Quantum Readiness for Financial Institutions

Quantum computing poses a specific threat to the cryptographic primitives that underpin modern finance. The computers capable of executing that threat do not yet exist at scale.

But the data that would need protection have histories ,and havehistories, vault keys, identity attestations has a long shelf life. An adversary with a future quantum computer could, in theory, decrypt today's traffic retroactively.

This is why NIST's post-quantum standards are being taken seriously not just by cryptographers, but by risk officers at major institutions. The migration has begun.

The mechanics of the threat require a brief explanation, because the timeline is less intuitive than most cybersecurity risks. Today's public-key encryption, the kind that secures bank transfers, interbank communications, and digital signatures across every major financial system, relies on mathematical problems that classical computers cannot solve in any practical timeframe. RSA encryption, for instance, is based on the difficulty of factoring very large numbers. Elliptic curve cryptography, used widely in payment authentication, depends on a related class of hard problems. These systems are secure not because they are unbreakable in principle, but because breaking them would take longer than the useful life of the universe using conventional hardware.

A quantum computer running Shor's algorithm changes that calculation entirely. It can solve the factoring problem that RSA depends on in hours rather than millennia. The cryptographic foundation that the entire global financial system rests on would cease to provide meaningful protection. What makes this threat unusual is that adversaries do not need a quantum computer to begin exploiting it today. They only need access to data that will still be valuable when quantum capability arrives.

This is what security researchers call the harvest now, decrypt later attack vector. A nation state or sophisticated criminal organization intercepts and stores encrypted financial data today, at scale, and waits. Storage costs have fallen dramatically, making archival of vast quantities of encrypted traffic economically feasible at the institutional level. When a sufficiently powerful quantum computer eventually becomes operational, all of that archived data becomes readable in retrospect. A merger negotiation recorded and encrypted in 2026 could be decrypted in 2034, years after the parties assumed it was safely buried. Transaction records subject to regulatory retention requirements spanning seven years or more face the same exposure. Intelligence agencies across multiple countries have now publicly confirmed that harvest now, decrypt later collection is already underway at an industrial scale.

Recent cryptographic research has made the timeline feel more pressing. Three papers published between May 2025 and March 2026 reduced the estimated quantum resources needed to break RSA-2048 encryption from around twenty million qubits to fewer than one million, and in some architectures as low as one hundred thousand. The hardware is not there yet. IBM's current roadmap targets fault-tolerant quantum systems in the coming years, and Google's Willow chip, unveiled in late 2024, demonstrated meaningful progress on error correction at scale. The consensus among researchers and government agencies is that a cryptographically relevant quantum computer, capable of attacking real-world encryption, could exist sometime between the early and mid 2030s. Most enterprise security planning assumes the same range. What that framing obscures is a simple arithmetic problem: the data being harvested today will still be sensitive in the mid 2030s, and cryptographic migrations in the financial sector routinely take seven to ten years to execute end to end.

The migration window is not measured in decades. It is measured in years. And for many institutions, the clock is already behind schedule.

In August 2024, NIST finalized its first three post-quantum cryptography standards after an eight-year international competition involving hundreds of submissions from cryptographers across industry, academia, and government. The three standards are FIPS 203, based on the ML-KEM algorithm for general encryption and key exchange; FIPS 204, based on ML-DSA for digital signatures; and FIPS 205, an alternative signature standard. In March 2025, NIST added a fourth algorithm, HQC, as a backup for ML-KEM based on different mathematical foundations, providing insurance against the possibility that a weakness is later found in lattice-based approaches. A draft standard incorporating HQC is expected in early 2026 with finalization in 2027.

These standards represent the first time the global cryptographic community has had a stable, tested baseline for quantum-resistant encryption. The question has shifted from what algorithms to use to how to deploy them across systems that were designed with a completely different cryptographic foundation, at scale, without disrupting the services that global finance depends on.

That question landed on the agenda of G7 finance ministers and central bank governors in January 2026 when the G7 Cyber Expert Group, co-chaired by the US Department of the Treasury and the Bank of England, published a coordinated roadmap for the financial sector's transition to post-quantum cryptography. The document does not set binding regulatory requirements. What it does instead is establish a shared planning framework across all G7 jurisdictions, treating quantum-safe migration as a systemic risk management issue rather than an optional technology upgrade. The co-chairs stated plainly that the introduction of quantum computers capable of breaking today's encryption could fundamentally undermine trust in the global financial system if institutions are not prepared.

The roadmap lays out six overlapping transition phases. The first two, awareness and preparation and discovery and inventory, are where most institutions still sit in 2026. Awareness means executive-level ownership of quantum risk, not just a security team concern. Inventory means knowing precisely where cryptography lives across every system, every vendor relationship, every protocol, and every data store. That second task is more difficult than it sounds. Most large financial institutions have cryptographic dependencies embedded across decades of legacy infrastructure, third-party payment processors, cloud providers, clearing networks, and counterparty connections. Mapping all of it is a project of considerable scale before any migration work begins.

