---
title: Two banks, four decisions by Dec 2027
description: Two banks, four decisions in Dec 2026, very different status in Dec 2027
image: https://sequre.ch/hubfs/AI-Generated%20Media/Images/Two%20Swiss%20Banks%20Quantum%20Cybersecurity%20vs%20Traditional%20Finance.png
---

[Skip to main content](https://sequre.ch/en/blog/decisions-by-dec-2027#main)

[![Sequre Logo\_Hor\_72x212](https://sequre.ch/hs-fs/hubfs/New/Sequre%20Logo_Hor_72x212.png?width=212&height=72&name=Sequre%20Logo_Hor_72x212.png) ![Sequre Logo\_Hor\_72x212](https://sequre.ch/hs-fs/hubfs/New/Sequre%20Logo_Hor_72x212.png?width=212&height=72&name=Sequre%20Logo_Hor_72x212.png) ![Sequre Logo\_Hor\_72x212](https://sequre.ch/hs-fs/hubfs/New/Sequre%20Logo_Hor_72x212.png?width=212&height=72&name=Sequre%20Logo_Hor_72x212.png) ![Sequre Logo\_Hor\_72x212](https://sequre.ch/hs-fs/hubfs/New/Sequre%20Logo_Hor_72x212.png?width=212&height=72&name=Sequre%20Logo_Hor_72x212.png)](https://sequre.ch)

- [Show submenu for Solutions Solutions](https://sequre.ch/solutions) 
    - Show submenu for Quantum Safe Security Quantum Safe Security 
      
          - [QuRisc Atlas](https://sequre.ch/solutions#AIRiskTool)
          - [QuRisc Scout](https://sequre.ch/solutions#Crawler)
          - [QuRisc Vantage](https://sequre.ch/solutions#Vantage)
          - [QuRisc Augur](https://sequre.ch/solutions#Augur)
          - [Quantum Safe encryption](https://sequre.ch/solutions#QSE)
          - [Quantum Security Hardware](https://sequre.ch/solutions#QKD)
          - [Quantum Detection System](https://sequre.ch/solutions#QKD)
    - [Consulting](https://sequre.ch/solutions#Consulting)
    - [Quantum Algorithms](https://sequre.ch/solutions#QuantAlgo)
    - [Industries](https://sequre.ch/solutions#Industries)
- [Show submenu for Resource Resource](https://sequre.ch/resources) 
    - [Blogs](https://sequre.ch/en/blog)
    - [Quantum Computing Knowledge Base](https://sequre.ch/resources#QKB)
- [Show submenu for Company Company](https://sequre.ch/company) 
    - [About Us](https://sequre.ch/company#AboutUs)
    - [Management Team](https://sequre.ch/company#Team)
    - [Advisors](https://sequre.ch/company#Advisors)
    - [Partners](https://sequre.ch/company#Partners)
    - [Careers](https://sequre.ch/company#Careers)
    - [Contact](https://sequre.ch/company#Contact-Us)
- [Whats New](https://sequre.ch/whats-new)

Open main navigation

Close main navigation

- Show submenu for Solutions Solutions 
  
    - Solutions
    - [Solutions](https://sequre.ch/solutions)
    - Show submenu for Quantum Safe Security Quantum Safe Security 
      
          - Quantum Safe Security
          - [QuRisc Atlas](https://sequre.ch/solutions#AIRiskTool)
          - [QuRisc Scout](https://sequre.ch/solutions#Crawler)
          - [QuRisc Vantage](https://sequre.ch/solutions#Vantage)
          - [QuRisc Augur](https://sequre.ch/solutions#Augur)
          - [Quantum Safe encryption](https://sequre.ch/solutions#QSE)
          - [Quantum Security Hardware](https://sequre.ch/solutions#QKD)
          - [Quantum Detection System](https://sequre.ch/solutions#QKD)
    - [Consulting](https://sequre.ch/solutions#Consulting)
    - [Quantum Algorithms](https://sequre.ch/solutions#QuantAlgo)
    - [Industries](https://sequre.ch/solutions#Industries)
- Show submenu for Resource Resource 
  
    - Resource
    - [Resource](https://sequre.ch/resources)
    - [Blogs](https://sequre.ch/en/blog)
    - [Quantum Computing Knowledge Base](https://sequre.ch/resources#QKB)
- Show submenu for Company Company 
  
