The Financial Conduct Authority (FCA) has urged UK financial firms to act now to prepare for a future in which a viable hostile quantum computer could break the cryptography standards widely used today. In a blog post, the regulator says firms should start planning their move to post-quantum cryptography (PQC) without waiting for official deadlines.
Security underpins finance. According to the FCA, the financial sector depends on secure information and communication. Cryptography, of which encryption is just one part, helps firms protect client data, verify who they are dealing with and maintain trust in their systems. Sufficiently powerful quantum computers, the regulator warns, pose a real threat to that security.
Without trustworthy cryptography, consumers would face fraud, firms would suffer operational disruption, and the integrity of financial transactions and markets would be put at risk.
No fixed date. The FCA admits it does not know for certain when a viable quantum computer will emerge, but expects the technology to advance rapidly in the coming years. Preparing means understanding where and how cryptography is used and migrating all hardware and software to PQC while managing operational risks. For most firms, it says, this will require significant time, investment and effort.
The timeline firms are working to
- By 2028: complete a PQC migration plan, as recommended by the National Cyber Security Centre (NCSC).
- By 2031: carry out high-priority migration activities.
- By 2035: migrate all systems, services and products to PQC.
- Now: map existing cryptography, set risk-based migration goals, then implement, test and validate the changes.
Do not wait. The regulator stresses that firms should not hold off until these milestones and, where it is safe to do so, should aim to be ready sooner. Senior managers are expected to allocate enough time, investment and resources to manage the migration safely. The FCA points out that failed change projects accounted for around a fifth of all incidents reported to it in 2025.
Supervisory support. The FCA is trialling a new supervisory self-assessment tool with an initial sample of firms and plans to extend it to others. The tool is meant to help firms gauge the maturity of their plans and give the regulator a picture of industry preparedness. It also intends to share common challenges and good practice, after publishing firm insights in April 2026, and will keep engaging through its Cyber Coordination Groups and the Cross Market Operational Resilience Group.
Why it matters. The FCA will also consult on cyber resilience guidance, including its expectations for how firms should address PQC risks through their cryptographic controls. For consumers, the concern is straightforward: if the cryptography protecting payments and identity checks fails, the door opens to fraud on a large scale.
Source: Financial Conduct Authority (UK)
Leave a Reply