PQC Migration for Banking, Capital Markets, and Insurance
Financial services is one of the most cryptography-dense sectors. Our faculty ran a cryptographic discovery exercise on representative components, written up in The Cryptographic Iceberg Inside a Mobile Banking Transaction. Opening a mobile banking app triggered roughly 320 cryptographic function calls. Along a cross-border payment chain with nine parties, they found more than 30,000 unique cryptographic functions. The figures are order-of-magnitude estimates and should not be read as an industry benchmark. The course authors have seen the same pattern in the institutions they have worked with. Institutions will have to migrate most of those functions to post-quantum algorithms. The main constraint is coordination across counterparties, payment networks, and market infrastructure. Every institution depends on the others to migrate.
This course applies the PQC Migration Framework to financial services. It covers the sector’s regulatory requirements, the multi-party coordination problem, and the advantages that well-governed financial institutions already have.
Course Outline
Module 1 The Financial Services Cryptographic Estate
The density and interconnectedness of cryptography in financial services. Inter-bank payment flows and their cryptographic dependencies. Trading, clearing, and settlement systems. Customer-facing channels. The multi-party coordination challenge: why no single institution can migrate in isolation.
Module 2 Regulatory Drivers
G7 Cyber Expert Group guidance and its implications. PCI DSS PQC roadmap. DORA crypto-agility requirements. MAS and HKMA directives. SEC disclosure considerations. How regulatory timelines differ across jurisdictions and what that means for global institutions.
Module 3 Migration Strategy for Financial Services
Where to start: high-value data at rest versus high-volume data in transit. The HSM estate challenge. Cross-border coordination requirements. The sector’s structural advantages: mature governance, established vendor relationships, and regulatory pressure that justifies budget. Building the financial services-specific migration roadmap.
Module 4 Implementation Considerations
HSM upgrade and key management migration. SWIFT and payment network coordination. Trading platform cryptographic migration. Regulatory reporting during transition. Testing and validation in financial services environments.
Prerequisites
None. Sector experience is helpful but not required. For a broader PQC foundation, consider starting with Post-Quantum Foundation.
Certificate of Completion
Upon completion, you receive a Quantum Academy certificate of completion. It is separate from our professional certifications and states your CPE credits, one for each 60 minutes of teaching. CISSP, CISM, CRISC and FRM holders can claim them with their certifying body. The credits also count toward renewing a Quantum Academy certification. Our CPE credits page explains how to claim them.
Who this course is for
Security leaders, risk managers, compliance officers, technology architects, and program managers at banks, broker-dealers, asset managers, insurers, and financial market infrastructure operators. Also appropriate for financial regulators and supervisory technology specialists.
What you’ll be able to do afterward
- Assess the cryptographic density of financial services environments and identify migration scope
- Map financial sector regulatory requirements (G7 CEG roadmap, PCI DSS v4.0 Requirement 12.3.3, DORA, NIS2, HKMA Quantum Preparedness Index) to migration timelines
- Plan multi-party PQC migration across interbank messaging, payment networks, and market infrastructure
- Address HSM-intensive environments and key management migration challenges
- Coordinate with sector coordination bodies (FS-ISAC PQC Working Group, Quantum Safe Financial Forum)
- Use the financial sector’s strengths, such as three-lines governance, evidence prepared for regulatory examination, and mature third-party risk programs, to accelerate migration
What you leave with
When you finish, we email you the course handbook, a PDF of every slide with notes that explain it in full. We also include a PDF copy of Quantum Ready. The handbook is yours to keep.
Enrollment includes 180 days of access to the online on-demand course. Where that course is not yet published, the 180 days start on the day it is.
Where this course fits
Nothing is required. Post-Quantum Foundation covers the algorithm vocabulary if you want it first. The Quantum-Safe Financial Services Intensive is the full-day, hands-on workshop where you build the plan. Teams about to start discovery should take Cryptographic Discovery, Inventory, and CBOM.
Why we teach this
The course is built on the Financial Services Extension of the Applied Quantum PQC Migration Framework. The practitioners who teach here wrote it, and it is published openly under Creative Commons at pqcframework.org. Our faculty runs migration programs in this sector and teaches the constraints they meet in that work.
About this program
Quantum Academy credentials are private professional credentials issued by Quantum Academy, a trade name of Post-Quantum Institute. They are not government-issued licenses, accredited degrees, or academic credit, and earning one does not guarantee employment, promotion, regulatory approval, or any other specific outcome.
Quantum Academy programs are educational and informational only, and are not legal, compliance, or engineering advice.
