Is the U.S. Banking System Ready for a Post-Quantum Future?

Center for Strategic and International Studies | Sultan Meghji

Because there is no federal deadline for migrating to post-quantum cryptography, the U.S. banking system is exposed to serious economic security risks and its vital financial infrastructure is at risk of being decrypted in the future by foreign opponents. Although federal agencies are required to make the transition by 2030–2031 as a result of Executive Order 14412, commercial banks have no mandatory timetable for doing so.

The fact that there is still a regulatory gap is due to financial supervisors having failed to require standardised readiness reporting from among the 8,500 depository institutions in the country. As a result, attackers are currently carrying out the practice of harvesting encrypted financial traffic with a view to decrypting it retrospectively when cryptographically relevant quantum computers become available. This kind of exposure of the data reveals sensitive information about supply chains, the financing of defence contractors, and methods used to evade sanctions. The transition involved is technically very difficult. In order to address this systemic weakness, the Financial Stability Oversight Council and the Federal Financial Institutions Examination Council should work together with major core processors such as FIS and Fiserv to establish standardised implementation schedules before the international network SWIFT is obliged to carry out its own upgrades by July 2027.

Comment

The fact that public-key cryptography is vulnerable to Shor's algorithm means that the financial sector is exposed to retroactive decryption, so that passive data collection becomes a long-term threat involving intelligence gathering. When attackers focus on the secure messaging network known as SWIFT, they will be able to map out industrial supply chains and the relationships between defence contractors many years before a cryptographically relevant quantum computer is fully in operation. As a result, the move towards using new cryptography changes from being just an ordinary IT compliance activity into becoming a key element of U.S. national security defence.

As a result, commercial organisations are forced to depend on the timeline provided by private-sector vendors, which leads to inconsistent security measures throughout the financial sector. This fragmented approach enables sophisticated state actors to take advantage of the weaker links in the transaction process and go around the strongly secured boundaries of large institutions such as Wells Fargo. Finally, since there are no coordinated standards, critical economic data become susceptible to being exploited retrospectively, thus compromising the integrity of the U.S. Department of Defense supply chain.

Strategic Question for Discussion

What impact will the gap between SWIFT's July 2027 post-quantum deadline and the absence of any domestic FFIEC requirements have on the security of chains of international transactions against retroactive decryption?

The fact that SWIFT has a proactive timetable while the FFIEC shows no regulatory response means that the domestic level of international transaction routes will continue to be vulnerable. I believe that skilled adversaries will take advantage of this imbalance by focusing on smaller, non-compliant regional banks in order to obtain the data before it gets to the more secure SWIFT network. This situation shows that global financial security cannot be attained simply by improving the infrastructure unless there is coordination among national regulatory authorities.

Share your assessment in the comments below.

To read in details click here