---
title: FINMA 05/2026 Readiness Self-Assessment
description: FINMA Guidance 05/2026 Readiness Self-assessment questionnaire to have a published migration plan by mid 2027
image: https://sequre.ch/hubfs/AI-Generated%20Media/Images/Quantum%20Computing%20Strategy%20Meeting.png
---

[Skip to main content](https://sequre.ch/en/blog/finma-05/2026-readiness-self-assessment#main)

[![Sequre Logo_Hor_72x212](https://sequre.ch/hs-fs/hubfs/New/Sequre%20Logo_Hor_72x212.png?width=212&height=72&name=Sequre%20Logo_Hor_72x212.png) ![Sequre Logo_Hor_72x212](https://sequre.ch/hs-fs/hubfs/New/Sequre%20Logo_Hor_72x212.png?width=212&height=72&name=Sequre%20Logo_Hor_72x212.png) ![Sequre Logo_Hor_72x212](https://sequre.ch/hs-fs/hubfs/New/Sequre%20Logo_Hor_72x212.png?width=212&height=72&name=Sequre%20Logo_Hor_72x212.png) ![Sequre Logo_Hor_72x212](https://sequre.ch/hs-fs/hubfs/New/Sequre%20Logo_Hor_72x212.png?width=212&height=72&name=Sequre%20Logo_Hor_72x212.png)](https://sequre.ch)

- [Show submenu for Solutions Solutions](https://sequre.ch/solutions) 
    - Show submenu for Quantum Safe Security Quantum Safe Security 
      
          - [QuRisc Atlas](https://sequre.ch/solutions#AIRiskTool)
          - [QuRisc Scout](https://sequre.ch/solutions#Crawler)
          - [QuRisc Vantage](https://sequre.ch/solutions#Vantage)
          - [QuRisc Augur](https://sequre.ch/solutions#Augur)
          - [Quantum Safe encryption](https://sequre.ch/solutions#QSE)
          - [Quantum Security Hardware](https://sequre.ch/solutions#QKD)
          - [Quantum Detection System](https://sequre.ch/solutions#QKD)
    - [Consulting](https://sequre.ch/solutions#Consulting)
    - [Quantum Algorithms](https://sequre.ch/solutions#QuantAlgo)
    - [Industries](https://sequre.ch/solutions#Industries)
- [Show submenu for Resource Resource](https://sequre.ch/resources) 
    - [Blogs](https://sequre.ch/en/blog)
    - [Quantum Computing Knowledge Base](https://sequre.ch/resources#QKB)
- [Show submenu for Company Company](https://sequre.ch/company) 
    - [About Us](https://sequre.ch/company#AboutUs)
    - [Management Team](https://sequre.ch/company#Team)
    - [Advisors](https://sequre.ch/company#Advisors)
    - [Partners](https://sequre.ch/company#Partners)
    - [Careers](https://sequre.ch/company#Careers)
    - [Contact](https://sequre.ch/company#Contact-Us)
- [Whats New](https://sequre.ch/whats-new)

Open main navigation

Close main navigation

- Show submenu for Solutions Solutions 
  
    - Solutions
    - [Solutions](https://sequre.ch/solutions)
    - Show submenu for Quantum Safe Security Quantum Safe Security 
      
          - Quantum Safe Security
          - [QuRisc Atlas](https://sequre.ch/solutions#AIRiskTool)
          - [QuRisc Scout](https://sequre.ch/solutions#Crawler)
          - [QuRisc Vantage](https://sequre.ch/solutions#Vantage)
          - [QuRisc Augur](https://sequre.ch/solutions#Augur)
          - [Quantum Safe encryption](https://sequre.ch/solutions#QSE)
          - [Quantum Security Hardware](https://sequre.ch/solutions#QKD)
          - [Quantum Detection System](https://sequre.ch/solutions#QKD)
    - [Consulting](https://sequre.ch/solutions#Consulting)
    - [Quantum Algorithms](https://sequre.ch/solutions#QuantAlgo)
    - [Industries](https://sequre.ch/solutions#Industries)
- Show submenu for Resource Resource 
  
