Post-quantum migration is a multi-year engineering and governance program that a financial firm can plan now, before any supervisor asks for it.
What post-quantum cryptography is
Post-quantum cryptography, usually shortened to PQC, is the family of public-key algorithms designed to resist attack by a quantum computer. The key exchange and digital signature algorithms a firm runs today were chosen because classical computers cannot break them in useful time. A quantum computer of sufficient size would change that arithmetic. Once quantum computers become sufficiently powerful, they will be able to break many of today’s widely used encryption and digital signature algorithms, according to CISA.
That machine has not been built. CISA also states that quantum computing technology capable of breaking modern public-key encryption does not yet exist, and that government agencies and critical infrastructure entities must begin preparing now. The Project Leap phase 1 report, a central bank experiment on quantum-resistant encryption, notes that today’s quantum computers have yet to reach the necessary scale, but that most experts believe this is only a matter of time.
Financial firms carry a particular exposure. The same report describes the quantum threat as potentially exposing all financial transactions and much of existing stored financial data to attack. The stored data point is the one that matters for planning. Encrypted traffic and records captured today could be decrypted once the machine exists, so data with a long confidentiality life carries risk before the threat is real. That is why the work starts before the deadline, and why the first step is knowing what you have.
The standards a migration targets
In August 2024, NIST released its principal PQC standards as Federal Information Processing Standards, specifying key establishment and digital signature schemes. NIST expects the two digital signature standards, ML-DSA and SLH-DSA, and the key-encapsulation mechanism standard, ML-KEM, to provide the foundation for most deployments of post-quantum cryptography, and says they can and should be put into use now. NIST also selected the Falcon digital signature algorithm and the HQC key encapsulation mechanism for ongoing standardization. NIST says it is developing additional standards to serve as backups or alternatives to the three principal ones. For validation, NIST administers the Cryptographic Module Validation Program to promote validated, trustworthy cryptography.
The timeline comes from a separate document. NIST published the final version of its transition plan, NIST IR 8547, in October 2026, replacing the draft issued on November 12, 2024. In its words, NIST “will deprecate quantum-vulnerable public-key cryptography after 2030 and disallow its use under NIST standards and guidelines after 2035.” The report says the 2030 to 2035 window accommodates lower-risk systems and applications with legacy constraints, and that it does not alter the earlier deadlines for federal high value assets and high impact systems. For those, Executive Order 14412 and OMB Memorandum M-26-15 require the government’s most sensitive systems to adopt PQC for key establishment by December 31, 2030, and for digital signatures by December 31, 2031.
NIST standards bind federal systems, not a bank or an exchange directly. The practical effect on private firms likely runs through vendors: as algorithms leave the NIST standards, products built to those standards are likely to drop support, and a firm that has not planned will find the change arriving through patch notes rather than through its own program. NIST says that cybersecurity products, services and protocols will need updates, and that organizations must identify where vulnerable algorithms are used and plan to replace or update them.
Where the obligations sit today
The published obligations sit on the federal side. CISA has worked to address threats posed by quantum computing since July 2022. The federal guidance issued under 6 U.S.C. § 1526, in CISA’s words, “requires each federal agency to establish and maintain a current inventory of IT vulnerable to quantum decryption and establishes criteria for agencies to prioritize their inventory efforts.” Under OMB Memorandum M-26-15 and OMB Memorandum M-23-02, CISA helps drive the federal migration through migration planning, working with cloud service providers and identifying the systems most vulnerable to quantum attacks. Under Executive Order 14306, CISA develops and regularly updates a list of product categories that include technologies that support or plan to support PQC standard algorithms. CISA also shares best practices and lessons learned with non-government entities to help them adopt PQC algorithms, and works with Sector Risk Management Agencies to assist critical infrastructure owners and operators with migration planning.
None of that binds a private bank, payments firm or exchange. In our reading, no financial supervisor has published examination expectations on post-quantum readiness for private firms, and nothing in the federal material above suggests one has. The migration work today sits with federal agencies and the largest institutions. The technology is moving quickly and we expect supervisors to take the topic up in the coming years, probably by folding it into existing expectations on cryptographic key management, third-party risk and resilience rather than through a standalone rule. Until that happens, the right posture is preparation, not compliance. A firm should not build this program to satisfy an examiner who is not asking. It should build it because the inventory takes years, the vendor dependencies are deep, and the federal model shows what a credible program looks like.
The migration work today sits with federal agencies and the largest institutions, which leaves private firms a window to prepare on their own timetable.
The migration plan, step by step
The federal program is the best available template for a private firm. It has four moving parts: inventory, prioritization, vendor engagement and evidence. The steps below follow that order and add the governance a board will expect.
Step 1: assign an owner and a mandate
Give the program a single accountable owner, usually the chief information security officer, with a named business sponsor. Write a one-page mandate that states the goal, the scope, the reporting line and the review cadence. Keep the mandate free of a target date until the inventory is done; a date set before the inventory is a guess.
Step 2: build the cryptographic inventory
The inventory is the step everything else depends on. The federal inventory model is a reasonable reference: a current record of systems vulnerable to quantum decryption, maintained over time, with criteria for which parts of the estate to inventory first. The Migration to Post-Quantum Project at the National Cybersecurity Center of Excellence is working with industry, academia and federal partners to demonstrate tools that find and prioritize vulnerable systems, support interoperable solutions and develop migration guidance. In partnership with that center, CISA demonstrates and evaluates automated cryptographic discovery and inventory tools to understand their capabilities and streamline federal inventories. A private firm can watch that work and borrow from it.
For each entry, record where the algorithm is used, what it protects, who owns the system, whether the firm or a vendor controls the cryptography, and how long the protected data must stay confidential. Expect the inventory to be incomplete on the first pass. Treat it as a living register, not a one-off project.
