Quantum risks demand cryptography migration plans by 2028
The Financial Conduct Authority (FCA) urges firms to prepare for post-quantum cryptography now. UK guidance sets milestones for migration plans by 2028, high-priority work by 2031 and migration of all systems, services and products by 2035.
Map cryptography before migrating
Quantum computing offers opportunities for UK finance, but sufficiently powerful machines could break widely used cryptography, exposing consumers to fraud, disrupting firms and compromising transaction and market integrity.
The timing remains uncertain.
Cryptography protects client data, verifies identities and maintains trust.
The National Centre for Cyber Security (NCSC) recommends the three migration milestones.
The FCA expects firms to inventory cryptography across systems and information, set safe, achievable, risk-based objectives and migrate hardware and software to post-quantum cryptography (PQC).
Firms must monitor, test, validate and adjust changes, starting now and completing work sooner where safe.
Supervisors test firms' readiness
The FCA is trialling a supervisory self-assessment tool with an initial sample of firms, with wider use planned.
It will assess plan maturity and sector preparedness, identifying common challenges and good practice to share.
Following insights shared in April 2026, engagement continues through Cyber Coordination Groups (CCGs), the Cross Market Operational Resilience Group (CMORG) and trade bodies and associations.
The FCA also plans to consult on cyber resilience guidance, including expectations for managing PQC risks through cryptographic controls.
Migration carries its own risks
Quantum preparation is also a change-management challenge.
Failed change projects accounted for around a fifth of incidents reported to the FCA in 2025.
Senior managers must allocate enough time, investment and resources to migrate safely and meet deadlines, rather than waiting for the milestones to act.
Source: Act now to be resilient in the quantum future
IN: