13 August 2026

Quantum Computing – Need for Action for Swiss Financial Institutions

  • Articles
  • Data / Technology / IP

Quantum computing is no longer just a topic for the future: FINMA believes that many financial institutions have some catching up to do in terms of governance and risk management.

  • Caroline Gaul

    Legal Partner

Following its analysis of a 2025 survey of 60 Swiss financial institutions, including authorised banks, insurance companies, managers of collective assets and financial market infrastructures, FINMA found that while many supervised institutions recognise the future risks posed by quantum computing, only a limited number have taken concrete steps to address them. However, the risks arising from quantum computing are not merely a theoretical issue for the distant future. According to FINMA Guidance 05/2026, supervised institutions are expected to address these risks in a timely manner and align their governance and risk management frameworks accordingly. The topic is relevant not only for regulated entities but for businesses generally, as organisations across all sectors may be affected by both the opportunities and risks associated with quantum computing

What is Quantum Computing and what opportunities does it offer?
Quantum computing refers to a fundamentally different approach to information processing based on the principles of quantum mechanics. While classical computers operate on a binary system using bits that can take either the value 0 or 1, quantum computers use so-called qubits. These can exist in a superposition of the states 0 and 1 and can also become entangled with one another. As a result, quantum computers can perform certain calculations far more efficiently than classical computers. It is expected that, for certain use cases, quantum computers will eventually be able to solve problems that are practically impossible, or only solvable with enormous effort, using today's classical computers.

What risks does Quantum Computing create?
The most significant risks arising from quantum computing relate to data security, particularly with regard to encryption, digital signature and authentication mechanisms. Additional material risks may result from incomplete migration to quantum-safe encryption, lack of expertise, "harvest now, decrypt later" attacks, and interoperability challenges involving legacy systems. The relevance of the topic, including for non-regulated companies, becomes apparent when considering that many everyday digital services rely on encryption and digital signatures. Examples include secure internet communications, electronic identities and crypto-assets such as Bitcoin. Because powerful quantum computers could eventually compromise many of these technologies, quantum computing is of considerable significance not only from a technological perspective but also from a legal and regulatory standpoint.

What does FINMA recommend?

  • Post-Quantum Strategy (PQC Strategy) and Roadmap by mid-2027 at the latest
    FINMA recommends that institutions develop a strategy and a clear roadmap for the migration to quantum-safe encryption by no later than mid-2027. The roadmap should include target dates for the complete migration as well as for the migration of critical business processes to quantum-safe cryptography. A Post-Quantum Cryptography Strategy (PQC Strategy) may form part of an institution's existing cyber risk strategy.
  • Risk Analysis and Inventory
    The foundation of a PQC strategy is a risk analysis that considers both the cryptographic methods currently in use and the critical data that requires long-term protection. As a starting point, institutions should conduct a comprehensive review of all business processes to identify the encryption, signature and authentication technologies being used.
    This analysis should cover all information and communication technology (ICT) systems, applications, infrastructure and emerging technologies such as distributed ledger technology (cf. Art. 973d para. 2 no. 2 of the Swiss Code of Obligations), irrespective of whether they are operated in-house, outsourced or procured as a service from third-party providers.

    The resulting inventory should, in particular, identify:
    • all cryptographic methods used, including those for data transmission (e.g. VPN, TLS, HTTPS), data storage, digital signatures, key management and authentication medhanisms;
    • whether any of the algorithms employed are vulnerable to quantum attacks (e.g. RSA, ECDSA, EdDSA, DH or EC-DH) and therefore need to be replaced.
    The inventory should be maintained on an ongoing basis and kept up to date.
  • Critical Data
    The risk analysis should also include the identification and assessment of the protection requirements of critical data. Data that must remain secure over the long term should be prioritised and protected using PQC algorithms. Given the lack of long-term operational experience with PQC algorithms, institutions may wish to consider hybrid approaches that combine classical cryptographic algorithms with PQC algorithms. Such hybrid solutions are widely regarded as an effective transitional measure.
  • Crypto-Agility
    Crypto-agility refers to the ability of an ICT system or application to replace cryptographic algorithms in a flexible manner. This concept extends beyond migration to PQC algorithms and applies to all cryptographic mechanisms used within a system. Since it cannot be ruled out that algorithms currently considered secure, including PQC algorithms, may need to be replaced in the future, FINMA recommends requiring crypto-agility for newly procured or newly developed ICT systems and applications.
  • What does this mean for external service providers?
    Migration to PQC inevitably creates dependencies on external service providers, both in the context of outsourced functions and external communication interfaces. FINMA emphasises that institutions remain responsible for outsourced functions and should therefore ensure that appropriate obligations and requirements are contractually imposed on service providers. External service providers should therefore expect clients to require, among other things, crypto-agility as part of their contractual and technical requirements.

Conclusion and Outlook
Although the opportunities offered by quantum computing are not yet being widely utilised in practice, organisations should already be addressing the associated risks. FINMA has announced that it will continue to closely monitor developments in the field of quantum computing and will place greater emphasis on this topic as part of its ongoing supervisory activities.
Back

Your Team