    - Resource
    - [Resource](https://sequre.ch/resources)
    - [Blogs](https://sequre.ch/en/blog)
    - [Quantum Computing Knowledge Base](https://sequre.ch/resources#QKB)
- Show submenu for Company Company 
  
    - Company
    - [Company](https://sequre.ch/company)
    - [About Us](https://sequre.ch/company#AboutUs)
    - [Management Team](https://sequre.ch/company#Team)
    - [Advisors](https://sequre.ch/company#Advisors)
    - [Partners](https://sequre.ch/company#Partners)
    - [Careers](https://sequre.ch/company#Careers)
    - [Contact](https://sequre.ch/company#Contact-Us)
- [Whats New](https://sequre.ch/whats-new)
- [Contact Us](https://sequre.ch/contact-us)

[Contact Us](https://sequre.ch/contact-us)

# FINMA 05/2026 Readiness Self-Assessment

![Amit Agarwal](https://sequre.ch/hs-fs/hubfs/AmitAgarwal.jpg?width=120&height=120&name=AmitAgarwal.jpg)

 by [Amit Agarwal](https://sequre.ch/en/blog/author/amit-agarwal)

Aug 24, 2026, 4:22:46 PM

**Ten questions. Five minutes. One honest answer about where your institution stands.**

On 9 July 2026, FINMA published Guidance 05/2026 on quantum computing. It surveyed 60 Swiss financial institutions and found that **72% had not yet planned or implemented any measures** for quantum-safe encryption, and **only 8% had a specific roadmap**.

FINMA did not create a new rule. It said something more uncomfortable: the technology-neutral, principles-based requirements your institution is *already* subject to cover this risk — and that it will give the topic greater prominence in its ongoing supervisory activities. It recommends a PQC roadmap **by mid-2027 at the latest**.

This self-assessment mirrors FINMA's own five recommendation areas. It is deliberately short, and deliberately hard to answer generously. Answer as you would if your supervisor were asking.

**Scoring:** for each question — **0** = No / not started · **1** = Partially, or in progress · **2** = Yes, and we could evidence it. Maximum score: **20**.

**Section A — Strategy and roadmap**

*FINMA 05/2026, §3.1*

*1. Has your board of directors adopted a strategy that explicitly covers migration to quantum-safe cryptography?*

(It may sit inside an existing cyber-risk strategy — but it must be board-adopted, not an IT initiative.)

*2. Do you have an implementation plan derived from that strategy, with milestones, priorities and named responsibilities — including target dates for migrating critical business processes?*

*3. Will you have a documented PQC roadmap in place by mid-2027?*

(FINMA's recommended date. "We intend to" scores 1; "it is scheduled and resourced" scores 2.)

**Section B — Risk analysis and cryptographic inventory**

*FINMA 05/2026, §3.2*

*4*. Hav*e you analysed your business processes to identify which encryption, signature and authentication technologies they actually depend on?*

*5. Does your cryptographic inventory cover systems that are operated in-house, outsourced \*and\* consumed as a service — including data in transit (VPN, TLS, HTTPS), data at rest, digital signatures, key management and authentication?*

*6. Is that inventory continuously updated to reflect the current situation — rather than a point-in-time snapshot that ages the moment it is signed off?*

(FINMA explicitly links continuous updating to the effectiveness of the measure.)

