SIX Group's Post-Quantum Security Post: What Switzerland's Payments Backbone Is Actually Doing

On 9 April 2026, SIX Group published a blog post titled "Quantum Computers and Post-Quantum Security: How the Swiss Payment Transactions System Is Protecting Itself," co-authored by Christian Bühler, Senior IT Security & Compliance Officer at SIX. It is not a regulatory circular. SIX is not a government body. But SIX operates the infrastructure that clears and settles nearly every Swiss franc payment and Swiss-listed security trade, and its own account of analysing where cryptography sits in its systems, "from interfaces, through to protocols and hardware security modules," is one of the most concrete, dated PQC disclosures to come out of Switzerland's financial sector so far, three months before the country's actual regulator weighed in.

Why SIX matters here even though it isn't a regulator

SIX Group is the entity behind several pieces of infrastructure that most people interacting with Swiss finance never see directly. It operates the SIX Swiss Exchange, the country's primary stock exchange, and the SIC system, the real-time gross settlement system for Swiss franc payments. As SIX's own post puts it: "Monitored and steered by the Swiss National Bank, the SIC system is operated by SIX as Switzerland's most important payment system." In practice, SIX sits underneath both cash payments and securities trading in Switzerland at the same time, a concentration of function that a single commercial company in most other markets would not hold. If SIX's cryptography were compromised, whether today through a conventional attack or years from now through a cryptographically relevant quantum computer decrypting data harvested today, the blast radius would extend across the entire Swiss payment and securities settlement chain, not just one bank's ledger. That systemic position is exactly why a technical blog post from SIX's own compliance staff is worth reading as closely as an actual regulatory document, even though it carries no legal force.

What the post says, in more detail

The post opens with as direct a statement of stakes as a financial-infrastructure operator is likely to publish: "Post-Quantum Cryptography is especially important in payment transactions since this sector is largely dependent upon cryptographic methods." It then lays out the harvest-now-decrypt-later threat model explicitly: "Hackers can copy encrypted data such as payment transactions, trading transactions, or archived files today, store it for the time being, and decrypt it later with quantum means." That framing, encrypted data intercepted or exfiltrated now becomes readable retroactively once a sufficiently powerful quantum computer exists, is the same threat model driving PQC mandates everywhere else in this tracker, and SIX states it without hedging.

On what SIX says it is actually doing, the post describes an inventory-style review: "Critical infrastructure operators such as SIX analyze where cryptographic techniques are implemented within their systems, from interfaces, through to protocols and hardware security modules." That is a broad description rather than a system-by-system list, no specific interface or HSM model is named, but the three-layer framing (interfaces, protocols, hardware security modules) signals a review that goes beyond a paper exercise and into the physical key-management layer. The post also states that systems are being "analyzed with regard to crypto-agility in order to allow a smoother replacement of cryptographic components in the future," and describes an intended hybrid mode, running post-quantum algorithms alongside existing traditional ones, with full replacement anticipated over time rather than a hard cutover.

On standards, the post names three NIST algorithms directly: FIPS 203 (ML-KEM) for key exchange, and FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) for digital signatures, all finalized by NIST in August 2024. On timeline, Bühler writes that "NIST has already declared a number of standard methods as no longer recommended for 2030, and assessed them as no longer permitted effective 2035," without specifying which legacy algorithms fall under each date. What the post does not contain is a phased migration roadmap with named milestones, target systems, or internal deadlines; it describes analysis, crypto-agility preparation, and an intent to follow "a step-by-step migration that incorporates the regulatory requirements, industry recommendations" (citing SwissBanking as an industry source), which reads as a stated intention to migrate rather than a published plan with dates SIX has committed itself to publicly.

How this compares with FINMA's actual guidance

Three months after SIX's post, on 9 July 2026, Switzerland's actual financial regulator acted. FINMA (Eidgenössische Finanzmarktaufsicht) published FINMA Guidance 05/2026 on quantum computing, based on a survey of 60 Swiss financial institutions — banks, insurers, managers of collective assets, and financial market infrastructures — conducted at the end of 2025. Its headline finding: "Only 8% of respondents have a specific roadmap for quantum-safe encryption," while "around two-thirds of the institutions surveyed by FINMA expect to be directly affected by the cyber risks posed by quantum computing within seven years."

FINMA's language throughout is recommendation, not requirement. It "recommends that a PQC roadmap be drawn up by mid-2027 at the latest," and separately recommends that the work "be based on a strategy adopted by the board of directors, from which an implementation plan setting out milestones and priorities is derived" — the board sign-off attaches to the strategy, not to the roadmap deadline. On suppliers, it recommends "that crypto-agility be made a prerequisite for all new outsourcing arrangements in the software and data sectors," with existing arrangements to be brought into line "at the earliest opportunity." The guidance names the harvest-now-decrypt-later risk directly and cites NIST's FIPS 203/204/205 standards.

Notably, FINMA's guidance does not name SIX Group, and SIX's blog post does not reference FINMA. The two sit side by side rather than one citing the other: SIX is a financial-market-infrastructure operator that FINMA's mid-2027 roadmap recommendation would itself apply to, describing its own preparatory work three months before its regulator recommended the sector at large draw one up. Read together, they show a Swiss financial sector where at least one systemically important operator was already doing inventory-style analysis before the supervisory push landed, which is a healthier sequence than the alternative, but it's one data point, not evidence the rest of the sector was moving at the same pace; FINMA's own 8%-have-a-roadmap survey finding says otherwise for the sector overall.

What SIX's post does not establish

It is worth being precise about what this blog post is and isn't. It is not a FINMA circular, it carries no compliance deadline, and it names no penalty or audit mechanism, because SIX is not a supervisory body and was not attempting to act as one. It also stops short of publishing an actual migration plan: there is no named target date for completing SIX's own transition, no list of which specific systems have been migrated versus merely analyzed, and no public commitment to a hybrid-then-full-PQC timeline with milestones. What it does establish is that a systemically important piece of Swiss financial infrastructure was engaged with FIPS 203/204/205, crypto-agility, and harvest-now-decrypt-later well before its regulator's formal guidance existed, and was willing to say so on the record with a named compliance officer's byline.

How this fits with other countries and regulators

Switzerland's primary scored source on this tracker is FINMA Guidance 05/2026, non-binding supervisory guidance with a mid-2027 roadmap deadline; see the Switzerland country page for the full scoring breakdown. SIX Group's post sits alongside that as critical-infrastructure-operator disclosure rather than government regulation, a distinction worth keeping straight when comparing Switzerland to jurisdictions like India, where the RBI's Q-SAFE committee and SEBI's CSCRF framework are actions taken directly by statutory regulators rather than by the market infrastructure they supervise. Both patterns, regulator-led and operator-led, are showing up as this tracker covers more countries, and both are worth tracking since a systemically important operator moving early can be as informative a signal as a regulator's own deadline.

Primary source: SIX Group, "Quantum Computers and Post-Quantum Security: How the Swiss Payment Transactions System Is Protecting Itself" (9 April 2026, updated 7 May 2026). Additional sources: FINMA, Guidance 05/2026 on Quantum Computing (9 July 2026); SIX Group corporate overview and SIC system description; NIST, FIPS 203, 204, and 205 post-quantum cryptography standards (August 2024).