Quantum computing represents an existential threat to global financial infrastructure, capable of dismantling the public-key encryption that secures every digital transaction, payment instruction, and communication moving across international markets.
Having closely examined quantum computing and its implications for financial services, we recognise that the window for passive observation has closed. Preparing for the advent of quantum is no longer a distant theoretical exercise; it is an urgent operational mandate. Continuing this industry-wide debate and taking concrete steps toward cryptographic migration is vital to ensuring the long-term integrity of the global financial system.
Our CEO, Ian Stirling, recently attended Sibos 2026 and captured key insights from the Innotribe session “The Quantum Cryptography Tipping Point”, led by Rebecca Krauthamer, CEO of QSecure.
Every payment, card tap, and digital signature moving through global markets today relies on public-key cryptography, primarily RSA and elliptic-curve cryptography, first developed in the late 1970s. While this maths has proven remarkably resilient against classical supercomputers, Shor’s algorithm, published in 1994, demonstrated that a quantum computer can easily solve the prime factorisation problems behind RSA and break these encryption schemes all at once.
Adversaries are not waiting for “Q-Day” to strike; they are actively conducting “harvest now, decrypt later” campaigns, intercepting long-lived confidential data in transit today to decrypt once quantum capabilities mature. Furthermore, a parallel threat – “trust now, forge later” – threatens the digital signatures, root certificates, firmware keys, and payment authentications that underpin multi-decade contracts and financial identity, risking a systemic loss of institutional trust.
The true danger facing financial institutions is not predicting the exact date a cryptographically relevant quantum computer will emerge, but rather reaching the “tipping point”, the moment when the time required to complete the migration from legacy public-key encryption to quantum-safe cryptography (PQC) and cryptographic agility exceeds the time remaining before a quantum machine arrives.
Migration across deeply embedded financial layer cakes is a multi-year endeavour. The UK’s NCSC estimates that large organisations will need two to three years just to discover, map, and assess where their cryptography resides before fix efforts can even begin. With major global regulators establishing migration mandates around 2030 for data confidentiality and 2031 for digital signatures, the operational timeline has already compressed significantly.
Contrary to popular belief, the core obstacle to quantum safety is no longer technological; it is human inertia. On August 13, 2024, NIST finalised three post-quantum cryptographic standards designed to run efficiently on conventional, existing computing hardware.
Despite the availability of standard solutions, practitioners estimate that 5% or fewer of global organisations are currently on track to complete their migration in time. A survey by Swiss regulator FINMA revealed that 72% of surveyed institutions had neither implemented quantum-safe measures nor established plans to do so. Research from the Hudson Institute underscores the scale of this vulnerability, estimating that a single-day quantum breach at just one major bank could cause $2 to $3 trillion in cascading global economic losses.
For fifty years, financial institutions built cybersecurity like an immutable vault door, bolting static hardware and encryption keys into place and leaving them untouched for decades. However, the dual pressures of quantum computing and rapid AI developments mean static security models are fundamentally obsolete.
To build resilient infrastructure, institutions must adopt “cryptographic agility”, i.e. decoupling encryption algorithms from core assets, applications, and hardware so security layers can be updated dynamically as threats evolve. Cryptographic agility creates adaptive cyber defences capable of responding to both quantum algorithms and AI-discovered cryptographic vulnerabilities in real-time.
Achieving quantum resilience does not require rewriting entire enterprise architectures overnight; rather, institutions must adopt a pragmatic, system-by-system approach starting with high-exposure touchpoints.
A powerful real-world demonstration of this staged approach was delivered by Banco Sabadell, in collaboration with Accenture, which successfully deployed post-quantum encryption and cryptographic agility across their customer-facing web connections in approximately four months without altering underlying application code. By tackling high-priority systems incrementally, institutions can establish proven migration blueprints before expanding across their broader environments.
To turn discussion into action, the session concluded by urging executive leadership teams and boards to evaluate three essential diagnostic questions:
