A bank's encrypted data can be copied today and opened years from now. That is why quantum computing is already a planning question for financial institutions, even though the machine that could do it does not exist yet.
Why this cannot wait
- Collect now, decrypt later. NIST warns that adversaries can store encrypted data today and open it when the technology matures.
- The locks in use are the target. RSA and elliptic-curve cryptography, used to exchange keys and sign, can be broken by a large enough quantum computer.
- Experts put it within reach. In one survey of 26 experts, such a machine within 10 years was rated 28–49% likely, and within 15 years 51–70%.
- Changing locks takes years. Hong Kong banks with a plan expect 5.6 years on average, and the HKMA expects the sector to be well prepared by 2030.
- Most are at the start. The HKMA survey puts sector readiness at 2.3 out of 10, and about half have no structured plan.
The sum every bank should do
| Must stay secret | Time to change the locks | Total |
|---|---|---|
| 10 years | 5.6 years | 15.6 years |
If the total runs past the date such a machine could arrive, that data is already at risk, so the work has to start now. Each bank sets its own secrecy periods.
Quantum encryption is not the main route
| Quantum key distribution (QKD) | Post-quantum cryptography (PQC) | |
|---|---|---|
| How it works | Physics: it can detect eavesdropping | New mathematics that quantum computers also find hard |
| What it needs | Special equipment on the network | Changes to applications, products and testing |
| Limits | Does not confirm who is on the other end | Not a simple swap; takes years and involves suppliers |
| Official view | UK NCSC does not support it for government and military systems | NIST published standards in 2024; NCSC calls it the best response |
QKD also does not make a network faster. It delivers keys, and the data still travels over the normal network. AES and similar symmetric encryption are far less affected, so the job is mainly the locks used for key exchange and signatures.
Find the locks, rank them, change one
The HKMA expects banks to assess the risk, build a cryptographic inventory and set a migration roadmap. We built a working demo of that first stretch, on a fictional bank's code.
- Find. The demo found 21 uses of cryptography in 12 files, 16 of them vulnerable. A plain keyword search missed 9 assets, including certificates and an algorithm name built at run time.
- Rank. Items are ordered by how long the data must stay secret, how critical the system is and whether it can be updated later.
- Change one. A hybrid of old and new locks runs live, and a tampered payment instruction fails its post-quantum signature.
AI suggests and a person confirms. All of this runs on one computer, offline, with synthetic data. It is not a real bank system or a production benchmark.
How we would start
- A short briefing for executives on the risk and on what regulators expect.
- A four-week pilot on one system, such as online banking, delivering its inventory and a ranked sample.
- Then you decide whether to go further.
Post-quantum migration is a new line of work for us, which is why we suggest proving it on a small pilot first. We do not sell quantum hardware or new algorithms, so we have no reason to push one route.
Sources
- HKMA circular: Results of Quantum Preparedness Index Survey (27 July 2026)
- HKMA press release: quantum preparedness white paper and index (27 July 2026)
- NIST: first three finalized post-quantum standards (August 2024)
- NIST IR 8547, initial public draft (November 2024)
- UK NCSC: quantum networking technologies (August 2025)
- BIS Paper 158: Quantum-readiness for the financial system (July 2025, authors' views)
- Gidney (2025): factoring RSA-2048 with under a million noisy qubits
- Global Risk Institute: Quantum Threat Timeline Report 2025