Taiwan's FSC Publishes a Financial-Sector PQC Migration Guide, With a Real Regulator's Name on It

On 18 June 2026, Taiwan's Financial Supervisory Commission (金融監督管理委員會, FSC) published the "Post-Quantum Cryptography Migration Reference Guide for the Financial Industry" (金融業後量子密碼遷移參考指引), a document that lays out seven strategic directions and a 2026-to-2035 migration timeline for the country's banks, securities firms, and insurers. FSC frames it explicitly as a reference guide, not a binding rule, but it is the first PQC-specific document to come directly from the regulator that actually supervises Taiwan's banking, securities, and insurance sectors, which sets it apart from the industry-alliance guideline that has so far been Taiwan's only scored source on this tracker.

What FSC actually published

FSC's press release states the guide's purpose directly: to help financial institutions respond to the cybersecurity risks that quantum computing may eventually pose, and to serve as a reference for the industry's PQC migration preparedness. The guide covers seven areas: governance mechanisms, cryptographic technology inventory, crypto-agility, ecosystem collaboration, risk prioritization, supply chain management, and testing and cutover. FSC says the goal is to let institutions prepare in a risk-based, progressive manner rather than treating migration as a single cutover event.

This builds on FSC's own prior work. At the end of ROC year 114 (late 2025), FSC had already published a "Financial Cybersecurity Resilience Development Blueprint" (金融資安韌性發展藍圖) that listed post-quantum cryptography migration as one of its priority items. The June 2026 guide is the detailed follow-through on that earlier commitment, not a standalone announcement.

The threats it names, in FSC's own terms

The guide explicitly names both quantum threats this tracker's methodology treats as the baseline case for regulatory relevance:

• "Harvest now, decrypt later" (先攔截、日後解密, HNDL): intercepting encrypted data today so it can be decrypted once quantum computing matures.
• "Trust now, forge later" (現在信任、稍後偽造, TNFL): digital signatures and certificates that are trustworthy today but could be forged once quantum computing breaks the underlying algorithms.

FSC ties both threats directly to financial-sector specifics: authentication, transaction signing, cross-institution interfacing, and data protection, the mechanisms Taiwan's financial services rely on most heavily.

The seven strategic directions, in full

FSC's press release enumerates all seven, and it's worth reading them in full rather than stopping at the first one, since the substance is spread across all seven and a few (four, five, six) contain the most concrete operational detail:

1. PQC policy and governance. Migration is described as a multi-year, cross-departmental undertaking. Institutions are told to elevate quantum risk to the board level as a strategic enterprise-risk matter, and to form a cross-departmental "post-quantum migration working group" convened by the CISO, CIO, or an equivalent-level executive, with clearly assigned authority and responsibility.

2. Inventory cryptographic technology and build a Cryptographic Bill of Materials (CBOM). The inventory must be maintainable and linked to business use cases and external dependencies, not a one-time snapshot. FSC recommends scoping the initial inventory by risk and priority, then expanding coverage progressively, prioritizing quality over completeness, and evaluating AI-assisted automation tools to help build and maintain the CBOM.

3. Improve crypto-agility, prioritizing the removal of "cryptographic anti-patterns." Because PQC standards and products are still evolving, FSC explicitly advises against treating migration as a one-time algorithm swap. Institutions should build crypto-agility, the ability to change algorithms and parameters through routine updates rather than large re-engineering projects, and prioritize fixing anti-patterns such as manually managed TLS certificates, weak cipher suites, and hardcoded keys or certificates.

4. Build ecosystem collaboration and a shared business risk map. Given how interconnected Taiwan's financial ecosystem is, the guide proposes a "four-tier" model in which hub institutions, named examples include the Financial Information Service Co. (財金公司) and the Taiwan Stock Exchange, coordinate cross-institution alignment, draft an ecosystem migration roadmap, and operate cross-institution collaboration mechanisms. Representative institutions would first propose a common inventory framework and risk map for others to follow.

5. Establish risk-based migration prioritization. FSC recommends scoring on two axes, a "quantum risk score" and a "migration time score," combining them to group systems by risk level and migration difficulty, and using that to set relative migration priority and resource allocation, including any ecosystem-level deadlines as constraints. The output should be an executable, phased, verifiable, and continuously updatable migration roadmap.

6. Update procurement and supply chain management requirements. Institutions should build PQC readiness and crypto-agility directly into procurement, outsourcing, and contract management: surveying key vendors' PQC readiness, updating procurement specifications and acceptance criteria, revising contracts and outsourcing agreements for responsibility and service-level terms, establishing early handling for components that become migration blockers, and building shared supply-chain verification mechanisms.

7. Establish testing, cutover, and operational resilience mechanisms. FSC frames this as the deciding factor for whether PQC or hybrid-mode adoption can go live safely: testing governance, cutover strategy, rollback drills, and observability. Institutions are told to institutionalize these into a repeatable, auditable evidence chain to reduce the risk of service interruption, interoperability failure, and exception handling during migration.

