A credible PQC roadmap

FINMA recommends that a post-quantum cryptography (PQC) roadmap be drawn up "by mid-2027 at the latest". Read quickly, that sounds like a date eight months away. Read carefully, it is a date that most institutions will meet or miss in the next eight weeks.

This article sets out why, and what a realistic path to mid-2027 looks like — quarter by quarter, with the questions a risk committee can use to check whether the institution is on it.

First, the date read precisely

Three points of precision are worth fixing before anything else, because each is routinely misquoted.

It is guidance, not a new rule. FINMA Guidance 05/2026 contains recommendations. What is binding is the existing, technology-neutral requirement for effective governance and risk management, which FINMA states already covers the risks arising from powerful quantum computers. Nothing new became mandatory on 9 July 2026. What changed is that the supervisor's expectation became explicit, and dated.

Mid-2027 is a date for a plan, not for a migration. FINMA recommends that a roadmap exist by then. It sets no date for completing the migration itself. Institutions that already hold roadmaps told FINMA they allow four to five years to execute them, which places completion for a mid-2027 roadmap in the early 2030s.

The supervisor will be asking. FINMA states that it "will give greater prominence to this topic in its ongoing supervisory activities." The question will not be whether an institution has read the guidance. It will be what the institution can show.

Why the date is decided before January

A roadmap is not a document that can be written in June. It is the output of four other pieces of work, each of which FINMA describes:

• a strategy adopted by the board of directors, from which an implementation plan with milestones and priorities is derived (§3.1);
• a risk analysis covering both the cryptographic methods in use and the critical data that requires long-term protection — which FINMA describes as "the first step" (§3.2, §3.3);
• a cryptographic inventory that results from that analysis (§3.2);
• answers from external service providers, whose own migration determines much of the institution's (§3.5).
• A named executive owner, with authority over procurement as well as architecture. Most of a Swiss institution's cryptography is bought rather than built, so an owner whose remit stops at the technology function cannot deliver the plan.
• A funded line in the 2027 budget — not for the whole programme, which nobody can yet cost credibly, but for the work that comes first: the risk analysis, the first inventory, and the people to run them.
• Critical suppliers asked, in writing, for their PQC plans. The answers take months; the letters take a week.
• The board aware of the date, with the strategy scheduled on its agenda for the first quarter.
• The strategy adopted by the board of directors. FINMA notes it can form part of an existing strategy, for example on cyber risks — so this need not be a new document, only an explicit one.
• The risk analysis under way, starting with data. FINMA asks institutions to identify critical data requiring long-term protection of confidentiality and integrity — or non-repudiation, for example with electronic signatures — and to give it priority, explicitly because of "harvest now, decrypt later" risk. Classify data classes by how long they must stay confidential before classifying systems; a system inherits the longest horizon of any data it touches.
• A first-pass inventory of where encryption, signatures, key management and authentication are used — in-house, outsourced and as-a-service alike. FINMA names RSA, ECDSA, EdDSA, DH and EC-DH as examples of quantum-vulnerable algorithms.
• Supplier responses collected and assessed.
• A roadmap with milestones, priorities and two target dates — one for the migration of critical business processes, one for complete migration. FINMA asks for both, and separating them is what makes the plan fundable: the early date is where the long-lived data is protected; the later one is where the programme closes.
• A migration plan commensurate with the associated risk for systems using quantum-vulnerable algorithms — which is FINMA's own permission to sequence rather than attempt everything at once.
• Crypto-agility written into procurement standards, and into new outsourcing arrangements in the software and data sectors, as FINMA recommends — with existing arrangements to follow "at the earliest opportunity".
• An out-of-scope list, stated deliberately, so that the board accepts those exclusions rather than discovering them later.
• The inventory stays live. FINMA describes a cryptographic inventory "continuously updated to reflect the current situation". New systems, new suppliers and new channels add cryptography continuously.
• Critical processes move first. The early target date is the one that reduces exposure; the programme should be judged against it.
• The algorithms themselves may change. FINMA anticipates that some algorithms currently regarded as secure — post-quantum ones included — will need to be replaced. Crypto-agility is what keeps that from becoming a second migration.

