[{"data":1,"prerenderedAt":146},["ShallowReactive",2],{"news-\u002Fnews\u002Ffinancial-regulators-quantum-deadlines-2026":3},{"id":4,"title":5,"author":6,"authorTitle":7,"authorUrl":8,"body":9,"canonical":8,"category":100,"date":101,"description":102,"draft":103,"extension":104,"faqs":8,"findingsSource":8,"geo":105,"image":8,"industries":108,"keyFindings":8,"meta":111,"modified":101,"navigation":112,"path":113,"pullquote":8,"recommendations":8,"references":114,"related":127,"seo":134,"seoTitle":135,"signposts":8,"slug":136,"stats":8,"stem":137,"tags":138,"tldr":144,"__hash__":145},"news\u002Fnews\u002Ffinancial-regulators-quantum-deadlines-2026.md","Financial Regulators Are Turning Quantum Risk Into a Supervised Duty","ArcQubit Team","",null,{"type":10,"value":11,"toc":91},"minimark",[12,17,34,38,53,57,64,68,74,78,81,84,88],[13,14,16],"h2",{"id":15},"the-answer-up-front","The answer, up front",[18,19,20,21,25,26,29,30,33],"p",{},"Quantum readiness is no longer a research topic for banks. It is becoming a supervised expectation. The G7 Cyber Expert Group, co-chaired by the U.S. Treasury and the Bank of England, published a roadmap in January 2026 that targets 2035 for the financial sector overall and 2030 to 2032 for the most critical systems ",[22,23,24],"span",{},"1",", ",[22,27,28],{},"2",". In July 2026 the European Central Bank told the largest eurozone banks that adoption of post-quantum cryptography must start now ",[22,31,32],{},"4",". The direction is clear: regulators expect financial firms to inventory their cryptography and plan the migration, and they are starting to ask for proof.",[13,35,37],{"id":36},"what-the-g7-roadmap-sets","What the G7 roadmap sets",[18,39,40,41,43,44,46,47,49,50,52],{},"The G7 roadmap is guidance, not a binding rule, but financial authorities from the G7 and the EU helped write it, so supervisors are likely to treat it as a benchmark ",[22,42,24],{},". It sets 2035 as the overall transition target for the sector and prioritizes the most critical systems in a 2030 to 2032 window ",[22,45,24],{},". It lays out six activities: awareness and preparation, discovery and inventory, risk assessment and planning, migration execution, migration testing, and validation and monitoring ",[22,48,24],{},". The stated reason is harvest-now-decrypt-later risk, where an attacker copies encrypted data today and decrypts it once a capable quantum computer exists ",[22,51,28],{},".",[13,54,56],{"id":55},"why-dora-already-makes-this-a-current-duty","Why DORA already makes this a current duty",[18,58,59,60,63],{},"In the European Union, the duty is not waiting for a new law. The Digital Operational Resilience Act (DORA) has applied to financial firms since January 2025 and governs how they manage information and communication technology risk ",[22,61,62],{},"3",". DORA sets no post-quantum deadline of its own, but its encryption and key-management duties sit in delegated technical standards whose recital refers to quantum threats. Supervisors use DORA as the legal anchor for cryptographic resilience. In practice, that means a bank can be asked how it would respond when cryptanalysis advances, and \"we have not looked\" is not a defensible answer.",[13,65,67],{"id":66},"the-ecb-signal","The ECB signal",[18,69,70,71,73],{},"The ECB's July 2026 letter to significant institutions focused on AI-enabled cyber threats, but it closed by saying that post-quantum cryptography adoption must start now and needs sustained strategic investment, and it promised a separate supervisory letter on quantum risk ",[22,72,32],{},". For boards, that is the tell: a dated, named quantum expectation is coming through the same supervisory channel that already carries