DuoKey

Quantum Compliance in Switzerland and the EU

Research report. 10 pages, July 2026.

Two parts. A summary of recent post-quantum supervisory items, including FINMA Guidance 05/2026, which expects a cryptographic inventory and roadmap by mid-2027. And a measurement of 21 anonymised Swiss financial institutions. Their average score is 62, eight use hybrid ML-KEM, and twelve are classical only. Download it to see how Swiss peers score, and use the eight-week inventory outline to get ahead of FINMA's mid-2027 expectation.

Cover of the July 2026 research report, Quantum Compliance in Switzerland and the EU.

Get the download

Tell us where to send the link. A business email is required.

DuoKey uses these details only to send the download link. Privacy notice

FINMA now expects a cryptographic inventory and roadmap by mid-2027. Of 21 Swiss financial institutions measured, twelve still rely on classical cryptography only.

The first part summarises June 2026's post-quantum supervisory items, with what each one asks for and by when. The second part scores the 21 institutions from their public websites, from 84 at the top to 33 at the bottom, based on key exchange, TLS version, and forward secrecy.

Then it gives you a way forward: an eight-week outline for building your cryptographic inventory. Download it to see where your peers stand and how to get ahead of FINMA's deadline.

FAQ

Who is this for?

Security, risk, and compliance staff at Swiss and EU financial institutions.

Who was measured?

21 Swiss retail, cantonal, private, and wealth banks, measured between 3 and 15 July 2026 on their public corporate websites. Online-banking systems were not measured. Names are removed.

Which regulatory items does it cover?

FINMA Guidance 05/2026, the European Commission's June roadmap, an ENISA draft on NIS2 evidence, and an EBA question on DORA Article 9.

What is in it besides the scores?

An eight-week outline for building a cryptographic inventory.

Is it an audit or legal advice?

Neither. The score reads only what is visible from outside. Internal PKI, HSMs, and suppliers are out of scope.