Banks already run much of the governance a post-quantum cryptography (PQC) migration program needs, from the three lines of defense to third-party risk management. What a bank cannot do alone is protect the transaction chains it shares with payment networks, market infrastructures, and counterparties, each on its own timetable. In this workshop, you integrate the program into that governance and plan the shared links with the parties who control them.

In one internal discovery exercise, the course author’s team counted about 320 cryptographic function calls as a mobile banking app opened, before any transaction began. Followed end to end, one cross-border payment from the app involved nine independent parties and more than 30,000 unique cryptographic functions. The exercise used a limited set of representative components at one point in time, so the figures show order of magnitude, not an industry benchmark. It is written up in The Cryptographic Iceberg Inside a Mobile Banking Transaction. What a CBOM Scoping Exercise Finds Inside One Mobile Banking Payment shows which parts of that chain a bank can inventory.

We run this intensive as an eight-hour planning workshop, in one day in person or in two four-hour sessions live online. You work from your own records, such as the HSM register, or from a sample bank we provide. No cryptography background is needed. You leave with a draft program plan and a year-one roadmap, with the assumptions you still need to check written down.

Who this intensive is for

Program managers and PMO leads, security architects, key management and HSM teams, and the people who lead payment operations, treasury, and digital channels. Third-party risk management, compliance, the second-line risk function, and the CISO or CTO who will sponsor the program belong in the room too. We recommend sending a mixed group from one institution, ideally the people who would be members of its quantum readiness steering committee. The people who run the HSM estate rarely own the regulatory map or the vendor contracts.

Bring at least one person from third-party risk management. Many of the sequencing decisions in this workshop are vendor decisions.

The intensive is for banks, broker-dealers, asset managers, custodians, and market infrastructure operators. Insurers can instead take the Quantum-Safe Insurance Intensive, which covers their own migration and adds the underwriting side. If you work on card payments as an issuer, acquirer, processor, or scheme, take the Quantum-Safe Payments Intensive instead. To work through confidential detail with only your own colleagues present, book the intensive as private team training through training@quantumacademy.com.

What you’ll be able to do afterward

• Explain how much of a bank’s PQC migration depends on other parties
• Draft a charter and a business case, and map the program onto your three lines of defense
• Plan a cryptographic inventory across the financial services tracks, starting from records you already keep
• Score and tier your estate with the sector’s risk factors, recording unknowns instead of guessing them
• Classify vendors, question them in the right order, grade their dates, and register your HSM estate
• Map the dates that supervisors, Swift, central banks, and counterparties set, and plan what to do while you wait
• Structure the program into workstreams, waves, and a year-one plan, with KPIs your board risk committee can read

What you leave with

Every participant receives the course handbook, a PDF of every slide with notes that explain it in full. Each participant also receives a PDF copy of Quantum Ready, the companion book to the framework the day draws on. During the day, you build first versions of these working documents:

• An estate map by business line, showing who controls each part
• A program charter, steering committee structure, and three-lines mapping
• An inventory plan, with its tracks, starting records, and order
• An initial priority list, with evidence gaps and blocked entries recorded
• Vendor dependency and HSM registers, with graded vendor dates
• An external dependency map for supervisors, Swift, central banks, schemes, and counterparties
• A workstream and wave structure with role and resource assumptions
• A year-one plan by quarter, with board KPIs and the decisions you need from others

The working documents are editable and yours to keep.

Preparing for the day

You can work through the day with data from your own institution or with a sample bank we provide. If you bring approximate figures from your own estate, you apply each module directly to your institution, and the documents you leave with contain your own numbers. If you cannot share your data or have not had time to collect it, you work with the sample bank’s illustrative figures. You then apply the same templates to your own institution when you return to work.

Your joining instructions, sent seven days before the course, list what to gather if you want to use your own data. Approximate figures are enough:

• Your business lines, and the core platforms and critical vendors behind each, with contract renewal dates
• Your HSM estate by model, with support and refresh dates
• The records an inventory would start from, such as the CMDB and your PCI DSS 12.3.3 documentation
• Your external connections, such as Swift, payment schemes, central bank settlement, and correspondents
• Any regulatory or supervisory deadlines your institution already tracks

You decide what you share with the room. If you cannot take the HSM register or contract terms off site, bring counts and dates instead.

The day

The day draws on the lifecycle of the Applied Quantum PQC Migration Framework and its Financial Services Extension. The instructor starts each module with a short briefing. You then apply the module’s template to your own institution or to the sample bank.

In person, we teach the intensive from 09:00 to 17:00 local time, with lunch and two breaks:

• 09:00–09:50 · Module 1. The shape of the program
• 09:50–10:40 · Module 2. Mandate, governance, and the business case
• 10:40–11:00 · Break
• 11:00–11:45 · Module 3. Inventory planning
• 11:45–12:30 · Module 4. Risk scoring and priorities
• 12:30–13:30 · Lunch
• 13:30–14:20 · Module 5. Vendor management and the HSM estate
• 14:20–15:10 · Module 6. Supervisors, networks, and counterparties
• 15:10–15:30 · Break
• 15:30–16:15 · Module 7. Program structure and the change calendar
• 16:15–17:00 · Module 8. Year-one plan, KPIs, and the asks

Live online, we teach it in two four-hour sessions on consecutive days, each with a short break. We cover Modules 1 to 4 in the first session and Modules 5 to 8 in the second.