DORA.",[13,75,77],{"id":76},"what-this-means-for-financial-institutions","What this means for financial institutions",[18,79,80],{},"Firms that have already built a cryptographic inventory and a risk-based priority list will be ready when the questions arrive. Those that have not should expect to explain why.",[18,82,83],{},"ArcQubit guidance: treat the inventory as the foundation. Map where public-key cryptography lives across systems, data and third-party providers, rank exposure by data shelf life and business impact, and build the ability to change algorithms without rebuilding systems. These steps satisfy the G7 roadmap's early phases and the DORA duty to manage cryptographic risk at the same time.",[13,85,87],{"id":86},"how-arcqubit-approaches-it","How ArcQubit approaches it",[18,89,90],{},"ArcQubit treats this as a sustained program, not a one-time project. QuCode delivers the discovery and cryptographic inventory that the G7 roadmap and DORA both assume, and QuTrust acts as the system of record for the migration so a bank can show supervisors a current, defensible plan rather than a stale snapshot.",{"title":7,"searchDepth":92,"depth":92,"links":93},2,[94,95,96,97,98,99],{"id":15,"depth":92,"text":16},{"id":36,"depth":92,"text":37},{"id":55,"depth":92,"text":56},{"id":66,"depth":92,"text":67},{"id":76,"depth":92,"text":77},{"id":86,"depth":92,"text":87},"Analysis","2026-09-15","The G7 sets 2030-2032 for critical financial systems, DORA anchors crypto duties, and the ECB says post-quantum work must start now. Quantum risk is now supervised.",false,"md",[106,107],"washington-dc","frankfurt",[109,110],"Cross-Sector","Financial Services",{},true,"\u002Fnews\u002Ffinancial-regulators-quantum-deadlines-2026",[115,118,121,124],{"label":116,"url":117},"G7 Cyber Expert Group, \"Advancing a Coordinated Roadmap for the Transition to Post-Quantum Cryptography in the Financial Sector,\" U.S. Department of the Treasury, Jan. 2026.","https:\u002F\u002Fhome.treasury.gov\u002Fsystem\u002Ffiles\u002F136\u002FG7-CEG-Quantum-Roadmap.pdf",{"label":119,"url":120},"U.S. Department of the Treasury, \"G7 Cyber Expert Group Releases Roadmap for Coordinating the Transition to Post-Quantum Cryptography in the Financial Sector,\" Jan. 12, 2026.","https:\u002F\u002Fhome.treasury.gov\u002Fnews\u002Fpress-releases\u002Fsb0355",{"label":122,"url":123},"European Securities and Markets Authority, \"Digital Operational Resilience Act (DORA),\" ESMA, n.d.","https:\u002F\u002Fwww.esma.europa.eu\u002Fesmas-activities\u002Fdigital-finance-and-innovation\u002Fdigital-operational-resilience-act-dora",{"label":125,"url":126},"Allen & Overy Shearman, \"ECB requires significant institutions to address AI-enabled cybersecurity threats,\" Jul. 9, 2026.","https:\u002F\u002Fwww.aoshearman.com\u002Fen\u002Finsights\u002Fecb-requires-significant-institutions-to-address-ai-enabled-cybersecurity-threats",[128,131],{"label":129,"url":130},"One Clock, Three Jurisdictions: How the U.S., UK, and EU Deadlines Line Up","\u002Fnews\u002Fus-uk-eu-post-quantum-deadlines-aligned",{"label":132,"url":133},"2028 Is the Post-Quantum Deadline Nobody Is Talking About","\u002Fnews\u002F2028-the-post-quantum-deadline-nobody-is-talking-about",{"title":5,"description":102},"Financial Regulators Set Quantum Deadlines","financial-regulators-quantum-deadlines-2026","news\u002Ffinancial-regulators-quantum-deadlines-2026",[139,140,141,142,143],"financial services","DORA","PQC migration","quantum readiness","for CISOs","The G7 financial roadmap targets 2030 to 2032 for critical systems and the ECB told eurozone banks that post-quantum migration must start now, which turns quantum readiness from a research topic into a supervised expectation.","YZSKjjJVNISVl1Xz4NHqOrZAunsLDIUY1ZBlEWjFJWE",1792182884973]