Our faculty ran a cryptographic discovery exercise on representative components and counted roughly 320 cryptographic function calls when a mobile banking app opened. Along a cross-border payment chain with nine parties, they found more than 30,000 unique cryptographic functions. The figures are order-of-magnitude estimates, and the exercise is written up in The Cryptographic Iceberg Inside a Mobile Banking Transaction.
The regulatory calendar for financial services is already set. DORA’s crypto-agility obligations are in force, and PCI DSS v4.0 requires documented cipher review. The G7 Cyber Expert Group has published its phased roadmap, and supervisors from the ECB to the HKMA are turning quantum readiness into examination material.
We run this intensive as a full-day, hands-on workshop. You bring your regulatory map, architecture documentation, and HSM inventory. You leave with a migration plan structured for regulatory review.
Who this intensive is for
Security leaders and architects, cryptography and HSM engineers, regulatory and compliance leads, program managers, and the risk staff who will sign the plan. They work at banks, broker-dealers, asset managers, insurers, and market infrastructure operators.
Send a mixed group from one institution. The engineer who runs the HSM estate rarely owns the regulatory map, and you need both people to build the plan.
If you work on card payments as an issuer, acquirer, processor, or scheme, take the Quantum-Safe Payments Intensive instead.
What you’ll be able to do afterward
- Map your institution’s cryptographic estate, including the places where inventories under-count it
- Connect DORA, PCI DSS 12.3.3, the G7 Cyber Expert Group phases, NIST IR 8547 deadlines, and your national supervisor’s expectations to concrete program phases
- Prioritize migration scope by harvest-now exposure and system criticality
- Plan HSM and key-management modernization, covering firmware-upgradeable versus replacement units, FIPS validation gaps, and dual-key operation during the hybrid period
- Build a counterparty engagement plan for interbank messaging, schemes, custodians, and market infrastructure, aligned to SWIFT’s migration window
- Plan around the performance of post-quantum signatures at transaction volume, using the results of settlement-system benchmarking
What you leave with
Every participant receives the course handbook, a PDF of the full material with the instructor notes written out. Each participant also receives a PDF copy of Quantum Ready. During the day you build a regulatory alignment map for your institution and a prioritized migration scope. You also draft an HSM and key-management modernization outline, a counterparty engagement plan, and a twelve-month roadmap skeleton for budgeting and board reporting. All are editable and yours to keep.
The day
Morning, first block. The density problem. Measure the cryptographic density of your environment and see why inventories under-count it. Then map your regulatory obligations in a working session with the other institutions in the room.
Morning, second block. Prioritization. Apply exposure scoring to realistic banking portfolios, from trading infrastructure to custody, using the framework’s harvest-now exposure and system-criticality criteria.
Afternoon, first block. Keys and counterparties. Plan your HSM estate against the FIPS and PCI certification gap. Then work through the multi-party coordination problem and decide what your counterparty plan must contain.
Afternoon, second block. The plan. Review the settlement-system benchmark results for post-quantum signatures at transaction volume, and plan around them. Then assemble the twelve-month roadmap, and an instructor reviews each table’s plan.
Where this course fits
We recommend Quantum-Safe Financial Services before this day. It covers the same ground at overview depth. Participants who have taken it already know the terms we use during the day. Afterward, the teams that own key material should take PKI Modernization for Post-Quantum. Whoever runs counterparty and supplier conversations should take PQC Vendor Governance and Supply Chain.
Why we teach this
This intensive is built on the Financial Services Extension of the Applied Quantum PQC Migration Framework, published openly under Creative Commons at pqcframework.org. The instructors run migration programs in this sector and teach the constraints they meet in that work.
Certificate of Completion
Upon completion, you receive a Quantum Academy certificate of completion. It confirms that you completed the course and is separate from Quantum Academy’s professional certifications.
Enrollment includes 180 days of access to the corresponding online on-demand course. Where that course is not yet published, the 180 days start on the day it is.
About this program
Quantum Academy credentials are private professional credentials issued by Quantum Academy, a trade name of Post-Quantum Institute. They are not government-issued licenses, accredited degrees, or academic credit, and earning one does not guarantee employment, promotion, regulatory approval, or any other specific outcome.
Quantum Academy programs are educational and informational only, and are not legal, compliance, or engineering advice.
