Table of contents
As Devtorium’s experts emphasized in our previous blog, the threat of Q-Day is very real. Financial institutions and fintech companies should address this risk for a good reason. According to Statista, the financial sector consistently ranks among the top three industries most targeted by cyberattacks worldwide. Once quantum computing capabilities become powerful enough to compromise current encryption methods and threat actors can take over them, financial systems will likely be among their primary targets.
So, if the Q-Day threat is this significant, how can financial organizations prepare for it and protect themselves now? The answer lies in adopting Post-Quantum Cryptography (PQC). These new algorithms are specifically designed to secure sensitive data against both current and future quantum computational threats.
In this blog, our CSO, Nataliia Kashuba, explores the fundamentals of PQC and its various families and shares practical steps fintech companies can take today to begin preparing for the transition to quantum-resistant security.
Read this if
- You’re a CTO, CISO, or technology leader at a fintech company
- Your organization depends on cryptography to protect customer and transaction data
- You’re trying to determine whether quantum computing is a future concern or a risk that requires action today
What Is PQC and How Is It Addressing the Q-Day Threat
As the name suggests, Post-Quantum Cryptography (PQC) refers to a new generation of cryptographic algorithms designed to withstand attacks from powerful quantum computers.
Because widely used encryption methods such as RSA and Elliptic Curve Cryptography (ECC) are expected to become vulnerable in the quantum era, the National Institute of Standards and Technology (NIST) launched its PQC standardization program in 2016 to identify actionable solutions against the threat.
In 2022, NIST announced the first selected algorithms from its PQC competition, including CRYSTALS-Kyber, CRYSTALS-Dilithium, and SPHINCS+. Then, in August 2024, NIST completed this eight-year effort by publishing the official standards:
- FIPS 203 (formerly Kyber)
- FIPS 204 (formerly Dilithium)
- FIPS 205 (formerly SPHINCS+)
This milestone marked the beginning of the transition toward quantum-resistant cryptography in both government and private-sector systems.
PQC Adoption Across the Financial Sector
Consequently, leading central and commercial financial institutions worldwide are already evaluating and piloting PQC algorithms in line with NIST standards:
- As part of Project Leap (Phase 2), SWIFT, the Bank for International Settlements, the Bank of Italy, and the Deutsche Bundesbank successfully replaced traditional digital signatures with post-quantum algorithms during liquidity transfer operations within the Eurosystem’s TARGET2 payment system.
- A pioneer in quantum resilience, Banque de France has successfully completed experiments to secure regulatory data exchanges using post-quantum cryptography.
- Wells Fargo has filed patents on quantum cryptography and is developing migration roadmaps to roll out PQC across its systems before 2030.
- Meanwhile, Banco Sabadell has deployed a post-quantum cryptographic infrastructure, establishing one of the first real-world examples of PQC implementation within the financial sector.
Such initiatives demonstrate that the transition to quantum-resistant security is an active priority for banking institutions seeking to protect sensitive financial data. Wondering whether your financial platform is secure enough? Explore Devtorium’s Information Security Services and discover how we help organizations strengthen data protection.
Organizations that treat post-quantum cryptography as a future problem are already behind on preparing for it.
The Four Core PQC Families Comparison
As discussed in the previous section, while the practical adoption of PQC is still in its early stages, financial institutions are already launching pilot initiatives and conducting initial tests of these algorithms.
However, as an entrepreneur in the financial sector, you may be wondering: Which PQC algorithms are currently available, and which one is the right fit? To answer that question, let’s take a brief look at the main post-quantum cryptographic families, view notable examples, and discuss the use cases they are best suited for.
Lattice-Based Cryptography
This is a type of PQC that uses enormous multidimensional mathematical grids made up of vectors and points. The security of this approach comes from the difficulty of solving problems within these high-dimensional lattices, such as finding the shortest path between points (SVP), the closest point to a target (CVP), learning hidden patterns in noisy data (LWE), or identifying small integer solutions (SIS).
