Post-Quantum Requirements in Saudi Arabia
On August 27, 2026, the Saudi Central Bank (SAMA) issued Circular 482021280 on quantum computing risks. It applies to banks, finance and payment companies, credit information companies and financing support entities licensed by SAMA. By December 31, 2026, each institution must have complete procedures for identifying and classifying all its cryptographic assets. By March 31, 2027, it must complete an enterprise quantum risk assessment with action plans.
The circular also requires remediation plans for priority assets. It makes quantum risk a standing item for the Information Security Supervisory Committee and the board risk committee. Algorithm requirements come from the National Cybersecurity Authority (NCA), whose draft update to the National Cryptographic Standards adds ML-KEM and ML-DSA. In this course, we cover what SAMA and the NCA require, who they bind, and the evidence that shows your institution is on track.
Course Outline
Module 1. What Regulators Everywhere Ask For (30 minutes)
Organizations face post-quantum requirements through government mandates, supplier obligations, critical infrastructure rules, sector supervision, and pressure from customers and insurers. Regulators in every jurisdiction ask for the same core evidence, from an accountable owner and a cryptographic inventory to a dated roadmap and progress reports. We cover NIST’s FIPS 203, 204 and 205 and compare Saudi requirements with those in the UAE, the EU and the United States.
Module 2. Saudi Requirements in Detail (60 minutes)
We work through each requirement in SAMA’s circular. That covers the inventory procedures, classification by sensitivity and migration priority, and the resilience assessment of priority assets. It also covers third-party dependencies, the enterprise risk assessment across operational, legal, regulatory, strategic and human-resources risk, and the remediation plans. We cover the committee oversight the circular requires and the reports the committees send to the board. We show how the circular connects to the SAMA Cyber Security Framework, which has required an asset register and a cryptographic standard since 2017. For government entities and critical national infrastructure, we cover the NCA’s Essential Cybersecurity Controls, the National Cryptographic Standards (NCS-1:2020) and the draft NCS-2:2025.
Module 3. Demonstrating Compliance in Saudi Arabia (30 minutes)
We cover what SAMA’s supervisors and your internal auditors will ask to see. That includes the documented inventory procedures and their results, priority classifications, the risk assessment with its action plans, and the remediation plans. It also includes committee minutes that record quantum risk as a standing item, and the reports to your board. The circular does not ask institutions to submit these documents to SAMA, so you learn to keep them ready for supervisory review.
Prerequisites
None. Post-Quantum Foundation explains the threat and the algorithms if you want that background first.
Who this course is for
CISOs, chief risk officers, compliance officers and migration program managers at SAMA-licensed banks, finance and payment companies, credit information companies and financing support entities. Also useful for government entities and critical national infrastructure operators that follow NCA controls, and for the technology providers that serve them.
What you’ll be able to do afterward
- Explain each requirement in SAMA’s circular and its deadline
- Build inventory procedures that meet the December 31, 2026 deadline
- Run the enterprise quantum risk assessment due by March 31, 2027
- Write remediation plans for priority assets, including third-party dependencies
- Set up committee oversight of quantum risk as the circular requires
- Apply the NCA’s cryptographic standards and controls where they bind your organization
What you leave with
When you finish, we email you the course handbook, a PDF of every slide with notes that explain it in full. It includes a reference table of the Saudi instruments covered, with their dates and sources. We also include a PDF copy of Quantum Ready. The handbook is yours to keep.
Enrollment includes 180 days of access to the online on-demand course. Where that course is not yet published, the 180 days start on the day it is.
Where this course fits
You can take this course on its own. If you also operate in the UAE, add PQC Compliance: United Arab Emirates, or take PQC Compliance: Global Overview for every jurisdiction in one session. Banks should continue with Quantum-Safe Financial Services, and payment companies with Quantum-Safe Payments. In Cryptographic Discovery, Inventory, and CBOM, you build the inventory the circular requires.
Why we teach this
We built the course on Quantum Ready, the book on organizational readiness written by the course author, and on the Applied Quantum PQC Migration Framework, published openly under Creative Commons. Our faculty runs migration programs and follows each Saudi instrument as SAMA and the NCA issue it. We revise the course when a regulator issues or changes a rule.
Certificate of Completion
Upon completion, you receive a Quantum Academy certificate of completion. It confirms that you completed the course and is separate from Quantum Academy’s professional certifications.
About this program
Quantum Academy credentials are private professional credentials issued by Quantum Academy, a trade name of Post-Quantum Institute. They are not government-issued licenses, accredited degrees, or academic credit, and earning one does not guarantee employment, promotion, regulatory approval, or any other specific outcome.
Quantum Academy programs are educational and informational only, and are not legal, compliance, or engineering advice.
