Taiwan, US Push Financial Sector Toward Post-Quantum Security

Financial institutions depend on RSA and elliptic-curve cryptography to secure payments, customer identities and market infrastructure. A cryptographically relevant quantum computer could eventually break those defenses, while “harvest now, decrypt later” attacks put long-lived data at risk before such a machine exists. Banks are therefore treating post-quantum cryptography, crypto-agility and inventories of cryptographic assets as core resilience work, not a one-off software upgrade.

On Aug. 24, 2026, the U.S. Treasury launched a public-private Quantum-Readiness Task Force, building on the G7 Cyber Expert Group roadmap. Its three workstreams cover sector alignment and PQC transition, vendor readiness, and digital-asset and emerging-technology risk; no budget was disclosed. The move follows the BIS Innovation Hub’s Project Leap Phase 2 report on Dec. 11, 2025, which tested post-quantum digital signatures during liquidity transfers in an operational payment system with the Bank of Italy, Banque de France, Deutsche Bundesbank, Nexi-Colt and Swift.

Quantum computers could eventually break the asymmetric encryption underpinning bank authentication, transaction signatures and the protection of personal data. Because financial institutions operate large, interconnected technology estates, replacing cryptographic infrastructure could take years. Experts say the potential damage extends beyond cryptocurrency, threatening the broader system of digital trust on which payments, customer records and government-linked financial services depend.

A survey by the Global Risk Institute found a rising likelihood that quantum computers will defeat widely used encryption within the next several years, placing banks among the sectors most exposed. Specialists are urging financial institutions and governments to treat the transition like the Y2K remediation effort: identify vulnerable systems now, prepare migration plans for post-quantum cryptography and begin coordinated upgrades before existing protections become obsolete.

As quantum computing capabilities continue to advance, the asymmetric encryption used in financial transactions could eventually be broken, exposing customer identities, transaction data and information retained for long periods. Taiwan’s Financial Supervisory Commission is therefore promoting migration to post-quantum cryptography to help financial institutions adjust their cybersecurity governance and encryption architecture in advance.

The FSC has issued its Reference Guidelines for Post-Quantum Cryptography Migration in the Financial Sector, setting out seven major strategies, including governance mechanisms and an inventory of cryptographic technologies. The guidelines also call for a cryptographic bill of materials, or CBOM, and cryptographic agility. They treat the possible emergence of quantum computers in 2029 as a risk milestone, encouraging the financial industry to begin planning its migration early.

Group of Seven (G7) central banks said quantum computers could eventually break the conventional public-key cryptography widely used by financial institutions. Bank transactions, customer identities and cross-border payments all rely on encryption. Without timely upgrades, a single cybersecurity incident could escalate into a systemic threat to the global financial system.

The G7 central banks recently published their first report on quantum-computing risks, warning that a practical quantum computer could break modern encryption within 10 years. The report highlighted the “harvest now, decrypt later” strategy, in which hackers steal encrypted data today and wait for the technology to mature before decrypting it. The publication date and any amounts involved were not disclosed. The report urged financial institutions to begin inventories immediately and migrate to post-quantum cryptography.

As quantum computing matures, it could break widely used public-key cryptography such as RSA and ECC. Companies that fail to inventory and migrate their systems early risk exposing sensitive data kept for long periods to “harvest now, decrypt later” attacks. uniXecure Technology and KeyXentic are therefore targeting financial institutions and multinational companies with post-quantum cryptography (PQC) adoption services aligned with requirements from regulators including Taiwan’s Financial Supervisory Commission.

uniXecure and KeyXentic recently announced a strategic partnership to help companies inventory existing cryptographic assets, assess quantum risks and plan PQC migration projects, declaring the start of “Taiwan’s first year of post-quantum cybersecurity.” Current reports did not specify the announcement date, the value of any investment or contracts, or the number of companies expected to adopt the services. The partners have yet to disclose a detailed implementation timetable.

U.S. banks and credit unions largely rely on public-key cryptography such as RSA and ECC to protect transactions and customer data. If fault-tolerant quantum computers become viable, those safeguards could be broken. The threat is already present because attackers can use a “harvest now, decrypt later” strategy, storing encrypted data today and decoding financial records that remain sensitive in the future.

NIST released three immediately deployable post-quantum cryptography standards—FIPS 203, 204 and 205—on August 13, 2024, covering ML-KEM and two digital-signature schemes. Google has used PQC to protect internal communications since 2022 and enabled ML-KEM by default in desktop Chrome in May 2024. Banks should immediately inventory their cryptographic assets and begin a phased migration.