Is the U.S. Banking System Ready for a Post-Quantum Future?

Washington does not need another study of quantum risk in banking. It needs a supervisory deadline.

The reason is straightforward. Modern finance depends on public-key cryptography to authenticate transactions and protect sensitive data, but a sufficiently capable quantum computer could break much of that cryptography. Post-quantum cryptography—the new class of standards designed to remain secure against both classical and quantum computers—is the replacement. But migration is not a software patch. Finding where vulnerable cryptography resides, making systems capable of changing algorithms, and replacing protocols, certificates, hardware, and third-party connections is a multiyear engineering program.

The risk does not begin when such a computer arrives. Adversaries can collect encrypted financial traffic today and hold it until they can decrypt it later. And the exposure is not only financial—payment traffic can reveal supply chains, defense relationships, sanctions activity, and ultimately the structure of the U.S. economy itself.

Washington already recognizes the problem. Executive Order 14412 and Office of Management and Budget Memorandum M-26-15 put federal high-value systems on a 2030–2031 migration clock. Yet the banking system the federal government supervises has no equivalent deadline. In January, the G7 Cyber Expert Group, cochaired by the U.S. Treasury and the Bank of England, laid out a financial sector roadmap calling for critical systems to transition by 2030–2032 and full migration by 2035. The Federal Reserve, the Office of the Comptroller of the Currency, and other U.S. regulators have issued guidance. None has named a year.

The result is an unusual contradiction: The federal government has imposed a deadline on itself while leaving the financial system largely to an advisory timetable. More striking still, no U.S. supervisor has required institutions to report their post-quantum readiness consistently, so Washington does not know how prepared the system actually is.

What the Threat Is, and What Fixing It Takes

The security of public-key cryptography rests on complex factoring and discrete-logarithm problems that classical computers cannot solve in useful time. Shor’s algorithm, run on a sufficiently capable quantum computer, solves these problems directly. Encryption does not become easier to guess; instead, the underlying math becomes tractable. Symmetric encryption degrades but survives. Public-key cryptography does not.

Mitigation begins with a cryptographic inventory, but most institutions do not know where their keys live, which protocols depend on them, or which vendor connections carry them. It proceeds to crypto-agility—changing algorithms without re-architecting the systems built around them. Only then does replacement begin, across protocols, certificates, hardware security modules, and every third-party interface. This is a multiyear engineering program. Waiting for a cryptographically relevant quantum computer to arrive means starting too late.

The program is expensive and invisible, which is why it needs advocates outside the banking agencies. Encrypted financial traffic is not only money. Payment flows are a map of the industrial base: which firms supply which primes, how defense contractors are financed, and where sanctioned entities move value. An adversary that decrypts a decade of intercepted financial messaging in 2032 does not read balances; it reads the structure of the U.S. economy, retroactively. That is an economic security and intelligence problem before it is a compliance problem. And it is already underway: Adversaries are collecting encrypted traffic now so they can decrypt it later. Anne Neuberger, formerly deputy national security adviser for cyber and emerging technology, wrote in Foreign Affairs this year that China and Russia are doing precisely this.

It is worth being honest about what can and cannot be recovered. Traffic already harvested is gone. No migration returns it and no future standard protects it. What migration to quantum-resistant systems does is stop the accrual: Every month of delay adds to a pile that will one day be read in full by someone who was patient. Any record that must remain confidential past 2030—a mortgage file, a trust account, the systems adjacent to them—is already exposed.

Is the United States Ready for Post-Quantum Migration?

The natural next question is how prepared U.S. financial institutions are to migrate before quantum computers can compromise the public-key cryptography they rely on. The honest answer is that nobody knows, because nobody has been required to say. The United States has about 8,500 federally insured depository institutions—roughly 4,280 banks and thrifts, and 4,250 credit unions. About 400 of these file annual reports with the Securities and Exchange Commission. Over the past year, according to a search of these filings, only about 1 in 10 of those mentions quantum at all, nearly always as a single line in a list of emerging technologies.

What institutions disclose bears no relationship to what they are doing. Wells Fargo is a named collaborator on the federal government’s own post-quantum migration project at the National Institute of Standards and Technology; however, the word “quantum” does not appear in its annual report. Ally Financial describes a multiyear post-quantum readiness program, with a cryptographic inventory and board reporting—in its proxy statement, where no risk analyst looks. The clearest public language appears outside the U.S. subsidiary of Spanish bank Santander: Banco Santander’s global 2025 annual report describes the group as playing a leadership role in post-quantum security, while Santander UK identifies quantum technology as an emerging risk and says it maintains an inventory of internal cryptography.

