Is the U.S. Banking System Ready for a Post-Quantum Future?

Washington does not need another study of quantum risk in banking. It needs a supervisory deadline.

The reason is straightforward. Modern finance depends on public-key cryptography to authenticate transactions and protect sensitive data, but a sufficiently capable quantum computer could break much of that cryptography. Post-quantum cryptography—the new class of standards designed to remain secure against both classical and quantum computers—is the replacement. But migration is not a software patch. Finding where vulnerable cryptography resides, making systems capable of changing algorithms, and replacing protocols, certificates, hardware, and third-party connections is a multiyear engineering program.

The risk does not begin when such a computer arrives. Adversaries can collect encrypted financial traffic today and hold it until they can decrypt it later. And the exposure is not only financial—payment traffic can reveal supply chains, defense relationships, sanctions activity, and ultimately the structure of the U.S. economy itself.

Washington already recognizes the problem. Executive Order 14412 and Office of Management and Budget Memorandum M-26-15 put federal high-value systems on a 2030–2031 migration clock. Yet the banking system the federal government supervises has no equivalent deadline. In January, the G7 Cyber Expert Group, cochaired by the U.S. Treasury and the Bank of England, laid out a financial sector roadmap calling for critical systems to transition by 2030–2032 and full migration by 2035. The Federal Reserve, the Office of the Comptroller of the Currency, and other U.S. regulators have issued guidance. None has named a year.