    - Company
    - [Company](https://sequre.ch/company)
    - [About Us](https://sequre.ch/company#AboutUs)
    - [Management Team](https://sequre.ch/company#Team)
    - [Advisors](https://sequre.ch/company#Advisors)
    - [Partners](https://sequre.ch/company#Partners)
    - [Careers](https://sequre.ch/company#Careers)
    - [Contact](https://sequre.ch/company#Contact-Us)
- [Whats New](https://sequre.ch/whats-new)
- [Contact Us](https://sequre.ch/contact-us)

[Contact Us](https://sequre.ch/contact-us)

# Two banks, four decisions by Dec 2027

![Amit Agarwal](https://sequre.ch/hs-fs/hubfs/AmitAgarwal.jpg?width=120&height=120&name=AmitAgarwal.jpg)

 by [Amit Agarwal](https://sequre.ch/en/blog/author/amit-agarwal)

Oct 26, 2026, 4:52:29 PM

Take two Swiss banks. Same size, same client base, same core-banking platform, same supervisor. In November 2026 both read FINMA Guidance 05/2026, and both boards agree it matters.

Thirteen months later they are in very different places. Not because one was reckless and the other brilliant, but because of four decisions made in a single winter.

This article follows both banks through 2027. They are illustrative, not real — but anyone who has run a multi-year change programme in a Swiss institution will recognise both.

**December 2026: the fork**

The 2027 budget round closes.

**The first bank** funds a modest line for post-quantum migration — not the whole programme, which nobody can yet cost, but the work that has to come first: a risk analysis, a first-pass cryptographic inventory, and the time of the people who will run them. It names an executive owner whose remit reaches procurement as well as architecture.

**The second bank** defers. The reasoning is respectable: the cost is uncertain, Q-Day is uncertain, there are more urgent challenges to solve, and the guidance contains recommendations rather than requirements. The board asks for a fuller business case in the spring.

Neither decision looks large at the time. Both are entirely defensible in a board minute. That is precisely why this is the moment that matters.

**March 2027: the work that comes first**

**The first bank** starts where FINMA says to start. Section 3.2 describes the first step as “a risk analysis – on the one hand, with regard to the cryptographic methods used, and on the other, with regard to critical data that requires long-term protection.” The bank classifies its data by how long it must stay confidential — client identity and onboarding files, wealth structures, credit files, archived payment traffic — and finds, as most institutions do, that a small share of its estate carries most of the long-term exposure.

It also writes to its critical suppliers, asking for their PQC plans in writing. Some answer quickly. Some do not. Both answers are useful.

**The second bank** is preparing the business case its board requested. To cost the programme credibly, it needs the inventory. To fund the inventory, it needs the business case. The loop is familiar to anyone who has sat on an investment committee.

**Mid-2027: the date**

FINMA recommends “that a PQC roadmap be drawn up by mid-2027 at the latest.”

**The first bank** has one. It rests on a strategy adopted by the board of directors, as Section 3.1 recommends, and it carries the two target dates FINMA asks for: one for critical business processes, one for complete migration. The critical-process date is early, because that is where the long-lived data sits. The full-migration date is honest about supplier dependencies.

**The second bank** has a draft, a vendor shortlist and a request for budget in the 2028 round.

None of this is a breach. The Guidance contains recommendations; the binding obligation is the existing requirement for effective governance and risk management. But that obligation now has a dated reference point in the supervisor’s own published expectations — and only one of the two banks can point to it.

**Autumn 2027: what the supervisor sees**

FINMA has said it “will give greater prominence to this topic in its ongoing supervisory activities.”

When the topic comes up, **the first bank** hands over a file: a board-adopted strategy, a roadmap, a risk analysis, a first inventory, supplier correspondence. The conversation is about pace and priorities.

**The second bank** explains. It explains well, and its intentions are sound. But the conversation is about why the work has not started, and that is a different conversation to be having with a supervisor.

**All year: what the data sees**

This is the part that neither bank can observe directly.

FINMA refers to “the already very real risk of 'harvest now, decrypt later' attacks” — data encrypted today, copied, and stored until it can be read. Neither bank can tell whether any of its traffic has been captured. But the first bank has spent the year narrowing the window for its most sensitive data: identifying it, prioritising it, and in some cases moving it to hybrid protection, which FINMA notes is frequently cited as a means of protecting critical data against exactly this risk — while also adding complexity that carries its own implementation risk.

