The answer, up front
Financial regulators across several jurisdictions now point banks in the same direction: start the post-quantum transition now, build a cryptographic inventory, and rank systems by risk. The Bank for International Settlements set that tone in July 2025, a Europol-linked framework published in early 2026 gives banks a method for deciding what moves first, and Singapore's regulator signaled formal supervisory expectations later in 2026. This is one of the best-covered sectors, though two of the three sources are secondary trade coverage of regulator work.
The BIS roadmap
The Bank for International Settlements told the financial system in July 2025 to start the transition now, with broad awareness and a cryptographic inventory as foundations 1. Its roadmap presents post-quantum cryptography as the viable near-term solution, stresses crypto agility, defense-in-depth, hybrid models and phased migration, and describes quantum key distribution as promising but limited by infrastructure today 1. As the central banks' own forum, the BIS signals how supervisors are likely to think, even though the paper is not a rule.
A way to rank the work
Europe supplied a method for sequencing. Help Net Security reported in January 2026 on a framework linked to Europol and a financial-sector forum that gives each system a Quantum Risk Score built from three factors scored 1 to 3, shelf life of the protected data, exposure and business impact, plus a separate Migration Time Score based on solution maturity, implementation effort and external dependencies 2. Combining the two yields a high, medium or low priority matrix 2. The framework flags point-of-sale payment systems as long-range challenges because of multi-year hardware cycles, while public websites are early candidates since hybrid post-quantum TLS already exists in major browsers and content delivery networks 2.
Singapore's signal
Singapore is the clearest regional signal. Trade coverage in August 2026 reported that the Monetary Authority of Singapore plans to issue formal supervisory expectations later in 2026, aiming for financial institutions to reach quantum resilience before the end of the decade, through three parts: cryptographic asset inventories, prioritized migration plans, and technical capability with governance 3. That is trade-press coverage of the regulator rather than a published MAS document, so treat the detail as reported.
What this means for banks
The common instruction is unmistakable: inventory first, then prioritize. Banks that build a cryptographic inventory and a risk-ranked migration plan now will be ready when supervisory expectations harden, and they can reuse the BIS and Europol framing to justify sequencing to boards and regulators.
How ArcQubit approaches it
ArcQubit treats the inventory as the foundation these regulators all assume. QuCode delivers the cryptographic discovery and inventory, and QuTrust acts as the system of record for a risk-ranked migration, so a bank can show supervisors a current, defensible plan rather than a stale snapshot.