One day. Your institution. A migration plan that survives contact with your regulator.
In a cryptographic discovery exercise our faculty ran on representative components, written up in The Cryptographic Iceberg Inside a Mobile Banking Transaction, opening a mobile banking app triggered roughly 320 cryptographic function calls, and a cross-border payment chain traversed more than 30,000 unique cryptographic functions across nine parties. Order-of-magnitude figures rather than a benchmark, and the point stands either way. Financial services is the most cryptography-dense sector in existence, and it now faces the most crowded regulatory calendar: DORA’s crypto-agility obligations are in force, PCI DSS v4.0 requires documented cipher review, the G7 Cyber Expert Group has published its phased roadmap, and supervisors from the ECB to the HKMA are turning quantum readiness into examination material.
This intensive is the working session that turns awareness into a program. It is built on the Applied Quantum PQC Migration Framework and its Financial Services Extension, taught by the practitioners who wrote them. You spend the day applying the framework to your own institution, and you leave with artifacts, not notes.
Who this intensive is for
Security leaders, architects, risk and compliance officers, and program managers at banks, broker-dealers, asset managers, insurers, and market infrastructure operators who own or will own part of the PQC migration. Teams are encouraged to attend together; the exercises work best with mixed security, risk, and technology perspectives at one table.
What you leave with
- A regulatory alignment map for your institution, connecting DORA, PCI DSS 12.3.3, G7 CEG phases, NIST IR 8547 deadlines, and your national supervisor’s expectations to concrete program phases
- A prioritized migration scope built with the framework’s harvest-now exposure and system-criticality lenses
- An HSM and key-management modernization outline covering firmware-upgradeable versus replacement units, FIPS validation gap handling, and dual-key operation during the hybrid period
- A counterparty engagement plan for the multi-party problem: interbank messaging, schemes, custodians, and market infrastructure, aligned to SWIFT’s migration window
- A twelve-month roadmap skeleton your team can take directly into budgeting and board reporting
The day
Morning — scope the problem honestly. The cryptographic density of your environment and why inventories under-count. Working session: regulatory alignment mapping for the institutions in the room. Prioritization exercise: applying exposure scoring to realistic banking portfolios, from trading infrastructure to custody.
Afternoon — build the program. HSM estate strategy and the FIPS/PCI certification gap. The multi-party coordination problem and what your counterparty plan must contain. Performance realities: what settlement-system benchmarking has shown about post-quantum signatures at transaction volume, and how to plan around it. Closing working session: assembling the twelve-month roadmap, with instructor review of each table’s plan.
What is included
Full-day instruction by the framework’s authors, all workshop materials and templates in editable form, the artifacts you build during the day, catering at in-person sessions, a certificate of completion, and 180 days of access to the Quantum-Safe Financial Services on-demand course for pre-work and reference. Attendees also receive a discount toward PQCS certification training, applied at registration.
Format and prerequisites
Delivered live online and in person at scheduled locations; see the training schedule. Private delivery for a single institution is available and recommended for teams of eight or more: write to training@quantumacademy.com. No formal prerequisites; the Quantum-Safe Financial Services on-demand course (included with your booking) is the recommended pre-work, and familiarity with your institution’s security architecture will make the exercises considerably more useful.
Who this course is for
Financial institution security architects, cryptography and HSM engineers, regulatory and compliance leads, and the risk staff who will sign the plan. Mixed teams from one institution get the most from it. The day works from your own estate.
It is a working session rather than a taught course. Come with your architecture documentation and your regulatory map.
What you’ll be able to do afterward
- Map your institution’s cryptographic estate across the systems that matter
- Build a regulatory obligation map covering the supervisors that reach you
- Sequence HSM and key-management migration against your certification constraints
- Draft a counterparty and vendor engagement plan
- Leave with a twelve-month roadmap skeleton ready for budgeting
What you leave with
You leave with the course handbook, a PDF of the full material with the instructor notes written out in place of the slides’ bullet points, and a PDF copy of Quantum Ready, included at no extra cost. The handbook is yours to keep and yours to share inside your team. For most organizations, that shared reference is the clearest return on a training budget.
Where this sits in your path
The corresponding overview course covers the same ground at overview depth and makes the day go further. PKI Modernization for Post-Quantum for the teams that own key material, and PQC Vendor Governance for the counterparty and supplier programs.
Why we teach this
The course is built on the Applied Quantum PQC Migration Framework, published openly under Creative Commons at pqcframework.org and written by the practitioners who teach here. Our faculty runs migration programs inside organizations doing this work now, and the course reflects what those programs run into.
