Solutions / Quantum Compliance
Prepare for a risk technology cannot solve alone.
Moving to post-quantum cryptography is not an IT upgrade. It raises questions of governance, risk, third-party dependency, operational resilience, regulatory expectation, investment and accountability. Quantum Compliance helps a financial institution see its exposure, give the risk an owner and build a readiness plan before migration becomes urgent. Technology teams handle the cryptography. Taft helps the organization govern the transition.
Who it’s for
For institutions where the transition will take years, and the data must last longer.
- Firms holding long-lived sensitive data: customer, KYC, transaction, custody, identity and legal information that must stay confidential for years.
- Complex technology estates: many applications, APIs, certificates, authentication mechanisms and legacy systems.
- Critical financial infrastructure: payments, custody, clearing, settlement, trading and market infrastructure.
- Heavy third-party dependence: cloud providers, core processors, technology vendors, payment providers and outsourced platforms.
- Long transformation cycles, where a major technology change takes years to plan, test and implement.
- In practice: banks, payment companies, market infrastructure, custodians, broker-dealers, asset managers, insurers, fintechs and digital-asset businesses.
What you get
What you receive.
We are not selling cryptography engineering. We turn a cryptography problem into a management problem the organization can govern.
Quantum readiness diagnostic
A clear statement of the organization’s current readiness and its principal exposures.
Readiness heat map
Governance, cryptographic visibility, data, critical systems, third parties, resilience and migration planning, on one page.
Exposure and dependency map
Where the firm depends on quantum-vulnerable cryptography, and which areas need deeper technical discovery or priority attention.
Third-party readiness assessment
The critical vendor dependencies, their readiness gaps, and the questions to build into vendor oversight.
Regulatory and standards horizon
The developments that matter in the jurisdictions you operate in, and what they mean for you.
Governance framework
Recommended ownership, responsibilities, escalation and management and board oversight.
Post-quantum roadmap
Now: understand the exposure and establish ownership. Next: inventory, prioritize and engage critical vendors. Prepare: build crypto-agility and migration capability. Migrate: execute the technical transition against risk and the applicable timelines.
Executive and board readout
The risk, the current readiness, the priorities and the decisions required, explained at management level.
Options
Three depths.
Most firms do not need a migration program yet. They need to know what is exposed and who owns it. Start there.
Quantum Readiness Check
- Executive-level diagnostic of governance, exposure, third parties and preparedness
- Maps where the firm depends on quantum-vulnerable cryptography
- Identifies the vendors and data with the most exposure
- A report you can act on and put in front of a board
- Typically one to two weeks
Quantum Compliance 360
- Everything in the Check
- Regulatory horizon and risk framework
- Vendor readiness, criticality and migration strategy
- Typically three to five weeks
Enterprise Quantum Readiness Program
- Multi-entity or multi-jurisdiction
- Deeper technology discovery with specialist technical partners
- Scope and timeline set with the organization
Why now
The standards are final. The rules are still forming. Migration takes years.
Quantum computers able to break today’s public-key cryptography do not yet exist at the necessary scale. The question for management is not when they will arrive. It is whether, if the cryptographic environment eventually has to change, the firm knows what is exposed, what matters most, who owns the risk, which third parties it depends on and how it would manage the transition.
The standards exist
NIST published the first post-quantum standards, FIPS 203, 204 and 205, on August 13, 2024. Its transition report, NIST IR 8547, was published in final form in October 2026 and replaced the November 2024 draft. It states that NIST will deprecate quantum-vulnerable public-key cryptography after 2030 and disallow its use under NIST standards and guidelines after 2035. Those dates are set for federal use of NIST standards. In our view they are already shaping private roadmaps. Source: NIST IR 8547, Transition to Post-Quantum Cryptography Standards (October 2026), https://csrc.nist.gov/pubs/ir/8547/final
Supervisors abroad are moving
FINMA in Switzerland has published guidance for the institutions it supervises. The HKMA in Hong Kong has published a quantum preparedness whitepaper and index for its banking sector. In the European Union, a Commission recommendation and a coordinated roadmap are aimed at the Member States, not at firms. The G7 Cyber Expert Group published a financial-sector roadmap statement in January 2026 that says it does not set guidance or regulatory expectations. In the United States, we are not aware of a financial regulator that has published an examination expectation for private firms. Sources: FINMA Guidance 05/2026 (July 9, 2026), https://www.finma.ch/en/news/2026/07/20260709-mm-am-05-26/; HKMA press release (July 27, 2026), https://www.hkma.gov.hk/eng/news-and-media/press-releases/2026/07/20260727-3/; Commission Recommendation (EU) 2024/1101 (April 11, 2024), https://eur-lex.europa.eu/eli/reco/2024/1101/oj/eng; G7 Cyber Expert Group statement (January 2026), https://home.treasury.gov/system/files/136/G7-CEG-Quantum-Roadmap.pdf
Harvest now, decrypt later
Data captured today can be decrypted when the capability arrives. For information with a long confidentiality life, the exposure is not in the future.
