Post-Quantum Readiness For PCI DSS Teams: Card Payments, POS And E-Commerce

Teams responsible for PCI DSS already track a great deal of cryptography: the protocols protecting cardholder data in transit, the keys in hardware security modules, the certificates on payment pages. That makes them well placed to lead post-quantum readiness for the payment estate. It also raises a practical question: which parts of card payments are actually exposed to a future quantum computer, and which can wait?

This article answers that question using the most detailed public analysis available as of October 2026, Europol’s 2026 report on prioritising post-quantum migration in financial services, which is published under a CC BY 4.0 licence.¹ It then sets out work PCI DSS teams can start now. For what PCI DSS itself requires on cryptography, see the PCI DSS cryptographic inventory article in the Cryptography Compliance section, which covers the requirement text and dates.

Where Public-Key Cryptography Sits In A Card Payment

Card payments mix two kinds of cryptography. Symmetric cryptography, where both sides share a secret key, is not broken by quantum computers in the same way. NIST’s draft transition guidance treats approved symmetric algorithms with at least 128-bit security, such as AES-128 and above, as meeting its lowest post-quantum security category.² Public-key cryptography, used for signatures and key agreement, is the part at risk. The Europol report describes how each is used in a typical point-of-sale transaction.¹

Citing EMVCo, which maintains the EMV chip specifications, the report identifies the main quantum threat to cards as recovery of a payment system or issuer private key. That would let an attacker produce counterfeit cards accepted for offline payments.¹ Online authorisation, the dominant case, relies on symmetric cryptography and is not exposed in the same way. EMVCo’s own analysis, updated on 24 August 2026, takes the same view of where the exposure lies, says it does not expect quantum computing to threaten EMV infrastructure until at least 2040, and says it is considering how to reduce the risk for offline transactions.³

E-commerce is different. Payment pages and banking websites use TLS, whose key exchange is exposed to harvest now, decrypt later attacks. The report notes that data sent through such sites may be subject to retention requirements of several years, giving seven years in some jurisdictions as an example, which raises its shelf life.¹

Why Point Of Sale Needs Early Planning

Europol’s report scores offline card authentication at the point of sale with its prioritisation framework, which the prioritisation article explains in full.

The result is a medium-risk use case that the report still rates as high priority, because of its long dependencies and the cost of replacing terminals before the end of their planned life.¹ Considering post-quantum hardware requirements early means new terminals bought in normal refresh cycles can be ready, rather than replaced again later.

For public websites, the same report finds the opposite pattern: medium risk but low migration time, because hybrid post-quantum key exchange is already widely supported.¹ The no-regret moves article covers how to enable it.

Practical Work For PCI DSS Teams

The report recommends several immediate actions for point of sale.¹ Combined with the general inventory and website guidance in this section, they give PCI DSS teams a concrete work list.

1. Inventory the public-key infrastructure in card payment processes. Record which keys and certificates support offline authentication, terminal management and connections to acquirers and processors, with owners and expiry dates. The inventory article describes what to capture.
2. Assess your reliance on offline payments. Understand where offline authorisation is used, including as a fallback during outages, and the impact a compromised signing key would have.
3. Map the supply chain. List terminal makers, payment service providers, acquirers and processors, and track each one’s post-quantum roadmap.
4. Consider interim controls. The report suggests evaluating mitigations such as enforcing online verification or adding detective controls for offline fraud.
5. Join industry coordination. The report calls for a shared transition timeline across financial institutions, vendors and standards bodies.
6. Pilot hybrid TLS on e-commerce front ends. Check the roadmaps of web servers, proxies, firewalls and CDNs in front of payment pages, test on a non-critical site, then roll out.
7. Add post-quantum requirements to procurement. Terminals, HSMs and network appliances bought in the next refresh cycle may still be in service in the 2030s, when official timelines expect migration to be finished. As of January 2026, CISA lists hardware security modules and networking equipment among product categories still transitioning to post-quantum standards, so ask suppliers for dated roadmaps.⁴

How This Fits With Compliance

Post-quantum readiness and PCI DSS compliance share the same foundation: knowing which cryptography protects cardholder data, where it runs and who maintains it. Building the inventory once and using it for both purposes avoids duplicated effort. The exact PCI DSS requirements, and other financial sector rules such as DORA, are covered in Cryptography Compliance, with dates in the Regulatory Deadline Tracker.