Act now to be resilient in the quantum future

A sufficiently capable quantum computer could undermine current public-key cryptography, threatening data confidentiality, identity verification, transaction integrity and market trust. Although the FCA has not set a fixed compliance deadline, its message is clear: firms should start PQC readiness now rather than wait for the threat to materialise. For compliance teams, this is an operational resilience and cyber-risk governance matter, not just an IT project.

Firms should be able to evidence board oversight, a cryptographic inventory, third-party dependencies, prioritised migration plans and tested contingency arrangements. RegCanary expects supervisors to ask about quantum risk in resilience and technology discussions, especially at larger and interconnected firms. Actions: map where cryptography supports critical services and client data; assess vendors and outsourced providers; align with NCSC/NIST PQC standards; build a phased migration roadmap with milestones; update risk registers, incident playbooks and supplier contracts.

Smaller firms should leverage sector guidance and shared industry solutions, while large firms should coordinate across legal entities and critical third parties. No immediate rule change is announced, but early preparation can reduce future remediation costs and support competitive trust. Compliance leaders should brief the board and assign ownership within existing operational resilience frameworks.