October 2026: Regulators Moved From Warnings to Expectations. What Changed for Financial Institutions.

· Industry · 5 min read

The short version

A year ago most supervisors talked about quantum as a future risk. This autumn the language moved to expectations: a board-approved roadmap, a cryptographic inventory, a plan for vendors. None of it is a hard migration deadline for banks yet. All of it points the same way.

Switzerland: a roadmap by mid-2027

FINMA's Guidance 05/2026 (9 July 2026) applies to all supervised institutions: banks, insurers, asset managers and market infrastructure. It does not create a new rule; it explains how existing governance and operational-resilience requirements cover post-quantum risk. The concrete ask is a board-approved post-quantum strategy or roadmap by mid-2027 at the latest, with priorities and target dates for critical processes.

It names five building blocks: strategy, a cryptographic inventory kept continuously up to date, priority for long-lived data and harvest-now-decrypt-later exposure, crypto-agility, and post-quantum requirements in vendor contracts. FINMA's own survey of 60 institutions found only 8% had a roadmap.

UK and Singapore compare notes

At the 11th UK-Singapore Financial Dialogue in October, HM Treasury, MAS, the Bank of England and the FCA discussed their approaches to quantum security: supervisory expectations for moving to quantum-safe technology, the NCSC's migration guidance, and lessons from MAS's quantum key distribution sandbox. It was an exchange of views, not a new commitment, but two of the most watched financial centres are now comparing notes on supervision rather than research.

Still pending: MAS and RBI

  • MAS has said it will issue formal supervisory expectations covering inventory, prioritisation and execution, aiming for quantum resilience before 2030. As of today they have not been published. Banks in Singapore already face CSA's dated milestone for critical infrastructure owners: a migration plan by 31 March 2027.
  • RBI's Q-SAFE committee, formed on 25 May 2026, was given six months from its first meeting to report. Its mandate includes crypto-agility, the most vulnerable systems and a CBOM-style view of the sector's cryptography, so expect inventory to feature.
  • IRDAI has already moved: its 2026 guidelines ask insurers to keep an up-to-date cryptographic inventory. [Read our IRDAI explainer →](/blog/irdai-2026-insurers-cryptographic-inventory)

In the US, the federal clock is running

OMB memorandum M-26-15 (24 June 2026) gave federal civilian agencies 120 days to file post-quantum migration plans, which put the deadline in the second half of October. It binds agencies, not banks, but agencies are customers and counterparties, and the order behind it also starts rulemaking for federal contractors by the end of 2030.

On the hardware side

On 19 October Quantinuum reported a logical fidelity of 99.9995% on its Helios system, which it says is ten times better than its own September record and within the target range for Apollo, the fault-tolerant machine it plans for 2029. Separately, Iceberg Quantum published new resource estimates for breaking RSA-2048 with QLDPC codes, in the range of tens of thousands of physical qubits under optimistic error rates. Both are company claims and neither is a break. Both say the same thing as the regulators: the estimates keep falling, so the inventory and the plan should not wait.

What this means in practice

  1. Have a roadmap the board has seen. FINMA set mid-2027; others will set their own. A roadmap needs an inventory under it.
  2. Make the inventory continuous. FINMA, IRDAI and CSA all say up to date, not one-off.
  3. Bring vendors in. Every framework this autumn names third parties.
  4. Prioritise by data lifetime. Long-lived confidential data first; signatures on a separate track.

Qypher keeps a current cryptographic inventory across your perimeter, code, cloud and binaries, maps it to the regulators that apply to you, and generates the post-quantum migration artifacts your team deploys. Run a free scan →

Sources: FINMA Guidance 05/2026 (9 July 2026), as summarised by EY Switzerland; 11th UK-Singapore Financial Dialogue joint statement (October 2026), reported by The Quantum Insider; RBI press release on Q-SAFE (25 May 2026); MAS annual report media conference remarks (2026); OMB M-26-15 (24 June 2026); Quantinuum press release (19 October 2026); Iceberg Quantum Pinnacle 1.2, reported by Quantum Computing Report. Company claims are as reported by the companies.