The Financial Conduct Authority told UK financial firms on 4 November to start preparing for post-quantum cryptography now, and set the National Cyber Security Centre’s three dates as the frame: a migration plan by 2028, priority migrations by 2031 and every system by 2035.
What the FCA said
The message came in a blog by Mark Francis, the FCA’s director of specialists. He wrote that “Quantum computing will bring significant opportunities to the UK financial sector, but firms need to act now to prepare for a world where a viable hostile quantum computer could break today’s widely used cryptography standards.” The blog gives no date for such a machine and says the regulator does not know for certain when one will emerge, only that the coming years will likely see rapid advances.
Francis described cryptography as what lets firms protect client data, verify who they are dealing with and maintain trust in their systems. Without it, he wrote, consumers would face fraud, firms would suffer operational disruption and the integrity of financial transactions and markets would be at risk. His reading of the work ahead is that it will take “significant time, investment and effort” for most firms.
Advertisement
Three dates, one starting task
The FCA points firms to the NCSC’s timelines for migration to post-quantum cryptography. By 2028, organisations define migration goals, run a full discovery exercise across the services and infrastructure that depend on cryptography, and build an initial plan. By 2031 they carry out the earliest, highest-priority migration work and refine the plan into a roadmap. By 2035 they complete migration of all systems, services and products. The NCSC adds that a small set of rarely used technologies may be harder to move by 2035.
The FCA says firms should not wait for those milestones where it is safe to be ready sooner. It lists three things it expects now. Firms should have a thorough and accurate understanding of the cryptography in place across their systems and information. They should set clear, achievable, safe and risk-based migration objectives. And they should implement migration plans while they monitor, test and validate the changes, adjusting as needed.
The first of those is an inventory, which matches the discovery exercise in the NCSC’s 2028 milestone. A firm that cannot list where public-key cryptography sits in its payment engines, card tokenisation, API gateways, signing services and vendor integrations cannot rank what to move first.
The FCA’s tooling and what comes next
The regulator is trialling a supervisory self-assessment tool with an initial sample of firms and intends to extend it to others in due course. The tool is meant to let firms assess how mature their plans are and to show the FCA how prepared the industry is. The trial is also meant to surface common challenges and examples of good practice, which the FCA intends to share with the sector.
The FCA also says it will consult on cyber resilience guidance, including its expectations for how firms address post-quantum risk through their cryptographic controls. It points to the Cyber Coordination Groups, the Cross Market Operational Resilience Group and trade bodies as the channels for engagement. It shared insights from firms in April 2026 and says it will continue to do so.
How it sits with the G7 roadmap
The January 2026 G7 Cyber Expert Group statement on the financial sector sets out six phases: awareness and preparation, discovery and inventory, risk assessment and planning, migration execution, migration testing, and validation and monitoring. It says plainly that it sets neither guidance nor regulatory expectations, and that the phases need not run in a straight line. The group also encourages cryptographic agility, so that firms can swap in new algorithms as standards change.
The NCSC gives indicative dates for UK industry, government and regulators. The G7 group gives a shared vocabulary. The FCA adds a supervisory step by trialling a way to see how far each firm has got.
What it means for the finance leader
For a CFO, treasurer or head of payments at a bank or fintech, the practical effect is a budget line and a vendor question. The NCSC says the total financial cost of migration could be significant and that organisations should budget for preparatory work as well as the migration itself. The FCA asks senior managers to ensure their firms allocate “enough time, investment and resources to manage PQC migration safely and meet the relevant deadlines.” The blog also notes that failed change projects accounted for around a fifth of all incidents reported to it in 2025, which is the regulator’s own reason for wanting the work staged and tested.
Vendor dependence is the other exposure. The G7 statement says obtaining detailed vendor roadmaps for specific cloud and cryptographic services can be essential to planning, and that collaboration with third parties is especially useful for smaller institutions with higher vendor dependency. A firm that buys its core, card processing or cloud hosting from others will need those suppliers’ migration dates in writing before it can finish its own plan. Earlier FinTech Edition coverage touches the same dependency in our piece on bank AI agents sold on old cores and in our opinion on the US Treasury quantum task force.
In our reading, the 2028 discovery deadline drives budgets, because every later step depends on the inventory. A firm that starts the inventory in 2027 leaves one year to find every certificate, key store and third-party library before the first milestone.
What to watch
Three things will show how binding this becomes: whether the FCA publishes the self-assessment tool beyond its initial sample, the timing and wording of its consultation on cyber resilience guidance, and whether the best practice examples it promised name specific cryptographic controls. Firms with an inventory under way before the consultation opens will be better placed to comment on it and to meet whatever it asks.
Source: FCA
