A Message to Global Regulators on Quantum Risk and Readiness

Brian Couzens

4 days ago

6 min read

Navy banner showing the logos of leading global financial regulators over a world map, with the SITG-Consulting wax seal bottom-left

The weakness in quantum guidance is not a shortage of guidance. It is the gap between a supervisory expectation and an enforceable requirement to prove readiness. Closing that gap does not take heavier regulation. It takes better-aimed regulation, built on outcomes rather than instruments.

Across the major financial centres, the direction is set. The Monetary Authority of Singapore has consulted. The United Kingdom, the European Union and the United States have each published timelines. What is not set is the quality of the response, and quality is where this will be won or lost.

A regulator facing post-quantum cryptography has two easy paths and one hard one.

The first easy path is to set expectations without teeth. Publish supervisory guidance, ask for ownership, inventories and plans, attach indicative dates, and stop short of a requirement anyone must meet and prove. Singapore has just shown how this looks: real expectations, no binding obligation, and completion left to the institution's own account of itself. It reads as action. It changes the timetable for no one who was already inclined to wait.

The second easy path is to over-prescribe. Fix the architecture, the vendor and the method in a circular. This looks decisive, and it freezes the estate while the standards are still moving.

The hard path, and the correct one, is to regulate the outcome and the proof, and leave the method alone. Be hard on the destination and on the evidence. Stay agnostic on the route. Everything below is a version of that one idea.

Capability is not readiness

The purpose of a regulator here is not to choose cryptography. It is to ensure that the institutions it supervises can be trusted to choose, deploy and change their own cryptography under supervision.

An institution has the capability to migrate when four things are true. It knows what cryptography it runs. It can change that cryptography without rebuilding the systems around it. A named executive is accountable for the outcome. And someone independent can confirm the first three.

Capability is not the same as readiness. Readiness is evidence that the priority exposures have actually been migrated, and that the systems carrying them work securely under real operating conditions. The Bank for International Settlements made the point concrete in its Project Leap tests, where running post-quantum algorithms in a live payment system exposed performance and compatibility effects that no inventory predicts. Require the capability, then require the evidence that it was used.

The requirements worth mandating

A validated cryptographic inventory. You cannot govern, price or migrate what you cannot see. The word that carries the weight is validated. A self-declared inventory that no one checks is a comfort, not a control.

Cryptographic agility as a standing capability. This is the heart of it. Mandate the ability to change algorithms on demand, not the algorithm itself. When a standard is broken, deprecated or superseded, and some will be, the agile institution changes course while the rigid one reopens a programme.

A named accountable owner. Not “the board should be engaged”, but a named executive accountable for the outcome and answerable to independent risk oversight. This is enterprise risk and not a technology upgrade, which in practice places it with the Chief Risk Officer. Accountability without a name is decoration.

Independent assurance. The institution should not be the only party marking its own work. Independent validation of the inventory and the migration is the difference between a regulator that believes it is supervising and one that is.

Dated, outcome-based readiness. Dates are necessary, and they should describe outcomes, not products. Demonstrate quantum-safe readiness for critical systems by a date, rather than deploy a named product by one. The first survives a change of standard. The second does not.

What a regulator should not do

The same principle marks the traps.

Do not lock institutions into a single algorithm, vendor or architecture. Pointing to approved standards is right and expected, and the United States has published them, with national schemes alongside. Freezing an institution onto one of them is the error, because it dates the rule to the week it was written and removes the agility the rest of the regime depends on.

Do not micromanage the method. The supervised institution understands its own estate better than its supervisor does. Set the outcome and the proof, and it will find the route.

Do not apply one standard to institutions of every size. A systemic bank and a small insurer do not carry the same risk and should not carry the same load. Tiering by systemic importance is the honest way to be proportionate.

Sovereign interoperability

Nations will not converge on one cryptographic future. Some will adopt the algorithms chosen by one standards body, some will mandate national schemes, and some will run both. That is legitimate. A state choosing the cryptography that protects its financial system is sovereignty working as intended.

But finance is cross-border by construction. A payment or a settlement crosses several jurisdictions and several cryptographic regimes in a second, and if those regimes cannot meet, the cost is failed settlement and a system fragmenting along cryptographic lines. The multilateral bodies see this. The Bank for International Settlements has tested cross-border post-quantum payments through Project Leap, and interoperability sits on its agenda.

Seeing the problem is not the same as owning its delivery, and here there are two requirements, not one. The first is mutual recognition of assurance, so that validation accepted in one jurisdiction is accepted in another. The second is technical interoperability, so that different cryptographic regimes can communicate at the border. Recognising another jurisdiction's assessment does not make incompatible protocols talk. Both need coordinating, and neither is any single national regulator's to deliver alone. That is the gap: not whether cross-border interoperability matters, but who is accountable for making it happen.

Quantum risk is financial stability

One framing change sits underneath all of this. Quantum risk is handled almost everywhere as a technology-security problem, owned by the people who run security. At the level of the system it is a financial-stability problem. Data leaving institutions today is already exposed to future decryption. Shared cryptographic dependencies turn a single broken algorithm into a common-mode failure across the system rather than an incident at one firm. Those are the properties of systemic risk, and the bodies that own financial stability should stress-test cryptographic exposure the way they stress-test capital and liquidity.

The enforcement loop

None of this means anything without a consequence. A missed milestone has to trigger a supervisory response: a documented explanation, an independent assessment of the residual risk, a time-bound remediation plan, and escalation where the exposure stays unacceptable. Without that, the MUST is just another should, and the regime collapses back into the paper it was meant to replace.

The message

So this is the message, and it is not a demand for heavier regulation. It is a demand for better-aimed regulation.

Set the requirements that are about capability, evidence and accountability. A validated inventory. Agility as a standing capability. A named owner. Independent assurance. Dated, outcome-based readiness, with a consequence attached. Then leave the method to the institutions and the market, and coordinate across borders on the things no single regulator can deliver alone.

A regulator should not ask whether a bank has a quantum strategy. It should ask what the bank can prove, by when, and what happens if it cannot. Evidence, deadlines and consequences. The quantum computer sets the deadline. What the financial system does before it arrives is a matter of governance, and governance is the regulator's to get right.

About the author

Brian Couzens is CEO of SITG-Consulting, an independent post-quantum cryptography advisory practice working across financial services, critical infrastructure and government. He is the author of the Quantum Cryptographic Assurance Standard (QCAS). SITG-Consulting publishes national post-quantum readiness assessments for the UK, the EU-27, ASEAN-10, BRICS-11 and Africa on Zenodo.