No single organization controls a payment chain, and no central authority coordinates its migration to post-quantum cryptography (PQC). Card schemes and payment system operators set requirements as conditions of market access, and merchants, acquirers, and processors cannot move their dates. Payment HSMs are certified twice, and POS terminals and ATMs are typically replaced every 7 to 15 years. In this workshop, you plan a migration program around those dates, certifications, and refresh cycles.

BIS Project Leap Phase 2 tested a post-quantum signature on liquidity transfers in the test environment of T2, the Eurosystem’s real-time gross settlement system. Every test scenario passed. To accept the new signature, the network service providers shipped updated modules, the central banks reconfigured their connectors, and a new verification component was built. A correctly signed transfer still did not settle, as the report expected, because no certificate for the test key existed in T2’s common reference data. What a CBOM Scoping Exercise Finds Inside One Mobile Banking Payment classifies each layer of the payment as owned, attested, or assumed.

We run this intensive as an eight-hour planning workshop, in one day in person or in two four-hour sessions live online. You work from your own HSM, terminal, and vendor records, or from a sample payments processor we provide. No cryptography background is needed. You leave with a draft program plan and a year-one roadmap, with the assumptions you still need to check written down.

Who this intensive is for

Program managers and PMO leads, the CISO or CTO who will sponsor the program, payment security architects, and HSM and key management leads. Terminal estate managers, settlement and Swift operations staff, vendor management, procurement, and scheme compliance belong in the room too. We recommend sending a mixed group from one organization, ideally the people who would be members of its quantum readiness steering committee. Running the HSM estate, managing the terminal fleet, and tracking scheme requirements are usually three different jobs.

Bring at least one person from payment HSM operations. Many of the sequencing decisions in this workshop are HSM refresh and certification decisions.

The intensive is for issuers, acquirers, processors, payment service providers, schemes, and terminal manufacturers. For a bank’s wider estate, including core banking, lending, and capital markets, take the Quantum-Safe Financial Services Intensive instead. To work through confidential detail with only your own colleagues present, book the intensive as private team training through training@quantumacademy.com.

What you’ll be able to do afterward

• Explain why a payments PQC migration is a multi-party program, and which parts of the chain you control
• Draft a program charter and business case, and define the steering committee that will govern the program
• Plan a cryptographic inventory from records you already hold, with your PCI DSS 12.3.3 evidence as one output
• Score and tier your estate, recording unknowns instead of guessing them and keeping blocked entries in their tier
• Track each payment HSM’s two certifications, and plan refresh or enclosure for terminals you cannot update remotely
• Map the dates that schemes, Swift, and settlement operators set, and plan how you coordinate with them
• Structure the program into workstreams and a year-one plan, with KPIs your board can read

What you leave with

Every participant receives the course handbook, a PDF of every slide with notes that explain it in full. Each participant also receives a PDF copy of Quantum Ready, the companion book to the framework the day draws on. During the day, you build first versions of these working documents:

• An estate map of your payment chain, marking who controls each part
• A program charter, steering committee structure, and business case outline
• An inventory plan, with its payment tracks, starting records, and order
• An initial priority list, with blocked entries and evidence gaps recorded
• An HSM register, a certification gate calendar, and a card and terminal population model
• An external dependency map for schemes, Swift, and settlement operators, with every date graded
• A workstream and wave structure, with exit evidence and role and resource assumptions
• A year-one plan by quarter, with board KPIs and the decisions you need from others

The working documents are editable and yours to keep.

Preparing for the day

You can work through the day with data from your own organization or with a sample payments processor we provide. If you bring approximate figures from your own estate, you apply each module directly to your payment operations, and the documents you leave with contain your own numbers. If you cannot share your data or have not had time to collect it, you work with the sample processor’s illustrative figures. You then apply the same templates to your own estate when you return to work.

Your joining instructions, sent seven days before the course, list what to gather if you want to use your own data. Approximate figures are enough:

• Payment HSMs by model and firmware version, with their certifications where known
• Terminal, PIN pad, and ATM counts by model, from the device census in your terminal management system
• The records an inventory would start from, such as your PCI DSS 12.3.3 documentation and certificate inventory
• Contract renewal and hardware refresh dates for your HSM, terminal, and processing vendors
• Any scheme, Swift, or regulatory deadlines your organization already tracks

You decide what you share with the room. If you cannot take key management records off site, bring counts and model names instead.

The day

The day draws on the lifecycle of the Applied Quantum PQC Migration Framework and its Payments Extension. The instructor starts each module with a short briefing. You then apply the module’s template to your own payments estate or to the sample processor.

In person, we teach the intensive from 09:00 to 17:00 local time, with lunch and two breaks:

• 09:00–09:50 · Module 1. The payment chain and who controls it
• 09:50–10:40 · Module 2. Mandate, governance, and the business case
• 10:40–11:00 · Break
• 11:00–11:45 · Module 3. Inventory planning
• 11:45–12:30 · Module 4. Risk scoring and priorities
• 12:30–13:30 · Lunch
• 13:30–14:20 · Module 5. HSMs, terminals, and certification gates
• 14:20–15:10 · Module 6. Schemes, Swift, and settlement operators
• 15:10–15:30 · Break
• 15:30–16:15 · Module 7. Program structure and staffing
• 16:15–17:00 · Module 8. Year-one plan, KPIs, and the asks

Live online, we teach it in two four-hour sessions on consecutive days, each with a short break. We cover Modules 1 to 4 in the first session and Modules 5 to 8 in the second.

