UK FCA urges immediate preparations for post-quantum cryptography and trials supervisory assessment tool

In a new blog post, Financial Conduct Authority (FCA) Director of Specialists Mark Francis urged firms to begin preparing for post-quantum cryptography (PQC) rather than wait for recommended migration milestones. Sufficiently powerful quantum computers could break widely used cryptographic standards, exposing consumers to fraud, disrupting firms’ operations and threatening financial market integrity. Although the timing of that threat remains uncertain, migrating hardware and software will require substantial time and resources. Firms are expected to understand where and how they use cryptography, set safe migration objectives based on risk, and implement plans with monitoring, testing and validation. The post cites recommended national cyber security milestones: complete migration plans by 2028, carry out high-priority migration activities by 2031 and migrate all systems, services and products by 2035. Firms should seek to be ready sooner where safe. Senior managers should allocate sufficient time, investment and resources to manage the transition safely. Failed change projects accounted for around a fifth of incidents reported to the FCA in 2025. A new supervisory self-assessment tool is being trialed with an initial sample of firms to assess the maturity of their migration plans and industry preparedness. The trial is intended to expand to other firms and identify common challenges and good practices for sharing across the sector. A consultation on cyber resilience guidance is also planned, including expectations for addressing PQC risks through cryptographic controls.