Teetering on the brink of quantum utility –
Not if, but when ...

Why now?

Three factors affect how long a firm has to transition its systems to use new quantum-safe cryptography¹:

• Migration time: how long it will take to migrate all the systems that handle important data to new quantum-safe cryptography.
• Shelf-life time: how long the firm and client data need to be retained and protected.
• Time to quantum utility: the number of years before existing quantum-vulnerable cryptography can be broken.

Mosca's Theorem

As noted, the current working hypothesis for the development of cryptographically relevant quantum computers is just under 10 years – the early 2030s. While the estimated migration time will vary by firm based on the scale, nature, and complexity of systems, this will be a long-term project – past cryptographic migrations have taken over a decade. Firms need to move now to protect data, not least as firm's existing encrypted data is at risk of being harvested today ready for exploitation when quantum computers become operational.

Regulatory response to date

Financial services regulators have published relatively little in terms of new requirements or granular guidance for firm on managing emerging quantum cyber risks. However, central banks have been seeking to address their own risks. In June 2023, the Bank of International Settlements Innovation Hub, in partnership with the Banque de France (BdF) and the Deutsche Bundesbank published its report on 'Project Leap - Quantum-proofing the financial system'. The initial phase involved the successful implementation of a quantum-safe environment at the network level, building a secure channel of communication to send data as well as payment messages through a post-quantum VPN tunnel. BdF and the Monetary Authority of Singapore (MAS) also plan to extend their joint project to extend PQC to critical financial transactions, particularly cross-border transactions on payment networks.

Globally-agreed supervisory standards for quantum computing in the financial services sector might be a logical next step. In January 2024, the World Economic Forum and the UK's Financial Conduct Authority white paper on 'Quantum Security for the Financial Sector: Informing Global Regulatory Approaches' presented four guiding principles and a roadmap to inform global regulatory and industry approaches. These are high-level, seeking to encourage the reuse and repurposing of existing regulatory frameworks and industry practices, establish a standardised approach, increase transparency through the exchange of information on strategies, best practices and approaches, and foster global thinking to avoid the regulatory fragmentation across different markets. As many financial services regulators adhere to a 'technology neutral' principle, we expect that they will look to apply existing regulatory requirements; operational risk and resilience rules are clearly relevant, but governance (including individual accountability regimes) and other rules will also figure. 

There is some sector neutral guidance, including the Canadian National Quantum Readiness Best Practices and Guidelines (updated in June 2023).

These set out a range of recommended actions together with suggestions on how to organise these into a quantum-readiness program, using a multi-year and multi-phase timeline involving:

• Initial planning & scoping, managed as three distinct project phases: preparation, discovery, and quantum risk assessment;
• Implementation, starting in 2025, also consisting of three distinct phases: quantum risk mitigation, migration to new quantum safe cryptography, and validation.

Additional materials cover the use of standardised hybrid cryptography to mitigate some of the risks of migrating to PQC, notes on a systematic approach to thinking about how and where to start migrating quantum-vulnerable IT systems to make use of quantum-safe cryptography by leveraging Cryptographic-Agility; and PQC Roadmap Questions to support system owners and operators in asking when and how their technology providers will introduce PQC capabilities into their products and services.

In August 2023, the Australian Signals Directorate updated its publication 'Protect - Planning for Post-Quantum Cryptography' and in September 2024, updated its guidelines for large organisations and infrastructure (not just financial services firms), also setting down a range of similar preparatory steps. Likewise in December 2023, the Netherlands National Communications Security Agency, the Applied Cryptography and Quantum Algorithms and the Cryptology Group published their PQC Migration Handbook with guidance on the determination of risk, the planning of migration strategies and their execution.

In February 2024, MAS issued a short advisory to all financial institutions on the cybersecurity risks associated with quantum technology, with some recommendations for those institutions to safeguard themselves against the identified threats, including carrying out proof-of-concept trials with quantum security solutions.

In Australia, the Australian Prudential Regulation Authority (APRA) recognises the transformative influence of the quantum computing evolution on the banking sector in its 2024-25 Corporate Plan.² Prudential Standard CPS 230 (commencing 1 July 2025) establishes minimum standards for APRA-regulated entities to manage operational risk – although CPS 230 does not specifically address quantum computing risks, they would fall under the umbrella of ‘operational risk’.³ The Australian Securities & Investments Commission (ASIC) has also signalled that its forthcoming actions include the development of supervisory approaches for emerging operational risks, including quantum computing.