Module 1. The payment chain and who controls it

The instructor walks through the parties in a domestic card payment and in a cross-border one, and the Project Leap results on T2. You then map your own estate by domain and mark whether your teams, a vendor, a scheme, Swift, or another counterparty controls each one.

Module 2. Mandate, governance, and the business case

You draft a charter with two outcomes: meeting your dated obligations, and being able to change algorithms on your own gateways, HSMs, and signing services on a planned date. You define a steering committee that includes acquiring, issuing, terminal management, HSM operations, Swift administration, and settlement. You build the business case on dates others set, hardware lead times, and the PQC changes you can add to funded ISO 20022 work.

Module 3. Inventory planning

You plan the inventory across the payment tracks, from message formats and the HSM estate to terminals, ATMs, and Swift. You start from records you already hold, such as HSM console exports and the terminal management system’s device census, and begin with PCI-scoped systems. You plan one data collection that produces both the PQC inventory and your PCI DSS 12.3.3 evidence, and tag each entry by who controls it.

Module 4. Risk scoring and priorities

You score the estate on exposure, trust-infrastructure criticality, migration feasibility, and regulatory pressure, with payment factors such as settlement chain position. You record unknowns instead of guessing them, then tier each fully scored entry. You keep entries that depend on a scheme, a certification, or a refresh cycle in their tier, and give the high-priority ones an owner and an interim treatment. Tokenization and Quantum Risk: What It Covers, What It Doesn’t explains which parts of a tokenized estate are still in scope.

Module 5. HSMs, terminals, and certification gates

You classify vendors by their role in the payment chain and ask the two crypto-agility questions first. You record each payment HSM’s FIPS 140-3 validation and PCI PTS HSM approval separately and build a certification gate calendar from them. You model card, terminal, and ATM populations by who can change their cryptography, and plan refresh or enclosure for those no one can change remotely. You grade every vendor date as committed, forecast, announced, or unknown, and draft the procurement clause for configuration-driven algorithm change.

Module 6. Schemes, Swift, and settlement operators

You map your dependencies on card and domestic schemes, EMVCo, Swift, and central bank settlement operators, and grade each date for firmness. You record Swift’s release dates apart from any date it sets for required PQC use. You plan dual-stack windows and interoperability tests with counterparties you cannot compel, and name an owner for each industry forum you follow. Counting the Trust Anchors in a Single Cross-Border Payment shows Swift and central banks renewing certificates on their own schedules.

Module 7. Program structure and staffing

You organize the work into workstreams, with the key exchange track starting at once and the signature and PKI track launching within 90 days. You plan the waves and their staffing, and define each wave’s exit evidence in a form your QSA, PIN assessor, and schemes can read. You schedule each wave’s algorithm-change rehearsal outside the freezes your change advisory board sets for month-end, quarter-end, and peak season. You also agree what the steering committee does when a vendor misses a committed date, or Swift or a scheme moves a date.

Module 8. Year-one plan, KPIs, and the asks

You assemble the day’s work into a year-one plan by quarter, ending with a first pilot and a year-two budget for HSM and terminal refresh. You select board KPIs for payment HSM readiness, external interface exposure, and terminal and ATM fleet disposition. You list the decisions you need from executives, HSM and terminal vendors, schemes, and Swift, and the instructor reviews each plan before the session ends.

Common questions

How technical is the day?

The day is about planning and program management. You need a working knowledge of your own payment operations, and no background in cryptography. The instructors explain the technical background to each decision in the module that needs it.

Do we need a cryptographic inventory before the day?

No. In Module 3, you plan the inventory from records you already hold, including your PCI DSS 12.3.3 documentation. Teams that already have an inventory or a cryptographic bill of materials (CBOM) bring it and use it in Module 4.

Can one person attend alone?

Yes. You complete the same templates and note the questions that need a colleague. A mixed group from one organization can answer more of those questions in the room.

Is the intensive vendor-neutral?

Yes. We favor no HSM vendor, terminal manufacturer, or processing platform, and we judge algorithms and products against published standards and public evidence.

Where this course fits

We recommend Quantum-Safe Payments as preparation, though you can enroll without it. It covers the same ground at overview depth. Participants who have taken it already know the terms we use during the day. Afterward, whoever will run the program can take PQC Migration Project Management, and whoever leads HSM and terminal vendor conversations can take PQC Vendor Governance and Supply Chain. Teams that own payment PKI and key material can take PKI Modernization for Post-Quantum.

Why we teach this

This intensive is built on the Payments Extension of the Applied Quantum PQC Migration Framework, published openly under Creative Commons at pqcframework.org. The course author wrote the framework and has led quantum readiness programs for financial institutions. The instructors run migration programs in this sector and teach the constraints they meet in that work.

Certificate of Completion

Upon completion, you receive a Quantum Academy certificate of completion. It confirms that you completed the course and is separate from Quantum Academy’s professional certifications.

Enrollment includes 180 days of access to the corresponding online on-demand course. Where that course is not yet published, the 180 days start on the day it is.

About this program

Quantum Academy credentials are private professional credentials issued by Quantum Academy, a trade name of Post-Quantum Institute. They are not government-issued licenses, accredited degrees, or academic credit, and earning one does not guarantee employment, promotion, regulatory approval, or any other specific outcome.

Quantum Academy programs are educational and informational only, and are not legal, compliance, or engineering advice.