Payments has some of the tightest technical constraints of any sector. A contactless transaction has a 300-millisecond budget, and the authentication field is limited to a couple of hundred bytes. Terminal estates are replaced over years, and certification gates add months to every hardware change. The new post-quantum standards do not change any of these constraints.
We run this intensive as a full-day, hands-on workshop. You bring your own authorization flows, HSM estate, and terminal refresh schedule. You leave with a plan sequenced around your certification gates.
Who this intensive is for
Payment security architects, cryptography and HSM engineers, terminal and card product managers, scheme compliance leads, and the risk staff who will sign the plan. It suits issuers, acquirers, processors, schemes, terminal manufacturers, and payment service providers.
We recommend sending a mixed team. The HSM estate, the terminal refresh schedule, and the scheme relationship usually have three different owners.
What you’ll be able to do afterward
- Size the post-quantum problem inside your own authorization path against its latency and message-size budgets
- Map the card and terminal installed base, and decide which parts migrate in place and which are replaced
- Sequence migration around dual FIPS 140-3 and PCI PTS certification gates and the months they add
- Apply what BIS Project Leap Phase 2 established to your own settlement and messaging paths
- Combine post-quantum migration with the ISO 20022 migration in one modernization program
- Meet PCI DSS 12.3.3 with a cryptographic inventory your teams can actually use
What you leave with
Every participant receives the course handbook, a PDF of the full material with the instructor notes written out. Each participant also receives a PDF copy of Quantum Ready. During the day, you produce a cryptographic exposure worksheet for the full authorization path and a card and terminal population model built on your own refresh data. You also produce a certification gate calendar and a coordination plan for schemes and processors. All are editable and yours to keep.
The day
Morning, first block. The authorization path. Trace cryptography through your own flows. Finding where the latency and size budgets constrain you, and where nobody has measured them.
Morning, second block. The installed base. Cards, terminals, and HSMs. Building the population model and separating in-place migration from replacement.
Afternoon, first block. Gates and coordination. Certification sequencing. Scheme timelines. What you cannot do alone and who else has to move first.
Afternoon, second block. The plan. Assemble the roadmap against the gate calendar. Draft the scheme and vendor conversations the plan depends on.
Where this course fits
We recommend Quantum-Safe Payments as preparation, though you can enroll without it. It covers the same ground at overview depth. Participants who have taken it already know the terms we use during the day. Afterward, teams that own key material can take PKI Modernization for Post-Quantum, and discovery teams can take Cryptographic Discovery, Inventory, and CBOM.
Why we teach this
This intensive is built on the Payments Extension of the Applied Quantum PQC Migration Framework, published openly under Creative Commons at pqcframework.org. The instructors run migration programs in this sector and teach the constraints they meet in that work.
Certificate of Completion
Upon completion, you receive a Quantum Academy certificate of completion. It confirms that you completed the course and is separate from Quantum Academy’s professional certifications.
Enrollment includes 180 days of access to the corresponding online on-demand course. Where that course is not yet published, the 180 days start on the day it is.
About this program
Quantum Academy credentials are private professional credentials issued by Quantum Academy, a trade name of Post-Quantum Institute. They are not government-issued licenses, accredited degrees, or academic credit, and earning one does not guarantee employment, promotion, regulatory approval, or any other specific outcome.
Quantum Academy programs are educational and informational only, and are not legal, compliance, or engineering advice.
