Few industries rely on public-key encryption as heavily as finance. That makes banks and payment firms some of the most exposed, and some of the most active, in preparing for quantum computers.
Where finance relies on public-key encryption
- ◆Online and mobile banking: every session starts with a key exchange that today mostly uses elliptic curves.
- ◆Payment cards: chip cards use RSA-based certificates to prove they are genuine.
- ◆Interbank messaging: payment networks rely on digital certificates and signatures to prove which institution sent a message.
- ◆Stored records: loan agreements, identity documents and account histories may need to stay confidential for decades.
The two main risks
Confidentiality: traffic recorded today, such as customer data or transaction details, could be decrypted later.
Integrity: once quantum computers can break signatures, attackers could forge transactions, certificates or software updates, unless systems have moved to post-quantum signatures by then.
What regulators and central banks are doing
- ◆In September 2024, the G7 Cyber Expert Group, chaired by the US Treasury and the Bank of England, urged financial authorities and firms to understand quantum risks, assess them and develop a plan to mitigate them.
- ◆The EU’s Digital Operational Resilience Act (DORA), which has applied since 17 January 2025, requires financial firms to manage ICT risk, including keeping their encryption controls up to date.
- ◆The Bank for International Settlements ran Project Leap with central banks. Phase 1 (2023) protected payment messages between the Banque de France and Deutsche Bundesbank with hybrid post-quantum encryption; phase 2 (2025) tested post-quantum signatures in an operational payment system.
Why finance faces a hard migration
Banks run a mix of modern cloud systems and decades-old core platforms, depend on many third-party vendors, and must keep payments running around the clock. Card and payment standards involve many parties who must upgrade together. That is why regulators advise starting inventories and planning now, even with a 2030–2035 horizon.
Practical first steps for financial firms
- 1Build a cryptographic inventory, starting with customer-facing and payment systems.
- 2Ask key vendors for their post-quantum roadmaps and add requirements to contracts.
- 3Enable hybrid post-quantum key exchange on external connections where it is supported.
- 4Add quantum risk to board-level risk registers and DORA ICT risk frameworks.
task_altKey takeaways
- check_circleFinance relies on public-key encryption for banking sessions, cards and interbank messages.
- check_circleThe G7 Cyber Expert Group urged firms to start planning in 2024.
- check_circleCentral banks have already tested post-quantum cryptography in payment systems.
