No one can say with confidence when a cryptographically relevant quantum computer will become operationally viable. But central banks and financial institutions cannot put off preparations for its arrival.
That’s because replacing vulnerable public-key cryptography across a financial system could take as many as 5 to 10 years of discovery, architecture design, provider engagement, testing, coexistence, migration, and eventual retirement. Given the uncertainty around quantum computing’s development timetable, the greatest risk is that institutions begin preparing too late for the transition that will itself be lengthy and complex.
Because no bank, payment infrastructure, or technology provider controls the full transaction chain, readiness cannot be assessed institution by institution. The governor-level responsibility is to ensure that there’s sufficient time for critical financial services, shared providers, and cross-border infrastructures to make a coordinated transition safely. Looking at it that way, quantum readiness is a key element of financial stability and coordination, not simply a technology problem.
Why quantum security delays pose systemic risks to banking
Three clocks are already running. The first is the exposure clock. Encrypted information can be collected today and retained for possible decryption in the future.
The second is the technology clock. No one knows when a sufficiently capable quantum computer will become operationally viable.
The third is the migration clock. This is measured in years because institutions must identify vulnerable cryptography, agree on new designs, secure provider support, test interoperability and performance, and migrate critical systems without disrupting services.
These clocks do not move in sequence. By the time the technology threat becomes apparent, the safest window for an orderly transition is likely to have narrowed, if not closed. While moving too late leaves mechanisms in place that may be vulnerable, moving in a fragmented way can result in institutions and providers adopting incompatible solutions or transitioning on different timelines. Either could disrupt authentication, payments, or settlement systems.
With no imposed deadline, the financial system needs to make one for itself, and central banks are obvious players to lead that effort. Governance, cryptographic discovery, assessment of long-lived information, mapping of critical transaction chains and shared dependencies, provider engagement, and crypto-agility can all begin before the threat date is known.
The readiness gap is already visible. In July 2026, the Hong Kong Monetary Authority reported a Quantum Preparedness Index score of 2.3 out of 10 for its banking sector. Around half of authorized institutions had no structured plan, while the average implementation timeframe among institutions with plans was 5.6 years.
FINMA found a similar gap. In its survey of 60 authorized institutions, 72% had not planned or implemented measures related to quantum-safe encryption, while only 8% had a specific roadmap.
The issue is no longer awareness alone. It is whether preparation can be executable before the available migration window closes.
How quantum risk becomes a financial stability risk
Public-key cryptography sits beneath many of the functions that make modern finance trustworthy. It helps protect sensitive information, verify identities and instructions, secure software, and establish trusted connections. If those mechanisms fail, the consequences extend beyond confidentiality. Institutions may no longer be able to determine whether a payment instruction is genuine, whether software can be trusted, whether a counterparty is who it claims to be, or whether critical systems can be accessed securely.
The first channel is already active: Adversaries can capture encrypted information today and retain it for decryption in the future. The other two depend on a cryptographically relevant quantum computer: Vulnerable certificates and digital signatures could be forged, while compromised authentication or key-exchange mechanisms could provide access to internal networks and critical systems.
Shared quantum security vulnerabilities could threaten financial stability
Confidential information intercepted during a period of stress could be exposed years later, while it is still commercially or market sensitive. The financial stability exposure begins when the information is intercepted, not when the quantum computer arrives.
Not every quantum-enabled breach would become systemic. The concern becomes greater when a common cryptographic weakness, or a poorly coordinated replacement of it, affects multiple critical services at the same time.
Financial institutions and infrastructures rely on many of the same public-key algorithms, certificate chains, messaging protocols, and specialist providers. Correlated compromise, or incompatible migration, could interrupt authentication and settlement across multiple participants, generate liquidity and confidence effects, and force simultaneous remediation.
That is what turns a technical vulnerability into a financial stability risk: The same trust mechanisms are shared across institutions, infrastructures, and borders. The next test is whether the system can replace them without losing interoperability, continuity, or trust.
