Tag: post-quantum cryptography

  • Quantum Computing Is Coming to UK Finance: What Banks and Fintechs Need to Know Now

    Quantum Computing Is Coming to UK Finance: What Banks and Fintechs Need to Know Now

    The threat is not arriving the day a working cryptographically-relevant quantum computer switches on. The threat is already here, embedded in data being harvested right now by state-level actors who plan to decrypt it later. That is the uncomfortable reality at the centre of what the National Cyber Security Centre (NCSC) has been trying to communicate to UK financial services organisations for the past two years, with limited success. Quantum computing UK finance businesses need to take seriously is not a five-year problem. It is a planning problem that starts today.

    Most banks, fintechs, and payment processors are still treating quantum as a research curiosity rather than an operational risk. That is a mistake. The window between now and when post-quantum cryptography must be fully deployed is narrowing faster than most technology roadmaps in financial services are built to accommodate.

    City of London financial office at dusk illustrating quantum computing UK finance businesses security risks
    City of London financial office at dusk illustrating quantum computing UK finance businesses security risks

    Why Quantum Breaks the Encryption That Protects Financial Data

    Modern financial systems rely heavily on public-key cryptography, specifically RSA and elliptic-curve cryptography (ECC), to protect transactions, authenticate users, and secure communications between institutions. Both of these schemes depend on mathematical problems that classical computers cannot solve in any useful timeframe. A sufficiently powerful quantum computer running Shor’s algorithm can crack both in hours or days. The moment that machine exists, every piece of data protected by RSA or ECC becomes readable.

    The more insidious version of this threat is known as “harvest now, decrypt later”. Sophisticated adversaries, including nation-state actors, are already intercepting and stockpiling encrypted data: transaction records, client communications, authentication tokens, interbank settlement data. The encryption protecting it today is uncrackable. In ten to fifteen years, or possibly sooner, it may not be. For financial services firms holding sensitive long-term customer data, this is an existential compliance issue, not a theoretical one.

    What the NCSC Is Actually Advising UK Financial Services

    The NCSC published its post-quantum cryptography guidance in 2023 and has since updated its migration timelines. Its current position is that UK organisations in critical sectors, which explicitly includes finance and payments infrastructure, should begin cryptographic inventory work immediately and aim to have a migration plan in place before 2028. Full migration to post-quantum cryptographic standards is recommended by no later than 2035, though the NCSC has signalled that this deadline may be pulled forward depending on quantum hardware progress.

    The specific standards the NCSC recommends aligning with are those published by the US National Institute of Standards and Technology (NIST), which finalised its first set of post-quantum cryptography standards in 2024. The three primary algorithms, CRYSTALS-Kyber for key encapsulation and CRYSTALS-Dilithium plus FALCON for digital signatures, are now considered production-ready. UK firms have no technical reason to wait. You can read the NCSC’s full guidance on post-quantum cryptography at ncsc.gov.uk.

    Financial technology professional working on post-quantum cryptography migration relevant to quantum computing UK finance businesses
    Financial technology professional working on post-quantum cryptography migration relevant to quantum computing UK finance businesses

    Where Most UK Financial Firms Currently Stand

    Honestly, most are behind. A 2025 survey by the UK Finance trade body found that fewer than 30 percent of member institutions had completed a formal cryptographic inventory. Without that inventory, you cannot even know which systems are vulnerable, let alone begin migration. Legacy infrastructure compounds the problem significantly. Older core banking platforms, sometimes running on decades-old architecture, use hardcoded cryptographic libraries that were never designed to be swapped out. Retrofitting them is not a software update; it is closer to open-heart surgery.

    Fintechs, paradoxically, have both an advantage and a disadvantage here. Their stacks are newer and more modular, making cryptographic agility more achievable in principle. But many fintech firms are not yet thinking about this at board level, treating it as a future infrastructure concern rather than a current strategic risk. That gap in governance will bite them when regulators begin mandating post-quantum readiness, which the Prudential Regulation Authority (PRA) and Financial Conduct Authority (FCA) are expected to formalise guidance on within the next two years.

    Cryptographic Agility: The Framework That Actually Matters

    The practical answer to the quantum threat is not simply swapping one algorithm for another once. It is building systems that can swap cryptographic primitives without major re-engineering. This concept, called cryptographic agility, should be the governing principle behind every infrastructure investment financial firms make right now. If you are commissioning a new API gateway, a new payment processing module, or upgrading your identity and access management stack, the ability to update cryptographic algorithms at configuration level rather than code level should be a hard requirement in every specification.

