A computer that does not yet exist is already shaping decisions inside the compliance and engineering departments of American banks. Federal regulators and researchers warn that a sufficiently powerful quantum machine could eventually break the encryption protecting nearly every financial transaction made today, and the window to prepare is narrower than it appears.
Why Today's Encryption Has an Expiration Date
Modern banking relies on RSA and elliptic curve cryptography to secure everything from wire transfers to customer logins. Both systems depend on mathematical problems - factoring large numbers or solving discrete logarithms - that ordinary computers cannot crack in a practical amount of time. A large-scale quantum computer, however, could solve these problems far faster, according to Md. Tauhid Hossain Rubel, a doctoral candidate and researcher who studies the issue. That machine does not need to exist today to pose a threat. Adversaries can harvest encrypted financial data now and simply wait, decrypting it once quantum capability matures. For records with long shelf lives - account histories, identity data, institutional communications - that delay offers little protection.
New Standards, New Deadlines
The groundwork for a response is already in place. On August 13, 2024, the National Institute of Standards and Technology published its first set of post-quantum cryptography standards. FIPS 203 introduced ML-KEM, an algorithm for secure key exchange, while FIPS 204 and FIPS 205 defined ML-DSA and SLH-DSA for digital signatures. Together, these form the technical foundation for replacing RSA and elliptic curve methods across sensitive systems.
Government timelines have since hardened into policy. Executive Order 14412, signed on June 22, 2026, requires federal agencies to migrate their most sensitive systems to post-quantum key establishment by December 31, 2030, with signature systems following by December 31, 2031. A proposed rule would extend these same requirements to federal contractors by the end of 2030. To coordinate the financial sector's response, the Department of the Treasury launched a Quantum-Readiness Task Force on August 24, 2026, tasked with addressing vendor readiness, sector-wide alignment, and risks specific to digital assets.
The Hard Part: Finding Every Weak Point
Deadlines are easier to set than to meet. Many banks still lack a complete cryptographic inventory - a detailed map showing exactly where RSA and elliptic curve encryption are embedded across their infrastructure, from core banking platforms to third-party vendor software. Without that inventory, institutions cannot reliably sequence their migration or even know the full scope of what needs replacing. Progress is further constrained by uneven vendor readiness across the sector, meaning a bank's timeline often depends on partners it does not control.
The G7 Cyber Expert Group, co-led by the U.S. Treasury and the Bank of England, has floated 2035 as a general target for the sector, though it carries no binding force. Full migration realistically spans years, not months, given the scale of legacy systems embedded in global banking infrastructure.
What Engineering Teams Should Do Now
Specialists point to a sequence of practical steps rather than a single fix:
- Build a cryptographic inventory first, ranking systems by the sensitivity and longevity of the data they protect.
- Test ML-KEM in lower-risk environments to understand performance costs and compatibility issues before wider rollout.
- Design for cryptographic agility, so systems can swap algorithms through configuration changes rather than ground-up rebuilds when standards evolve further.
That last principle may matter most. Quantum computing research continues to shift, and today's chosen algorithms may need refinement or replacement later. A bank that builds flexibility into its systems now avoids repeating this costly transition from scratch the next time the underlying mathematics changes.