Post-Quantum Cryptography: The Next Y2K Challenge — Are You and Your Critical Third Parties Ready?

At an Operational Risk industry forum this week, we discussed the extraordinary pace of technological change, including agentic AI, increasingly capable AI systems and quantum computing. One comparison particularly resonated: post-quantum cryptography could become the next Y2K-scale technology challenge — but without knowing precisely when the critical event will occur.

Y2K involved a known deadline and a relatively well-understood problem. The quantum challenge involves uncertainty about timing, technological development and the scale of the threat. Yet the underlying operational risk challenge is familiar: potentially systemic vulnerabilities embedded across interconnected systems, with complex dependencies on technology providers and other third parties. Preparation cannot wait until the threat materialises.

From Theory to Reality: The Pioneering Work of David Deutsch

It is worth remembering how far quantum computing has come since the pioneering work of Oxford physicist David Deutsch, one of the most important scientists and thinkers in the field. In 1985, Deutsch established the theoretical foundations of universal quantum computing, subsequently developing one of the earliest quantum algorithms demonstrating how quantum computation could outperform classical approaches.

What began as a profound theoretical insight into computation and physical reality has developed into a major international research and technology programme. More than 40 years later, the question is not whether quantum computing is scientifically possible, but when sufficiently powerful and reliable quantum computers will become available — and whether our cryptographic infrastructure will be ready.

What's the Threat?

Much of today's digital infrastructure depends on public-key cryptography to protect communications, authenticate identities and verify digital signatures. A sufficiently powerful, fault-tolerant quantum computer could break widely used public-key algorithms, including RSA and elliptic-curve cryptography. That could compromise the confidentiality, integrity and authenticity of information and transactions across financial services.

Not all cryptography is equally vulnerable. The primary concern is current public-key cryptography, rather than an immediate collapse of every encryption mechanism. There is also a threat today: 'harvest now, decrypt later'. Adversaries can collect encrypted information now and potentially decrypt it in the future when sufficiently capable quantum computers become available. For sensitive information requiring protection over many years, exposure may already exist.

The Regulators Are Telling Us to Prepare

The UK National Cyber Security Centre (NCSC) has established a phased roadmap for migration to post-quantum cryptography:

2028: Complete discovery, assess cryptographic dependencies and develop an initial migration plan.
2031: Complete the highest-priority migration activities and refine the overall roadmap.
2035: Complete migration across systems, services and products.

The FCA reinforced the message in November 2026, emphasising the need for firms to act now, understand their cryptographic dependencies and manage migration safely. Internationally, NIST has standardised post-quantum cryptographic algorithms, while the Bank for International Settlements has published a roadmap addressing quantum readiness across the financial system. The migration challenge is no longer simply theoretical.

What Could Go Wrong? Six Operational Risk Scenarios

1. Compromise of confidential customer information

Sensitive customer, financial or transaction information intercepted today could become readable in the future. Consequences could include breaches of confidentiality, fraud, regulatory exposure and reputational damage.

2. Compromise of digital identities and transaction authentication

If vulnerable cryptographic mechanisms remain in use, attackers equipped with sufficiently capable quantum technology could potentially forge signatures or impersonate trusted systems. Payment authorisation, secure communications and system authentication could be affected.

3. A critical third-party technology failure

A major cloud, payment, telecommunications or financial infrastructure provider discovers that key services cannot safely transition to post-quantum cryptography. Emergency remediation or incompatible upgrades cause widespread disruption to dependent financial institutions.

4. A disorderly industry-wide migration

Firms and suppliers delay preparations, then undertake urgent upgrades following a major quantum breakthrough. Inadequate testing, incompatible systems, certificate failures and poorly coordinated changes cause significant disruption. The migration itself becomes a source of operational risk.

5. Concentration risk and systemic disruption

Multiple financial institutions depend on common technology platforms, cryptographic libraries, certificate authorities and infrastructure providers. A vulnerability or failed migration affecting one widely used component could have consequences across the financial system.

6. The Convergence of Agentic AI and Quantum Computing: A Potential Systemic Cyber Threat

Perhaps the most concerning forward-looking scenario involves the convergence of highly capable agentic AI and quantum computing. We are already seeing increasingly sophisticated AI systems capable of identifying software vulnerabilities, developing code and undertaking complex tasks with considerable autonomy. Frontier models with capabilities comparable to Anthropic's Mythos, combined with coordinated swarms of AI agents, could potentially undertake sophisticated cyberattacks at a speed and scale difficult for human defenders to match.

Now consider a future in which sufficiently powerful quantum computers can also compromise widely used public-key cryptography. AI agents could potentially identify vulnerable systems, coordinate attacks across interconnected networks, exploit compromised authentication mechanisms and move rapidly between institutions and their technology providers.

For financial services, the consequences could extend beyond individual cyber incidents. A coordinated attack affecting common technology providers, payment infrastructure, financial market utilities or other critical services could disrupt multiple institutions simultaneously. The concern is the combination of increasingly capable autonomous attackers, weaknesses in cryptographic infrastructure and concentration of critical financial services dependencies.

This is a hypothetical future threat scenario, not a prediction. AI agents do not currently possess quantum cryptanalytic capabilities simply by virtue of being highly capable AI systems. The scenario illustrates why quantum readiness, AI governance, cybersecurity, third-party risk management and operational resilience cannot be considered in isolation.

All six scenarios are illustrative rather than predictions. Their likelihood and severity depend on technological progress, existing controls and the effectiveness of migration programmes.

The Third-Party Elephant in the Room

For many financial institutions, much of the cryptographic infrastructure on which they depend is not directly controlled by them. It sits within cloud platforms, core banking systems, payment networks, software products, telecommunications services and other third-party arrangements. This raises important questions:

Do we know which critical and material third parties rely on quantum-vulnerable cryptography?
Have we asked key providers about their post-quantum migration strategies, investment plans and timelines?
How will providers manage compatibility, testing and the operational risks of migration?
What assurance can they provide, and how will we monitor progress?
What happens if a critical supplier is not ready, or its migration causes significant disruption?

The three Os of Third-Party Risk Management — On-Boarding, OnGoing oversight and Off-Boarding — provide a useful framework. New relationships should consider quantum readiness during due diligence. Existing material relationships need appropriate ongoing oversight. Exit and contingency planning should recognise the difficulty of replacing technology that cannot be upgraded safely. Crucially, outsourcing technology does not outsource accountability.

An Operational Resilience Issue — Not Just Cybersecurity

Post-quantum migration is an operational resilience challenge. Firms need to understand how cryptographic dependencies support important business services, the consequences of failures and their ability to continue delivering services during a complex technology transition. This connects cybersecurity, technology change management, operational risk, third-party oversight and operational resilience.

The immediate priority is not necessarily to replace everything tomorrow. It is to understand the exposure, identify critical dependencies, engage suppliers and establish a credible, risk-based migration programme.

The JADEtc Academy Perspective

Quantum computing offers enormous opportunities, but the implications for existing cryptography present a significant long-term challenge for financial services. We do not know precisely when a sufficiently capable quantum computer will emerge. That uncertainty is not a reason to postpone preparation. The NCSC's 2028, 2031 and 2035 milestones provide a practical basis for action today.

The greatest threats may not come from quantum computing or AI considered individually, but from their interaction with vulnerabilities in the complex, interconnected systems on which financial services depend.

For Boards, senior management and operational risk practitioners, the questions are straightforward: Do we understand our exposure? Do we have a plan? And, perhaps most importantly, are we talking to our critical third parties about theirs?

Waiting until quantum computing becomes a crisis is unlikely to be a viable risk management strategy.