Module 1. The shape of the program

The instructor walks through one mobile banking payment, from the app to central bank settlement, and the parties it depends on. You then map your estate by business line and mark whether your teams, a vendor, a network operator, or a counterparty controls each part.

Module 2. Mandate, governance, and the business case

You draft a charter with two outcomes, each mapped to something your supervisor already measures: readiness against dated obligations, and the ability to change cryptography on a planned date. You define the steering committee, with payment operations, treasury, compliance, and digital channels alongside security, and map the program onto your three lines of defense. The CISO, the Three Lines, and Who Owns PQC Migration explains why the program belongs to the first line, whoever leads it. You build the business case on what applies to you, from PCI DSS Requirement 12.3.3 and DORA to NIST IR 8547 and the G7 Cyber Expert Group’s roadmap.

Module 3. Inventory planning

You plan the inventory across the extension’s tracks, from core banking and digital channels to signed records and long-retention data. You start each track from a record you already keep, such as the CMDB, the HSM register, or your PCI DSS 12.3.3 documentation. You put customer-facing channels and interbank messaging first, and extend the inventory in rings, from what you control to what you consume from vendors and depend on from counterparties.

Module 4. Risk scoring and priorities

You score the estate on the framework’s four dimensions, with the extension’s factors for systemic criticality, multi-party dependency, and verifier updatability. You record unknowns instead of guessing them, and put the scoring model under your model risk management, with second-line validation. You then tier each fully scored entry, keeping blocked entries in their tier with the dependency that unblocks them and an interim treatment.

Module 5. Vendor management and the HSM estate

You classify vendors by role and mark core banking vendors as Strategic Blocking from the start. You run the questionnaire through your third-party risk cycle, opening with the two crypto-agility questions, and grade every date as committed, forecast, announced, or unknown. You record each HSM with its firmware family and validation status. You then mark each one as firmware-upgradeable or due for replacement. You also draft a crypto-agility clause whose acceptance test is a rehearsed algorithm change before go-live.

Module 6. Supervisors, networks, and counterparties

You map and grade the dates you depend on, from supervisors and Swift to central banks and payment schemes. Switzerland’s FINMA, for example, recommends a post-quantum roadmap by mid-2027, while Swift has announced a PQC-enabled SwiftNet 8.0 for 2027 without stating publicly what it will require of participants. You plan dual-stack windows and test events with correspondents, custodians, and corporate clients, and record who decides when a counterparty will not move.

Module 7. Program structure and the change calendar

You organize the work into workstreams and set the gates and the staffing. You choose first pilots on layers you control, such as the online banking portal, and schedule algorithm-change rehearsals outside the reporting freezes your change advisory board applies. You define the evidence you need to close each wave, with protection and agility results recorded separately for auditors and supervisors. You also agree what the steering committee does when a network or vendor misses a committed date.

Module 8. Year-one plan, KPIs, and the asks

You assemble the day’s work into a year-one plan by quarter, starting with governance, PCI DSS 12.3.3-aligned inventory, and HSM and core-platform vendor engagement. You choose KPIs for your board risk committee from the sector supplement, such as external interface exposure and the stage you report on a readiness index like the HKMA’s. You list the decisions you need from executives, vendors, counterparties, and supervisors, and the instructor reviews each plan before the session ends.

Common questions

How technical is the day?

The day is about planning and program management. You need a working knowledge of your own institution, and no background in cryptography. The instructors explain the technical background to each decision in the module that needs it.

Do we need a cryptographic inventory before the day?

No. In Module 3, you plan the inventory from records you already keep, such as your PCI DSS 12.3.3 documentation. Teams that already have an inventory or a cryptographic bill of materials (CBOM) bring it and use it in Module 4.

Can one person attend alone?

Yes. You complete the same templates and note the questions that need a colleague. A mixed group from one institution can answer more of those questions in the room.

Is the intensive vendor-neutral?

Yes. We favor no HSM vendor, core banking platform, or cloud provider, and we judge algorithms and products against published standards and public evidence.

Where this course fits

We recommend Quantum-Safe Financial Services as preparation, though you can enroll without it. It covers the same ground at overview depth. Participants who have taken it already know the terms we use during the day. Afterward, whoever will run the program can take PQC Migration Project Management, and the teams that own key material can take PKI Modernization for Post-Quantum. Whoever runs vendor and counterparty conversations can take PQC Vendor Governance and Supply Chain.

Why we teach this

This intensive is built on the Financial Services Extension of the Applied Quantum PQC Migration Framework, published openly under Creative Commons at pqcframework.org. The course author wrote the framework and has led quantum readiness programs for financial institutions. The instructors run migration programs in this sector and teach the constraints they meet in that work.

Certificate of Completion

Upon completion, you receive a Quantum Academy certificate of completion. It confirms that you completed the course and is separate from Quantum Academy’s professional certifications.

Enrollment includes 180 days of access to the corresponding online on-demand course. Where that course is not yet published, the 180 days start on the day it is.

About this program

Quantum Academy credentials are private professional credentials issued by Quantum Academy, a trade name of Post-Quantum Institute. They are not government-issued licenses, accredited degrees, or academic credit, and earning one does not guarantee employment, promotion, regulatory approval, or any other specific outcome.

Quantum Academy programs are educational and informational only, and are not legal, compliance, or engineering advice.