A specialist practice of Silver Brain AI.silverbrain.ai
FINMA Supervisory Guidance 05/2026
FINMA has put the transition to quantum-safe cryptography on the management agenda. We help institutions turn cryptographic risk, dependencies and regulatory expectations into a structured, executable transition roadmap.
On 9 July 2026, FINMA published Supervisory Guidance 05/2026. It pairs a survey of 60 authorised banks, insurers, managers of collective assets and financial market infrastructures with recommendations for the migration to quantum-safe cryptography.
It is a supervisory communication, not a new circular. Institutions are expected to address quantum-related risks in a timely manner under existing governance, operational-risk and resilience requirements, and FINMA will give the topic more weight in its ongoing supervision.
What FINMA expects
The scope is migration to quantum-safe algorithms (NIST FIPS 203, 204 and 205). Quantum key distribution and business applications of quantum computing are explicitly out of scope.
Guidance 3.1
A board-adopted strategy and implementation plan with milestones, priorities and target dates, for critical processes and for full migration.
Guidance 3.2
Every business process analysed for the encryption, signature and authentication in use, in-house, outsourced or as a service, in a continuously updated cryptographic inventory.
Guidance 3.3
Data that needs long-term confidentiality, integrity or non-repudiation identified and prioritised. Hybrid classical-plus-PQC schemes are recommended for the transition.
Guidance 3.4
The ability to swap cryptographic algorithms without major architectural change, recommended as a requirement for systems still to be procured or built.
Guidance 3.5
Responsibility stays with the institution. PQC is anchored in contracts and release plans, and crypto-agility becomes a prerequisite for new outsourcing.
FINMA’s recommendation
References to FINMA guidance are provided for context and do not imply endorsement or affiliation.
Sector readiness
These figures describe the sector, not any single institution. The mid-2027 recommendation puts roadmap preparation on the management agenda whatever the starting point.
have neither planned nor implemented any measures on quantum-safe encryption.
have a specific roadmap. Those that do plan four to five years for critical data and processes.
expect direct impact from quantum-computing cyber risks within seven years.
intend to draw up a roadmap in the next one to three years; 43% are undecided.
Source: FINMA survey of 60 institutions, November 2025 to January 2026.
Why timing matters
Migration protects future traffic and systems, and data still under an institution’s control can be re-protected. Data already intercepted cannot be protected retroactively. That is why long-lived confidentiality comes first.
There is no exact Q-day to plan around, only uncertainty to manage. Exposure is concentrated in public-key schemes such as RSA, ECDSA, EdDSA, DH and EC-DH.
Encrypted traffic or archives are intercepted. Nothing visible happens.
The ciphertext is stored. It keeps its value as long as the data stays sensitive.
A cryptographically relevant quantum computer may break the public-key protection.
The roadmap’s subject
The first PQC standards are final: ML-KEM, ML-DSA and SLH-DSA, published by NIST in August 2024. The roadmap is not about the algorithms. It is about where, what first, in which order, under whose ownership, and by when.
Across channels, interfaces, certificates, key management, archives and provider systems, whether in-house, outsourced or as a service.
Ranked by protection horizon, harvest-now-decrypt-later exposure, long-term assurance requirements and service criticality.
Certificate authorities before certificates, the trust layer before what rides on it, and provider release plans alongside the institution’s own.
Including the two dates FINMA asks for: critical processes, and full migration.
Strategy, resources and residual risks, in a form that satisfies governance today and supervisory scrutiny later.
What we do
We structure the transition at the level where technology, risk, governance and execution meet. Engagements build on each other, and each can stand alone.
Orientation
Establish what the quantum transition means for the institution and what management needs to decide.
Core engagement
Develop the institution-specific roadmap from current exposure to controlled migration.
Outcome: A board-ready strategy and roadmap: priorities, target dates, ownership, dependencies, resource frame and the first migration decisions.
Execution
Turn the roadmap into managed execution.
Where specialised cryptographic or engineering capabilities are needed, we bring the right partners into a single programme.
Who we work with
We work with leadership teams across Switzerland’s financial sector: institutions with complex technology estates, long-lived sensitive information, regulated operations and significant third-party dependencies.
Why Silver Brain
When a technology changes what an enterprise can do and what it is exposed to, the response cannot stay in the technology layer. We combine strategy, operating-model design and technology fluency, the same premise behind our work in AI-native transformation.
About Silver Brain AIDirect engagement around management decisions, programme design and executive alignment.
Technology considered together with processes, governance, data, vendors, ownership and operating implications.
Roadmaps designed to become transformation programmes, not to end as presentation material.
Contact
Tell us where your institution stands. We will come back to you to arrange a first discussion.
