Guest Post: Why Crypto-Agility Matters for Financial Institutions Preparing for PQC

Guest Post by Andrew Gault, CEO, ZeroTier.

The financial services industry depends on cryptography to move money, protect customer and transaction data, verify digital identities, and connect banks with processors, cloud providers, and other third parties. This protection, Quantum computing puts that protection at risk.

A sufficiently capable cryptographically relevant quantum computer, or CRQC, will be able to break much of the public-key cryptography that protects those functions, exposing sensitive data, disrupting trusted communications, and undermining the digital signatures financial systems rely on.

The risk doesn’t begin at Q-Day, [explain what this means]. Adversaries can collect encrypted financial and personal data today and attempt to decrypt it later, a practice known as “harvest now, decrypt later” (HNDL).

Governments and standards bodies are rapidly preparing for this possibility. NIST finalized its first post-quantum cryptography standards in 2024. That urgency was reinforced in June 2026 by White House Executive Order 14412, which directs the transition of federal information systems to NIST-approved post-quantum cryptography standards. The U.S. Treasury has also signaled the sector’s need to prepare. In August 2026, it announced a Quantum-Readiness Task Force to identify critical dependencies, improve cryptographic agility, and address third-party implementation challenges. [SWIFT mention?]

That urgency makes not only higher strength cryptography, but also crypto agility a priority for all financial institutions. 

Crypto agility means that a system or organization’s cryptographic algorithms and standards can rapidly adapt as threats, technology. and regulatory expectations change, without repeatedly replacing major hardware or rewriting critical applications.

For financial institutions, putting that into practice starts with management discipline: setting the scope, identifying the highest-risk systems and connections, and embedding the quantum transition in technology planning and downstream vendor management.

Build an internal cryptography inventory 

The work begins with an inventory, or cryptographic bill of materials (QBOM). It should show where cryptography is used across the institution and its external connections, which systems depend on it, what can be updated, and who owns the decision to change it.

Importantly, the review should distinguish between data at rest and data in transit. Data moving between applications, branches, cloud environments, and external services deserves particular attention. Each connection may use different cryptography, run on different infrastructures, and follow a different upgrade path.

For every connection, leaders need answers to a few practical questions: Which cryptography is in use? Is it embedded in hardware or tied to an application? How does identity flow across systems? Can it be updated through software, or will it require a larger replacement project?

The inventory also needs to show where older protocols are still allowed. Even if a system supports stronger cryptography, an attacker may be able to force it to use a weaker connection – a downgrade attack. Institutions need clear rules about which protocols are acceptable, and a plan to phase out the rest.

The Citi Institute’s quantum-readiness guidance follows the same sequence: identify exposure, prioritize critical systems and long-lived data, enable crypto-agility, and manage the migration over time.

Set priorities and fund the work

No institution can tackle every cryptographic dependency at once, so the CBOM must help leaders decide where to begin.

Early priorities will often include payment infrastructure, identity systems, digital signatures, interbank communications, long-lived confidential data, and high-value payment connections. The question is simple: How valuable is the data, and what happens if that connection fails or is compromised?

Much of this work extends beyond the security operations center. Application owners, infrastructure teams, procurement, compliance, and executive leadership all have a role in setting priorities and funding the response. Any migration plan should establish clear owners, a budget, testing requirements, and a realistic timeline. 

Protect critical data during the transition

Replacing hardware makes sense when it’s already up for renewal. But few large institutions have the capability to overhaul an entire security estate overnight. Updating applications and protocols also takes time, testing, and coordination across internal teams and vendors.

For critical data in transit, an end-to-end software network or a quantum-safe overlay can help reduce exposure during the transition. It encrypts traffic between endpoints, so institutions can protect sensitive data while devices, applications, and intermediaries are upgraded over time.

It doesn’t replace the broader move to post-quantum standards. But it can give institutions more time and flexibility to prioritize the work around risk, budgets, and existing refresh cycles.

Extend readiness across third parties

Crypto-agility also has to extend to partners. Banks, payment processors, cloud providers, service providers, and technology vendors are all working to their own cryptographic dependencies and upgrade timelines. If a partner cannot support the same standards as the institution, the exposure risk remains.

Security, procurement, and vendor-management teams should ask direct questions: Which cryptographic standards does the vendor support? How can its cryptography be updated physically and on what timeline? What is its migration plan? How will it maintain interoperability during the transition? Does it prevent requests from falling back to weaker protocols?

Those conversations will help institutions avoid building new dependencies that become costly or difficult to change later.

Digital assets illustrate the same coordination problem. Changing cryptography in a blockchain network requires alignment across software, infrastructure, custodians, exchanges, and other participants. No single institution can complete the work alone.

A discipline built for the next change

Financial institutions can’t predict when a CRQC will arrive. But by being crypto agile, they can better understand where cryptography sits today, who owns it, and be ready to rotate keys or change cryptography when needed before the next cryptographic change becomes a crisis.

Guest posts reflect the views and opinions of their authors and do not necessarily represent those of The Quantum Insider, its staff or its affiliated organizations. Publication does not constitute an endorsement of any company, product, service or claim discussed.