Each of those needs an owner and a budget before it can start. And in most Swiss institutions, the budget for 2027 is being settled now.

Work backwards from mid-2027 and the critical path runs straight through the 2027 budget round. An institution that leaves December without a funded line and a named owner can still produce a document by mid-2027 — but it will be a plan to make a plan.

The plan, quarter by quarter

What follows is SeQure AG's practical sequence. It is not FINMA's — the Guidance sets one date and leaves the sequencing to the institution — but each step is anchored in what FINMA recommends.

Q4 2026 — now to December: mandate and money

What must be true by the end of the quarter

The common pitfall: waiting for a full business case before funding anything. The business case needs the inventory; the inventory needs funding. Breaking that loop is the single most valuable decision of the quarter.

Q1 2027 — January to March: strategy and analysis

What must be true by the end of the quarter

The common pitfall: treating the inventory as the first step. It is the second. Without the data analysis, an inventory returns thousands of findings with no way to tell which matter.

Q2 2027 — April to June: the roadmap

What must be true by mid-2027

The common pitfall: a single distant completion date. It looks unfundable, and it hides the fact that most of the risk reduction happens early.

Five questions to check you are on the path

These are the questions from the LinkedIn post, with what a credible answer sounds like. A non-specialist can ask all five — and can tell whether the answer is real.

1. Who owns this — and does their remit reach our supplier contracts?

Credible: a named executive, with authority over procurement standards. Weak: "IT security is looking at it."

2. Is it funded in the 2027 budget?

Credible: a line, with an amount, for the risk analysis and first inventory. Weak: "We will request funding once the business case is ready."

3. Which of our data must stay confidential longest — and has the risk analysis started there?

Credible: named data classes — client identity, wealth structures, credit files, archived payment traffic — with a start date. Weak: "We are scanning the whole estate."

4. Which critical suppliers have given us their PQC plans in writing?

Credible: a list, with dates and gaps. Weak: "We have asked them." This is the question that lands hardest, because FINMA is explicit: responsibility for an outsourced function "lies in all cases with the outsourcing institution". A supplier's silence is the institution's exposure.

5. When FINMA asks, what will we show?

Credible: a board minute, a strategy, an analysis in progress, supplier correspondence. Weak: a presentation about quantum computing.

If all five have credible answers by January, the institution is on track for mid-2027.

After mid-2027

A roadmap is the start of execution, not the end of the exercise. Three things carry on:

What this plan does not require

It does not require a Q-Day forecast. The sequencing rests on how long the institution's data must stay confidential and how long its migration will take — both properties of the institution, both knowable today. Cryptographically relevant quantum computers do not yet exist; FINMA says so plainly. The case for starting does not depend on pretending otherwise.

It does not require the full programme to be costed before anything begins. And it does not require a new governance structure — only an explicit owner, an explicit budget line and an explicit board decision.

The point

Mid-2027 will be met or missed in the 2027 budget round. Everything after that is execution.

SeQure AG's QuRisc suite follows this path: Scout builds the cryptographic inventory, Augur forecasts the quantum threat as a range rather than a date, Atlas turns both into a prioritised migration roadmap, and Vantage presents it to business, finance and technology leadership. More at www.sequre.ch.

References

1. FINMA, Guidance 05/2026, Quantum computing, 9 July 2026 — §1 (introduction), §2 (survey), §3.1 (strategy and roadmap), §3.2 (risk analysis and inventory), §3.3 (critical data), §3.4 (crypto-agility), §3.5 (external service providers), §4 (outlook).

2. FINMA, Circular 2018/3 Outsourcing — banks and insurers.

3. NIST, FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), FIPS 205 (SLH-DSA), August 2024.

About the author. Amit Agarwal is CEO and Co-Founder of SeQure AG, a Swiss quantum cybersecurity company helping banks and financial institutions identify, prioritise, and remediate cryptographic vulnerabilities before Q-Day. He brings 25+ years across software, SaaS, payments and FinTech and holds a BTech (Computer Science), an MBA, an MAS, and a Quantum Computing qualification from MIT's executive education.