Lattice-based cryptography is used by many leading PQC algorithms, including NIST-selected standards such as CRYSTALS-Kyber (also known as ML-KEM, FIPS 203) and CRYSTALS-Dilithium (also known as ML‑DSA, FIPS 204). These algorithms are primarily designed for public-key encryption, key establishment, and digital signatures, making them suitable for financial systems.
Code-Based Cryptography
It is one of the longest-studied post-quantum cryptosystems, relying on codes originally developed to detect and correct errors in transmitted data. Code-Based Cryptography is based on a challenge to decode a randomly generated linear code without knowledge of its hidden structure, a problem known as the Syndrome Decoding Problem, along with several related decoding challenges.
This approach is best exemplified by the Classic McEliece algorithm. Code-Based Cryptography is well-suited to public-key encryption and key establishment, making it attractive for fintech solutions that focus on long-term security over compact key sizes.
Multivariate-Based Cryptography
Multivariate cryptography, as its name suggests, centers on systems of multivariate polynomial equations defined over finite domains. Its security depends on the Multivariate Quadratic (MQ) Problem – the difficulty of solving large sets of interconnected nonlinear equations.
This family includes algorithms such as UOV (Unbalanced Oil and Vinegar), Rainbow, and several other signature schemes proposed during the NIST PQC standardization process. Unlike lattice-based and code-based cryptography, cybersecurity specialists have discovered vulnerabilities in several multivariate cryptography schemes that are susceptible to cryptanalytic attacks. As a result, it is generally viewed as a less mature and less trusted approach, in spite of its potential for highly efficient digital signatures.
Hash-Based Cryptography
Hash-based cryptography derives its security from cryptographic hash functions, mathematical mechanisms that transform data into unique fixed-length outputs. Instead of grounding in complex geometric forms or algebraic equations, this algorithm relies on the difficulty of reversing a hash function (preimage resistance) or of finding two distinct inputs that produce the same output (collision resistance).
Hash-based cryptography includes algorithms such as SPHINCS+ (also known as SLH-DSA, FIPS 205) and XMSS, both of which are designed to provide quantum-resistant digital signatures. On the other hand, this PQC family is not generally used for public-key encryption or key establishment. Notably, SPHINCS+ was standardized by NIST in 2024, along with Kyber and Dilithium, as one of the first quantum-resistant digital signature algorithms.
Need expert advice on selecting PQC algorithms?
Contact our expertsPractical Steps: How to Start Preparing
Before outlining practical steps organizations can take to prepare for the Q-Day risk, it is important to emphasize one aspect to avoid: do not rush into purchasing a PQC migration solution. At the same time, the growing urgency surrounding quantum threats is real (and this blog demonstrates that too), the immediate priority is not a wholesale migration to post-quantum algorithms. Instead, financial companies should first conduct the necessary preparatory work. With that in mind, let’s review the key actions organizations should take today.
1. Provide Cryptographic Inventory
Before planning any migration to PQC, organizations must first gain visibility into where and how cryptographic technologies are deployed across their systems. A Cryptography Bill of Materials (CBOM) provides a practical starting point by creating an inventory of the cryptographic algorithms, libraries, certificates, keys, and protocols used throughout your environment. Consistent with NIST guidance, one of the first steps in preparing for PQC adoption is to identify and inventory cryptographic assets. This process enables organizations to understand where cryptography is used, which business processes depend on it, and which sensitive data it currently protects.
2. Ensure crypto-agility in systems
Before asking, “Which PQC algorithm should we choose?”, it is better to start with, “How easily can we replace cryptographic algorithms in our systems?”
The point is that after Q-Day, new threats may rapidly emerge, along with new cryptographic standards. Therefore, organizations need systems that can adapt to changes without major redesigns.
In practice, this means understanding cryptographic dependencies and designing systems that can support future cryptographic updates. Building this flexibility is a more urgent priority than selecting a specific PQC algorithm, especially as post-quantum standards continue to mature.
3. Develop a migration plan aligned with NIST standards
Any serious organization should rely on official government guidance rather than vendor marketing when planning PQC migration. The key is that government agencies, such as NIST, generally describe migration as a gradual process that will take place over many years, extending into the 2030s.
The common directions across government guidance are:
- Start inventorying and assessing cryptography now.
