The UK's Financial Conduct Authority (FCA) has issued a formal warning to financial services firms, urging them to begin preparing immediately for the post-quantum cryptography (PQC) era, with binding deadlines stretching from 2028 to 2035. The regulator outlined a clear timeline aligned with National Cyber Security Centre (NCSC) recommendations: by 2028, firms must complete a comprehensive PQC migration plan; by 2031, high-priority migration activities should be carried out; and by 2035, all systems, services, and products must be fully migrated to PQC.
The FCA emphasized that sufficiently powerful quantum computers pose a genuine threat to the cryptographic standards widely used today. Cryptography — of which encryption is just one component — underpins secure information exchange, identity verification, and overall trust in financial systems. Without trustworthy cryptography, the FCA warned, consumers would face fraud, firms would experience operational disruption, and the integrity of financial transactions and markets would be put at risk.
The regulator stressed that firms should not wait for the official milestones before acting. Senior managers are expected to ensure their organizations allocate sufficient time, investment, and resources to manage PQC migration safely. This urgency is underscored by the statistic that failed change projects accounted for around a fifth of all incidents reported to the FCA in 2025.
In addition to the migration requirements, the FCA announced the launch of the Quantum Experimentation Group — the world's first regulator-led quantum computing experimentation group — set to launch in the first quarter of 2027. The group will bring together financial services firms, quantum technology providers, and national research laboratories to explore how quantum machine learning could help detect money laundering and fraud. Participants will use an FCA synthetic dataset of artificially generated data to overcome barriers to testing, and the findings will help guide future regulatory approaches.
Jessica Rusu, chief data, information and intelligence officer at the FCA, commented: "We want to help firms explore where quantum could make a meaningful difference, and early experimentation is essential to understanding its potential in financial services."
The FCA is also trialling a new supervisory self-assessment tool with an initial sample of firms, which will help assess the maturity of their PQC migration plans. The regulator intends to extend the tool to other firms and will consult on cyber resilience guidance, including expectations for how firms should address PQC risks through their cryptographic controls. Financial services firms, quantum technology providers, and national research laboratories can register interest in joining the Quantum Experimentation Group by 31 December 2026.
