Post-Quantum Requirements in Switzerland
FINMA published Guidance 05/2026 on July 9, 2026, after surveying 60 supervised institutions about quantum risk. It asks each institution to adopt a post-quantum strategy approved by its board, then set an implementation plan with milestones, priorities and target dates. FINMA recommends that institutions prepare a post-quantum roadmap by mid-2027.
FINMA does not require an immediate migration. It considers its existing principles on governance and risk management to cover quantum risk already, and it has said it will monitor the topic in supervision. In this course, we cover what the guidance expects, how it connects to FINMA’s existing rules and federal guidance, and the evidence that shows your institution is on track.
Course Outline
Module 1. What Regulators Everywhere Ask For (30 minutes)
Organizations face post-quantum requirements through government mandates, supplier obligations, critical infrastructure rules, sector supervision, and pressure from customers and insurers. Regulators in every jurisdiction ask for the same core evidence, from an accountable owner and a cryptographic inventory to a dated roadmap and progress reports. We cover NIST’s FIPS 203, 204 and 205 and compare FINMA’s expectations with those of supervisors in the EU, the UK and Singapore.
Module 2. Swiss Requirements in Detail (60 minutes)
We work through FINMA Guidance 05/2026. That covers the board-approved strategy, the mid-2027 roadmap, and the risk analysis of business processes, ICT systems, applications and outsourced services. It also covers the cryptographic inventory, migration priorities for data that needs long-term protection, and FINMA’s view of hybrid schemes. We explain FINMA’s expectation of crypto-agility in new systems and outsourcing contracts, and why distributed ledger technology is in scope. We show how the guidance connects to FINMA’s existing rules, including Circular 2023/1 on operational risks and resilience for banks. We also cover the 2024 assessment of post-quantum cryptography by Switzerland’s National Cyber Security Centre, and the data security duty in the revised Federal Act on Data Protection. Swiss firms with EU subsidiaries or EU clients learn which parts of DORA, NIS2 and the Cyber Resilience Act apply to them.
Module 3. Demonstrating Compliance in Switzerland (30 minutes)
We cover what FINMA and your regulatory audit firm will ask to see. That includes the approved strategy, the roadmap, the cryptographic inventory and the priority ranking of data that needs long-term protection. It also includes crypto-agility clauses in outsourcing contracts and regular progress reports. You map the work to FINMA’s operational resilience requirements and ISO/IEC 27001, and learn to report progress to your board.
Prerequisites
None. Post-Quantum Foundation explains the threat and the algorithms if you want that background first.
Who this course is for
CISOs, compliance officers, risk managers, legal counsel and migration program managers at Swiss banks, insurers, asset managers and financial market infrastructures. Also useful for DLT and digital asset firms, and for technology and outsourcing providers that serve Swiss financial institutions.
What you’ll be able to do afterward
- Explain what FINMA Guidance 05/2026 expects of your institution, and which existing FINMA rules it relies on
- Draft a post-quantum strategy for board approval, and a roadmap ready by mid-2027
- Scope the risk analysis across processes, systems, outsourced services and distributed ledgers
- Rank data by how long it needs protection, and set migration priorities
- Write crypto-agility requirements into procurement and outsourcing contracts
- Report progress to your board, to FINMA and to your regulatory audit firm
What you leave with
When you finish, we email you the course handbook, a PDF of every slide with notes that explain it in full. It includes a reference table of the Swiss and EU instruments covered, with their dates and sources. We also include a PDF copy of Quantum Ready. The handbook is yours to keep.
Enrollment includes 180 days of access to the online on-demand course. Where that course is not yet published, the 180 days start on the day it is.
Where this course fits
You can take this course on its own. If you also operate in the EU, add PQC Compliance: European Union, or take PQC Compliance: Global Overview for every jurisdiction in one session. Banks should continue with Quantum-Safe Financial Services, insurers with Quantum-Safe Insurance, and DLT firms with Quantum-Safe Digital Assets. In PQC for GRC Professionals, you map the requirements into controls and audit evidence.
Why we teach this
We built the course on Quantum Ready, the book on organizational readiness written by the course author, and on the Applied Quantum PQC Migration Framework, published openly under Creative Commons. Our faculty runs migration programs and follows each Swiss instrument as FINMA and federal authorities issue it. We revise the course when a regulator issues or changes a rule.
Certificate of Completion
Upon completion, you receive a Quantum Academy certificate of completion. It confirms that you completed the course and is separate from Quantum Academy’s professional certifications.
About this program
Quantum Academy credentials are private professional credentials issued by Quantum Academy, a trade name of Post-Quantum Institute. They are not government-issued licenses, accredited degrees, or academic credit, and earning one does not guarantee employment, promotion, regulatory approval, or any other specific outcome.
Quantum Academy programs are educational and informational only, and are not legal, compliance, or engineering advice.
