Australia's APRA signals tougher quantum supervision
24 JUNE 2026, SYDNEY
The Australian Prudential Regulation Authority signalled tougher quantum supervision on 24 June 2026. It told regulated financial firms to map their cryptographic dependencies, including those of third parties. Rather than issue a new quantum-specific rule, APRA uses its existing prudential standards CPS 234 and CPS 230 as the hooks for the expectation.
Those two standards already bind regulated firms. CPS 234 covers information security and CPS 230 covers operational risk, so APRA can supervise quantum readiness through them without waiting for a dedicated regulation. This mirrors how other supervisors, such as those using DORA in Europe, anchor cryptographic expectations in standing operational-resilience rules.
The emphasis on third parties is deliberate. A firm's cryptographic risk extends to the vendors and services it relies on, so mapping only internal systems would miss exposure that sits with external providers. Because financial firms depend heavily on third parties for critical functions, APRA wants that dependency chain included in the cryptographic picture.
Why it matters. APRA has put quantum readiness squarely inside its existing supervision, using CPS 234 and CPS 230 so firms cannot treat it as a future concern without a current hook. The focus on third-party dependencies means a firm's inventory must reach beyond its own systems. Regulated firms that map their full cryptographic footprint, vendors included, will be ready to answer APRA's questions as supervision tightens.