The timeline: 2026 through 2035

FSC's press release sets out a phased timeline, explicitly referencing NIST, G7, and FS-ISAC migration roadmaps and the trajectory of international standards development as its reference points:

• Short-term (2026 to 2027): build governance structures, inventory methods, the cryptographic technology inventory, and crypto-agility foundations.
• Mid-term (2027 to 2029): run pilot verification, upgrade infrastructure, and build shared testing mechanisms.
• Mid-to-long-term (through 2035): migrate high-risk and highly critical systems first, then progressively expand the scope of migration.

That is a specific, named timeline running to 2035, considerably more concrete than most reference-guide-style PQC documents this tracker has reviewed elsewhere. It is not, however, phrased as a compliance deadline with penalties attached; it's presented as FSC's own recommended pacing for the industry to follow.

Advisory, not binding, and FSC says so directly

This point matters enough to state plainly: FSC's press release repeatedly uses the language of a reference guide (參考指引) rather than a binding directive. FSC states that the current phase's main purpose is to drive institutions and key suppliers to plan and prepare early, and that FSC will continue to focus on three tracks going forward, ecosystem alignment (driven by hub institutions), shared supply-chain survey and tracking mechanisms, and pilot verification and experience-sharing. FSC also says it will keep the guide under rolling review as domestic and international technical developments, standards, and financial-industry practice evolve.

Nothing in the press release states that following the guide is legally mandatory, that non-compliance carries a penalty, or that FSC will audit institutions against it the way it would a binding directive or regulation. This tracker records the guide as advisory guidance from a supervisory regulator, not as a binding mandate, absent confirmation otherwise. If FSC later folds any of this guide's requirements into a binding directive or examination standard, that would be a materially different, and more significant, development, and this page will be updated if that happens.

Who it covers

The guide is addressed to Taiwan's FSC-regulated financial industry broadly, banks, securities firms, and insurers, consistent with FSC's supervisory remit across its Banking Bureau, Securities and Futures Bureau, and Insurance Bureau. The press release does not carve out a narrower population (for example, only systemically important institutions); the seven strategic directions are addressed to the industry as a whole, with the ecosystem-collaboration direction singling out "hub institutions" like the Financial Information Service Co. and the Taiwan Stock Exchange for a coordinating role rather than a narrower compliance scope.

Notably, FSC's press release names no specific algorithms. There is no reference in it to ML-KEM, ML-DSA, or lattice-based cryptography; the only technical anchoring is to NIST, G7, and FS-ISAC roadmaps as the international context the guide aligns with. That is consistent with the announced logic of strategic direction three: because standards are still evolving, FSC steers institutions toward crypto-agility rather than naming a single target algorithm.

This is a statement about the announcement, not about the full guide attached to it. Everything above is drawn from the press release text, which is what we have verified directly.

Why this is different from Taiwan's other PQC guideline

Taiwan's country page has, until now, scored the country almost entirely on a separate document: the "Post-Quantum Cryptography Migration Guidelines" (後量子密碼遷移指引), published in April 2025 by the Post-Quantum Cybersecurity Industry Alliance (後量子資安產業聯盟) and the Institute for Information Industry (資策會), with the Ministry of Digital Affairs' Administration for Digital Industries (ADI/數位產業署) named only as a supporting sponsor, not the publishing authority. That guideline scores 20/100 on this tracker precisely because it's non-binding, has no deadline, and comes from an industry alliance that ADI merely supports rather than enforces.

The FSC guide is a different kind of document in a way that matters for how much regulatory weight it should carry. FSC is not an industry alliance and not a sponsor: it is Taiwan's actual financial regulator, the body with statutory supervisory authority over the banks, securities firms, and insurers this guide addresses, the same regulator that issues FSC's binding orders and conducts examinations of regulated entities. A reference guide published directly by the supervisor that licenses and examines these institutions carries more practical weight than one published by an alliance a ministry merely supports, even when both documents use non-binding language. It is also considerably more detailed than the ADI guideline: seven strategic directions instead of four steps, a named 2026-2035 timeline instead of no deadline at all, and financial-sector-specific framing (interoperability, high-availability constraints, cross-institution dependencies) instead of a generic roadmap.

That said, this tracker's scoring methodology weighs binding force heavily, and FSC's own language does not claim binding force for this guide. Readers should treat the FSC guide as a materially more authoritative and more detailed advisory document than Taiwan's prior guideline, without over-reading it as a mandate FSC has not yet made it.

How this fits with other regulators and countries

FSC's approach, a detailed advisory reference guide from the actual financial regulator, with a named multi-year timeline but no binding compliance deadline, sits in an interesting middle position compared to how other jurisdictions on this tracker have approached PQC migration. It's more detailed and more sector-specific than Taiwan's own ADI-sponsored guideline, but it's not yet the binding master-direction-style regulation that India's RBI is expected to eventually produce through its Q-SAFE committee, nor is it a single in-force clause like SEBI's CSCRF cryptographic-inventory requirement, which is narrower in scope but already legally binding today. See the Taiwan country page for how this tracker scores the combination of both Taiwan documents together.

Primary source: FSC, "金管會發布「金融業後量子密碼遷移參考指引」引導金融機構強化量子風險整備" (18 June 2026). Related: MODA/ADI, "後量子密碼遷移指引" v1.00 (16 April 2025).