Post-Quantum Readiness for Swiss Financial Institutions: FINMA's Mid-2027 Deadline

FINMA recommends the transition to quantum-safe encryption to be based on a strategy approved by the board of directors, with an implementation plan setting out milestones and priorities. Target dates should be defined for the complete migration, and separately for critical business processes.

For financial institutions, a concrete and robust strategy should answer the following key questions:

• Which cryptographic risks matter most to our customers, our business partners and our own organization?
• How do these cryptographic risks influence the current and future business and operating model?
• Which business services, applications, data flows and third-party dependencies are in scope?
• Which assets and data require protection beyond the expected quantum threat horizon?
• Which changes can be embedded into existing technology refresh, cloud, core systems, identity, certificate management or cyber resilience programs?
• What decisions are required from executive management and the board?

An actionable roadmap should be risk driven and establish clear direction, ownership, prioritization logic and decision points without the need to prescribe every technical answer upfront

FINMA describes risk analysis and inventory as the first step in the transition. Financial institutions should identify encryption, digital signature and authentication technologies spanning across business processes, IT systems, on-premises infrastructure, cloud services, and third-party integrations.

This is where many organisations underestimate the challenge. Cryptography is often embedded deep inside applications, protocols, certificates, hardware, middleware, cloud services, and workflows. Without an inventory, an organisation cannot reliably answer which systems use quantum-vulnerable algorithms, which data is exposed, which third-parties are involved, or where migration will be most difficult.

The inventory should be comprehensive and cover aspects such as:

• encryption of data in transit;
• encryption of data at rest;
• digital signatures;
• authentication mechanisms;
• key management processes;
• certificates and certificate lifecycle management;
• dependencies on third-party software, platforms and managed services;
• cryptographic algorithms potentially vulnerable to quantum attacks.
  

This inventory should be maintained and updated continuously to reflect changes in systems, applications and third-party dependencies. While this can be an effort intensive undertaking, crypto-agility enabling technologies exist to automate the majority of related activities.

FINMA places emphasis on critical data and the "Harvest Now, Decrypt Later" (HNDL) risk. The practical question financial institutions should answer regarding HNDL is: “which data would still create unacceptable harm if decrypted several years from now?”

Financial institutions should therefore identify which data requires long-term confidentiality, integrity, authenticity and non-repudiation. This may include customer records, transaction data, legal agreements, sensitive communications and records subject to long retention periods.

FINMA notes that various organisations recommend hybrid solutions in the short to medium term, combining traditional and postquantum algorithms. This can provide additional assurance while post-quantum algorithms continue to mature, but it also increases implementation complexity.

A crypto-agile organisation is one that is fast, flexible and efficient when updating cryptographic algorithms, parameters, processes and technologies.

This helps better respond to new protocols, standards, and security threats, which are not limited to quantum risk.

Benefits:

• Faster implementation or adjustment of cryptography used across the technology stack, including newly published Post-Quantum Cryptography (PQC) algorithms by National Institute of Standards and Technology (NIST).
• More efficiency in cryptographic operations, leading to possible reduction of cost or more effective investment of existing cyber-security resources.
• Faster response to cryptographic vulnerabilities and incidents, reducing exposure to regulatory sanctions, customer data breaches, and operational disruplion.
• More flexible IT-infrastructure, opening the door to more innovation and implementation of new technologies.

FINMA recommends crypto-agility as a requirement for applications and other IT systems to be procured or developed. Even after post-quantum algorithms are adopted, some may later need to be replaced. Regardless of the advancements of quantum computing, cryptographic weaknesses can arise from weaknesses in the design of the algorithm, poor implementation, outdated libraries, incorrect configurations or vulnerable software supply chains. It is common that from time to time an algorithm or its implementation becomes vulnerable and requires to be replaced. Past examples include SHA-1 (a deprecated hash function), MD5 (a broken cryptographic hash) and RC4 (a compromised encryption cipher), which took some organizations several years to replace because they lacked crypto-agility.

A crypto-agile organisation is better positioned to respond when such weaknesses are discovered, whether the trigger is quantum progress, AI-enabled threat activity, a new standard, or a vulnerability in a cryptographic component.

For financial institutions, crypto-agility should be embedded into architecture, procurement, secure development, key and certificate lifecycle management, and technology change governance. It should also become a design requirement for new systems, rather than an afterthought when migration pressure increases.

FINMA explicit states that post-quantum migration will create dependencies on external service providers. This is critical for financial institutions because a large part of cryptographic exposure may sit within externally managed infrastructure, such as core platforms, payment services, cloud environments, and identity providers.

Financial institutions should initiate conversations with external service providers to understand their post-quantum readiness, supported algorithms, product roadmaps, release timelines, and migration dependencies.

Post-quantum and crypto-agility requirements should be integrated into:

• new outsourcing and procurement requirements;
• third-party cyber risk assessments;
• contract renewals and service level discussions;
• architecture and integration standards;
• release planning and testing cycles.
  

In practice, three things are required:

1. visibility into supplier roadmaps and dependencies;
2. contractual clarity on post-quantum requirements and timelines;
3. influence over release planning to align with the financial institution's migration schedule.
   

Without these, financial institutions risk being dependent on supplier timelines rather than driving their own post-quantum transition.

To help financial institutions assess supplier readiness, the maturity model below outlines the progression from no formal process to fully integrated post-quantum requirements in third-party management.

Pathway A: Getting started for financial institutions with limited or nopost-quantum readiness

If the answer is "no" to most of these questions, the focus should be on establishing the foundation for post-quantum readiness. The following steps provide a structured approach to build the foundations:

• Step 1: Establish governance and ownership within the organisation and business function.
• Step 2: Design the post-quantum roadmap to include milestones, sequencing, decision points, dependencies and target dates, aligning with FINMA's mid-2027 recommendation.
• Step 3: Define a risk management framework for identifying, assessing and remediating post-quantum risks.
• Step 4: Define the in-scope systems, applications and data, and identify the risks that matter most from a confidentiality, integrity, authentication and resilience perspective.
• Step 5: Conduct a diagnostic assessment to understand the breadth and depth of the cryptographic exposure, providing the
  foundation for prioritising where to invest in deeper analysis.
• Step 6: Build or enhance the crypto-inventory, starting from high-priority environments based on exposure and criticality.
• Step 7: Embed crypto-agility to ensure that future changes to cryptographic standards do not require disruptive rework.

Pathway B: Going deeper for financial institutions already in transition

If the answer is "yes" to most of these questions, the foundations are likely established, and the next steps should focus on acceleration, depth and resilience:

• Step 1: Embed crypto-agility into operations by implementing key and certificate lifecycle management tools and by integrating cryptographic risk management into incident response and vulnerability management processes.
• Step 2: Enhance visibility with advanced assessment tools to scan systems and networks to identify cryptographic implementations that may have been missed in manual inventories or vulnerable.
• Step 3: Develop a hybrid approach for critical data requiring immediate long-term protection combining traditional and postquantum algorithms.
• Step 4: Accelerate third-party readiness by negotiating contractual commitments for post-quantum support, by collaborating with suppliers on testing and validation of post-quantum solutions, and by integrating post-quantum requirements into service level agreements and renewal discussions.