Post-Quantum Cryptography, Explained: What The FCA Expects Financial Firms To Do Now

Post-quantum cryptography means encryption and signatures built to resist attack by a powerful quantum computer. Today's widely used methods protect client data, payments and logins, and a hostile quantum computer could one day break them. Nobody knows exactly when, which is why the FCA and NCSC want firms to start now.

What did the FCA say on 4 November?

In a blog published on 4 November 2026, the FCA said firms need to act now to prepare for a world where a viable hostile quantum computer could break today's widely used cryptography standards. It said that for most firms this will require significant time, investment and effort.

The FCA pointed to the NCSC's recommended timetable: high-priority migration activities by 2031, and all systems, services and products migrated by 2035. It said firms should not wait for those dates and should be ready sooner where it is safe to do so.

• **Know your cryptography.** Have a thorough and accurate understanding of the cryptography in place across systems and information.
• **Set objectives.** Set clear, achievable, safe and risk-based migration objectives.
• **Do the work and check it.** Implement migration plans and monitor, test and validate the changes.

The FCA added that senior managers should make sure their firms allocate enough time and resources, and noted that failed change projects accounted for around a fifth of all incidents reported to it in 2025. It is trialling a supervisory self-assessment tool with an initial sample of firms and plans to consult on cyber resilience guidance, including how firms should address post-quantum risks.

What did the NCSC change on 15 October?

The NCSC updated its TLS guidance on 15 October 2026 to include recommended post-quantum configurations, both hybrid and pure post-quantum. It said TLS 1.3 is the only version that supports post-quantum cryptography and that earlier versions will not be upgraded, so anyone still on TLS 1.2 or older should move to TLS 1.3 as soon as possible. For many organisations, it said, protecting data in transit will be a high-priority activity for the 2031 milestone.

Where does post-quantum cryptography meet AI tools?

Every AI tool your firm uses sends data somewhere: to a model provider, a cloud service or an internal system. Each of those connections relies on cryptography. Your inventory should include AI tools and their suppliers, the same as any other system. Ask each supplier which TLS versions they support and what their post-quantum plans are.

What can an operations team start now?

• **Build the list.** Systems, suppliers, file transfers and AI tools, with what each connects to.
• **Find the old protocols.** Anything still on TLS 1.2 or older goes on the priority list.
• **Keep evidence.** Record what was checked, by whom and when, so the board can see progress.
• **Plan change carefully.** Given the FCA's point about failed change projects, test every change before it goes live.

Keeping that evidence current each month is the kind of work our MI and board packs workflow prepares, with a person approving every number. Our featured article on AI cyber threats covers the wider security picture, and our piece on sovereign cloud and data residency covers where AI tools keep data.

Where should a firm start?

Start the inventory this quarter and name an owner for it. Our AI Developers London team can help, and a 14-day Proof Run can show how much of the list-building and evidence work can be prepared automatically for your team to check. This explainer summarises FCA and NCSC publications and is not security or regulatory advice.