- Plan migration in stages.
- Expect classical and post-quantum cryptography to coexist for some time.
- Complete migration over a multi-year period.
Thus, these timelines are planning guides, not signs that organizations must immediately deploy PQC solutions.
Eventually, based on my experience as a CTO working with security-critical systems, here are my guidelines for helping your company prepare for Q-Day:
PQC Readiness Checklist
- Inventory cryptographic assets and services across the organization.
- Identify systems that rely on RSA, ECC, and other public-key cryptographic algorithms.
- Classify long-lived sensitive data that must remain secure for 5-10 years or longer.
- Assess the PQC readiness of vendors, cloud providers, and third-party solutions.
- Develop a phased migration roadmap aligned with NIST recommendations.
- Conduct pilot deployments of post-quantum algorithms in non-critical environments.
- Establish a migration budget and long-term quantum-readiness strategy.
Ready to elevate your security posture?
Check out Devtorium Information Security services to align your project with certifications and recognitions such as GDPR, CCPA, PIPEDA, and HIPAA.
Conclusion: From Quantum Risk to Quantum Readiness
The ability to guarantee the protection of customers’ financial data for decades to come is a significant competitive advantage for financial service providers. Moreover, increasingly strict information protection and compliance requirements (emerging not only in the EU but across the globe) are placing growing pressure on fintech organizations to provide stronger security assurances today.
The two most important takeaways are simple:
- Organizations that begin planning their transition to post-quantum cryptography today will be better positioned to avoid costly migrations later.
- Preparing for the post-quantum era should begin with understanding your current cryptographic landscape.
A practical first step is to identify one critical application or service and document the cryptography it relies on. This exercise can provide valuable insight into the scope of future migration efforts and help prioritize the next stages of preparation.
If you would like expert guidance in assessing your cryptographic environment and developing a practical PQC readiness roadmap, our cybersecurity team is ready to help.
FAQs
What is post-quantum cryptography (PQC) and how does it effectively resist quantum computer attacks?
Post-quantum cryptography (PQC) is a new generation of cryptographic algorithms designed to remain secure even against powerful quantum computers. Unlike RSA and ECC, which are expected to become vulnerable to quantum attacks, PQC relies on mathematical problems that are believed to be resistant to both classical and quantum computing.
How are fintech companies and financial institutions already preparing for Q-Day?
Leading financial institutions are not waiting for quantum computers to become a reality. Organizations such as SWIFT, Banque de France, Wells Fargo, and Banco Sabadell have already launched PQC pilots, tested quantum-resistant algorithms, and developed long-term migration roadmaps. Most are focusing first on cryptographic inventories, pilot deployments, and phased migration strategies rather than immediate, organization-wide replacement of existing encryption.
What are the types/families of post-quantum cryptography, and which are most relevant for financial services?
The four primary PQC families are lattice-based, code-based, multivariate-based, and hash-based cryptography. Today, lattice-based algorithms such as ML-KEM (formerly Kyber) and ML-DSA (formerly Dilithium), along with hash-based SLH-DSA (formerly SPHINCS+), are the most widely adopted because they have been standardized by NIST and are considered strong candidates for securing financial systems.
Why is Q-Day considered a real business risk for fintech, even though large-scale quantum computers don’t exist yet?
The greatest risk on Q-Da is what happens before it. Threat actors can already steal encrypted financial data today and store it until quantum computers are powerful enough to decrypt it, a strategy known as “Store Now, Decrypt Later” (SNDL). Combined with the future vulnerability of RSA and ECC, this makes early preparation a strategic necessity. If you’d like to better understand Q-Day, quantum computing, and why today’s encryption is at risk, read Part 1 of our blog.
What are the first practical steps organizations should take to prepare for Q-Day?
The first priority is understanding your existing cryptographic environment rather than immediately deploying PQC solutions. Start by creating a cryptographic inventory, identifying systems that rely on RSA or ECC, assessing long-lived sensitive data, improving crypto-agility, and developing a phased migration roadmap aligned with NIST guidance.
If you need help assessing your environment or creating a PQC readiness strategy, contact our cybersecurity experts.
