A Point of View for Boards, CEOs, and Risk Committees
By Gail Letts | CEO & Founder, LETTS CONSULT
In thirty-five years of banking, I have watched three technology shifts reshape how we think about trust.
The arrival of online banking forced us to rethink the branch. The mobile wallet forced us to rethink the card. Cybersecurity, after a generation of breaches, forced us to rethink the perimeter.
Each of these shifts created winners and losers, and in every case, the institutions that moved early built advantages that compounded for years.
We are now at the front edge of the fourth shift.
Quantum computing will reshape the cryptography that underwrites every digital transaction in financial services. The question for boards is not whether to act, but how quickly and how deliberately.
The Stakes
Financial services is built on trust, and trust is built on cryptography.
Every wire, every customer authentication, every settlement message, and every line of regulatory reporting depends on encryption that quantum computing will eventually break.
The G7 Cyber Expert Group, co-chaired by the U.S. Treasury and the Bank of England, issued a coordinated post-quantum cryptography (PQC) roadmap in January 2026 directing banks, insurers, and exchanges to begin migration now. The European Commission has set a 2026 transition start and a 2030 critical-infrastructure deadline. FINRA, the SEC, and the OCC are signaling that cryptographic inventory and crypto-agility are becoming part of the reasonable standard of care.
Boards that wait for an explicit U.S. mandate will find themselves behind their regulators, behind their peers, and behind adversaries who are already harvesting encrypted traffic today to decrypt tomorrow.
Why This Matters Now
Harvest Now, Decrypt Later.
Adversaries are capturing encrypted financial traffic today and storing it for the day a cryptographically relevant quantum computer arrives. Loan files, M&A correspondence, customer PII, and intellectual property carry decade-long confidentiality requirements. That data is already exposed.
Migration timelines outrun the threat.
Cryptographic migration in a global bank takes five to seven years when done properly. Most institutions have not yet completed a credible inventory. The window to act deliberately rather than reactively is closing.
Regulators are converging.
NIST finalized FIPS 203, 204, and 205 in 2024. CNSA 2.0 sets hybrid PQC milestones beginning in 2025. The G7 financial-sector roadmap, EU coordinated implementation, and Central Bank of Jordan banking roadmap all point to the same destination on overlapping timelines.
The market just moved faster than the regulators.
On March 25, 2026, Google announced it is accelerating its full migration to post-quantum cryptography to 2029, six years ahead of NIST’s 2035 disallowance deadline and one year ahead of NIST’s 2030 deprecation target.
Google’s VP of Security Engineering and Senior Staff Cryptographer cited faster-than-expected advances in quantum hardware, error correction, and factoring resource estimates. Cloudflare matched the 2029 target the next day, citing the same research and warning that the meaningful Q-Day signals will likely stop being published as the threat becomes imminent.
When the two companies that carry most of the world’s encrypted traffic re-price the risk, financial services boards should take note. Google is not hedging. It is re-pricing the risk.
Disclosure and liability are shifting.
Recent S-1 filings disclose hybrid PQC encryption as material security posture. Once CISA declares PQC-capable products widely available in a category, plaintiffs and regulators have a benchmark for the standard of care. A breach involving deprecated cryptography becomes a governance failure.
Customer trust is the asset at risk.
Banking is one of the few industries where customers are required to share lifetime financial records, and they extend trust on the assumption that we are protecting those records for the long term. A future decryption event affecting historical data would damage trust in ways that no quarterly earnings call can repair.
Why Financial Services Is Uniquely Exposed
Financial services carries quantum risk that other sectors do not.
Payment rails and long-lived records.
Our rails embed cryptographic assumptions that cannot be ripped out without coordinated industry action. Mortgages, wealth positions, trust agreements, and KYC files retain confidentiality value for thirty years or more.
Third-party density and interconnectedness.
Core providers, payment processors, custodians, HSM vendors, and SaaS platforms each manage cryptography we depend on but do not control. The slowest institution in a clearing relationship sets the cryptographic floor for everyone else.
Zero Trust depends on cryptographic trust anchors.
