Post-quantum migration: who in finance moves first?
Papers on post-quantum cryptography went from 2 to 10 a year, but almost all are in AI and computing journals and none in finance. Banks, payment networks and blockchains will have to replace the cryptography they run on. What will the migration cost, and which assets are exposed first?
What prompted this#
Since October 2025, 10 papers carry a post-quantum-cryptography keyword, up from 3 in the year before and 2 two years earlier. Nine appeared in AI journals and none in finance journals. Over three years they sit next to blockchain (4), federated learning (3), lattice-based cryptography (2) and quantum attacks (2). NIST published its first post-quantum standards in August 2024, and data encrypted today can be stored now and decrypted later, so long-lived financial secrets are already exposed. A related note asks what quantum computers can do for optimization; this one asks what they mean for the cryptography finance relies on.
Questions#
- What does migration cost a bank or a payment network: larger keys and signatures in payment messages, hardware security modules to replace, slower handshakes?
- Which assets are exposed first: long-lived encrypted records, or blockchain addresses whose public keys are already visible?
- Do firms disclose quantum risk in their annual reports, and does disclosure track IT spending or regulators' guidance?
- Do markets price quantum risk in crypto assets?
Data that could help#
NIST standards and migration guidance, the risk-factor sections of 10-K filings, blockchain data on addresses with revealed public keys, and benchmark results for post-quantum algorithms from open-source projects.
Next step#
Count mentions of quantum-computing risk in 10-K risk factors from 2018 to 2026 by industry, and compare banks with payment and technology firms.