UK regulators set 2035 deadline for banks to replace encryption quantum computers could break

UK financial firms have until 2035 to move every system, service and product onto post-quantum cryptography, under milestones set out by the National Centre for Cyber Security and backed by the UK's financial regulator. The first deadline comes sooner: a complete migration plan is due by 2028, with high-priority migration work to be finished by 2031.

The regulator said a sufficiently powerful quantum computer poses a real threat to the cryptography the financial sector depends on to protect client data, verify counterparties and keep trust in its systems. Without trustworthy cryptography, it warned, consumers would face fraud, firms would suffer operational disruption, and the integrity of financial transactions and markets would be at risk. It added that it does not know when a viable quantum computer will emerge, but expects the technology to advance rapidly in the coming years.

Firms are told not to wait for the milestones and to be ready sooner where it is safe to do so. The regulator expects them to build a thorough and accurate picture of the cryptography in place across their systems, set clear and risk-based migration objectives, and implement, monitor, test and validate the changes. Senior managers are expected to allocate enough time, investment and resources; failed change projects accounted for around a fifth of all incidents reported to the regulator in 2025.

To gauge readiness, the regulator is trialling a supervisory self-assessment tool with an initial sample of firms and intends to extend it. It said the trial will help identify common challenges and good practice to share with the sector, and that it will consult on cyber resilience guidance covering how firms should address post-quantum risks through their cryptographic controls. It is also engaging through its Cyber Coordination Groups, the Cross Market Operational Resilience Group and trade bodies.

The push follows guidance from the National Centre for Cyber Security on migration timelines and a statement from the G7 Cyber Expert Group on a coordinated roadmap for the financial sector's transition to post-quantum cryptography.

What it means for Pakistan: The same cryptographic exposure applies to Pakistan's banks, payment switches and digital wallets, which rely on public-key encryption to secure transactions and customer data. No Pakistani migration deadline has been announced, and the State Bank of Pakistan and PVARA have not published post-quantum requirements, so the UK's 2028, 2031 and 2035 milestones offer a template local institutions can plan against while they wait.