Step 3: prioritize by data life and exposure
Two questions drive priority. How long must this data remain secret? How exposed is the channel to capture today? Data that must stay confidential for a decade and crosses a network someone else controls sits at the top. Internal signatures on short-lived sessions sit near the bottom. NIST’s timeline deprecates quantum-vulnerable public-key cryptography after 2030 and disallows it after 2035, and the federal deadlines for the most sensitive systems fall at the end of 2030 and 2031. A firm’s priority list should show the same shape.
Step 4: engage vendors and collect evidence
Most cryptography in a financial firm lives in products the firm did not write: core banking platforms, payment gateways, hardware security devices, cloud key services, messaging middleware, customer-facing applications. The list of product categories CISA maintains under Executive Order 14306 is a useful checklist of where to ask. For each vendor, ask three things in writing: which quantum-vulnerable algorithms the product uses, when the vendor plans to support the NIST algorithms, and whether validated modules are on the roadmap. File the answers with the inventory. A vendor that cannot answer is itself a finding.
Step 5: pilot in hybrid mode
Do not swap algorithms in production first. Project Leap tested the implementation of post-quantum cryptographic protocols between two central banks, running one traditional public key algorithm alongside several quantum-resistant algorithms in a hybrid cyphering mode to maintain the confidentiality of payment messages sent between two distant IT systems. The project set out to prepare central banks and the global financial system for a transition towards quantum-resistant encryption by addressing the challenges of updating and replacing the cryptographic algorithms the financial system relies on. The hybrid approach is a sensible pattern for a private firm’s first pilot: keep the classical algorithm, add a quantum-resistant one, and measure latency, message size and interoperability before anything depends on it.
Step 6: keep the record
Every step above produces a document. Keep them together: mandate, inventory, priority criteria, vendor responses, pilot results, board reporting. If a supervisor does take the topic up, that record is likely to be what it asks for first, because it is what the federal program already produces.
The plan at a glance
| Step | Output | Evidence to keep |
|---|---|---|
| Owner and mandate | One-page charter, named sponsor | Approved charter, reporting cadence |
| Cryptographic inventory | Register of algorithm use by system and data | Inventory with owners and data life |
| Prioritization | Ranked list by data life and exposure | Criteria document, ranked list |
| Vendor engagement | Written answers on algorithms and roadmaps | Vendor letters, gap list |
| Hybrid pilot | Classical plus quantum-resistant trial | Test plan, measurements, lessons |
| Record and reporting | Board and risk committee updates | Minutes, status reports |
Questions people actually ask
Is this a regulatory requirement? Not for private financial firms, in our reading. The published obligations sit with federal agencies and run through CISA, the Office of Management and Budget and NIST. We expect supervisors to pick the topic up in the coming years, but nothing in the sources above suggests a private firm is examined on it today.
Which algorithms should we plan for? NIST expects ML-KEM for key establishment and ML-DSA and SLH-DSA for signatures to carry most deployments, with Falcon and HQC in ongoing standardization. Plan for the three principal standards and leave room in the design to add alternatives later.
The transition plan is final now. Does that change the plan? NIST published the final IR 8547 in October 2026, so the dates are set: deprecation after 2030, disallowance after 2035. The inventory does not depend on the document either way. A firm that has not started the inventory loses the years it needs most.
What do we tell the board? That the threat is future, the exposure is current for long-lived data, the standards exist, and the firm has a plan with an owner. Give the board the inventory coverage figure and the vendor gap list, and update both quarterly.
Does hybrid mode double the cost? It adds overhead, which is what the pilot measures. The central bank experiment ran a classical and a quantum-resistant algorithm side by side precisely to find out what that overhead looks like on real payment messages.
Where Taft helps
Taft is monitoring technological and regulatory developments on quantum-safe cryptography and is developing products for the point at which regulators require readiness. In its innovation lab, Taft has been experimenting with solutions for quantum banking and quantum regulatory requirements. Details of that work are at /solutions/quantum-compliance.
Questions
Is post-quantum migration a regulatory requirement for private financial firms?
Not in our reading. The published obligations sit with federal agencies, which must inventory IT vulnerable to quantum decryption under CISA guidance. We are not aware of a financial supervisor that has published examination expectations for private firms, so the work today is preparation.
Which algorithms should a migration target?
NIST expects the two digital signature standards, ML-DSA and SLH-DSA, and the key-encapsulation mechanism ML-KEM to provide the foundation for most post-quantum deployments, and says they can and should be put into use now. Falcon and HQC were selected for ongoing standardization.
What is the deadline?
There is no deadline for private firms. NIST's final transition plan, IR 8547 of October 2026, deprecates quantum-vulnerable public-key cryptography after 2030 and disallows it under NIST standards after 2035. Federal high value and high impact systems must move earlier. Vendor support is likely to follow that timeline.
Why act before a quantum computer exists?
CISA states that quantum computing capable of breaking modern public-key encryption does not yet exist, but that agencies and critical infrastructure must begin preparing now. Encrypted data captured today could be decrypted later, so long-lived data carries risk before the machine arrives.
Sources
- Post-Quantum Cryptography Initiative | CISA, CISA
- Project Leap phase 1: quantum-proofing the financial system | Bank for International Settlements, BIS
- Post-Quantum Cryptography | CSRC | CSRC, NIST
- NIST IR 8547, Transition to Post-Quantum Cryptography Standards, initial public draft of November 2024 (obsoleted by the final report), NIST
- NIST IR 8547, Transition to Post-Quantum Cryptography Standards (final, October 2026), NIST
Taft does not provide legal advice. Content is for informational purposes only and subject to regulatory guidance.