**Section C — Critical data and "harvest now, decrypt later"**

*FINMA 05/2026, §3.3*

**7.** *Have you identified which of your data requires long-term confidentiality, integrity or non-repudiation — and stated, in years, how long that protection must hold?*

**8.** *Have you assessed your exposure to "harvest now, decrypt later" attacks and prioritised the longest-lived data for early protection, including consideration of hybrid (classical + PQC) approaches?*

**Section D — Crypto-agility**

*FINMA 05/2026, §3.4*

**9.** *Is crypto-agility a stated requirement for systems you procure or develop — that is, can you replace a cryptographic algorithm without major changes to the software architecture?*

**Section E — External service providers**

*FINMA 05/2026, §3.5*

**10.** *Do your new outsourcing and software agreements require crypto-agility or PQC readiness — and have you begun incorporating those requirements into existing arrangements?*

(Responsibility for an outsourced function remains with your institution — FINMA Circular 2018/3.)

**Your result**

**0–5 · \*\*In the 72%\*\***

You are where most of the Swiss market currently sits — FINMA found that 72% of surveyed institutions had not yet planned or implemented any measures. That is context, not comfort: the same guidance says existing operational-risk and resilience requirements already cover this.

***The next two moves:** get a board mandate (even a one-page decision), and start the cryptographic inventory. Everything else in the guidance depends on knowing what you actually run.*

**6–11 · \*\*Decided, but not yet executing\*\***

You are in the 28% who have taken a strategic decision — ahead of the majority, but the gap between decision and roadmap is where mid-2027 will be won or lost.

***The next two moves:** complete the risk analysis and inventory (§3.2), and convert intent into a dated, resourced roadmap. Note FINMA's own finding: institutions that have roadmaps expect **four to five years** until critical data and processes are quantum-safe.*

**12–16 · \*\*On track\*\***

You are meaningfully ahead of roughly nine in ten of your peers. The risk at this stage is not absence of effort but decay: a static inventory, or a roadmap that never reaches the supplier chain.

***The next two moves:** make the inventory continuous rather than periodic, and push crypto-agility into procurement and outsourcing templates (§3.4, §3.5).*

**17–20 · \*\*In the 8%\*\***

You are in the small minority FINMA identified as having a specific roadmap. The useful question is no longer "have we started" but "would this survive scrutiny" — by an auditor, by your board, or by a supervisor now giving the topic greater prominence.

***The next two moves:** independently validate the inventory's completeness (the gaps are usually in as-a-service and legacy interfaces), and stress-test the roadmap's dates against realistic migration durations.*

*The what is now clear — FINMA has set it out in five areas. The how, the when and the with what are the hard part. That is precisely the work we do at SeQure AG: a live cryptographic inventory, an institution-specific risk analysis, a prioritized migration roadmap, a governance framework, and the board-level evidence to go with it.*

*Source throughout: FINMA Guidance 05/2026, "Quantum computing", 9 July 2026. All figures are FINMA's own survey results (60 institutions, November 2025 – January 2026).*

**Tags:** 

[Knowledge Base,](https://sequre.ch/en/blog/tag/knowledge-base) [Blog Post,](https://sequre.ch/en/blog/tag/blog-post) [Quantum Security,](https://sequre.ch/en/blog/tag/quantum-security) [QDay,](https://sequre.ch/en/blog/tag/qday) [Swiss Banks,](https://sequre.ch/en/blog/tag/swiss-banks) [MigrationComplexity,](https://sequre.ch/en/blog/tag/migrationcomplexity) [Shor'sAlgorithm,](https://sequre.ch/en/blog/tag/shorsalgorithm) [RSA2048,](https://sequre.ch/en/blog/tag/rsa2048) [QuantumAdvantage,](https://sequre.ch/en/blog/tag/quantumadvantage) [ReadinessSelfAssessment,](https://sequre.ch/en/blog/tag/readinessselfassessment) [FINMA](https://sequre.ch/en/blog/tag/finma)

![Amit Agarwal](https://sequre.ch/hs-fs/hubfs/AmitAgarwal.jpg?width=120&height=120&name=AmitAgarwal.jpg)

Post by [Amit Agarwal](https://sequre.ch/en/blog/author/amit-agarwal)  
 Aug 24, 2026, 4:22:46 PM

