Bank of Israel orders banks to submit quantum preparedness plans
7 JANUARY 2025, TEL AVIV
The Bank of Israel's Banking Supervision Department ordered banks to submit quantum preparedness plans within one year, in Letter 202501 dated 7 January 2025. That timing made initial plans due by 7 January 2026. The letter ties to Directive 364 and places the harvest-now-decrypt-later threat at the centre of its reasoning.
Harvest-now-decrypt-later drives the urgency. An adversary can record encrypted data today and decrypt it once a quantum computer can break the encryption, so a bank's long-lived sensitive data is already exposed even before such a computer exists. By centring that threat, the letter frames preparedness as a present obligation rather than a future one.
The legal basis comes from Directive 364. Issued in November 2024, the directive consolidates earlier directives and provides the supervisory foundation on which the Bank of Israel builds the quantum requirement. The directive does not mention quantum itself, so the letter supplies the quantum-specific expectation while the directive supplies the authority behind it.
Why it matters. The Bank of Israel moved early and concretely, ordering banks to produce quantum preparedness plans on a one-year clock rather than issuing open-ended guidance. Its focus on harvest-now-decrypt-later tells banks the risk to long-lived data is current. Banks subject to the letter needed a credible plan by January 2026, and the inventory and prioritisation behind such a plan remain the practical starting point.