By Edward B. Cody
For several years, discussions about quantum computing and financial services have usually begun with the same question: When will a quantum computer become powerful enough to break the encryption protecting today’s financial system?
I think bank and credit union boards are asking the wrong question. The better question is: How long will it take our institution to replace vulnerable cryptography once the need to act becomes unavoidable?
Unlike the Year 2000 problem, we can’t confidently predict when a cryptographically relevant quantum computer will arrive. What we can say is that changing the cryptographic foundation of a financial institution will be complicated, time-consuming, expensive and heavily dependent on third parties. That turns quantum computing from a technology forecasting problem into a governance problem, and developments on Capitol Hill suggest that the time for boards to recognize that distinction has arrived.
The Federal Government Has Moved From Planning to Migration
On June 22, President Trump issued Executive Order 14412, “Securing the Nation Against Advanced Cryptographic Attacks,” directing an accelerated federal transition to Post-Quantum Cryptography (PQC) to protect data against future quantum computer attacks. Under the order, federal high-value and high-impact systems must use PQC for key establishment by December 31, 2030, and digital signatures by December 31, 2031. The National Institute of Standards and Technology (NIST) must also conduct a migration pilot by the end of 2027.
Additionally, the order calls for guidance to help critical infrastructure sectors transition to PQC and for federal acquisition rules that incorporate applicable NIST requirements into federal contracting. While that doesn’t mean every bank and credit union faces a new 2030 compliance deadline, it does mean the federal government is moving from planning for the transition to actively managing it.
Treasury Brings The Issue Directly to Financial Services
On August 24, two months after the executive order, the U.S. Treasury Department established the Quantum Readiness Task Force specifically for the financial sector. The initiative brings together public-private sector stakeholders to accelerate the sector’s transition to quantum-safe technology while maintaining orderly and operational resilience. Its work is organized around three areas: sector alignment and PQC transition, third-party and vendor readiness and digital assets and emerging technology risk.
For financial institution boards, that may be more important than another announcement about progress in a quantum computing laboratory. The Treasury hasn’t imposed a new regulatory mandate. However, it has created a structure for financial sector readiness, and financial institutions will now need to consider quantum readiness as part of their long-term risk management strategies, including how they protect sensitive data and assess the security of their technology and third-party vendors.
NIST Explains Why Waiting is Risky
NIST has already finalized three principal post-quantum cryptographic standards, which are now available for implementation. But one of NIST’s most important observations for directors has little to do with quantum physics: integrating a new cryptographic algorithm into information systems can take 10 to 20 years.
That scenario should inform the board conversations happening today. Imagine that a serious cryptographic vulnerability were confirmed tomorrow and management had to begin replacing vulnerable encryption. Where would it start? Which applications use affected algorithms? What about mobile banking, cloud services, payments, authentication systems and archived data?
While a board doesn’t need to know which algorithm protects a particular system, it can reasonably ask whether management knows where the institution’s most important cryptographic dependencies are located.
Vendors May Determine the Timetable
The Treasury’s decision to make third-party and vendor readiness a key focus is particularly important for financial institutions. Banks and credit unions rely on outside companies for many of their technology services, including core processors, cloud computing, payment providers, digital banking platforms, identity verification and hardware. Even if a financial institution is ready to transition to PQC, it may have to wait for its vendors to update their systems.
Management should know where cryptography exists in their products, which NIST standards they plan to support, when upgrades will be available, how much those upgrades will cost and what happens if a migration causes an operational failure. Importantly, boards should ask: Which of our critical vendors can’t yet answer those questions?
The Transition Will Also Have A Price Tag
Boards should begin thinking about cost before migration becomes urgent. No institution can accurately estimate the final cost before completing inventories and vendor assessments. However, it’s reasonable to expect expenses for software upgrades, hardware replacement, testing, architecture changes, contract modifications, training and periods when old and new technologies must operate together.
Vendor costs will also play a role. Technology providers will incur their own development and infrastructure expenses, and financial institutions should expect some of those costs to flow through future pricing. A Plan of Action and Milestones (POA&M) approach can help institutions manage these costs.
Management should identify the work that needs to be done, assign responsibility, map dependencies, establish target dates and refine cost estimates as more information becomes available. These estimates should then inform multiyear capital and operating plans to avoid being surprised later by several expensive migrations arriving at the same time.
Some Data May Already Face A Future Threat
There is another reason that quantum readiness can’t be reduced to guessing when a powerful quantum computer will appear.
Executive Order 14412 specifically identifies the risk of adversaries collecting U.S. information now and decrypting it later once sufficiently capable quantum computers become operational. NIST identifies the same problem as a reason to begin transition planning now. As NIST explains, “Since sensitive data often retains its value for many years, starting the transition to post-quantum cryptography now is critical to preventing these future breaches. This threat model is one of the main reasons why the transition to post-quantum cryptography is urgent.”
Prepping for the Transition Today
There is no “Quantum Day” on the calendar, and that uncertainty can create a dangerous temptation to wait for more certainty before acting. But the absence of a specific date doesn’t eliminate the eventuality.
The most valuable resource we possess today may be time, and boards should prepare, plan and budget before they are out of it.
Edward B. Cody is the chairman of the Board of Directors at PenFed Credit Union, one of the nation’s largest federal credit unions, serving nearly three-million members worldwide.
