Iberian PQC Cooperation Programme: A Photograph of a Handshake

On 23 October 2026, Banco de España and Banco de Portugal announced they had signed a Memorandum of Understanding to launch a Post-Quantum Cryptography Cooperation Programme (announcement, Spanish).

Two governors. Two deputy governors. Five directors general. Two board members. Six department heads. A two-day meeting in Lisbon. The programme was one of several items on the agenda, alongside artificial intelligence, financial system competitiveness and macroprudential policy.

The rationale is clear enough. Iberian banks share service providers, market infrastructures and interoperability dependencies. The two central banks state that uncoordinated migration to quantum-resistant technologies could pose systemic risks. That assessment is correct.

The question is whether what followed the assessment amounts to an actionable programme or a statement of intent.

Three phases, no deadlines

The announced programme has three phases.

Phase one: share information, good practices and common methodologies.

Phase two: shared dependencies, ecosystem readiness and migration priorities may be assessed.

Phase three: tests, interoperability assessments and analysis of emerging technologies may follow.

The conditional language in phases two and three is the announcement's own. Dependencies "may be" assessed. Testing "may" follow. A working group with industry is planned to advance the later phases.

No published phase deadlines. No defined deliverables. No disclosed budget. No new bank-level obligations specified.

Recognition is not a control

The announcement recognises that Iberian banks face shared cryptographic exposure. That recognition is not in dispute.

A control would be an inventory requirement. A dependency register. A reporting obligation. A migration deadline. Any mechanism that creates a consequence for inaction.

The announcement specifies none of these.

The distinction matters because recognition, without an obligation attached to it, does not change what a bank has to do or when it has to do it. In financial services, the items that get resourced are the items that are measured, reported and enforceable. An acknowledged risk without a supervisory expectation sits in the discretionary category, competing for budget with other unfunded priorities.

That is the same gap we identified in Hong Kong ten days later. The HKMA PQC Toolkit is detailed where the Iberian announcement is thin, but both leave banks "encouraged" rather than obliged. Singapore's MAS P019-2026 consultation raises the same question from a third direction. We set out the pattern across jurisdictions in our message to global regulators.

The external clock

Compare the Iberian programme with what is already in motion elsewhere.

NIST finalised its first three post-quantum cryptography standards in August 2024. The G7 Cyber Expert Group published a coordinated financial sector transition roadmap in January 2026. The EU's coordinated implementation roadmap asks member states to begin the transition by the end of 2026. The UK's National Cyber Security Centre (NCSC) has published a three-phase migration timeline with milestones at 2028, 2031 and 2035.

The algorithm standards have been final for over two years. The international roadmaps exist. Spain and Portugal sit inside the EU timetable that starts at the end of this year.

Announcing a three-phase programme in October 2026 without publishing a deadline for any phase is not evidence of migration leadership. It is an opening position dressed as progress.

The right question

The question is not whether cooperation between Spain and Portugal is sensible. It plainly is. Shared market infrastructure and common service providers make bilateral coordination a structural necessity, not a diplomatic courtesy.

The question is whether this MoU commits either country's banking sector to do anything it was not already doing.

The announcement identifies no new bank-level commitment against which delivery can be judged.

Cooperation programmes without timelines are aspirations. Aspirations without deadlines are intentions. Intentions do not migrate cryptographic infrastructure.

What would make this credible

A joint cryptographic inventory requirement, built on evidence-led discovery rather than self-reported questionnaires.

A shared dependency register across Iberian institutions, covering the common service providers and market infrastructures the announcement itself names.

A reporting obligation with a supervisory consequence, measured against a published readiness baseline.

A date by which phase one must be complete.

An assurance standard against which delivery can be tested independently. We have argued why that is now a board-level requirement, and published our own in the Quantum Cryptographic Assurance Standard (QCAS).

And a plan for cryptographic agility, so the programme does not end with one migration and no capacity for the next.

Any mechanism that creates a consequence for inaction.

Until then, this is a photograph of a handshake.

Brian Couzens

CEO, SITG-Consulting

Related reading: Cryptographic Discovery Sprint: The First Defensible Step in PQC Migration | Independent PQC Assurance: Why Evidence Must Replace Assumption | Our transformation methodology

Sources:

Banco de España, press release, 23 October 2026 (presbe2026-99); NIST, first three finalised PQC standards, 13 August 2024; G7 Cyber Expert Group, statement on a coordinated roadmap for the financial sector, January 2026; European Commission / NIS Cooperation Group, Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography; NCSC, Timelines for migration to post-quantum cryptography.