    This is also where the digital communications layer intersects with quantum risk in ways that operations teams sometimes overlook. Secure email infrastructure, encrypted API communications between institutions, and signed transaction logs all depend on cryptographic standards that will be compromised. A firm that has secured its core banking system but left its email infrastructure running on legacy public-key encryption has a gap. UK-based technology tools built around internet and computer security, such as the free email testing service offered by Mail Tester (mail-tester.co.uk), already reflect the increasing awareness among tech support and technology professionals that even routine digital communications channels require proper cryptographic validation. Ensuring that email authentication records, DKIM signing, and encrypted transmission are correctly configured is a basic-hygiene step that sits within the broader push to audit every layer of digital infrastructure before post-quantum migration begins. Firms that ignore the communications stack whilst hardening their core systems are creating blind spots.

    The Business Decisions That Need to Happen Before 2028

    There are four concrete decisions that quantum computing UK finance businesses should be making in the next twelve to twenty-four months, regardless of where they sit on the maturity curve.

    First: complete a cryptographic inventory. Map every system, service, and integration that uses public-key cryptography. This is non-negotiable. You cannot migrate what you cannot find.

    Second: assess supplier and third-party exposure. Your own systems may be relatively modern, but if your payment processor, cloud provider, or software vendor is running RSA-dependent infrastructure, your exposure extends to theirs. Third-party risk questionnaires need a quantum section now.

    Third: begin hybrid cryptography deployments where practical. Running a post-quantum algorithm alongside a classical one in parallel provides protection today without requiring full migration. CRYSTALS-Kyber in hybrid mode is already supported by major TLS libraries and is production-viable.

    Fourth: engage your board and audit committee. Quantum risk needs to sit in the same risk register as cyber risk, operational risk, and regulatory risk. It is not an IT department footnote; it is a governance issue with regulatory implications. The FCA’s operational resilience framework already encompasses systemic cryptographic vulnerabilities under its broader definition of important business services.

    What Good Preparation Actually Looks Like

    Barclays, HSBC, and NatWest have all publicly referenced post-quantum cryptography work in their technology strategy disclosures over the past two years. Smaller fintechs and building societies have less visibility, which does not mean the work is happening. In many cases it is not.

    Preparation does not require enormous capital expenditure upfront. It requires rigour. Cryptographic inventory software exists. Open-source post-quantum libraries are available and battle-tested. The standards are finalised. What is generally missing is internal prioritisation, which is a leadership and governance problem, not a technology one. The firms that start the migration work methodically now will face a manageable, phased transition. Those that wait for a regulatory deadline or, worse, a quantum computing breakthrough announcement, will face an emergency with no clean options.

    The broader technology ecosystem is already moving. Cloud providers including AWS and Google Cloud have quantum-safe key management options in production. Hardware security module vendors are shipping post-quantum compatible firmware. The infrastructure supply side is ready. The demand side, meaning the decisions made inside UK financial institutions, is the remaining bottleneck. And for quantum computing UK finance businesses, that bottleneck needs to close soon.

    Frequently Asked Questions

    How close are we to a quantum computer that can break current encryption?

    Most estimates from credible research institutions suggest a cryptographically-relevant quantum computer is ten to fifteen years away, though some timelines are being revised downward. The NCSC advises UK organisations not to wait for this milestone, as the ‘harvest now, decrypt later’ threat means data captured today could be decrypted once such a machine exists.

    What is post-quantum cryptography and is it ready to use?

    Post-quantum cryptography refers to algorithms designed to resist attacks from quantum computers. NIST finalised its first set of post-quantum standards in 2024, including CRYSTALS-Kyber and CRYSTALS-Dilithium, both of which are considered production-ready and are already supported by major software libraries and cloud platforms.

    What is the NCSC's official deadline for migrating to post-quantum cryptography?

    The NCSC currently recommends that critical sector organisations, including financial services firms, have a migration plan in place before 2028 and complete full migration by no later than 2035. However, the NCSC has indicated this timeline may be accelerated depending on advances in quantum hardware.

    What should UK fintechs do first to prepare for quantum risk?

    The most important first step is completing a cryptographic inventory: identifying every system, API, and third-party integration that currently uses RSA or elliptic-curve cryptography. Without this baseline, prioritising migration work is impossible. Fintechs should also add quantum readiness criteria to supplier and third-party risk assessments.

