Britain’s Financial Conduct Authority (FCA) urged financial firms Wednesday to identify vulnerable cryptography and plan upgrades, as future quantum computers could put customer data and financial transactions at risk.
Guidance from the National Cyber Security Centre (NCSC) sets out three stages. By 2028, organizations should identify their cryptographic dependencies, define migration goals and prepare an initial plan. By 2031, they should carry out their early, highest-priority migration activities and refine their roadmap. The guidance targets migration across all systems, services and products by 2035.
Those dates are guidance targets, not statutory deadlines. The FCA endorsed the schedule but urged firms to start now and finish earlier where they can do so safely. It said firms should set priorities by risk, then test and adjust their plans as work proceeds.
The concern centers on public-key cryptography, which helps secure communications and verify identities. The NCSC says future large-scale quantum computers could solve the mathematical problems on which it relies. A Jan. 13, 2026, roadmap from the G7 Cyber Expert Group also warns that data intercepted now might be decrypted later. The roadmap describes 2035 as a useful general target cited in other guidance; it sets no regulatory expectations of its own.
“We don’t know for certain when a viable quantum computer will emerge,” FCA Director of Specialists Mark Francis wrote. The regulator said a loss of trustworthy cryptography could expose consumers to fraud and disrupt firms. Migration will require firms to commit time, investment and resources.
The upgrades carry operational risks, too. Failed change projects figured in around one-fifth of all incidents reported to the FCA in 2025, the regulator said. It urged senior managers to give the transition enough time and support.
The FCA is testing a supervisory self-assessment tool with an initial group of firms and plans to expand the trial. It also intends to consult on cyber resilience guidance covering cryptographic controls. It gave no timetable for either step.
On Aug. 13, 2024, the U.S. National Institute of Standards and Technology (NIST) announced that the Secretary of Commerce had approved three post-quantum standards covering key establishment and digital signatures. EconoTimes has covered the U.S. transition to post-quantum standards. For firms following the UK schedule, the next milestone is the 2028 inventory, migration goals and initial plan.
