Financial services firms need to start building crypto agility now, because the cryptography that protects money movement, customer data, digital identities and outside connections will not look safe forever. Andrew Gault, writing in a guest post, argues that institutions should treat the shift to post-quantum cryptography as a management task, not a hardware refresh.
The reason the topic is drawing attention today is simple: the transition has moved from theory to policy. NIST finalized its first post-quantum cryptography standards in 2024, the White House Executive Order 14412 in June 2026 directed federal systems toward NIST-approved post-quantum cryptography, and the U.S. Treasury announced a Quantum-Readiness Task Force in August 2026. For institutions that search for financial services guidance now, the message is that the clock has started, even if no single deadline has reached the industry yet.
Gault defines crypto agility as the ability of a system or organization to change cryptographic algorithms and standards quickly as threats, technology and regulatory expectations evolve, without repeatedly replacing major hardware or rewriting critical applications. In practice, he says the work starts with management discipline: set scope, identify the systems and connections most exposed, and fold the quantum transition into technology planning and vendor oversight. That matters because financial institutions rely on cryptography not just inside their own systems, but across processors, cloud providers and other third parties that can widen the attack surface.
The first task is an inventory, or cryptographic bill of materials, known as a QBOM. That inventory is supposed to show where cryptography is used across the institution and its external connections, which systems depend on it, what can be updated and who has the authority to make the change. It should also separate data at rest from data in transit, because long-lived records and messages face different risks when an adversary can store encrypted information today and try to decrypt it later in a harvest now, decrypt later attack.
That threat becomes more serious once a cryptographically relevant quantum computer, or CRQC, exists. A sufficiently capable machine would break much of the public-key cryptography that underpins authentication, secure communications and key exchange. But Gault also points to a less obvious problem: even systems that support stronger cryptography can still be pushed onto weaker older protocols if an attacker can force a downgrade. In other words, simply adding new standards is not enough if the old path is still open.
The Citi Institute’s quantum-readiness guidance follows the same sequence: identify exposure, prioritize critical systems and long-lived data, enable crypto agility and manage the migration over time. That is the part many institutions are likely to find hardest, because the exposure is not confined to one platform or one vendor. The real work is deciding where to start, which links can wait and which connections carry data that cannot afford a long exposure window.
The unresolved question is less about whether the transition will happen than how quickly financial institutions can map their cryptography before the pressure shifts from planning to remediation. Gault’s answer is blunt: build the inventory, find the fragile links and make the organization ready to change before a CRQC makes the choice for it.