Migration is slow
Inventory, vendors, testing and replacement take years in a large estate. A firm that starts when a regulator asks has started late.
Source status
Standard, guidance, recommendation or statement: the sources by jurisdiction.
What each source is, whom it addresses and whether it binds, checked against the primary sources on November 8, 2026. A date in these documents is a planning date. It is not a prediction of when a quantum computer will exist.
United States: NIST FIPS 203, 204 and 205
Standards, final since August 13, 2024: ML-KEM for key establishment, ML-DSA and SLH-DSA for digital signatures. They apply to information systems used or operated by federal agencies or on their behalf. NIST states that their adoption and use are available to private and commercial organizations. Sources: FIPS 203 (August 13, 2024), https://csrc.nist.gov/pubs/fips/203/final; FIPS 204, https://csrc.nist.gov/pubs/fips/204/final; FIPS 205, https://csrc.nist.gov/pubs/fips/205/final
United States: NIST IR 8547
Transition report, final, published October 2026. NIST marks the November 2024 draft as obsoleted on October 27, 2026. NIST will deprecate quantum-vulnerable public-key cryptography after 2030 and disallow its use under NIST standards and guidelines after 2035, and organizations may continue using these algorithms as they migrate. The schedule describes the use of NIST standards by federal agencies. In our reading, it is a planning reference for a private firm, not a rule that applies to it. Source: NIST IR 8547 (October 2026), https://csrc.nist.gov/pubs/ir/8547/final
United States: Executive Order 14412
Executive order of June 22, 2026. It sets the policy of moving federal information systems to the NIST post-quantum standards, and directs Sector Risk Management Agencies to assist critical infrastructure owners and operators in developing their migration plans. Its directions are to federal agencies. Among them, it directs the FAR Council to publish a proposed rule amending the Federal Acquisition Regulation that would require covered contractors to comply with NIST’s FIPS, including the post-quantum standards, by December 31, 2030. That is a direction to propose a procurement rule for covered federal contractors, not a deadline in force for private firms generally. Source: Executive Order 14412, sections 5 and 6(c), 91 FR 38483 (June 25, 2026), https://www.govinfo.gov/content/pkg/FR-2026-06-25/pdf/2026-12909.pdf
United States: financial supervisors
We are not aware of a published post-quantum examination expectation for private firms. In our view, the questions are more likely to arrive through existing information security, operational resilience and third-party risk requirements.
Switzerland: FINMA Guidance 05/2026
Supervisory guidance of July 9, 2026, to supervised institutions. FINMA states that the existing technology-neutral, principles-based requirements for governance and risk management also cover the risks from powerful quantum computers, and that it expects supervised institutions to address these risks in a timely manner. Its specific measures are recommendations for internal risk management. Source: FINMA Guidance 05/2026, Quantum computing (July 9, 2026), https://www.finma.ch/en/news/2026/07/20260709-mm-am-05-26/
Hong Kong: HKMA whitepaper and index
The Whitepaper on Quantum Preparedness of Hong Kong’s Banking Sector and a first Quantum Preparedness Index, published July 27, 2026 under the HKMA’s Fintech Promotion Blueprint, with a planned toolkit and workshops for banks. A whitepaper and a sector benchmark. In our reading, it sets no requirement on a bank. Source: HKMA press release (July 27, 2026), https://www.hkma.gov.hk/eng/news-and-media/press-releases/2026/07/20260727-3/
European Union: Commission Recommendation (EU) 2024/1101
A recommendation of April 11, 2024 that encourages Member States to coordinate their transition through a coordinated implementation roadmap. It is addressed to Member States, not to financial firms. Under Article 288 of the Treaty on the Functioning of the European Union, recommendations have no binding force. Sources: Commission Recommendation (EU) 2024/1101 (April 11, 2024), https://eur-lex.europa.eu/eli/reco/2024/1101/oj/eng; TFEU Article 288, https://eur-lex.europa.eu/eli/treaty/tfeu_2016/art_288/oj/eng
European Union: NIS Cooperation Group roadmap
A Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography, version 1.1 of June 11, 2025. A high-level paper aimed at the Member States, with a recommended timeline for national transitions. It says public administrations and other critical infrastructures, notably entities in scope of the NIS2 Directive, should refer to it. Its contents are recommendations. Source: NIS Cooperation Group roadmap, version 1.1 (June 11, 2025), https://digital-strategy.ec.europa.eu/en/library/coordinated-implementation-roadmap-transition-post-quantum-cryptography
G7: Cyber Expert Group statement
Non-binding statement of January 2026 for the financial sector. It says it “does not set guidance or regulatory expectations,” and that its roadmap and timelines are not intended to be prescriptive. Source: G7 Cyber Expert Group statement (January 2026), https://home.treasury.gov/system/files/136/G7-CEG-Quantum-Roadmap.pdf
What we assess
Ten questions, calibrated to the size of the organization.
