PQC Migration for Payment Networks and Processing
The payments industry has to migrate the cryptography in card networks, real-time gross settlement (RTGS) systems, SWIFT messaging, terminal fleets, and payment HSMs. Because the systems are connected, the migration has to be coordinated among many parties, each working to its own timeline.
This course covers migration in payments, including lessons from BIS Project Leap and the PCI PQC migration timeline. It also covers how to sequence migration across a device fleet you cannot simply reboot.
Course Outline
Module 1 Where Payment Systems Use Cryptography
What a quantum computer would break in a payment, and what it would not. Cryptographic functions in card processing: authorization, clearing, settlement. PIN block encryption and key injection ceremonies. RTGS and Swift message authentication. Terminal and POS device cryptography. The payment HSM estate.
Module 2 BIS Project Leap and Industry Initiatives
What BIS Project Leap Phase 2 showed when post-quantum signatures were tested on the Eurosystem’s T2 settlement system. What PCI Security Standards Council standards require for cryptography today. What card networks and EMVCo have published on post-quantum cryptography. Industry coordination efforts and their status. How firm each date you do not control is.
Module 3 Device Fleet Migration
The terminal migration challenge: millions of devices with limited upgrade paths. What cards and terminals can take: online authorization, offline authentication, and the contactless channel. Key injection ceremony changes. HSM firmware upgrade sequencing. Managing dual-algorithm support during transition. The economics of payment device migration.
Module 4 Migration Sequencing
Where to start among connected payment systems. Back-end versus front-end migration sequencing. Cross-network coordination requirements. ISO 20022 work and Swift’s releases as windows for post-quantum changes. Testing payment flows during cryptographic transition.
Prerequisites
None. Sector experience is helpful but not required. For a broader PQC foundation, consider starting with Post-Quantum Foundation.
Certificate of Completion
Upon completion, you receive a Quantum Academy certificate of completion. It is separate from our professional certifications and states your CPE credits, one for each 60 minutes of teaching. CISSP, CISM, CRISC and FRM holders can claim them with their certifying body. The credits also count toward renewing a Quantum Academy certification. Our CPE credits page explains how to claim them.
Who this course is for
Payment security architects, cryptography and HSM engineers, terminal and card product managers, scheme compliance leads, and the risk and audit staff who end up signing off on a migration plan. It suits people at issuers, acquirers, processors, card schemes, terminal manufacturers, and payment service providers.
You can take the course on your own. The exercises use a fictional payments processor instead of your employer’s systems.
If you do not work on authorization flows, key management, or scheme certification, start with Quantum-Safe Financial Services.
What you’ll be able to do afterward
- Assess PQC migration constraints specific to payment authorization flows
- Apply lessons from BIS Project Leap Phase 2 (post-quantum signed liquidity transfers on Eurosystem test infrastructure)
- Explain what PCI standards, card networks, EMVCo, and Swift have published on post-quantum cryptography, and grade how firm each of their dates is
- Evaluate the card and terminal installed base against post-quantum algorithm requirements
- Test a “quantum-safe” claim about a card, terminal, or HSM, or a forecast of when quantum computers will threaten card payments, against what has been demonstrated
- Decide where a payments organization should start, sequencing back-end systems ahead of the cards and terminals it cannot update
- Use the ISO 20022 messaging migration as a parallel modernization window
What you leave with
When you finish, we email you the course handbook, a PDF of every slide with notes that explain it in full. We also include a PDF copy of Quantum Ready. The handbook is yours to keep.
The handbook includes reference sheets you can use at work. One of them lists the dates that PCI standards, card networks, EMVCo, Swift, and settlement operators have set, with how firm each one is.
Enrollment includes 180 days of access to the online on-demand course. Where that course is not yet published, the 180 days start on the day it is.
Common Questions
How is this course different from the intensive?
This course explains the problem in three hours. You learn where payment systems use cryptography and what a quantum computer would break. You learn what PCI standards, card networks, and Swift have published, and which cards, terminals, and HSMs are hardest to change. You also learn where a payments organization should start. The short exercises use a fictional payments processor. You can attend alone without sharing anything about your employer. The Quantum-Safe Payments Intensive is a full working day, best taken by a team from one organization. Each module opens with a short briefing. You then spend most of the module building one part of your organization’s plan, from the program charter to a year-one roadmap. Take this course to understand the constraints and brief your colleagues. Take the intensive when your organization is ready to plan.
How technical is the course?
You need no background in cryptography. Module 1 starts with the parts of a card payment that a quantum computer would break. HSM, card, and key management specialists also get the detail of their own work: PIN blocks, key injection, remote key loading, and the certification of payment HSMs and terminals.
Is the course vendor-neutral?
Yes. We favor no HSM vendor, terminal manufacturer, card network, or processing platform. We judge products and claims against published standards and public evidence.
Where this course fits
Nothing is required. Post-Quantum Foundation covers the algorithm vocabulary if you want it first. When your organization is ready to plan, send a team to the Quantum-Safe Payments Intensive. In that full-day workshop, you apply the same framework to your own estate or to a sample processor and leave with first versions of your program documents. Engineers who own key material can take PKI Modernization for Post-Quantum, and discovery teams can take Cryptographic Discovery, Inventory, and CBOM.
Why we teach this
The course is built on the Payments Extension of the Applied Quantum PQC Migration Framework. The practitioners who teach here wrote it, and it is published openly under Creative Commons at pqcframework.org. Our faculty runs migration programs in this sector and teaches the constraints they meet in that work.
About this program
Quantum Academy credentials are private professional credentials issued by Quantum Academy, a trade name of Post-Quantum Institute. They are not government-issued licenses, accredited degrees, or academic credit, and earning one does not guarantee employment, promotion, regulatory approval, or any other specific outcome.
Quantum Academy programs are educational and informational only, and are not legal, compliance, or engineering advice.