FINMA Guidance 05/2026
Time left until FINMA’s recommended date: ≈ 8 months to mid-2027A post-quantum roadmap by mid-2027.
FINMA recommends that supervised institutions have one by mid-2027. It also says it will look at this topic more closely in future supervision.
From today to mid-2027
-
Today
Exposure is running
-
Inventory
Step 01 · ch. 3.2
-
Risk ranking
Step 02 · ch. 3.2–3.3
-
Board roadmap
Step 03 · ch. 3.1, 3.4, 3.5
-
Mid-2027
FINMA’s recommended date
Status at a glance
Red, amber, green. For every system.
A board does not read cipher suites. It reads status. The inventory gives every system one, based on rules you set.
Post-quantum status per system
Example-
Customer portal
TLS 1.2 · ECDHE-RSA
Vulnerable
-
Payment interface
TLS 1.3 · X25519MLKEM768 · RSA certificate
Hybrid, on track
-
Internal service
ML-KEM-768 · ML-DSA-65 certificate, internal CA
PQC-ready
-
The key exchangeHow two systems agree on a secret key before they encrypt. Whoever breaks it can read everything encrypted under that key, including traffic recorded years earlier. is quantum-vulnerable. Traffic recorded today can be read later.
-
A hybridA classical and a post-quantum algorithm used together, for example X25519 with ML-KEM-768. The connection stays secure as long as either one holds. key exchange protects the traffic. The certificates still need to move.
-
Post-quantum key exchange and post-quantum certificates.
The systems are invented. The three states are the ones the product reports.
If nothing happens
- Closer supervision. FINMA says it will look at this topic more closely in its ongoing supervision.
- Duties you already have. FINMA states that the governance and risk rules that bind you today cover quantum risk too.
- No evidence. Without an inventory, a question about your cryptography gets an estimate, not an answer.
- Growing exposure. Every month, more data is sent under a key exchange that a quantum computer will be able to break.
- Reputation. A gap that supervision finds is harder to explain than a gap you found and planned for.
FINMA recommends a roadmap. It does not require one. The risk comes from supervision and from duties that already apply.
Take this to your board
The guidance, the exposure and the three steps on one page. For colleagues who will not read a website.
The method
How to get on it
One method in three steps. Each step builds on the one before.
-
01
Find it
ch. 3.2
List every system: your own, outsourced, and bought as a service. Find the encryption, signatures, authentication and keys they use, for data in transit and data at rest. Then mark what a quantum computer will break.
Post Quantum Leap
A network scan finds what answers. A host scanner reaches inside machines a scan cannot see. You import the rest. Each endpoint then gets a post-quantum status, based on rules you set.
Result
An inventory, with a status for every system.
-
02
Rank it
ch. 3.2 · 3.3
Find the data that must stay secret for years. That is the data a harvest-now attack targets. Then write a migration plan for each system, sized to its risk.
Both
A view of how critical each system is against how hard it is to move. How long data must stay secret is a business decision, so we do that part with you.
Result
A ranked list: what moves first, and why.
-
03
Plan it
ch. 3.1 · 3.4 · 3.5
A strategy your board approves, with milestones and target dates: one for the full migration, one for critical processes. New systems and new outsourcing contracts must allow algorithms to be changed later.
Both
A workshop with us makes the decisions. Post Quantum Leap then holds the plan: dated waves, owners, and the effect on your exposure.
Result
A roadmap your board has approved.
About twelve weeks for a first project. It ends with the roadmap and a FINMA report that shows the evidence behind every number. Your systems decide the real time, and we tell you after the first scan, not before.
The evidence
Evidence, not estimates.
Every status traces back to a scan result. The compliance view sets your whole estate against the standards you are measured on, including FINMA Guidance 05/2026.
- How many endpoints are ready, on track or vulnerable
- The rule behind every verdict, one row per endpoint
- A FINMA view that reports the guidance as written: a recommendation, not a circular
- Every report exports to Excel or PDF
The document
What the guidance says
- What
- Guidance 05/2026, Quantum computing · 9 July 2026
- Type
- Guidance (Aufsichtsmitteilung)A FINMA guidance (Aufsichtsmitteilung) shares what FINMA sees in supervision and what it expects. It is not a circular (Rundschreiben), which sets out how FINMA applies the law., not a circular. It creates no new duty.
- Applies to
- Banks, insurers, managers of collective assets, financial market infrastructures
- Asks for
- A roadmapA plan your board approves: which systems move to post-quantum cryptography, in which order, and by when. by mid-2027, built on an inventory of the cryptography you useA list of where your systems use encryption, signatures and keys, which algorithms they use, and which of those a quantum computer will break. (ch. 3)
- Algorithms
- None of its own. Points to NIST FIPS 203, 204 and 205The first three post-quantum standards, published by the US National Institute of Standards and Technology on 13 August 2024: ML-KEM for key exchange (FIPS 203), and ML-DSA and SLH-DSA for signatures (FIPS 204 and 205)..
- Also states
- The rules on governance and risk that already bind you cover quantum risk too. FINMA expects action in good time.
Read it PDF, German ↗ PDF, English ↗ PDF, French ↗ Press release ↗
Request a live demo
See it live, then try it yourself.
Around 30 to 45 minutes, online. We drive: nothing to install, no environment to prepare, no data needed from you. We walk through discovery, the inventory, the crypto graph, compliance reporting and planning on a full demo installation, then spend most of the time on whatever is closest to your situation.
If you want to keep going after that, we can give you a login to a demo tenant, or set you up with a local install so you can try it against your own infrastructure.
- What you get
- A straight answer on whether Post Quantum Leap fits your infrastructure, including when it does not.
- Prefer email
- info@postquantumleap.com
Request received.
We have emailed you a confirmation and will reply within one working day with a few suggested times. If nothing arrives, write to info@postquantumleap.com.