Coordinating quantum security migration across the financial system
The financial system is an interconnected transaction chain, which means significant chains require some degree of orchestration. A bank may successfully upgrade its own systems and still be unable to authenticate a payment, settle a transaction, or connect securely if a shared provider, financial market infrastructure, or cross-border counterparty has not made the same transition.
Readiness must therefore be assessed at three levels:
- Institutional readiness asks whether each organization can change its own systems and controls.
- Dependency readiness asks whether critical providers and counterparties can support the transition.
- System readiness asks whether the end-to-end transaction chain can migrate without losing interoperability, continuity, or trust.
The distinction is crucial because no single participant controls the full transaction chain. If institutions and providers adopt incompatible solutions or move on different timelines, systems may no longer recognize or trust one another. Payment instructions could fail validation, performance could deteriorate, and temporary workarounds could introduce weaker controls.
While individual readiness is necessary, it is not sufficient, and central banks will have to worry about the weakest part of the chain as much as the strongest.
Larger institutions may be able to fund discovery, architecture, and testing independently, but it is likely to be harder for midsize institutions, clearinghouses, payment operators, and other participants with fewer specialist resources. Because the chain migrates at the pace of its least-ready participants, those capability gaps can become a systemwide concern.
Building quantum readiness across the financial system through shared standards
Quantum readiness should not be measured simply by asking how many institutions have migration programs. The more important question is whether critical transaction chains can migrate safely together.
That requires common standards and implementation profiles, compatible migration and coexistence timelines, end-to-end interoperability testing, validated fallback and continuity arrangements, visibility into provider dependencies, and mechanisms for resolving sequencing conflicts.
Central banks and relevant financial authorities have particular roles to play because they can see across individual institutions and shared infrastructures and establish a system-level view. That involves setting common expectations, demanding comparable evidence, coordinating end-to-end testing, and resolving dependencies that no individual participant can address alone.
Authorities can convene institutions, infrastructures, cybersecurity authorities, and vendors around common approaches and milestones. They can require inventories, migration plans, and evidence where systemic exposure is greatest. And they can disclose aggregate readiness information to improve comparability and senior-level attention.
Used together, the three instruments move the system from voluntary coordination toward comparable evidence, targeted accountability, and, eventually, transparent system-level reporting. Each instrument has limitations: Voluntary coordination may lead to uneven participation, supervisory requirements need to be proportionate, and disclosure depends on comparable data. Combining all three can help address these gaps and strengthen systemwide readiness.
Four questions central banks must answer on quantum risk
There are four key questions and decisions that only governors can tackle. The chart below shows how the answers and decisions translate into action.
These decisions require governors to set system priorities, establish clear accountability, define the evidence needed to assess readiness, and determine how coordination will be organized and resourced.
Governor decision: Set the system ambition and sequencing.
What the decision covers: Decide which long-lived information, critical services, and transaction chains require earlier action; which low-regret measures should begin immediately; and under what conditions larger migration waves, coexistence, fallback, and retirement should proceed.
Governor decision: Define the mandate and accountability.
What the decision covers: Decide how responsibility for the identified risks is allocated across internal operations, payments, supervision, and financial stability; appoint the executive sponsor and program owner; and define how material dependencies, exceptions, and residual risks will be escalated.
Governor decision: Set the evidence and coordination requirements.
What the decision covers: Decide what inventories, migration roadmaps, and provider evidence are required; which interoperability, performance, fallback, and continuity tests must be completed; and how incompatible standards, timelines, and implementation choices will be identified and resolved.
Governor decision: Choose and resource the coordination model.
What the decision covers: Decide how the authority will combine convening, supervisory requirements, and disclosure; which domestic and cross-border infrastructures and corridors require priority attention; and what funding, specialist capability, international engagement, and communication are needed.
Together, these decisions provide the basis for answering the governor-level question with evidence rather than assurance. Because the threat date remains uncertain while it’s known that migration takes years, central banks should prepare now and sequence migration proportionately to information lifetime, service criticality, migration lead time, and provider readiness. That is the difference between a collection of isolated projects and a systemwide readiness program.
