This post was originally published on fca.org.uk
Quantum computing will bring significant opportunities to the UK financial sector, but firms need to act now to prepare for a world where a viable hostile quantum computer could break today’s widely used cryptography standards.
The financial sector depends on secure information and communication. Cryptography – of which encryption is just one part – helps firms protect their clients’ data, verify who they are dealing with, and maintain trust in their systems.
Sufficiently powerful quantum computers pose a real threat to that security. Without trustworthy cryptography, consumers would face fraud, firms would suffer operational disruption, and the integrity of financial transactions and markets would be put at risk.
That’s why we are talking to firms about preparing for post-quantum cryptography (PQC) now. We don’t know for certain when a viable quantum computer will emerge, but the coming years will likely see the technology advance at a rapid pace.
Preparing for this new world requires firms to understand where and how they use cryptography and to be able to migrate all hardware and software to PQC, while managing operational risks.
Realistically, for most firms, this will require significant time, investment and effort.
What firms need to do now
So, what kind of timescale are we talking about? The National Centre for Cyber Security (NCSC) recommends 3 key milestones:
- By 2028, firms complete a PQC migration plan.
- By 2031, firms carry out high-priority migration activities.
- By 2035, firms have migrated all systems, services and products to PQC.
Firms should not wait for these milestones before acting and where it is safe to do so, they should seek to be ready sooner. In line with NCSC guidance, we expect firms to act now to:
- Have a thorough and accurate understanding of the cryptography in place across systems and information.
- Set clear, achievable, safe and risk-based migration objectives..
- Implement migration plans and monitor, test and validate the changes, adjusting them where necessary.
Senior managers should ensure that their firms allocate enough time, investment and resources to manage PQC migration safely and meet the relevant deadlines. Failed change projects accounted for around a fifth of all incidents reported to us in 2025.
How we are supporting firms
We are trialling a new supervisory self-assessment tool with an initial sample of firms and intend to extend it to other firms in due course. This will help firms assess the maturity of their plans and help us understand the industry’s preparedness for PQC migration.
This trial will also help us identify common challenges and examples of good practice, which we intend to share with the sector.
We shared relevant insights from firms in April 2026 and will continue to engage with the industry through our Cyber Coordination Groups (CCGs), the Cross Market Operational Resilience Group (CMORG), and trade bodies and associations.
We will also consult on cyber resilience guidance for firms, including our expectations for how firms should address PQC risks through their cryptographic controls.
You can find more information:
