Quantum Threat Puts Financial Systems on Front Line

Advances in quantum computing could eventually break encryption that underpins financial transactions, identity verification and online communications. The threat extends beyond cybersecurity: compromised cryptographic systems could erode trust among banks, customers and markets. Attackers may also collect encrypted data now and decrypt it once quantum capabilities mature, increasing pressure on financial institutions and their technology suppliers to begin a complex, multi-year transition before current protections become vulnerable.

The US Treasury and Taiwan’s Financial Supervisory Commission have established response groups and issued migration guidance for the financial sector. Institutions are being steered to inventory cryptographic assets, assess quantum exposure and prepare to deploy post-quantum cryptography, or PQC, with readiness targeted by 2035. The timetable makes migration a major enterprise transformation challenge, as banks must coordinate upgrades across core systems, vendors and cross-border transaction networks while maintaining security and operational continuity.

Group of Seven (G7) central banks said quantum computers could eventually break the conventional public-key cryptography widely used by financial institutions. Bank transactions, customer identities and cross-border payments all rely on encryption. Without timely upgrades, a single cybersecurity incident could escalate into a systemic threat to the global financial system.

The G7 central banks recently published their first report on quantum-computing risks, warning that a practical quantum computer could break modern encryption within 10 years. The report highlighted the “harvest now, decrypt later” strategy, in which hackers steal encrypted data today and wait for the technology to mature before decrypting it. The publication date and any amounts involved were not disclosed. The report urged financial institutions to begin inventories immediately and migrate to post-quantum cryptography.

RSA and elliptic-curve cryptography are widely used to protect financial transactions, cloud services and government data, but quantum computers with sufficient processing power could break those safeguards. Google views 2029 as a potential “Q-Day,” bringing post-quantum cryptography and quantum-resilience services forward as priorities in corporate cybersecurity procurement.

The latest developments show Big Tech accelerating plans to add post-quantum cryptography (PQC) and quantum resilience as a service (QRaaS) to product road maps as it confronts a risk window of only about three years until 2029. Reports did not disclose how much individual organizations are investing, but companies have moved beyond technical assessments to procurement, system inventories and cryptographic migration planning.

U.S. banks and credit unions largely rely on public-key cryptography such as RSA and ECC to protect transactions and customer data. If fault-tolerant quantum computers become viable, those safeguards could be broken. The threat is already present because attackers can use a “harvest now, decrypt later” strategy, storing encrypted data today and decoding financial records that remain sensitive in the future.

NIST released three immediately deployable post-quantum cryptography standards—FIPS 203, 204 and 205—on August 13, 2024, covering ML-KEM and two digital-signature schemes. Google has used PQC to protect internal communications since 2022 and enabled ML-KEM by default in desktop Chrome in May 2024. Banks should immediately inventory their cryptographic assets and begin a phased migration.