17 August 2026

Quantum Computing, PQC and the new urgency for financial institutions

  • Articles
  • Legal
  • Banking / Insurance
  • Data / Technology / IP

Quantum computing threatens today’s cryptography. As identifying and replacing vulnerable systems can take years, lead time itself becomes a key risk.

  • Tanja Steiner-Müller

    Senior Legal Associate

Why action is required today

Quantum computing is often perceived as a technology of the future. However, the real challenge for financial institutions lies not in the future use of quantum computers, but in their impact on the cryptography already in use today. In our article "Quantum Computing - Need for Action for Swiss Financial Institutions", we outlined the need for action as identified by FINMA and the measures it recommends for financial institutions to mitigate risks posed by quantum computers. The increasing digitization of services (such as online banking and digital payment systems), the encryption technologies currently in use, and the growing use of artificial intelligence (AI) in cyberattacks further increase the risks and the need for action on the part of financial institutions.

The real risk: Long migration cycles

The greatest challenge lies less in the technology itself than in the complexity of the migration. Financial institutions have heterogeneous IT environments comprising core banking systems, legacy applications, cloud services, interfaces to third-party providers, archiving systems, and signature solutions. The complete identification and replacement of quantum-vulnerable cryptography is time-consuming and may even take several years under certain circumstances. This explains why preparations should begin today. Those who wait to react until quantum computer-based attacks actually become possible will likely be unable to complete the necessary transformation in time. The lead time itself therefore becomes a key risk factor.

Post-Quantum Cryptography (PQC) as a strategic task

The introduction of post-quantum cryptography (PQC) must not be viewed as a one-time, isolated IT project. Rather, it is an institution-wide task that equally affects governance, compliance, and risk management, information security, IT infrastructure, procurement, and third-party management.

Crypto-agility as a key concept

A key factor in the migration is crypto-agility. Crypto-agility refers to the ability of an ICT system or an organization to quickly and efficiently replace or update cryptographic algorithms without having to undertake extensive system overhauls or changes to the software architecture. Since future PQC methods may also be further developed or replaced, crypto-agility is a long-term strategic capability and not merely a prerequisite for the current migration.

How we can support you

In addition to the technical challenges, a PQC migration also presents various legal challenges that must be overcome. We would be pleased to assist you, for example, in the following areas:

  • Legal gap assessment: We assist you in assessing compliance with FINMA Guidance 05/2026 and prepare a legal gap analysis for you – in close collaboration with technical partners.
  • Documentation for the board of directors: We can assist you in preparing a presentation or other documentation for the board of directors regarding strategic planning on this topic.
  • Legal guidance and review of a PQC roadmap: We can assist you in developing a PQC roadmap from a legal perspective and/or review a PQC roadmap you have already prepared from a legal standpoint.
  • Data protection impact assessment: We are happy to assist you in classifying your data sets in terms of criticality and confidentiality, as well as with regard to applicable retention periods.
  • Third-party management and contract management: We can review contracts with external service providers and assist you with contract amendments, contract drafting, and/or contract negotiations.
  • Ad hoc legal assessment: Of course, we’re also happy to provide you with an ad hoc legal assessment on a topic you need.

Click here to learn more about our expertise:

Banking / Insurance

Data / Technology / IP
Back