UK CMORG issues voluntary post-quantum guidance for financial institutions
8 APRIL 2025, LONDON
The Cross Market Operational Resilience Group, CMORG, published voluntary post-quantum guidance for UK financial institutions on 8 April 2025. The guidance sets strategic direction for the sector and aligns with the NCSC and NIST, giving firms a finance-specific view that stays consistent with national and international standards.
The guidance is voluntary. It offers UK financial institutions a shared strategic direction rather than imposing requirements, so firms can use it to coordinate their approach without a regulatory obligation attached to this document. That makes it a reference point the sector can rally around while firmer rules develop elsewhere.
Alignment with the NCSC and NIST is the guidance's key feature. A firm that follows CMORG moves in step with UK national guidance and the international algorithm standards, which avoids steering the sector toward choices that later clash with those authorities. For a sector where firms interconnect heavily, that consistency reduces the risk of fragmented, incompatible migrations.
Why it matters. CMORG gives UK financial institutions a coordinated, finance-specific starting point that does not conflict with the NCSC or NIST. Because it is voluntary, its value depends on firms adopting it, but its alignment with the recognised authorities makes it a low-risk reference for building a migration strategy. Firms can use it to shape plans now, ahead of any firmer supervisory expectations.