Zero Trust architectures rely on certificates, device identity, TLS, mTLS, and PKI to authenticate users, workloads, APIs, and endpoints. If those trust anchors remain dependent on quantum-vulnerable public-key cryptography, the assurance model behind Zero Trust can be weakened, even if other controls remain in place.
API growth and M&A increase hidden cryptographic exposure.
Open Banking, fintech integration, and API-driven financial services have expanded the number of externally connected systems that depend on cryptographic authentication and encryption. M&A can introduce inherited cryptographic debt unless certificates, keys, protocols, libraries, and third-party dependencies are discovered during diligence.
PQC migration has performance and architecture implications.
PQC algorithms involve larger keys, ciphertexts, and signatures and introduce additional compute and bandwidth requirements that must be modeled before migration, particularly for low-latency environments like trading platforms and high-volume payments.
Quantum readiness is therefore not just an enterprise risk question. It is a systemic resilience question, and one that examiners will increasingly treat as such.
What Boards and Executives Should Be Asking
- Do we have a real cryptographic inventory across applications, endpoints, certificates, and third parties, or a stale spreadsheet?
- Have we mapped our long-lived data and the algorithms protecting it, including hardcoded crypto in legacy core and payment platforms?
- Do we have crypto-agility: the ability to swap algorithms through configuration rather than rebuilding applications?
- Have we assigned an accountable executive, briefed the board on quantum risk in the same cadence as cyber and operational risk, and built PQC into third-party risk management for HSM, payments, and core providers?
- Are we tracking PQC readiness in our key vendors and clearing partners, and have we built it into procurement and contract renewals?
- Are we including cryptographic discovery in our M&A diligence checklist alongside cybersecurity and data privacy?
A Recommended Path Forward
1. Discover and inventory.
Deploy automated cryptographic discovery and inventory (ACDI) tooling that detects legacy algorithms, including RSA, ECC, RC4, and deprecated TLS, alongside modern PQC, including ML-KEM and hybrid key exchanges. A spreadsheet is not an inventory.
2. Score and prioritize.
Rank exposure by data shelf life, attacker exposure, and business impact, the framework adopted by Europol’s Quantum Safe Financial Forum. Not all cryptography carries equal risk.
3. Capture early wins.
Move to TLS 1.3 with hybrid PQC key exchange where supported. Most modern browsers, load balancers, and CDNs already negotiate it.
4. Plan the hard migration.
Sequence core banking, payment rails, HSMs, and certificate authorities. Build PQC requirements into procurement and vendor renewals. Treat a Cryptography Bill of Materials (CBOM) as you would an SBOM.
5. Govern continuously.
Quantum readiness is a posture, not a project: continuous monitoring, board reporting, and audit-ready evidence.
A Call to the Board
Banking has always been a business of managing risks that materialize over decades, not quarters.
The institutions I most admire have one thing in common: they were honest with their boards about emerging risk before the regulator made them.
Quantum readiness is the next test.
Institutions that begin cryptographic discovery in 2026 will have time to migrate deliberately, defend their data, and answer their regulators with confidence. Institutions that wait will be answering very different questions, in a very different room.
Directors should not need to become cryptographers. They do need to ask three questions at their next risk committee:
What do we encrypt? What is protecting it today? And what is our plan to replace it before our adversaries can read it?
The constraint is time, not technology. The tools exist. The standards are published. The roadmap is written.
What remains is leadership.
Ready to Start the Conversation?
If you are interested in learning more about quantum readiness and how your organization can prepare, contact Gail Letts, CEO & Founder of LETTS CONSULT, at gl****@***********lt.com.
Sources: G7 Cyber Expert Group PQC Roadmap (January 2026); European Commission PQC Coordinated Implementation Roadmap; NIST FIPS 203/204/205; CNSA 2.0; FINRA Quantum Implications Report; Europol Quantum Safe Financial Forum; Google Security Engineering announcement (March 25, 2026); Cloudflare post-quantum roadmap update (March 2026); Tychon LLC research and field deployments across federal and enterprise environments.