This incoherence is not negligence. It is the absence of a question anyone is required to answer the same way twice—and for most of the system, there is nowhere to answer it. The roughly 8,100 institutions outside SEC reporting have no narrative disclosure vehicle at all: The Call Report, submitted by banks to financial regulators, is a set of numeric schedules, with no field in which a bank could describe its cryptographic posture if it wanted to.

Other governments have measured quantum readiness. Hong Kong has announced a Quantum Preparedness Index as part of its 2026 banking-sector resilience agenda; Swiss supervisors surveyed 60 financial institutions and found that 72 percent had not yet planned or implemented measures relating to quantum-safe encryption. No U.S. supervisor has measured anything quantum-related, and the major 2026 surveys of U.S. bank and credit union executives do not ask. International infrastructure is already beginning to impose its own timetable: SWIFT, the secure messaging network used by the financial industry for international transactions, has put its community on an upgrade path toward post-quantum readiness, with mandatory Release 8.0 planned for the end of July 2027 and Release 7.9 reaching end of support 15 months later. A Belgian cooperative is therefore imposing an operational migration clock on U.S. institutions before any U.S. regulator has set a comparable date.

Y2K as a Case Study

Y2K is a useful precedent—while the technical problem is very different, the management problem is the same one that U.S. banking faces today. The financial system completed a forced, sector-wide migration on a calendar because three conditions held at once: (1) a date certain, (2) examination against that date, and (3) shared vendor infrastructure that could be fixed once and inherited many times. The Federal Financial Institutions Examination Council (FFIEC) set December 31, 1998, as the milestone for substantially completing tests of internal mission-critical systems; by the end of the first quarter of 1999, the Office of the Comptroller of the Currency reported that 95 percent of national banks had completed that testing.

Post-quantum migration has the third condition, but it lacks the first two. That the work is genuinely hard is not speculation: When the BIS Innovation Hub, the Bank of Italy, the Bank of France, Deutsche Bundesbank, Nexi-Colt, and SWIFT replaced traditional digital signatures with post-quantum equivalents in an operational payment flow last December, post-quantum signature verification averaged 209.9 milliseconds versus 28.1 milliseconds for traditional cryptography, and the project identified larger key sizes and additional infrastructure demands. But ultimately, all test scenarios—and the overall experiment—succeeded. It also demonstrated that this is a problem of engineering, not configuration.

Shared infrastructure and the concentration of technology vendors create an opportunity. For most smaller institutions, the relevant cryptographic infrastructure is not designed and operated in-house; it is embedded in systems supplied by core processors and other technology vendors. FIS, Fiserv, and Jack Henry serve a large share of those institutions, yet none has publicly laid out a comprehensive post-quantum migration timetable—Jack Henry’s own list of the top cybersecurity trends for 2026 does not mention quantum. What initially looks like 8,500 separate remediation programs is therefore, in significant part, a much smaller set of vendor migrations. That gives supervisors leverage. Examining the cryptographic inventories and migration plans of the major service providers can improve the posture of thousands of institutions at once.

Four Steps to Prepare U.S. Banking for the Post-Quantum Transition

1. Set the date. The Treasury and the FFIEC should align post-quantum examination expectations with the 2030–2031 gates the federal government has already accepted for itself. Closing a gap the Treasury helped create is the highest-leverage move available and requires no new authority.
2. Examine the vendors, not only the banks. The Bank Service Company Act already permits direct examination of third-party service providers. Make cryptographic inventory and migration status examination items at the core processors, and thousands of institutions inherit the answer without each solving the problem alone.
3. Measure the system. The Financial Stability Oversight Council (FSOC) should name delayed post-quantum migration a systemic vulnerability in its annual report, and supervisors should publish a readiness measure. The United States cannot manage what it has never counted.
4. Congress should press for the date. Bipartisan supportexists for post-quantum readiness and broader quantum policy; it does not yet exist for a banking-sector migration mandate. Oversight hearings, report language, and the National Quantum Initiative Act reauthorization are the instruments for pushing the Treasury, FSOC, and the banking agencies to set a deadline, and for funding shared migration tooling for institutions that cannot build it alone.

None of this requires a precise forecast of when a cryptographically relevant quantum computer will arrive. It requires only recognizing the inconsistency Washington has already created: urgency and a timetable for its own systems, but neither for the banking system it supervises. Cryptographic migration is not the only clock running against the same defenders; it is the one Washington can set this year, using authorities it already has. But setting a deadline may be the most important step—a migration plan without a required completion date is not a plan.

Sultan Meghji is a senior technical expert (non-resident) in the Economic Security and Technology Department at the Center for Strategic and International Studies in Washington, D.C.