Quantum and cryptographic transition
Much of the financial system's security rests on public-key cryptography that a sufficiently capable quantum computer could break. The move to quantum-resistant cryptography is therefore a continuity question for payments, records, digital identity and market infrastructure, and it is already urgent for data that must stay confidential for many years. This page sets out how The Global Risks Alliance (GRA) researches that transition as a financial-system risk. It is part of financial technology and transformation.
- Institution
- The Global Risks Alliance (GRA)
- Service level
- R0: information and enquiries
Innovation pipeline
GRA · Stage gates
By readiness level
Readiness criteria
pilot vs gate
Pilot issues
- I-1Data licence for pilot siteTo check1 d
- I-2Observer protocol signedDone9 d
GRA · Innovation pipelineInnovation pipeline, in outline: domain structure with placeholder names and illustrative values, not a record.
The short answer.
The quantum and cryptographic transition is the move from public-key cryptography that a capable quantum computer could break to quantum-resistant algorithms, a continuity question for payments, records, digital identity and market infrastructure. GRA researches readiness questions for institutions and supervisors, urgent already for data that must stay confidential for years.
Draft to published version.
Fig.How a finding is reviewed before it is published. Design, not a record.
Digital demand and connectivity in West Africa.
Urban demand centres and the hubs that anchor digital and data infrastructure, shown for West Africa as an example geography for this subject.
The risk begins before the machine exists.
Collect now, decrypt later
Encrypted data captured today could be read once quantum capability matures. Records with long confidentiality lives are exposed already.
Long migrations
Replacing cryptography across payment networks, devices, contracts and archives takes years and depends on many parties moving together.
Shared infrastructure
Institutions rely on the same certificate authorities, hardware and protocols, so the weakest link sets the exposure.
The migration targets institutions are planning against.
| Standard or guidance | Status |
|---|---|
| NIST FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), FIPS 205 (SLH-DSA) | Published August 2024 |
| Cryptographic inventory and migration planning | Recommended by national cyber agencies and financial supervisors; timelines differ by jurisdiction |
| Payment and messaging standards | Network operators set their own migration plans; GRA reports none as fixed unless published |
Inventory first, then dependency.
The first step is a cryptographic inventory: where public-key algorithms protect payments, messaging, identity and archives, and which data must stay confidential for many years. The second is dependency: which third parties and infrastructures must migrate before an institution can. Evidence sits at GCRI post-quantum migration.
Where the financial system relies on cryptography.
| Function | What depends on it |
|---|---|
| Payments and messaging | Authentication of instructions between banks, card networks and payment systems |
| Market infrastructure | Secure links to clearing, settlement and trade repositories |
| Digital identity | Customer authentication, signatures and onboarding |
| Records and archives | Confidential data that must stay protected for decades |
| Digital assets | Keys and signatures that control ownership on distributed ledgers |
Readiness questions for institutions and supervisors.
- Does the institution have an inventory of where and how it uses cryptography?
- Which data and systems need protection the longest, and are they prioritised?
- Which third parties and shared infrastructures must migrate before the institution can?
- How is crypto-agility, the ability to change algorithms quickly, built into new systems?
- What continuity plan applies if a cryptographic weakness is disclosed suddenly?
GRA frames research questions. It does not audit systems, recommend vendors or products, or certify any migration.
Science from GCRI, financial reading from GRA.
The underlying technology is described by The Global Centre for Risk and Innovation (GCRI) on quantum computing, sensing and communication and cybersecurity and cryptography, and its in-development Quantum Technologies platform. On this site, see cyber and operational risk and the technology and operational risk platforms. Related lines: AI and automation and digital assets research.
Terms used on this page.
Each term as this page uses it. Where a standard-setting body defines the term, the wording follows that body.
| Term | Definition |
|---|---|
| Post-quantum cryptography | Algorithms designed to resist attack by quantum computers, standardised by NIST. |
| Harvest now, decrypt later | Collecting encrypted data today to decrypt it once quantum computers can break the encryption. |
| Crypto-agility | The ability to replace cryptographic algorithms in a system without major redesign. |
| Quantum-safe migration | The planned replacement of public-key cryptography that a future quantum computer could break with post-quantum algorithms, such as those NIST standardised, across an organization's systems. |
Where this page's references lead.
The bodies and documents this page is read against. Status and editions change; each link goes to the issuing body.
Questions and answers.
When will quantum computers break current cryptography?
Does GRA recommend specific algorithms?
Is this only a technology issue?
How can security professionals contribute?
Around GRA.
Start with an enquiry.
The current service level is R0: information and enquiries. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.