Every engagement is scoped to the organization’s business, technology environment and regulatory footprint.
Governance and accountability
Who owns quantum readiness, and whether responsibilities are set across technology, cyber, risk, compliance, procurement and senior management.
Cryptographic visibility
Whether the organization knows where quantum-vulnerable cryptography exists and which systems, processes and data depend on it.
Data longevity and exposure
Which information needs long-term confidentiality, and where harvest-now, decrypt-later risk could matter.
Criticality and prioritization
Which systems and processes would cause the greatest customer, financial, operational or regulatory harm if their cryptographic protection failed.
Third-party readiness
Which vendors and infrastructure providers create dependencies, and whether they have credible post-quantum roadmaps.
Operational resilience
How migration could affect critical services, interoperability, availability and business continuity.
Regulatory and standards horizon
Which emerging standards, supervisory expectations and jurisdictional requirements are relevant to the organization.
Policies and risk frameworks
Whether quantum risk sits properly within cybersecurity, technology, operational resilience, third-party and enterprise risk frameworks.
Migration governance
Whether there is a documented, risk-based strategy for discovery, prioritization, testing and eventual migration.
Management and board oversight
Whether management can explain the exposure, the strategy, the dependencies, the investment required and the progress.
What Taft brings
Regulation, risk, governance, business, third parties and execution.
Our value sits where those six meet. In our Innovation Lab we have been testing approaches to quantum-safe banking and to the regulatory requirements likely to follow, so the advice is grounded in what the technology actually does.
Regulation
What regulators, governments and standards bodies are beginning to expect.
Risk
What quantum exposure actually means for this institution.
Governance
Who should own it and how it should be managed.
Business
Where investment makes sense, and where it would be premature.
Third parties
Which critical dependencies sit outside the organization’s control.
Execution
How a highly technical migration becomes a manageable enterprise program.
When to start
Start with the exposure, not with a purchase.
The moments below are when a readiness check earns its cost. The last one matters most: do not begin by buying technology.
When management cannot say where vulnerable cryptography sits
The inventory is the first thing any supervisor, auditor or board will ask for.
When critical data must stay confidential for years
The harvest-now, decrypt-later exposure is already running.
When the firm depends heavily on vendors
Their roadmaps decide yours.
When planning a multi-year technology or cyber strategy
Crypto-agility is cheaper to design in than to retrofit.
Before a major platform modernization
The best time to remove a dependency is when the platform is already open.
When regulators or customers begin asking
A considered answer beats an improvised one.
When operating where supervisory expectations are emerging
Supervisors in Switzerland and Hong Kong have published material for the firms they oversee, and the European Union has a coordinated roadmap for its Member States. Firms with reach into those markets may be asked sooner.
Before committing significant budget to post-quantum technology
Understand the exposure first. The purchase, if any, should follow the inventory.
Illustrative example
Questions to put to a critical vendor.
Illustrative only. A starting set of questions for a post-quantum vendor readiness assessment. It is not a standard form or a regulator’s template, and which questions fit depends on what the vendor does for the firm.
Inventory
Which of the products and services you provide to us rely on quantum-vulnerable public-key cryptography, and where?
Roadmap
Do you have a written post-quantum roadmap for those products, and which NIST standards (FIPS 203, 204, 205) does it target?
Crypto-agility
Can the algorithms be changed through configuration or a normal release, or would a change require re-architecture?
Transition modes
Will you support hybrid modes during the transition, and how can we test them in our environment?
Long-lived data
Which of our data that you hold or carry needs long-term confidentiality, and how is it protected against harvest-now, decrypt-later collection?
Your suppliers
Which of your own critical suppliers must move first, and how will you report their progress to us?
Contract
Will you commit to the roadmap, and to notice of changes, in our contract?
Evidence
What evidence will you give us: test results, module validation status, release notes?
Ownership
Who at your firm owns the migration, and who is our contact?
The wider plan
Our guide places these questions inside a whole migration plan: owner, inventory, priorities, vendors, hybrid pilots and the record. It is at /resources/post-quantum-cryptography-migration-plan-financial-services
Illustrative example
What a quantum readiness extract for the board can look like.
