Quantum computing

Since the start of 2026, authorities and industry bodies have given the financial sector’s transition to quantum-resistant cryptography a clearer operational shape, marking a shift from awareness-raising towards operationalizing the roadmap to quantum resilience. At the same time, industry feedback continues to highlight practical constraints, including hidden cryptography, legacy infrastructure, long data-retention periods, vendor dependencies, evolving standards, and competing cyber-resilience priorities.

At global level, publications issued since the start of 2026 have addressed both the organisation of post-quantum migration and the current state of industry preparedness. In January, the G7 Cyber Expert Group, which advises G7 finance ministers and central bank governors on cybersecurity matters, published a non-prescriptive roadmap for the financial sector's transition to post-quantum cryptography. The roadmap is intended to provide financial authorities, institutions, market infrastructures, critical service providers and technology vendors with a shared reference for migration planning and coordination, rather than establish regulatory requirements. It groups migration activities into six broad phases:

The roadmap treats governance and risk management, management of external dependencies and stakeholder dialogue as continuing activities throughout the transition. It also provides an indicative planning horizon: 2035 is identified as a broad reference point for overall migration, while institutions may address their most critical systems during 2030?32. These dates are described as non-authoritative and subject to adjustment as the threat environment, standards and implementation experience evolve.

In May, the G7 Central Bank Quantum Technologies Working Group, co-chaired by the Banque de France and the Bank of Canada, published Preparing for Quantum Technologies: Key Considerations for Financial Sector Participants. The report provides a broader assessment of quantum-related security risks and potential financial applications. On cryptographic security, it describes post-quantum cryptography as a central component of the transition while noting that implementation involves more than replacing existing algorithms. Relevant considerations include larger keys and signatures, performance effects, integration with legacy systems, interoperability across institutions and the parallel operation of conventional and quantum-resistant systems during the migration period. It also examines complementary approaches, including distributed symmetric key exchange and quantum key distribution, and records their different maturity, infrastructure, scalability, cost and governance characteristics.

The industry perspective was set out in the World Federation of Exchange's (WFE) January report, Regulatory Signals and Industry Perspectives on Quantum Computing Preparedness. The WFE drew on regulatory developments and preliminary feedback from members of its Global Cybersecurity Working Group. Respondents generally regarded a cryptographically relevant quantum computer as a five-to-ten-year or longer-term prospect. Awareness was increasing, but deep technical preparedness remained limited, and firms continued to allocate greater attention and resources to more immediate concerns such as generative-AI threats, ransomware, cloud dependency and broader cyber-resilience requirements.

The WFE nevertheless recorded several forms of early preparation. Exchanges and clearing houses were monitoring regulatory and standard-setting developments, discussing quantum risk in governance forums, engaging technology suppliers and undertaking preliminary risk assessments. A smaller number were considering cryptographic inventories or incorporating quantum-safe criteria into procurement and vendor evaluation. The report also identified practical migration constraints: cryptography embedded across databases, application programming interfaces, messaging layers, file systems and legacy systems; long-lived infrastructure and data; reliance on cloud, software and market-data providers; uncertainty about algorithm maturity; and the cost of designing systems that can replace cryptographic algorithms without substantial redesign.

At the national level, authorities have begun incorporating post-quantum migration into sectoral roadmaps, supervisory engagement, and longer-term technology planning. In parallel, several authorities have launched sector-wide diagnostics and measurable readiness benchmarks to inform clearer short- and medium-term actions and expectations.

The Hong Kong Monetary Authority's Quantum Preparedness Index, initially announced in February as part of the Authority's release of Fintech Promotion Blueprint and subsequently released in July, offers one of the most granular illustration of the early stage of sectoral preparedness. The Index assesses banks across Awareness, Planning, Pilots and Practical Preparedness, with an overall sector score of 2.3 out of 10. Formal governance, dedicated funding, workforce training, quantum-risk assessments, cryptographic inventories, approved migration strategies, testing arrangements and progress monitoring remain limited across most institutions. The Authority notes that progress is also constrained by the lack of established assessment methodologies, the complexity of identifying cryptography across legacy systems, technical debt, uncertainty over standards and timelines, and dependence on vendors, financial market infrastructures and shared service providers.