UK regulator urges banks to get their encryption ready for quantum computers

On November 4, Mark Francis, director of specialists at the Financial Conduct Authority (FCA), the UK financial watchdog, published a blog post with a blunt title: Act now to be resilient in the quantum future. It is addressed to the financial firms the FCA supervises. Their move to post-quantum cryptography, designed to withstand future quantum computers, must start without delay.

The reason is well known: a powerful enough quantum computer could break widely used encryption methods. “We do not know with certainty when a viable quantum computer will emerge,” the FCA acknowledges. But for most firms, it warns, migration will take a great deal of time, investment and effort.

Three dates borrowed from the UK cybersecurity agency

The FCA does not set its own timeline. It adopts that of the National Cyber Security Centre (NCSC), the UK counterpart of ANSSI (France's national cybersecurity agency). It calls for an initial migration plan by 2028, priority migrations completed by 2031, and all systems, services and products moved to post-quantum by 2035. The FCA immediately adds that firms should not wait for these deadlines to act, and should be ready earlier where it can be done safely.

These dates should be read for what they are: NCSC recommendations, which the FCA presents as its expectations. They are not a binding rule backed by penalties. The regulator does, however, ask senior leaders to devote enough time, money and staff to meet the deadlines.

What the FCA expects in practice

The post sets out three expectations, which make a good starting list for any organization:

• knowing where cryptography is used in its systems and data;
• setting clear, achievable, safe and risk-based migration goals;
• implementing the plan, then monitoring, testing, validating and adjusting it.

To track progress, the FCA is piloting a self-assessment tool with a first group of firms, which it plans to expand later. It also announces a consultation on cyber resilience guidance, which will clarify how to handle quantum risk in cryptographic controls. No date is given.

The danger of a botched migration

Why so much emphasis on the word “safe”? The FCA offers a figure: in 2025, about one in five incidents reported to it came from a failed change project. Cryptography, it reminds readers, helps firms protect their customers' data and verify who they are dealing with; without it, the integrity of financial transactions would be at risk. A rushed switchover could cause the very outage it was meant to prevent.

The next day, November 5, the same regulator showed the other side of the issue. It invited UK firms, vendors and labs to test, on a synthetic dataset, whether quantum computing can better detect money laundering and fraud. Registration is open until December 31, and work is due to begin in the first quarter of 2027.

For a French reader, this timeline resembles the European Union's, which Germany has adopted as its own: 2030 for the most sensitive uses, then 2035. To know where to start, taking inventory remains the first step, as our six-step guide explains. The next milestone to watch in London is the text of the consultation, which will show whether the FCA's expectations become formal guidance.