Illustrative only. The firm and the facts are invented. It is not a real board pack, and not a template any supervisor has endorsed.
Firm
Illustrative: a fictional payments company with a cloud-hosted core platform and four critical vendors.
Ownership
The Chief Risk Officer is accountable. The CISO runs the technical inventory. Procurement owns vendor terms.
Readiness
Cryptographic inventory complete for customer-facing systems. Internal systems in progress.
Principal exposure
Customer and payment data that must stay confidential for many years, carried over vendor connections that use quantum-vulnerable key exchange.
Vendors
Two of four critical vendors have shared a written post-quantum roadmap. The other two have received the vendor questions.
Reference points
NIST IR 8547 is recorded as a planning reference, not as a requirement on the firm.
Decisions requested
Confirm the ownership above. Approve adding crypto-agility terms to new technology contracts. Note the date of the next report.
Next report
At the next scheduled risk committee, with the vendor responses and the internal inventory.
How it runs
How it runs.
Discover
Establish the business, technology, regulatory and third-party perimeter.
Assess
Evaluate readiness across governance, exposure visibility, data, critical systems, vendors, risk management and migration planning.
Prioritize
Identify what matters first, by business criticality, data longevity, regulatory exposure and dependency.
Design
Set the governance structure, the risk framework, the responsibilities and the migration oversight model.
Roadmap
A practical sequence: what needs attention now, what to prepare next and what can wait. Where deep cryptographic discovery, architecture, testing or technical migration is required, Taft works alongside your technology organization and specialist technology partners.
Questions
Asked before, answered plainly.
- What is quantum compliance?
- The governance work of finding every place a firm depends on public-key cryptography that a quantum computer could one day break, and preparing to replace it in an order a supervisor could follow. It is not a regulatory term, and we are not aware of any rulebook that uses it. It is the name Taft uses for existing duties on information security, operational resilience and third-party risk, applied to a risk that is still taking shape.
- Is this a technology project?
- The migration is. The compliance work is making sure it is scoped against the right standards and expectations, prioritized by what is actually exposed, governed, evidenced and explained. Taft works alongside your technology team and your vendors. It does not replace them.
- Our regulator has not asked. Why start?
- Because data with a long confidentiality life is exposed today, because vendor contracts and system replacements take years, and because supervisors in Switzerland and Hong Kong have already published guidance and a preparedness whitepaper for the firms they oversee. In the European Union, a Commission recommendation and a coordinated roadmap address the Member States. In the United States we expect the questions to arrive through existing information security, operational resilience and third-party risk requirements, and sooner for firms with international reach.
- Should we buy post-quantum technology first?
- No. Start by understanding the exposure. A purchase made before the inventory tends to protect the wrong things. The Quantum Readiness Check exists so that the first spend is on knowing, not on buying.
- How long does it take?
- A Quantum Readiness Check typically takes one to two weeks. Quantum Compliance 360 typically takes three to five weeks. An enterprise program is scoped with you before anything starts.
- Is there a post-quantum deadline for private financial firms?
- We are not aware of one in force for private financial firms generally in the United States. NIST will deprecate quantum-vulnerable public-key cryptography after 2030 and disallow its use under NIST standards and guidelines after 2035. Executive Order 14412 directs federal agencies, and among those directions it tells the FAR Council to publish a proposed rule that would require covered federal contractors to comply with NIST’s FIPS, including the post-quantum standards, by December 31, 2030. A firm that contracts with the federal government should check whether it would be a covered contractor under that rule as proposed and as finally adopted. For other private firms, in our reading, those dates are a planning reference. Firms that operate in Switzerland, Hong Kong or the European Union should read those authorities’ publications as well. Source: NIST IR 8547 (October 2026), https://csrc.nist.gov/pubs/ir/8547/final. Source: Executive Order 14412, section 6(c), 91 FR 38483 (June 25, 2026), https://www.govinfo.gov/content/pkg/FR-2026-06-25/pdf/2026-12909.pdf
- What should we ask our critical vendors?
- Start with the inventory, the roadmap, crypto-agility, the evidence and who owns the migration. The illustrative questions on this page are a starting set. FINMA’s guidance notes that future risks, such as those posed by powerful quantum computers, can be anticipated today, and that measures can be set out contractually with service providers. Source: FINMA Guidance 05/2026 (July 9, 2026), https://www.finma.ch/en/news/2026/07/20260709-mm-am-05-26/
Taft advises on governance, regulatory expectations and planning. It does not implement cryptography, provide legal advice, or guarantee any regulatory outcome.