FINMA Quantum Readiness: Three Questions Every Swiss Financial Institution Needs to Answer

Picture a Swiss financial institution’s board meeting sometime in the spring of 2027. The CISO is three slides into a quantum-readiness update when a board member interrupts with a question that has nothing to do with quantum computers: “How many cryptographic certificates and keys do we actually have across our own systems, our outsourced providers, our cloud environment?” Nobody in the room has a confident number.

That boardroom moment is closer than it looks. FINMA Guidance 05/2026, issued on July 9, 2026, gives supervised Swiss financial institutions until mid-2027 to have a board-approved post-quantum cryptography (PQC) roadmap in place.

A roadmap is only as credible as the inventory it’s built on. The risk underneath it isn’t hypothetical either: encrypted data can be harvested today and decrypted once quantum computers mature — “Harvest Now, Decrypt Later.”

FINMA’s own survey of 60 Swiss institutions found that 72% have no quantum-safe plan today, and only 8% have a concrete roadmap. Which means the scene above is more realistic than most boards would like to admit.

The first question: what do we actually have?

If that CISO were honest, the first answer would be some version of “we’re still finding out.” Cryptographic assets accumulate quietly over years. They get provisioned by different teams, spread across infrastructure, applications, networks, cloud, and outsourced providers, and nobody inherits ownership of the full picture by default. FINMA’s guidance makes that an explicit expectation rather than a nice-to-have: a cryptographic inventory covering in-house, outsourced, and cloud-based systems alike, not just whatever IT happens to manage directly.

The harder question behind it: what’s actually dangerous?

Once an inventory exists, the next question is the one that trips institutions up: of everything on that list, what genuinely needs attention first? Quantum risk is only part of the answer. The cryptographic vulnerabilities already sitting in the environment today, from expired or mismanaged certificates to weak algorithms and configurations nobody’s revisited in years, are a separate, more immediate problem. Treating every item on the list as equally urgent is how institutions end up fixing the wrong things first. The risk analysis must include business context to prioritize resolution of what’s actually exposed.

The question that comes back every year: does this still hold up?

The roadmap that board signs off on isn’t the end of the conversation; it’s the start of a new one that repeats year over year. The list will and should look different 18 months later when new vendors, new applications, and new infrastructure have quietly changed what’s actually true on the ground. FINMA’s mid-2027 checkpoint is the first time this gets tested, not the last. Institutions that treat it as a one-time deliverable are setting up next year’s version of the same uncomfortable board question.

Giving that CISO a better answer

This is where Keyfactor AgileSec Analytics comes in. By leveraging existing security and IT investments, AgileSec delivers continuous cryptographic discovery and a centralized, harmonized inventory across infrastructure, applications, networks, cloud, and supported third-party environments. Instead of fragmented information and point-in-time assessments, institutions gain a consistent, enterprise-wide view of their cryptographic exposure.

But visibility is only the starting point. AgileSec identifies existing cryptographic vulnerabilities, from weak algorithms and exposed keys to vulnerable libraries and insecure protocols, alongside emerging quantum risks. By combining technical severity with business context, it helps institutions prioritize what matters most and drive remediation through existing security workflows.

This continuous cryptographic intelligence supports Cryptographic Bills of Materials (CBOMs), risk-based PQC migration planning, and ongoing monitoring of remediation progress. It provides the technical evidence institutions need to build a defensible roadmap aligned with FINMA’s recommendations and demonstrate measurable progress toward quantum readiness.

So the next time a board member asks, “What cryptography do we have, where are the risks, and what are we doing about them?” the CISO can provide an evidence-based answer.

Mid-2027 may seem distant, but building a credible PQC roadmap takes time. Establishing visibility, understanding vulnerabilities, prioritizing risks, and planning migration across complex financial environments cannot happen overnight.

The first step is knowing where you stand. Talk to Keyfactor about a PQC/FINMA Readiness Assessment to establish your cryptographic baseline, identify priority risks, and define the next steps toward quantum readiness.