PQC Migration for Payment Networks and Processing
Payment systems present a unique PQC migration challenge: the cryptographic infrastructure spans card networks, real-time gross settlement systems, SWIFT messaging, terminal fleets, and the payment HSMs underneath them all. Migration cannot be done system by system, and it requires coordinated movement across an ecosystem of interconnected parties, many of whom operate on different timelines.
This course covers the payment-specific migration challenge, including lessons from BIS Project Leap, the PCI PQC migration timeline, and the practical question of how to sequence migration across a device fleet you cannot simply reboot.
Course Outline
Module 1. Where Payment Systems Use Cryptography
Cryptographic functions in card processing: authorization, clearing, settlement. PIN block encryption and key injection ceremonies. RTGS and SWIFT message authentication. Terminal and POS device cryptography. The payment HSM estate.
Module 2. BIS Project Leap and Industry Initiatives
What BIS Project Leap demonstrated about cross-border PQC migration. PCI Security Standards Council PQC guidance and timeline. Card network migration requirements. Industry coordination efforts and their status.
Module 3. Device Fleet Migration
The terminal migration challenge: millions of devices with limited upgrade paths. Key injection ceremony changes. HSM firmware upgrade sequencing. Managing dual-algorithm support during transition. The economics of payment device migration.
Module 4. Migration Sequencing
Where to start in a payment ecosystem. Back-end versus front-end migration sequencing. Cross-network coordination requirements. Testing payment flows during cryptographic transition.
Prerequisites
None. Sector experience is helpful but not required. For a broader PQC foundation, consider starting with Post-Quantum Foundation.
Certificate of Completion
Upon completion, you will receive a Quantum Academy certificate of completion. This is not a professional certification.
Who this course is for
Payment security architects, cryptography and HSM engineers, terminal and card product managers, scheme compliance leads, and the risk and audit staff who end up signing off on a migration plan. It suits people at issuers, acquirers, processors, card schemes, terminal manufacturers, and payment service providers.
If your work never touches authorization flows, key management, or scheme certification, Quantum-Safe Financial Services is the better starting point.
What you’ll be able to do afterward
- Assess PQC migration constraints specific to payment authorization flows
- Evaluate the card and terminal installed base against post-quantum algorithm requirements
- Apply lessons from BIS Project Leap Phase 2 (post-quantum signed liquidity transfers on Eurosystem test infrastructure)
- Plan PQC migration within card scheme timelines and certification frameworks
- Use the ISO 20022 messaging migration as a parallel modernization window
What you leave with
You leave with the course handbook, a PDF of the full material with the instructor notes written out in place of the slides’ bullet points, and a PDF copy of Quantum Ready, included at no extra cost. The handbook is yours to keep. For most organizations, that shared reference is the clearest return on a training budget.
Enrollment includes 180 days of access to the online on-demand course. Where that course is not yet published, the 180 days start on the day it is.
Where this course fits
Nothing is required. Post-Quantum Foundation covers the algorithm vocabulary if you want it first. The Quantum-Safe Payments Intensive is the full-day working session. PKI Modernization for Post-Quantum for engineers who own key material, and Cryptographic Discovery, Inventory, and CBOM for whoever runs discovery.
Why we teach this
The course is built on the Payments Extension of the Applied Quantum PQC Migration Framework, published openly under Creative Commons at pqcframework.org and written by the practitioners who teach here. Our faculty runs migration programs in this sector, and that is where the constraints in this material come from.
About this program
Quantum Academy credentials are private professional credentials issued by Quantum Academy, a trade name of Post-Quantum Institute. They are not government-issued licenses, accredited degrees, or academic credit, and earning one does not guarantee employment, promotion, regulatory approval, or any other specific outcome.
Quantum Academy programs are educational and informational only, and are not legal, compliance, or engineering advice.