The subsequent phases move through risk assessment and planning, migration execution, testing, and finally ongoing validation. The G7 explicitly notes that these phases are not linear. Organizations must run multiple workstreams in parallel, and they must build the capacity to change course as standards evolve. The overall migration window that G7 guidance points toward is 2030 to 2035, with 2035 cited as a commonly referenced outer limit in aligned national guidance. The European Union set end of 2026 as its first milestone for beginning transition, with 2030 as the deadline for high-risk financial use cases.

One concept runs through every layer of the G7 framework and through every serious institutional response to this problem: cryptographic agility. This is the organizational capacity to change cryptographic algorithms, key types, and protocols without redesigning the systems they protect. A financial institution that treats post-quantum migration as a one-time upgrade from RSA to ML-KEM will find itself repeating the exercise as standards evolve and as new vulnerabilities are discovered. The G7 is explicit that agility, not any particular algorithm, is the durable objective. Building systems that can be updated through configuration and interface changes rather than ground-up reconstruction is a design philosophy as much as a security requirement.

Some institutions are further along than others. JPMorgan Chase has established what it calls a quantum-secured crypto-agile network connecting its data centers over deployed fiber, a tangible piece of post-quantum infrastructure already in operation. The bank has been a participant in NIST's National Cybersecurity Center of Excellence migration project alongside other major firms, working through the practical challenges of deploying quantum-resistant algorithms in production financial environments. Goldman Sachs has maintained active quantum computing partnerships, and several European central banks have begun their own cryptographic inventory exercises in response to the EU roadmap.

Most institutions, however, are still in the early stages. A 2025 ISACA survey found that only five percent of cybersecurity professionals had defined a formal strategy for addressing the quantum threat, despite two thirds of respondents expressing concern about quantum's eventual ability to break encryption. That gap between stated concern and operational preparation is precisely the problem the G7 roadmap is trying to close by framing the migration timeline at the executive and regulatory level rather than leaving it to security teams to advocate for internally.

There is also a deadline with real teeth for institutions that operate within or alongside US national security infrastructure. The NSA's Commercial National Security Algorithm Suite 2.0 requires that all new national security system acquisitions be compliant with quantum-resistant standards by January 1, 2027, with full mandatory compliance across most system types by 2033. For financial institutions with government contracts or national security system connections, that deadline is not a planning exercise. It is a hard requirement. CISA published its list of quantum-safe product categories for technology acquisition in January 2026, and TLS 1.3 adoption across government-connected systems is required by 2030.

One sector within finance carries a specific and unusual vulnerability. Blockchain networks, including Bitcoin and most major public ledgers, store their entire transaction histories in a publicly accessible and permanent format. The cryptography protecting those records cannot be deleted or retroactively replaced. If a sufficiently powerful quantum computer arrives, historical blockchain transaction data becomes permanently exposed with no possibility of remediation. A Federal Reserve study has flagged this risk explicitly, noting that the immutability that makes blockchain valuable from a ledger integrity standpoint is precisely what makes it so difficult to protect against retroactive quantum attack. Quantum-resistant blockchain infrastructure is being developed, but the transition challenges for public networks are considerably more complex than for private institutional systems.

For risk officers sitting down to build a quantum readiness program today, the G7 framework offers practical direction. It starts with governance: elevating quantum risk to board and C-suite visibility, establishing clear ownership, and securing multi-year budget commitment for what is not a short or inexpensive project. It continues with inventory: building a cryptographic bill of materials that maps every algorithm in use, every key and certificate dependency, every vendor that handles cryptographic functions on the institution's behalf. That inventory informs risk prioritization, and risk prioritization determines sequencing: long-lived data with high sensitivity, externally exposed services, and systems that touch payment settlement move first. Less critical internal applications provide a place to build experience before the stakes are highest.

The algorithms exist. The standards are final. The regulatory signal from G7 governments is as clear as guidance documents get without being regulations. What is still missing at most institutions is the organizational infrastructure to execute: the internal expertise, the vendor coordination, the testing environments, and the governance processes that a migration of this complexity requires.

The threat is not arriving next quarter. But the migration cannot begin next quarter either, which is the point every major standards body, intelligence agency, and financial regulatory group has now converged on. The quantum computer that breaks RSA does not need to exist yet to create risk. It only needs to exist eventually, and the data flowing through financial systems today needs to still be protected when it does.

The harvest has already begun. The question for every institution in 2026 is not whether to prepare, but whether the preparation is moving fast enough.to be stillbecomes available, historical blockchain transaction data will bethe ,,end-to-end