What Financial Supervisors Are Signalling On Quantum Risk

Banks and other financial institutions depend on cryptography for payments, trading, customer authentication and links with each other. That makes the sector a natural focus for quantum risk, and financial supervisors have been publishing on it since early 2024. Their documents range from statements that set no expectations to circulars with dates.

This article compares the main supervisory signals as of October 2026. It focuses on what each issuer asks for, how binding it is, and what that tells a financial institution about the direction of travel. DORA’s binding cryptography rules for EU firms are covered in a separate article in this section.

The Shared Message

Read together, these documents send a consistent message. Quantum risk needs attention from senior management and the board, an inventory of cryptographic assets and a risk assessment come early, and firms should plan for crypto-agility, meaning the ability to change algorithms without rebuilding systems. Where they differ is in how firmly they say it and whether they attach dates.

International Reference Points: The G7 And Europol

The G7 Cyber Expert Group advises G7 finance ministers and central bank governors on cybersecurity. Its September 2024 statement described the benefits and risks of quantum computing. Its January 2026 roadmap goes further and sets out six phases: awareness and preparation, discovery and inventory, risk assessment and planning, migration execution, migration testing, and validation and monitoring.¹

The roadmap is careful about its status. It states that it does not set guidance or regulatory expectations and that its timelines are not prescriptive. It notes that guidance in several jurisdictions often points to 2035, and suggests that addressing the most critical systems in 2030 to 2032 would limit the risk of the threat arriving early.¹ Its value is as a common reference that national supervisors can build on.

In Europe, Europol’s Quantum Safe Financial Forum issued a call to action on 7 February 2025 urging financial institutions and policymakers to prioritise the move to quantum-safe cryptography.² It carries no legal force, and the G7 group lists the forum among the sources it drew on.¹

Asia Pacific And Canada: MAS, The HKMA And OSFI

The Monetary Authority of Singapore issued its advisory, MAS/TCRS/2024/01, on 20 February 2024, addressed to the chief executives of all financial institutions.³ It asks institutions to consider a set of measures under three headings: keeping up with quantum developments, maintaining an inventory of cryptographic assets, and building strategies and skills.

The inventory guidance is unusually specific. MAS suggests recording the algorithm and key length, who owns and maintains each cryptographic asset, and the system or application where it is used. It also suggests classifying dependent IT and data assets by sensitivity, criticality, risk exposure and how long they stay sensitive, so that migration can be prioritised. The advisory is supplementary to MAS’s technology risk management notices and guidelines.³

MAS has since signalled firmer expectations. On 28 July 2026 its managing director said MAS would issue supervisory expectations later in 2026, with milestones and timelines covering cryptographic asset inventories, migration priorities, technical capabilities and governance, and that MAS aims for financial institutions to reach quantum resilience before the end of this decade.⁴ Readers should check the MAS website to see whether those expectations have since been issued; the 2024 advisory is the MAS text that this article describes in detail.

On 27 July 2026 the Hong Kong Monetary Authority launched a whitepaper on the quantum preparedness of Hong Kong’s banking sector, together with its first Quantum Preparedness Index. The initial score was 2.3 out of 10, which the HKMA describes as an early stage of preparedness. It aims for full sector readiness by 2030 and is co-developing a toolkit to help banks identify transition priorities and improve crypto-agility.⁵ That 2030 date is the HKMA’s own objective, not a deadline imposed on banks.

In March 2026 Canada’s Office of the Superintendent of Financial Institutions (OSFI) published a technology risk bulletin on quantum readiness phases and timelines. It describes five phases: building competency and awareness, inventorying cryptographic assets, assessing risk and planning the migration, carrying out the transition, and testing and validating the result.⁶ It notes that guidance from other authorities generally points to quantum readiness across all systems by 2035, rather than setting that date itself. OSFI states that its technology risk bulletins are not regulatory expectations; they describe sound practices that institutions can apply at their discretion.⁷

SAMA In Saudi Arabia

SAMA’s circular 482021280, dated 27 August 2026, is the most specific supervisory instrument in this group. It requires SAMA-supervised financial institutions to do four things.⁸

1. Carry out an enterprise-level assessment of quantum computing risks, with action plans, by the end of Q1 2027.
2. Make sure their procedures for identifying and classifying all cryptographic assets are accurate and comprehensive, by the end of Q4 2026.
3. Build plans to reach the required cryptographic resilience for priority assets, based on that classification. No date is given.
4. Make quantum risk a standing monitoring item for the Information Security Supervisory Committee and the Risk Committee, with challenges and recommendations reported to the board.

FINMA In Switzerland

FINMA Guidance 05/2026, published on 9 July 2026, combines survey findings with recommendations.⁹ Only 8 percent of the institutions surveyed had a specific roadmap for quantum-safe cryptography. FINMA recommends that the work rest on a strategy adopted by the board of directors, that target dates be set for both critical processes and complete migration, and that a roadmap for post-quantum cryptography (PQC) be drawn up by mid-2027 at the latest.

FINMA sees a risk analysis as the first step, covering both the cryptographic methods in use and the critical data that needs long-term protection. To support it, FINMA asks institutions to analyse their business processes to identify the encryption, signature and authentication technologies in use. It expects that analysis to cover every information and communication technology (ICT) system, whether run in-house, outsourced or bought as a service, and to produce a comprehensive inventory that is kept current.⁹

What Firms Can Take From This

Three practical points follow for a financial institution anywhere.

First, start the inventory early. Every issuer above that gives operational guidance puts it among the first tasks, alongside a risk assessment, and SAMA attaches dates to both. Second, give the board a role. SAMA requires board committee oversight and FINMA recommends a board-adopted strategy. Third, cover third parties. The G7 roadmap and FINMA both stress dependencies on vendors and outsourced services, which are often where cryptography is hardest to see.