The second bank has spent the same year with its exposure unchanged. Not worse — just a year older.

**The renewal cycle: what the suppliers see**

Contracts renew on their own schedule. During 2027 both banks renew several significant software and data agreements.

**The first bank** has written crypto-agility into its procurement standards, as FINMA recommends — “a prerequisite for all new outsourcing arrangements in the software and data sectors.” Its renewals carry the clause.

**The second bank’s** renewals pass without it. The next opportunity to add it may be several years away. This is the least visible consequence of the deferral and, over a decade, perhaps the most expensive.

**The arithmetic underneath**

Institutions that already hold roadmaps told FINMA they allow four to five years to reach a quantum-safe state. Michele Mosca’s well-known formulation makes the consequence plain: if the time your data must stay confidential (X) plus the time your migration takes (Y) exceeds the time until a cryptographically relevant quantum computer exists (Z), you have a problem today.

Z is a forecast, and it will remain a range. X is a property of the business. The second bank’s year of deferral has done one thing only: it has added a year to Y. Every other term is unchanged.

That is the whole difference between the two banks, expressed as a sum.

**The case for the second bank**

It deserves stating fairly. Waiting for certainty is a sound instinct in most risk disciplines. Costs are uncertain, technology is moving, and early movers sometimes pay for lessons that later movers get free.

But the uncertainty here does not resolve in time to be useful. Nobody will announce Q-Day in advance. And most of what the first bank spent in 2027 — a risk analysis, an inventory, supplier correspondence, a procurement clause — is work the second bank will have to do anyway, at the same cost, one year later and with one year less margin. The deferral bought information that never arrived.

**The four decisions**

Both banks were one winter apart. The decisions that separated them were:

1\. **A named owner** whose remit reaches procurement, not just architecture.

2\. **A funded line** in the 2027 budget for the work that comes first.

3\. **A risk analysis started**, beginning with the data that must stay confidential longest.

4\. **Critical suppliers asked, in writing**, for their PQC plans.

None of them requires knowing when Q-Day arrives. None of them requires the full programme to be costed. All four can be made before the end of January.

**The point**

Two banks, same starting point, same supervisor, same uncertainty. By December 2027 one has a programme and the other has a plan to make a plan.

The difference was not foresight. It was four ordinary decisions, made in time.

*SeQure AG’s QuRisc suite is built for the first bank’s year: Scout finds the cryptography, Augur forecasts the threat as a range rather than a date, Atlas turns both into a prioritised migration roadmap, and Vantage presents it to business, finance and technology leadership. More at www.sequre.ch.*

**References**

1\. FINMA, Guidance 05/2026, *Quantum computing*, 9 July 2026 — §1, §2 (survey), §3.1 (strategy and roadmap), §3.2 (risk analysis and inventory), §3.3 (critical data, hybrid), §3.4 (crypto-agility), §3.5 (external service providers), §4 (outlook).

2\. M. Mosca, “Cybersecurity in an Era with Quantum Computers: Will We Be Ready?“, *IEEE Security & Privacy*, vol. 16, no. 5, pp. 38–41, September/October 2018, doi 10.1109/MSP.2018.3761723.

3\. FINMA, Circular 2018/3 *Outsourcing — banks and insurers*.

**About the author.** Amit Agarwal is CEO and Co-Founder of SeQure AG, a Swiss quantum cybersecurity company helping banks and financial institutions identify, prioritise, and remediate cryptographic vulnerabilities before Q-Day. He brings 25+ years across software, SaaS, payments and FinTech and holds a BTech (Computer Science), an MBA, an MAS, and a Quantum Computing qualification from MIT.