    Will the FCA or PRA require UK financial firms to comply with post-quantum cryptography standards?

    Formal regulatory mandates from the FCA and PRA have not yet been published, but both bodies are expected to issue guidance within the next two years. Post-quantum readiness is already implicitly covered under the FCA’s operational resilience framework, and firms should treat proactive preparation as regulatory risk management.

  • Quantum Computing in Business: What the 2026 Landscape Actually Looks Like

    Quantum Computing in Business: What the 2026 Landscape Actually Looks Like

    Quantum computing has been the technology that’s always five years away. Except now it isn’t. The conversation has shifted from theoretical white papers and university labs to boardrooms, government procurement teams, and the R&D departments of some very serious UK enterprises. That doesn’t mean it’s ready for every business to bolt on tomorrow morning, but the landscape in 2026 looks meaningfully different from where it stood even two years ago. Here’s a grounded read of where quantum computing in business genuinely sits right now.

    Before getting into specific industries, it’s worth being honest about what the technology still can’t do. Large-scale, fault-tolerant quantum computers capable of outperforming classical systems on general business tasks don’t exist yet. What does exist is a growing category of near-term quantum processors, sometimes called NISQ (Noisy Intermediate-Scale Quantum) devices, that are genuinely useful for specific, well-defined problem types. The distinction matters because it determines which industries can start extracting value today and which are still in the preparation phase.

    Researchers working on quantum computing in business at a UK technology facility
    Researchers working on quantum computing in business at a UK technology facility

    Which Industries Are Seeing Real Quantum Applications Right Now

    Financial services is probably the furthest along. UK banks and asset managers have been quietly running quantum-assisted optimisation workloads for the better part of two years. Portfolio optimisation, derivatives pricing, and fraud pattern detection are areas where quantum annealing approaches, offered commercially through platforms like IBM Quantum and IonQ, have started to show marginal but measurable improvements over classical methods at scale. HSBC and Barclays have both publicly acknowledged quantum research programmes, and the FCA has been paying close attention to how quantum-resistant cryptography needs to factor into regulatory compliance frameworks.

    Pharmaceuticals and life sciences is the other sector attracting serious investment. Simulating molecular interactions is computationally expensive for classical systems, but it’s exactly the kind of problem quantum hardware handles more elegantly. AstraZeneca has been involved in collaborative quantum research through partnerships with quantum software firms, and the broader UK life sciences sector, backed partly by the government’s Life Sciences Vision, has flagged quantum simulation as a medium-term priority. Drug discovery timelines that currently take years could, in theory, compress significantly once fault-tolerant systems mature.

    Logistics and supply chain is an interesting case. Optimising complex routing problems across thousands of variables, what’s often called the travelling salesman problem at enterprise scale, is a classical computing headache. Quantum-inspired algorithms, which run on standard hardware but borrow quantum principles, are already being deployed by logistics firms to cut fuel costs and improve last-mile efficiency. It’s a bridging category worth paying attention to.

    What the UK Government Is Actually Doing About Quantum

    The UK’s National Quantum Strategy, published in 2023 and running through to 2033, committed £2.5 billion in public investment. That’s not window dressing. Innovate UK and UKRI have been channelling funding into quantum hubs across the country, including facilities at Bristol, Oxford, and UCL. The full National Quantum Strategy is available on gov.uk and is worth a read if you’re planning any long-horizon technology investment decisions.

    The National Physical Laboratory in Teddington is doing particularly important work on quantum metrology and standards, which is the unglamorous but critical infrastructure layer that commercial deployment eventually depends on. Without agreed measurement standards, the industry becomes a wild west of competing claims from hardware vendors. The UK is actually quite well positioned here, partly because of NPL’s history and partly because British academia has punched above its weight in quantum theory for decades.

    Close-up of a developer working on quantum computing in business applications
    Close-up of a developer working on quantum computing in business applications

    Quantum Computing in Business: What Not to Do Right Now

    The hype machine has created a predictable set of bad decisions. A few worth flagging.

    Don’t buy a quantum computer. Unless you’re running a national lab or a genuinely specialised research operation, it makes no sense. Access the capability through cloud quantum services from IBM, Amazon Braket, or Microsoft Azure Quantum. The hardware is noisy, requires near-absolute-zero operating temperatures, and the operational overhead is enormous. Pay-per-use cloud access is the only rational model for the vast majority of businesses.