 CEO, SeQure AG · AI-driven crypto inventory & Quantum-Safe Migration for Swiss Banks and FIs · FINMA · DORA · PQC · Q-Day Risk in CHF for Executive Board

[Follow me on my website](https://www.sequre.ch) [Follow me on LinkedIn](https://www.linkedin.com/in/amitagarwal-ch/)

### Related Articles

##### [![From Molecules to the Cosmos — The Real Promise of Quantum Computing](https://sequre.ch/hs-fs/hubfs/AI-Generated%20Media/Images/Futuristic%20Quantum%20Lab%20with%20Floating%20Data%20Screens.png?width=520&height=294&name=Futuristic%20Quantum%20Lab%20with%20Floating%20Data%20Screens.png) Knowledge Base • Jun 23, 2026, 6:17:38 PM From Molecules to the Cosmos — The Real Promise of Quantum Computing 8 min read](https://sequre.ch/en/blog/quantumexplained-4)

##### [![Is AES Really Safe in the Quantum Era?](https://sequre.ch/hs-fs/hubfs/AI-Generated%20Media/Images/Quantum%20Cryptography%20Landscape%20with%20AES%20Lock%20and%20Algorithmic%20Flow.png?width=520&height=294&name=Quantum%20Cryptography%20Landscape%20with%20AES%20Lock%20and%20Algorithmic%20Flow.png) Knowledge Base • Jun 23, 2026, 6:07:08 PM Is AES Really Safe in the Quantum Era? 7 min read](https://sequre.ch/en/blog/quantumexplained-3)

## Comments

###### Recent Posts

- [From Molecules to the Cosmos — The Real Promise of Quantum Computing](https://sequre.ch/en/blog/quantumexplained-4)
- [Is AES Really Safe in the Quantum Era?](https://sequre.ch/en/blog/quantumexplained-3)
- [The Algorithm With Your Encryption's Name On It — How Shor's Algorithm Breaks RSA](https://sequre.ch/en/blog/quantumexplained-2)
- [How a Quantum Computer Actually Computes — The Mathematics Beneath the Magic](https://sequre.ch/en/blog/quantumexplained-1)

[![Sequre Logo_Hor_72x212](https://sequre.ch/hs-fs/hubfs/New/Sequre%20Logo_Hor_72x212.png?width=212&height=72&name=Sequre%20Logo_Hor_72x212.png)](https://sequre.ch)

- Stay Connected 
    - [Mail](mailto:info@sequre.ch?subject=Inquiry)
    - [LinkedIN](https://www.linkedin.com/company/sequreag)
- Important Links 
    - [About Us](https://sequre.ch/company#AboutUs)
    - [Contact Us](https://sequre.ch/contact-us)
- Privacy Details 
    - [Data Privacy Statement](https://app.privacybee.io/v/cmirii0su00baqmood8br1jnp?lang=en&type=dsg)
    - [Term of Use](https://sequre.ch/termsofuse)

©2026 SeQure. All rights reserved. [Privacy Policy](https://244153970.hs-sites-na2.com/data-privacy)<https://sequre.ch/privacy-policy>

```json
{
  "@context" : "https://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Amit Agarwal",
    "url" : "https://sequre.ch/en/blog/author/amit-agarwal"
  },
  "dateModified" : "2026-08-24T14:22:46.612Z",
  "datePublished" : "2026-08-24T14:22:46.000Z",
  "headline" : "FINMA 05/2026 Readiness Self-Assessment",
  "image" : [ "https://sequre.ch/hubfs/AI-Generated%20Media/Images/Quantum%20Computing%20Strategy%20Meeting.png" ],
  "mainEntityOfPage" : {
    "@id" : "https://sequre.ch/en/blog/finma-05/2026-readiness-self-assessment",
    "@type" : "WebPage"
  },
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "url" : "https://sequre.ch/hubfs/Sequre%20Logo%20Profile%20Image.jpg"
    },
    "name" : "Sequre AG"
  }
}
```