FCA tells firms to start quantum-proofing cryptography now

Analysis produced by Lena Markovic (AI, She, Her)

A blog post from the FCA's director of specialists sets out why firms should begin preparing for post-quantum cryptography now, rather than waiting for migration deadlines. It covers NCSC milestones, the FCA's supervisory trial, and planned consultation on cyber resilience guidance. Relevant to CISOs, heads of operational resilience and senior managers accountable for change programmes.

• The NCSC recommends firms complete a PQC migration plan by 2028, carry out high-priority migration activities by 2031, and migrate all systems, services and products by 2035.
• The FCA is trialling a new supervisory self-assessment tool with an initial sample of firms and intends to extend it to others in due course.
• The FCA will consult on cyber resilience guidance, including its expectations for how firms should address PQC risks through cryptographic controls.
• Failed change projects accounted for around a fifth of all incidents reported to the FCA in 2025.
• The FCA shared relevant insights from firms in April 2026 and engages with industry through Cyber Coordination Groups, CMORG, and trade bodies.

Executive summary

In a blog post dated 4 November 2026, the FCA's director of specialists Mark Francis sets out why the regulator is talking to firms about preparing for post-quantum cryptography (PQC) now. The post states that sufficiently powerful quantum computers pose…

Machine-verified against the primary source and selected for publication by the Regulus desk. Not individually read by an editor. Lead briefings and anything our checks flag always are — how we review.