Skip to content
Free membership
Parabanking
Sign in

Regulation & Licensing

FCA urges firms to start post-quantum security migration now

The FCA is urging financial firms to prepare now for post-quantum cryptography and is trialling a supervisory tool to assess their readiness. It points to milestones for migration planning by 2028 and completion across all systems, services and products by 2035.

Parabanking Editorial Desk · · 1 min read
Financial cybersecurity illustration representing the transition to post-quantum cryptography
Parabanking AI-generated illustration

What happened

The Financial Conduct Authority (FCA) has urged financial firms to begin preparing for post-quantum cryptography (PQC), warning that sufficiently powerful quantum computers could break widely used cryptographic standards.

In a blog, the regulator said firms should understand where and how they use cryptography, set safe and risk-based migration objectives, and implement plans with monitoring, testing and validation. Senior managers should allocate sufficient time, investment and resources to manage the transition safely.

The FCA is also trialling a supervisory self-assessment tool with an initial sample of firms. It intends to extend the tool to other firms to help assess the maturity of their plans and the sector’s preparedness.

Why it matters

Cryptography supports the protection of customer data, identity verification and trust in financial systems. The FCA warned that compromised cryptography could expose consumers to fraud, disrupt firms’ operations and threaten the integrity of transactions and markets.

The transition itself carries operational risks. Failed change projects accounted for around a fifth of all incidents reported to the FCA in 2025, the regulator said. Migrating hardware and software to PQC will require significant time, investment and effort for most firms.

Context / What to watch

The FCA highlighted three milestones recommended by the NCSC:

  • By 2028: complete a PQC migration plan.
  • By 2031: carry out high-priority migration activities.
  • By 2035: migrate all systems, services and products to PQC.

Firms should not wait for these milestones to act and should seek to be ready sooner where safe, the regulator said. It acknowledged uncertainty about when a viable quantum computer will emerge.

The supervisory trial is intended to identify common challenges and good practice for sharing across the sector. The FCA also plans to consult on cyber resilience guidance, including expectations for addressing PQC risks through cryptographic controls.

Sources & references

Prepared by the Parabanking Editorial Desk using automated editorial tools from the sources listed, under our Editorial Standards. This article is for general information only and is not investment, legal or financial advice. Spotted an error? Request a correction.

Related coverage