**Tags:** 

[Knowledge Base,](https://sequre.ch/en/blog/tag/knowledge-base) [Quantum Security,](https://sequre.ch/en/blog/tag/quantum-security) [QDay,](https://sequre.ch/en/blog/tag/qday) [Swiss Banks,](https://sequre.ch/en/blog/tag/swiss-banks) [MigrationComplexity,](https://sequre.ch/en/blog/tag/migrationcomplexity) [Quantum Computing,](https://sequre.ch/en/blog/tag/quantum-computing) [ReadinessSelfAssessment,](https://sequre.ch/en/blog/tag/readinessselfassessment) [FINMA,](https://sequre.ch/en/blog/tag/finma) [PQCRoadmap,](https://sequre.ch/en/blog/tag/pqcroadmap) [MigrationRoadmap](https://sequre.ch/en/blog/tag/migrationroadmap)

![Amit Agarwal](https://sequre.ch/hs-fs/hubfs/AmitAgarwal.jpg?width=120&height=120&name=AmitAgarwal.jpg)

Post by [Amit Agarwal](https://sequre.ch/en/blog/author/amit-agarwal)  
 Oct 26, 2026, 4:52:29 PM

 CEO, SeQure AG · AI-driven crypto inventory & Quantum-Safe Migration for Swiss Banks and FIs · FINMA · DORA · PQC · Q-Day Risk in CHF for Executive Board

[Follow me on my website](https://www.sequre.ch) [Follow me on LinkedIn](https://www.linkedin.com/in/amitagarwal-ch/)

### Related Articles

##### [![A credible PQC roadmap](https://sequre.ch/hs-fs/hubfs/AI-Generated%20Media/Images/Premium%20Quantum%20Cryptography%20Utopia.png?width=520&height=294&name=Premium%20Quantum%20Cryptography%20Utopia.png) Knowledge Base • Oct 16, 2026, 5:35:33 PM A credible PQC roadmap 6 min read](https://sequre.ch/en/blog/a-credible-pqc-roadmap)

##### [![Crypto-agility: what it costs to specify, and what it costs to skip](https://sequre.ch/hs-fs/hubfs/AI-Generated%20Media/Images/Crypto%20Agility%20Infographics%20in%20Swiss%20Bank%20Tech%20Office.png?width=520&height=294&name=Crypto%20Agility%20Infographics%20in%20Swiss%20Bank%20Tech%20Office.png) Knowledge Base • Aug 24, 2026, 4:44:23 PM Crypto-agility: what it costs to specify, and what it costs to skip 7 min read](https://sequre.ch/en/blog/crypto-agility-cost)

## Comments

###### Recent Posts

- [A credible PQC roadmap](https://sequre.ch/en/blog/a-credible-pqc-roadmap)
- [The board approval paper](https://sequre.ch/en/blog/boardpaper)
- [Crypto-agility: what it costs to specify, and what it costs to skip](https://sequre.ch/en/blog/crypto-agility-cost)
- [FINMA 05/2026 Readiness Self-Assessment](https://sequre.ch/en/blog/finma-05/2026-readiness-self-assessment)

[![Sequre Logo\_Hor\_72x212](https://sequre.ch/hs-fs/hubfs/New/Sequre%20Logo_Hor_72x212.png?width=212&height=72&name=Sequre%20Logo_Hor_72x212.png)](https://sequre.ch)

- Stay Connected 
    - [Mail](mailto:info@sequre.ch?subject=Inquiry)
    - [LinkedIN](https://www.linkedin.com/company/sequreag)
- Important Links 
    - [About Us](https://sequre.ch/company#AboutUs)
    - [Contact Us](https://sequre.ch/contact-us)
- Privacy Details 
    - [Data Privacy Statement](https://app.privacybee.io/v/cmirii0su00baqmood8br1jnp?lang=en&type=dsg)
    - [Term of Use](https://sequre.ch/termsofuse)

©2026 SeQure. All rights reserved. [Privacy Policy](https://244153970.hs-sites-na2.com/data-privacy)<https://sequre.ch/privacy-policy>

```json
{
  "@context" : "https://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Amit Agarwal",
    "url" : "https://sequre.ch/en/blog/author/amit-agarwal"
  },
  "dateModified" : "2026-10-26T16:08:36.256Z",
  "datePublished" : "2026-10-26T15:52:29.000Z",
  "headline" : "Two banks, four decisions by Dec 2027",
  "image" : [ "https://sequre.ch/hubfs/AI-Generated%20Media/Images/Two%20Swiss%20Banks%20Quantum%20Cybersecurity%20vs%20Traditional%20Finance.png" ],
  "mainEntityOfPage" : {
    "@id" : "https://sequre.ch/en/blog/decisions-by-dec-2027",
    "@type" : "WebPage"
  },
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "url" : "https://sequre.ch/hubfs/Sequre%20Logo%20Profile%20Image.jpg"
    },
    "name" : "Sequre AG"
  }
}
```