Topic hub

Post-quantum cryptography for payments and banking

Post-quantum cryptography replaces the public-key algorithms that a future quantum computer could break, such as RSA and elliptic curves. It matters to banks now because data captured today can be decrypted later, and regulators have set migration dates. This hub gives verified standards and deadlines, reading paths by role and direct answers.

At a glance

The facts that matter

NIST published FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) on 13 August 2024. Source (checked 2026-11-10)
NIST selected HQC on 11 March 2025 as a backup to ML-KEM; a final standard is expected in 2027. Source (checked 2026-11-10)
The NCSC asks organisations to define migration goals by 2028, carry out early, highest-priority migration by 2031 and complete migration by 2035. Source (checked 2026-11-10)
Under the EU coordinated roadmap, Member States should start moving to PQC by the end of 2026 and protect high-risk use cases by the end of 2030. Source (checked 2026-11-10)
The BIS published a quantum-readiness roadmap for the financial system on 7 July 2025, starting with awareness and a cryptographic inventory. Source (checked 2026-11-10)
NIST IR 8547, Transition to Post-Quantum Cryptography Standards, was published in final form on 27 October 2026. Source (checked 2026-11-10)

Start here

Three ways in

Roadmap

Dates to plan around

2024-08-13 NIST publishes the first three post-quantum standards: FIPS 203, 204 and 205. Source
2025-03-20 NCSC publishes its PQC migration timelines (2028, 2031, 2035). Source
2025-06-23 EU publishes the Coordinated Implementation Roadmap for the transition to post-quantum cryptography. Source
2026-10-27 NIST IR 8547 (Final), Transition to Post-Quantum Cryptography Standards, is published. Source
2026-12 EU Member States should have started the transition to PQC (end of 2026). Source
2030-12 EU high-risk use cases should have moved to PQC (no later than the end of 2030). Source

Tools

Free tools

PQC sizing calculator

Latest thinking

Latest articles

All 79 articles

FAQ

Questions and answers

What is post-quantum cryptography?

It is public-key cryptography designed to resist attacks from quantum computers. NIST published the first three standards, ML-KEM, ML-DSA and SLH-DSA, on 13 August 2024.

Why does it matter to banks now and not later?

Because of harvest-now, decrypt-later: an attacker can collect and store encrypted data today and decrypt it once a capable quantum computer exists. Payment and settlement data with long-lived sensitivity is already exposed to that risk.

Which algorithms are at risk?

The asymmetric algorithms, RSA, elliptic-curve cryptography and Diffie-Hellman, which underpin TLS, PKI, code signing and interbank authentication. Symmetric encryption such as AES-256 remains sound if key lengths are maintained.

What are the migration deadlines?

The UK NCSC asks organisations to define migration goals by 2028, carry out early, highest-priority migration by 2031 and complete migration by 2035. The EU roadmap asks Member States to start by the end of 2026 and protect high-risk use cases by the end of 2030.

What is ML-KEM?

ML-KEM is the Module-Lattice-Based Key-Encapsulation Mechanism standardised in FIPS 203, formerly known as CRYSTALS-Kyber. NIST selected HQC in March 2025 as a backup to it.

Should banks use hybrid schemes?

The NCSC says a hybrid post-quantum and traditional scheme should be an interim measure, used within a flexible framework that allows a straightforward later move to post-quantum only. Hybrid deployment preserves compatibility while the ecosystem migrates.

What is crypto-agility?

Crypto-agility is the ability to change algorithms without redesigning the system. In practice the algorithm becomes a configuration choice rather than a load-bearing assumption, so the next migration is cheaper than this one.

Why might legacy payment rails need replacing rather than patching?

Post-quantum keys and signatures are much larger: an ML-KEM-768 public key is 1,184 bytes and an ML-DSA-65 signature is 3,309 bytes. Many message formats, HSM estates and certificate hierarchies were not sized for that.

Where should a bank start?

With awareness and an inventory of where cryptography is used, as the BIS quantum-readiness roadmap recommends. The inventory drives prioritisation by data lifetime and system criticality, and the migration plan follows from it.

Is quantum key distribution an alternative?

Not in the near term for most uses. The BIS roadmap notes that QKD may have long-term potential but faces infrastructure limits, and presents post-quantum cryptography as the practical near-term option.