Quantum risk in banking and financial services

Not by name. DORA requires an ICT risk management framework, and Delegated Regulation (EU) 2024/1774 Article 6 requires an encryption policy that keeps pace with developments in cryptanalysis. Supervisors can reasonably ask how that policy treats the quantum threat. Article 8 asset identification and Article 28 third-party diligence also apply to cryptography.

The EU roadmap targets high-risk use cases by the end of 2030 and as many systems as feasible by 2035. NIST IR 8547 deprecates 112-bit RSA and ECC after 2030 and disallows them after 2035. The UK NCSC sets milestones at 2028, 2031 and 2035.

An adversary copies encrypted traffic or data today and stores it until a quantum computer can break the encryption. Any record that must stay confidential beyond the arrival of that computer is already at risk, which is why long retention periods matter.

With a cryptographic inventory of the systems behind critical or important functions, a map of which records must stay confidential past 2030, and post-quantum roadmaps from critical ICT third-party providers. Those three give the management body the evidence to set priorities.

Everything on this page. The two-minute readiness check scores your financial services programme and routes you to the right next step. The free tools, including the HNDL Risk Calculator and the Q-Day Timeline Risk Calculator, run in your browser with no registration. The weekly peer call runs every Tuesday at 15:00 CET and is open to anyone. Sample lectures from the 170-plus expert library are linked above, and the page is reviewed as the mandates change; the date beside the key facts is the last check.

It depends on the role. Board and executives start with the Certified Quantum Business Professional bootcamp, about 22 hours self-paced across ten modules. Security, risk and IT teams take Introduction to Quantum Cyber Security, four to five hours online with a QSECDEF certificate. AI, GRC and compliance leads take AI Security and Resilience Leadership Bootcamp, twenty live online lectures connecting AI security, resilience and post-quantum readiness. Whoever will run the migration takes CPQCPM, the Certified Post Quantum Cryptography Programme Manager course: ten hours live online over five weeks, with the next public cohort in January 2027.

Yes. QSECDEF runs private CPQCPM cohorts for a single organisation, live online or in person, and private deliveries of the sector courses listed under Equip your people for your risk, GRC and compliance teams. Board and leadership workshops are built on your own exposure and obligations and end with an agreed position on quantum risk. Use the contact button in the For your organisation section and tell us your timeline.

Through the QSECDEF Expert Members directory. Every listed member has been vetted, has signed the Members' Charter and has presented to the community. You can filter by consulting and services, technology vendor or enablement and investment, and send a request for further information from the member's own page. QSECDEF is vendor-neutral and sells training, not migration products, so the shortlist stays yours.

Two routes. QSECDEF membership gives your team the self-paced courses, the full lecture archive, the weekly call and 25 per cent off CPQCPM and partner training. Expert Membership is for the builders, consultancies and technology vendors serving financial services who want to be found by the people reading this page; it includes a showcase listing with an enquiry form, the Industry Conversations and speaking slots at the annual QSECDEF symposium.

No. QSECDEF is a vendor-neutral membership network. We train people and connect them with peers and peer-reviewed experts; we do not sell migration software or services.

Public examples include JPMorgan Chase, which built a quantum-secured crypto-agile network in 2024, and HSBC, which piloted quantum-safe tokenised gold in 2024. Central banks are active too: Banque de France and the Monetary Authority of Singapore exchanged post-quantum encrypted emails in 2024, and BIS Project Leap phase 2 tested post-quantum signatures in a live payment system with Banca d'Italia, Banque de France, Deutsche Bundesbank, Nexi-Colt and Swift.

Requirement 12.3.3 asks entities to document the cipher suites and protocols in use, review that inventory at least every 12 months and plan for emerging cryptographic weaknesses. It has been mandatory since 31 March 2025, and it gives payment firms the inventory a post-quantum programme starts with.

Yes. DORA covers insurance and reinsurance undertakings alongside banks, investment firms and payment institutions. Long-tail policy, claims and annuity records are among the data most exposed to harvest now, decrypt later.

Five numbers: inventory coverage of critical or important functions, the records that must stay confidential beyond 2030, how many critical suppliers have a post-quantum roadmap, how many key systems are crypto-agile, and budget and milestones against the 2030 and 2035 deadlines.

Discover and plan in 2026, update policy and supplier contracts and run pilots in 2027, migrate high-risk payment, messaging and long-lived data systems from 2028 to 2030, and complete the rest of the estate by 2035.

CPQCPM is ten hours of live instruction over five weeks, two hours a week. The Quantum Cyber Security course is 4 to 5 hours, self-paced. The business bootcamp is self-paced at your own speed.