this topic in your house.
If post-quantum security is on your agenda — or should be, before the 2027 budget round closes — get in touch and we'll set up a 30-minute briefing: what the roadmap FINMA describes actually contains, and what it takes to get there for an institution of your size.
Daniel
Daniel Hug · qubit-lab.ch · daniel.hug@qubit-lab.ch