The opportunity is to ensure that the cryptographic underpinnings of this digital infrastructure are quantum-ready. Preparation will require understanding the technology and the timeframe, and banks are not alone. The threat of quantum computers that can break public-key cryptography is distant, but readiness timelines need to factor in how long information needs to stay protected and how long the ecosystem and suppliers will take to adopt new cryptography.
The value of a quantum-safe pilot is that it provides banks with a foundation to test new cryptography while understanding their own infrastructure and roadmap.
A Foundation is Already in Place
Banks can start quantum-safe preparations right away. Post-quantum cryptography (PQC) refers to cryptographic algorithms that are resistant to attacks from quantum computers. In August 2024, the US National Institute of Standards and Technology (NIST) finalized its first three principal standards for post-quantum encryption and digital signatures, providing a reference for organizations to start their preparations.
India has begun its effort to prepare enterprises for a post-quantum world. The May 2026 Roadmap to Quantum Resiliency from the Department of Science and Technology sets the direction for organizations to prepare for a transition. For banks and financial services, the challenge is to take this direction and begin to develop their own approach to transitioning.
The need to take this direction and turn it into an action plan becomes obvious when one considers what banking infrastructure entails. Banking environments are complex, consisting of a host of interconnected applications, legacy technology and third-party technology suppliers. The transition between cryptographic algorithms requires cross-ecosystem testing and migration planning. Further, data that is currently being captured and stored can be decrypted and misused in the future, a risk referred to as “harvest now, decrypt later”.
A roadmap provides banks the time to identify these dependencies, evaluate the available standards, and build the capability to migrate the cryptographic algorithms as required. An international perspective can offer insights into how this preparation can begin, focusing on specific use cases that are relevant to a bank.
What Global Examples Teach Us
One such example comes from Apple’s PQ3 project. In February 2024, Apple announced a post-quantum cryptographic protocol for iMessage called PQ3. Its approach to combining post-quantum and classical cryptography provides a useful lesson for banks. A quantum-safe pilot does not need to be an end-to-end encryption exercise, but can focus on enhancing the cryptographic protocols for a specific application, considering its dependencies. This is where the experience of the financial sector offers a more direct example of a quantum-safe pilot. In September 2024, HSBC announced a quantum-safe trial for transactions in tokenized physical gold.
In addition to evaluating quantum-safe algorithms for this transaction type, the test included interoperability between distributed ledgers and digital wallets.
The benefit of a bank using a use-case-focused pilot is that it can begin to evaluate the implications of new cryptography on its own systems. Instead of a bank-wide pilot, the test can focus on a single application and its dependent systems.
However, testing a single application is only a part of the story. The Bank for International Settlements’ (BIS) Project Leap offers a useful perspective on the other half. Project Leap is a collaborative initiative to test post-quantum cryptography solutions in financial market infrastructures. The focus of this project is on the interaction between a host of financial institutions and their technology suppliers. The quantum-safe migration is not an end-to-end application-specific exercise, but one that requires ensuring compatibility across multiple ecosystems. It is not enough to ensure that a given set of cryptography solutions works – they need to work across technologies and institutions in a production-grade environment.
A quantum-safe pilot should focus on a defined use case, test its practical application in the real world, and use the results to determine the broader migration path.
What Should an Indian Bank’s First Pilot Look Like?
The first pilot should be large enough to provide useful results, but narrow enough to limit risk exposure. A partner API gateway, a controlled data replication link, or a staged customer authentication flow can provide a useful starting point that involves real technology dependencies without impacting overall settlement infrastructure.
With a use case selected, the scope of focus for migrating cryptographic algorithms is defined. The first step is to create a cryptographic inventory identifying the algorithms, keys, certificates, and cryptographic libraries that need to be replaced in the selected environment. The bank can also identify suppliers that support post-quantum cryptography and those that have a published migration plan.
With a baseline inventory and an understanding of technology suppliers, the bank can test the proposed quantum-safe solution to identify the practical implications of transitioning to new cryptography. The pilot should test a hybrid cryptography approach, if one is being considered for the transition, to understand the changes during the migration period. Testing should go beyond establishing a secure connection and include latency, performance overheads, overheads in message size and signatures, interoperability with partner systems, reliability of operations, and the ability to roll back.
A bank testing a quantum-safe partner API gateway finds that the new cryptographic handshake works within its environment, but a partner’s older middleware is unable to process it correctly. The pilot has revealed a dependency that will need to be addressed before rolling this out more widely. The bank can establish a timeline for a partner’s technology upgrade, ensuring responsibilities across technology suppliers and including it as a requirement in future procurement.
That is the value of a pilot – an unknown dependency has been transformed into a documented requirement. To realize the benefits of a pilot, each one should have clearly defined success metrics and stop conditions, a tested rollback plan and an executive sponsor. Security, technology, risk and procurement functions should work together to ensure implementation and prioritization. The results of a pilot should inform a prioritized approach to a quantum-safe migration, not get locked away in a document.
Turning Early Preparation Into an Advantage
The value of a pilot is not only in developing a quantum-safe roadmap, but the capabilities it can develop in an organization. By focusing on an area that has significant dependencies and impact once quantum computers arrive, a bank can develop capabilities across its technology and business functions.
First, banks can develop crypto-agility – the ability to transition between cryptographic algorithms and certificates – without rewriting applications. This helps banks prepare their technology stack for future changes in cryptography.
Second, suppliers will need to be more prepared for changes in cryptographic requirements. As more financial institutions begin to evaluate quantum-safe alternatives, technology suppliers will have a clearer idea of how to respond to market needs.
Third, India has an opportunity to strengthen its quantum-safe technology ecosystem. The National Quantum Mission has an approved outlay of ₹6,003.65 crore through 2030–31. As financial institutions begin to evaluate quantum-safe cryptography and their requirements, India’s research and development community, cybersecurity firms and technology developers can strengthen their offerings for the financial sector.
For banks, the next 90 days can be used to turn these advantages into actions. An executive sponsor, a cryptographic inventory and a single pilot can be the start of more effective preparations for quantum-safe technology.
The objective of preparing for a quantum-safe world is not to predict when the change will occur, but to have the preparedness and capability to respond when the circumstances demand it.
India’s digital financial infrastructure has developed with scale, innovation and collaboration. A well-designed quantum-safe pilot can build on these advantages, strengthening the technology-readiness and supplier-readiness of banks and financial institutions, and preparing them for the next era of digital finance. The advantage will come from what they learn and how they apply that learning.
