Post-Quantum Cryptography: Migration Priorities for Financial Services

A joint industry report published by Europol sets out a practical methodology for financial organisations to prioritise post-quantum cryptography migration. It recommends first creating an inventory of business use cases that rely on public-key cryptography, then ranking them using Migration Priority as a function of Quantum Risk and Migration Time. Quantum Risk is scored using three parameters, shelf life of protected data, exposure, and severity, while Migration Time is assessed through solution availability, execution cost/time, and external dependencies.

The report also identifies near-term “no-regret” actions that strengthen security today while improving readiness for the quantum transition, particularly for public-facing web services threatened by “harvest-now, decrypt-later” collection of encrypted traffic. It highlights that hybrid post-quantum/classical key agreement (e.g., X25519MLKEM768) is already widely supported across major browsers, cryptographic libraries and CDNs, making some website protections feasible with relatively low disruption, and it encourages reducing technical debt by remediating common cryptographic antipatterns such as manual certificate management and inconsistent TLS configurations. 

Source: Joint report outlines practical approach to prioritising post-quantum cryptography migration in financial services - Framework supports early action and long-term planning as quantum computing challenges existing encryption methods | Europol