    Don’t build a business case around timelines that assume fault-tolerant quantum computing arrives in the next three years. The physics is still hard. Qubit error rates are improving, but the estimates for when we’ll have millions of logical qubits required for transformative general-purpose computation keep shifting. Plan in phases: exploration now, pilot applications in two to four years for relevant industries, strategic deployment further out.

    Don’t ignore cryptography. This one is urgent regardless of your quantum strategy. The threat of quantum computers breaking current encryption standards (specifically RSA and elliptic curve cryptography) is real and the timeline for it is uncertain, which is exactly why businesses should be starting the migration to post-quantum cryptography now. NCSC, the UK’s National Cyber Security Centre, has already published guidance on this.

    What Forward-Looking UK Businesses Should Be Doing Instead

    There’s a practical middle path between ignoring quantum entirely and throwing budget at it prematurely. The businesses getting this right in 2026 are doing a few specific things.

    First, they’re identifying their hardest optimisation and simulation problems. These are the use cases that are genuinely quantum-amenable. If your toughest computational challenges involve large combinatorial optimisation, molecular simulation, or machine learning model training at unusual scale, you have something worth exploring. If they don’t, quantum isn’t your immediate priority.

    Second, they’re building internal literacy. Quantum computing in business doesn’t require every engineer to understand quantum mechanics. It does require someone in your technical leadership to understand the commercial landscape, the vendor ecosystem, and the relevant use cases. That’s a training and hiring question, not a capital expenditure question.

    Third, they’re auditing their cryptographic exposure. This is table-stakes operational security work. Any business handling sensitive data, financial transactions, or regulated information needs a plan for post-quantum cryptography migration. It’s the kind of methodical infrastructure task that sits alongside things like keeping your data management practices clean, from digital record hygiene to physical waste disposal routines like scheduling regular wheelie bin cleaning as part of broader compliance housekeeping. Boring? Yes. But the businesses that skip the fundamentals tend to find the advanced stuff falls over too.

    The Honest Timeline for General Business Impact

    My read of the current state is this: for specialised industries (finance, pharma, materials science, defence), meaningful quantum advantage on targeted problems is a 2027 to 2030 story. For general enterprise computing, you’re looking further out, probably 2032 and beyond for anything transformative. That might sound anticlimactic after years of breathless headlines, but it’s actually a manageable planning horizon. It means you have time to build capability, migrate your cryptography, and identify genuine use cases without panicking.

    The businesses that will benefit most from quantum computing won’t necessarily be the ones that invested earliest. They’ll be the ones that understood the technology clearly enough to invest at the right time, in the right problems, with realistic expectations. That requires curiosity, a decent grasp of the underlying physics (at least at a conceptual level), and the discipline to ignore the noise. Which, as it happens, describes how the best tech-literate businesses approach pretty much everything.

    Frequently Asked Questions

    Is quantum computing actually being used by businesses in 2026?

    Yes, but in a limited and targeted way. Financial services firms, pharmaceutical companies, and some logistics operations are running quantum or quantum-inspired workloads for specific optimisation and simulation problems. Broad general-purpose quantum computing for everyday business tasks is still several years away.

    How can a UK business access quantum computing without buying hardware?

    Cloud-based quantum services are the practical route for most businesses. Platforms like IBM Quantum, Amazon Braket, and Microsoft Azure Quantum all offer pay-per-use access to quantum processors. This removes the enormous operational overhead of running physical quantum hardware, which requires near-absolute-zero cooling environments.

    What does the UK government's quantum computing investment actually cover?

    The UK’s National Quantum Strategy commits £2.5 billion over ten years, running to 2033. The investment covers hardware research, quantum software development, talent pipelines through universities, and quantum hubs at institutions including Bristol, Oxford, and UCL. UKRI and Innovate UK manage much of the grant distribution.

    Why does quantum computing matter for cybersecurity right now?

    Sufficiently powerful quantum computers will be capable of breaking the RSA and elliptic curve encryption that currently underpins most internet security. While that scale of quantum capability doesn’t exist yet, businesses should start migrating to post-quantum cryptography standards now, as the NCSC has advised, because the timeline is uncertain and migration takes time.

    Which industries will benefit most from quantum computing in the near term?

    Financial services (portfolio optimisation, risk modelling), pharmaceuticals (molecular simulation and drug discovery), materials science (new material design), and defence (logistics and secure communications) are the sectors expected to see the earliest real-world advantages. For most other industries, meaningful quantum impact is more likely in the early 2030s.

The Latest