On 4 November 2026, the Financial Conduct Authority published a supervisory blog asking firms to prepare for post-quantum cryptography. The FCA says sufficiently powerful quantum computers could eventually undermine widely used public-key cryptography, although it does not claim that a viable hostile quantum computer will arrive on a known date.

The publication is a supervisory communication, not a new rule or completed consultation. It points firms towards preparation and says the FCA intends to consult on cyber-resilience guidance that will include expectations for cryptographic controls. The blog does not state when that consultation will begin or set a response deadline.

The milestones come from NCSC guidance

The FCA refers to three National Cyber Security Centre milestones:

  • by 2028, define migration goals, complete discovery work and build an initial plan;
  • by 2031, undertake the highest-priority migration activity and refine the roadmap; and
  • by 2035, complete migration across systems, services and products.

The NCSC describes these as indicative timelines and target dates for a long-running national technology change. They should not be presented as new statutory deadlines created by the FCA blog. The NCSC also recognises that sectors and organisations start from different levels of cryptographic maturity and that some less commonly used technologies may be harder to migrate by 2035.

What the FCA is asking firms to consider

The FCA says firms should understand the cryptography used across their systems and information, set risk-based migration objectives and implement, monitor, test and validate migration plans. It also says senior managers should provide sufficient time, investment and resources for safe migration.

The FCA is trialling a supervisory self-assessment tool with an initial sample of firms and intends to extend it later. The announcement does not say that every regulated firm is already participating or that completing this tool is currently a universal requirement.

For payment, e-money and digital-asset businesses, a proportionate first step may be to understand where important services, sensitive or long-lived data, identity controls, communications and transaction processes depend on cryptography. The assessment may also need to cover outsourced platforms, cloud services, payment infrastructure, hardware and software suppliers because a firm's migration sequence can depend on provider readiness and replacement cycles.

This is an operational mapping question, not a conclusion that a particular firm is unprepared. Firms using mainly commodity technology may receive many changes through vendors, while bespoke or long-lived systems may require more detailed planning and testing.

Governance questions for boards and senior leaders

Relevant questions include:

  • which important services and data depend on public-key cryptography;
  • who owns the cryptographic dependency record and migration plan;
  • which suppliers control upgrades, standards support or replacement timing;
  • how priorities reflect data sensitivity, retention periods and operational impact;
  • how traditional and post-quantum technologies may need to coexist during transition; and
  • how testing, rollback, incident response and board reporting will support safe change.

Technical design and implementation require appropriate specialist expertise. The FCA and NCSC material supports early planning, but it does not establish the correct technical solution or timetable for every firm.

Status and sources

The FCA blog was published on 4 November 2026. The NCSC milestones are guidance targets. No new FCA rule, effective date or consultation deadline was announced in the inspected material.

This article provides general information, not legal, regulatory or technical advice for a particular firm.

← All insights