Financial services must start preparing for a post-quantum future now, not when the technology arrives at scale, writes the Global Financial Markets Association (GFMA) in a recent paper. The potential for existing encryption methods to be compromised within the next 5 – 10 years has already catalyzed concern and action across a number of financial entities, global regulatory, and industry bodies.
For every financial entity, the threat quantum computers present to encryption raises urgent questions regarding data protection, the risk of disruption to critical operations, and the resilience of the sector overall in an increasingly digitized financial ecosystem. Without action, banks will undoubtedly be caught out by the advent of cryptographically-relevant quantum computers and its inevitable misuse by malicious actors to break encryption to access sensitive data. To mitigate this risk, financial entities must prepare by transitioning to post-quantum cryptography.
In response, GFMA have convened a series of expert-led roundtables, to draw out and map the activities of institutions including the US National Institute of Standards and Technology (NIST), the UK Financial Conduct Authority (FCA), the World Economic Forum (WEF), the Bank of England’s Cross Market Operational Resilience Group (CMORG), and the Quantum Safe Financial Forum (QSFF). Other bodies, such as FS-ISAC, are also active in this space.
The paper provides a summary of the emerging landscape and proposes a set of collective next steps as financial entities endeavor to understand, prepare for, and ultimately transition to systems that are resistant to quantum attacks. The recommendations outlined herein reflect both the publicly available guidance, and the industry concerns shared during the GFMA sessions on preparing for quantum readiness.
In related news, the Wall Street Journal reported that several quantum computing companies are in talks with the US administration for equity stakes in exchange for federal funding, a signal of expanding interventions in segments considered critical.