The answer, up front
Quantum readiness is no longer a research topic for banks. It is becoming a supervised expectation. The G7 Cyber Expert Group, co-chaired by the U.S. Treasury and the Bank of England, published a roadmap in January 2026 that targets 2035 for the financial sector overall and 2030 to 2032 for the most critical systems 1, 2. In July 2026 the European Central Bank told the largest eurozone banks that adoption of post-quantum cryptography must start now 4. The direction is clear: regulators expect financial firms to inventory their cryptography and plan the migration, and they are starting to ask for proof.
What the G7 roadmap sets
The G7 roadmap is guidance, not a binding rule, but financial authorities from the G7 and the EU helped write it, so supervisors are likely to treat it as a benchmark 1. It sets 2035 as the overall transition target for the sector and prioritizes the most critical systems in a 2030 to 2032 window 1. It lays out six activities: awareness and preparation, discovery and inventory, risk assessment and planning, migration execution, migration testing, and validation and monitoring 1. The stated reason is harvest-now-decrypt-later risk, where an attacker copies encrypted data today and decrypts it once a capable quantum computer exists 2.
Why DORA already makes this a current duty
In the European Union, the duty is not waiting for a new law. The Digital Operational Resilience Act (DORA) has applied to financial firms since January 2025 and governs how they manage information and communication technology risk 3. DORA sets no post-quantum deadline of its own, but its encryption and key-management duties sit in delegated technical standards whose recital refers to quantum threats. Supervisors use DORA as the legal anchor for cryptographic resilience. In practice, that means a bank can be asked how it would respond when cryptanalysis advances, and "we have not looked" is not a defensible answer.
The ECB signal
The ECB's July 2026 letter to significant institutions focused on AI-enabled cyber threats, but it closed by saying that post-quantum cryptography adoption must start now and needs sustained strategic investment, and it promised a separate supervisory letter on quantum risk 4. For boards, that is the tell: a dated, named quantum expectation is coming through the same supervisory channel that already carries DORA.
What this means for financial institutions
Firms that have already built a cryptographic inventory and a risk-based priority list will be ready when the questions arrive. Those that have not should expect to explain why.
ArcQubit guidance: treat the inventory as the foundation. Map where public-key cryptography lives across systems, data and third-party providers, rank exposure by data shelf life and business impact, and build the ability to change algorithms without rebuilding systems. These steps satisfy the G7 roadmap's early phases and the DORA duty to manage cryptographic risk at the same time.
How ArcQubit approaches it
ArcQubit treats this as a sustained program, not a one-time project. QuCode delivers the discovery and cryptographic inventory that the G7 roadmap and DORA both assume, and QuTrust acts as the system of record for the migration so a bank can show supervisors a current, defensible plan rather than a stale snapshot.