Saudi Arabia: SAMA's Quantum Deadlines For Banks And The NCA's Cryptography Rules

Most post-quantum dates covered in this group are guidance or apply only to government systems. Saudi Arabia is different. On 27 August 2026 the Saudi Central Bank (SAMA) issued a circular that gives every institution it supervises two dated quantum duties: classify cryptographic assets by the end of 2026 and complete a quantum risk assessment by the end of March 2027.¹ As of October 2026, research for this group found no other binding instrument that sets dated post-quantum duties for a whole financial sector.

The circular did not arrive in a vacuum. Many Saudi entities already work under binding cryptography controls from the National Cybersecurity Authority (NCA), and all SAMA member organisations under SAMA’s own Cyber Security Framework. This article explains the circular, the controls beneath it, and what the time left means in practice. It is general information, not legal advice.

What The SAMA Circular Requires

Circular 482021280, titled “Enhancement of Operational Resilience to Address Quantum Computing Risks”, is listed as in force in the SAMA Rulebook and is addressed to financial institutions under SAMA’s supervision.¹ Status: Binding. It sets four measures:

1. Quantum risk assessment. Carry out an enterprise-level assessment of quantum computing risks, aligned with the institution’s enterprise risk management, covering at least operational, legal, regulatory and strategic risks, including people-related risks, and develop action plans. Deadline: end of the first quarter of 2027.
2. Cryptographic asset procedures. Make sure the procedures for identifying and classifying all cryptographic assets are accurate and comprehensive. That means linking data, systems and services to their cryptographic assets, classifying them by sensitivity and by priority for migration, and assessing the resilience of priority assets, including constraints and third-party dependencies. Deadline: end of the fourth quarter of 2026.
3. Plans for priority assets. Develop plans to reach the required level of cryptographic resilience, or suitable alternatives, for all priority assets. No date is given.
4. Governance. Put quantum risk on the agenda of the Board’s information security and risk committees as a regular item, with challenges and recommendations reported to the Board or its equivalent. No date is given.

The order of the two dates is worth reading carefully. The inventory procedures come first, at the end of 2026, and the risk assessment follows a quarter later. The assessment builds on the classification: you cannot rank quantum exposure across the business without knowing which systems use which cryptography.

The Controls Underneath

SAMA’s circular sits on top of two older layers of binding cryptography controls.

NCA Essential Cybersecurity Controls. The current edition, ECC-2:2024, applies to government entities in the Kingdom and their affiliated companies, and to private sector entities that own, operate or host critical national infrastructure.² Subdomain 2-8 covers cryptography. Entities must identify, document and approve their cryptography requirements, implement them, and review them periodically. Control 2-8-3 says those requirements must include at least the NCA’s National Cryptographic Standards, at a level chosen by the sensitivity of the data and systems, and must cover approved cryptographic solutions, key management through the lifecycle, and encryption of data in transit and at rest. Status: Binding for entities in scope.

NCA National Cryptographic Standards. NCS-1:2020, first issued in July 2020, defines two strength levels: MODERATE, which targets 128-bit security, and ADVANCED, which targets 256-bit security.³ The levels have real consequences. RSA and finite-field Diffie-Hellman need keys of at least 3,072 bits at MODERATE and are not accepted at all at ADVANCED. For TLS 1.3, the only accepted cipher suite at either level is TLS_AES_256_GCM_SHA384. The standard’s post-quantum appendix acknowledges the quantum risk to RSA, DSA and ECDSA, and states that post-quantum cryptography will be considered in upcoming versions of the standard.³ As of October 2026, no final updated edition with post-quantum algorithms was confirmed from the NCA’s site.

SAMA Cyber Security Framework. Section 3.3.9 of SAMA’s framework requires member organisations to define, approve and implement a cryptographic security standard, monitor compliance with it, and periodically evaluate the effectiveness of cryptographic controls.⁴ The standard must list approved solutions and their restrictions, say when they apply, and cover key management, including lifecycle, archiving and recovery. Status: Binding for SAMA member organisations.

Why Saudi Arabia Stands Out

Two features make the Saudi position unusual. The first is the combination of a binding instrument with near-term dates. The other financial supervisors covered in this group mostly recommend: Switzerland’s FINMA recommends a roadmap by mid-2027,⁵ and Singapore’s MAS has said it will issue expectations with milestones later in 2026.⁶ The second is that the NCA standards already link the choice of algorithm to the sensitivity of the data. At the ADVANCED level, RSA and finite-field Diffie-Hellman are not accepted, but elliptic curve algorithms are, and those are just as exposed to a future quantum computer.³ Choosing ADVANCED therefore does not remove the post-quantum work.

The neighbouring comparison is the UAE, where the National Encryption Policy describes what a post-quantum transition plan should contain in more detail but sets no date. See the UAE article and the overview of post-quantum and cyber regulation in 2026.

Working Back From The Deadlines

With the end of 2026 close, the inventory duty is the immediate one. The circular asks for procedures that are accurate and comprehensive, so two kinds of evidence follow from the wording: the method for finding cryptographic assets, and the classified result, ranked by sensitivity and migration priority. Institutions that already maintain a cipher suite inventory for PCI DSS requirement 12.3.3 or a certificate register for other regimes have a starting point, though neither covers SAMA’s classification fields on its own. Which Regulators Require A Cryptographic Inventory? compares the fields each regime asks for, and Cryptography Compliance covers PCI DSS and DORA in depth.

Saudi AI rules, including SDAIA’s frameworks, are outside this article; see AI rules in the UAE and Saudi Arabia in the AI Governance group.