Quantum Risk In Banking: Five Priorities For Readiness

(MENAFN- Mid-East Info) By Alain Sanchez, EMEA CISO, Fortinet Borderless Finance. AI-Native.

Your digital companion for smarter everyday choices. Built for how you live, earn, and grow. Move money at your pace with AI-powered finance, all in one tap.

Join the waiting list. Earn

Recent conversations with financial-services CISOs across Middle East, African and Europe have reinforced one point: banking relies on cryptography. It authenticates customers and devices, protects payments and sessions, and proves, through certificates, that an application is legitimate. Quantum computing threatens each of these building blocks. That makes quantum readiness a resilience issue banks need to address now.

Encrypted banking traffic can be stolen now and read later. Nation states and criminal groups can collect this traffic and store it until a cryptographically relevant quantum computer (CRQC) is able to break RSA and ECC, the public-key algorithms that banking services depend on. The strategy is called harvest now, decrypt later (HNDL).

At CISO 500 in Riyadh, one message was clear: the window for preparation may be considerably shorter than the migration itself. For banks, that is the important point. A cryptographic migration of this scale takes years.

Why Now?

A few specifics make banks particularly exposed. Their data must remain confidential for decades, and their architecture is complex, resulting from generations of network enhancements. As a result, any change to the cryptography of live banking and payment services is slow and carries operational risk.

A cryptographic migration of this scale takes years.

A banking service is a constant exchange between applications, infrastructure, and third parties. Each exchange travels encrypted across WAN and VPN links, SD-WAN, cloud connections, APIs, and east-west traffic inside the data center. Data in motion is therefore one of the highest priority areas of exposure.

Quantum readiness cannot run as an isolated project. It must follow a regulatory framework that is taking shape quickly, and it must be built into the programs European banks already prioritize: risk governance, AI transformation, payments modernization, and operational resilience. Research cited in the Fortinet European Banking Cybersecurity Report 2026 found that 61% of banks have no post-quantum cryptography (PQC) roadmap.

The Migration Journey:

For a tier one bank, post-quantum migration touches the entire infrastructure, from core systems to the third-party supply chain.

“I simply cannot afford a migration that interrupts critical services,” a CISO told me last month. What this CISO is asking for is crypto-agility, the ability to replace cryptographic algorithms without disrupting live systems. Crypto-agility also removes the need to predict when a CRQC will arrive, since the bank can adapt as standards and regulatory deadlines evolve. In practice, this means a controlled migration based on hybrid cryptography, where classical and post-quantum algorithms run in parallel.

NIST has standardized its first post-quantum algorithms, giving financial institutions a clearer basis on which to plan their transition.

Five Steps:

Identify Critical Data and Its Flows

Not all data carries the same risk. Start with data that combines high business value with long-term confidentiality requirements, then map every application and network path that carries it, beginning with the applications at the core of value creation. This map shows where exposure is highest and offers a prioritization scheme that is specific to each bank.

Build Crypto-Agility

Crypto-agility allows algorithms to be replaced step by step while services stay on. It also prevents disruptions as obsolete algorithms are retired.

Preserve Trust

Transaction integrity depends on being certain of who sent an instruction. Certificates and digital identities will not remain unbreakable. Banks have to give them quantum-safe protection.

Extend Readiness

Cloud platforms, open banking APIs, real-time data, and enterprise AI all move more sensitive data across more connections, and each new program adds cryptographic dependencies. Building quantum readiness into these programs helps prevent today's transformation programs from creating tomorrow's cryptographic technical debt.

Make It a Board Priority

The board needs visibility of quantum exposure, potential service impact and the migration strategy. The scale of the transition will create hurdles that only active executive sponsorship can overcome. The Bank of England made the point in its July 2026 Financial Stability Report: given the scale of the transition to post-quantum cryptography, banks need to plan now, and quantum risk management belongs within operational resilience. For boards, the relevant question is therefore not when the first CRQC arrives, but whether the bank can make an orderly transition without compromising confidentiality, trust or service availability.

The board needs visibility of quantum exposure, potential service impact and the migration strategy.

The most effective approach is to treat post-quantum readiness as part of existing resilience and infrastructure modernization, rather than as a standalone technology programme. That is the approach we are developing with banking customers today.

What matters now is having a migration path that protects long-lived data and trust while preserving the availability of critical banking services.

MENAFN14102026005446012082ID1111805895