FINMA’s Quantum Computing Guidance for Financial Institutions
The Swiss Financial Market Supervisory Authority (FINMA) has released its latest document, entitled “FINMA Guidance 05/2026: Quantum computing,” This publication sends a clear signal to the financial sector: Quantum‑enabled cyber risks are no longer theoretical, and preparation must begin now.
Across 60 surveyed banks, insurers, asset managers and financial market infrastructures, FINMA found strong awareness of the risks — but limited action. While two‑thirds of institutions expect quantum‑related cyber threats to affect them within seven years, only 8% have a roadmap for quantum‑safe encryption, and 72% have not yet started any migration work.
For a sector built on trust, confidentiality, and resilience, this gap is significant. And it is precisely where ID Quantique (IDQ) can help.
Quantum Risk Is Accelerating
FINMA’s report highlights several concerns shared across the industry:
- Breakthrough timelines are shortening. Many institutions expect RSA‑2048 to be breakable within a decade.
- “Harvest now, decrypt later” attacks are already a real threat. Data stolen today may be decrypted once quantum computers mature.
- Critical data requires long‑term protection. Customer information, transaction records, digital signatures, and regulatory data must remain secure for decades.
- Migration will take years. Cryptographic inventories, system upgrades, vendor dependencies, and governance processes cannot be completed overnight.
FINMA’s conclusion is unambiguous: Institutions must begin transitioning to quantum‑safe encryption now, not when quantum computers arrive.
FINMA’s Recommendations: A Clear Roadmap
FINMA outlines five priority actions for financial institutions:
- A Board‑Approved Post-Quantum Cryptography (PQC) Strategy and Roadmap – Institutions should define milestones and target dates, with a PQC roadmap in place by mid‑2027.
- A Dynamic Cryptographic Inventory – All encryption, signatures, authentication and key‑management systems must be mapped—across applications, infrastructure and outsourced services.
- Prioritization of Critical, Long‑Lived Data –
Data vulnerable to harvest now, decrypt later attacks must be protected first, potentially using hybrid cryptographic approaches. - Crypto‑Agility – Systems must be designed to switch algorithms flexibly as standards evolve.
- Engagement with External Providers – Quantum‑safe requirements must be integrated into vendor contracts and release cycles.
These recommendations align closely with global regulatory trends (NIST, ENISA, NCSC) and with the broader shift toward quantum‑safe architectures.
How ID Quantique Supports Financial Institutions
ID Quantique (IDQ), now part of IonQ, has been helping governments, critical infrastructure operators, and financial institutions prepare for quantum risk for more than two decades. IDQ’s solutions directly address the gaps identified in FINMA’s report.
Quantum‑Safe Cryptography (PQC) Integration
IDQ supports institutions in:
- Building cryptographic inventories
- Designing PQC migration roadmaps
- Implementing hybrid cryptographic schemes
- Ensuring crypto‑agility across systems and applications
IDQ’s teams work closely with CISOs, architecture leads, and compliance teams to ensure alignment with FINMA, NIST and ENISA requirements.
Quantum Key Distribution for High‑Value Links
While FINMA’s guidance focuses on PQC, many institutions are also exploring the implementation of Quantum Key Distribution (QKD) to secure their most sensitive backbone links, in addition to PQC. IDQ is the global leader in QKD, with deployments across:
- Financial market infrastructures
- Government networks
- Telecom operators
- Cross‑border secure communication corridors
QKD provides information‑theoretic security, ensuring that critical data in transit remains protected even against future quantum computers.
Quantum Random Number Generation
Strong cryptography depends on strong randomness. IDQ’s Quantum Random Number Generation (QRNG) technology is already used by banks and payment providers to strengthen key generation and authentication systems.
Whether an institution is just beginning its quantum‑safe journey or already running pilots, IDQ provides end‑to‑end support to help you with:
- Assess quantum risk exposure
- Prioritize critical data
- Engage vendors and align outsourcing contracts
- Build crypto‑agile architectures
- Train teams and strengthen internal expertise
The Time to Act Is Now
FINMA’s message is clear: even though quantum computers are not yet at full scale, the associated risks are already impacting today’s security. Transitioning to quantum‑safe encryption will take years, and institutions that delay will face increasing operational, regulatory and reputational exposure.
ID Quantique believes that preparing early is the only responsible path forward. IDQ is ready to help financial institutions build the quantum‑safe foundations required for long‑term resilience.
About ID Quantique
Founded in 2001, ID Quantique (IDQ) is the world leader in quantum-safe crypto solutions, designed to protect data for the future. The company provides random number generation, quantum-safe security, and quantum detection systems to the financial industry, enterprises, and government organizations globally. IDQ’s quantum random number generator has been validated according to global standards and independent agencies and is the reference in highly regulated and mission-critical industries such as security, encryption, critical infrastructure, and IoT — where trust is paramount.
IDQ’s Quantum Sensing business unit provides photon counting solutions for the visible and near infrared regions of the optical spectrum, pulsed laser sources, counting & timing electronics and photonic sensing solutions for both industrial and research applications in various domains, such as quantum physics, communication, biological and material sciences, defense and security, oil and gas, etc.
To request more information or a quotation for any ID Quantique products, contact IL Photonics.