NIST finalized the first post-quantum cryptography standards on August 13, 2024 — FIPS 203 (the ML-KEM key-establishment scheme built on lattice mathematics), FIPS 204 (the ML-DSA signature scheme), and FIPS 205 (the stateful-hash SLH-DSA alternative) — giving cryptographic engineering a federal destination after eight years of competition. The financial-sector problem is temporal: a quantum adversary need not exist today for today's captured ciphertext to be decrypted later, so the harvest-now-decrypt-later threat prices every year of delay against data whose confidentiality must survive the 2030s — and the migration itself runs on an inventory discipline, the cryptographic bill of materials, that most institutions are still building.
3G Times publishes information, not legal advice. Cryptographic risk management is institution-specific and belongs with security architecture and the applicable supervisors' expectations.
What actually shipped in 2024?
Three schemes, two jobs. ML-KEM (from CRYSTALS-Kyber) establishes shared keys — the TLS and VPN layer that protects data in transit. ML-DSA (CRYSTALS-Dilithium) signs — code signing, document signing, the certificate chains the financial system trusts. SLH-DSA (SPHINCS+) signs with a different mathematical bet, stateful hashes, as diversity insurance. The federal migration calendar follows: government systems move on the NSA's CNSA 2.0 timeline — new acquisitions hybrid by mid-decade, legacy decommissioned by 2033 — and vendors to government inherited those dates contractually. Financial infrastructure inherits by dependency: the HSMs, the network stacks, the certificate authorities, and the payment schemes' own roadmaps all track the same destination on their own calendars, which is why partner diligence questionnaires started asking about crypto-agility in 2025.
Why does an inventory precede everything?
Because you cannot migrate what you cannot enumerate, and financial institutions' cryptographic estate is famously unaudited: keys in hardware, in code, in vendor products, and in that 2009 integration nobody remembers. The cryptographic bill of materials — CBOM, standardized in the SPDX lineage — is the SBOM's sibling: an inventory of algorithms, key sizes, protocols, and locations, versioned and refreshed. Building it is the migration's first deliverable and its most durable control, because the same inventory that finds the RSA-2048 in the legacy settlement link also finds the weak algorithm that ships in next year's emergency patch — if the inventory is wired to change management. Institutions that finished their CBOMs describe the exercise as archaeology with a deliverable; institutions that skipped it are pricing their migration by vendor assertion.
| Migration stage | Deliverable | Where programs stall |
|---|---|---|
| Inventory (CBOM) | Algorithms, keys, protocols, locations | Vendor estate enumerated by questionnaire |
| Risk classification | Data lifetime × exposure mapping | Everything graded medium, nothing sequenced |
| Pilot | Hybrid key establishment in test paths | Waiting for final vendor stacks |
| Production rollout | High-lifetime data first | Big-bang planning instead of lanes |
| Decommission | Classical-only paths retired on calendar | Legacy exceptions without expiry |
What does hybrid deployment buy?
Risk diversification during the migration window: classical and post-quantum key establishment combined, so the connection is no weaker than the strongest of the two — protection against the possibility that a young lattice scheme harbors a cryptanalytic surprise. The major TLS stacks shipped hybrid modes first, which is why the pilot lane is cheap: enabling hybrid key agreement on internal high-value paths exercises the new algorithms under production load without betting confidentiality on them alone. Signatures follow later — long-lived signatures (code signing, sealed documents) want durability measured against the 2030s standard, and certificate chains re-root on the CA ecosystem's schedule, not the institution's.
How do regulators and partners read the program?
As an operational-resilience item with a decade-long fuse. Supervisors' expectations arrive through the same channels as other technology risk: the exam asks what the institution knows about its cryptographic estate, what the migration plan's sequencing is, and who owns it. Partner diligence — bank sponsors, card networks, cloud providers — transmits the vendors' own timelines as flow-downs. And the compliance-adjacent note that keeps the program funded: the data whose confidentiality must outlive the migration (identity records, health-adjacent financial data, long-dated contracts and their confidentiality terms) defines the priority order, which means the CBOM's risk classification is partly a legal-records question — the retention schedule and the cryptography roadmap must agree about what "long-lived" means.
What does this mean in practice?
- Finish the CBOM before buying anything. The inventory converts vendor roadmaps into an institution's plan; without it, the migration is a procurement mood.
- Sequence by data lifetime, not system convenience. The settlement link carrying 90-day transaction data migrates differently than the archive holding 30-year identity records.
- Pilot hybrid on internal paths now. Production load on the new algorithms, this year, without confidentiality betting on them alone.
- Wire crypto into change management. The CBOM that updates when libraries and HSMs change is a control; the CBOM as a document is a museum.
The quantum migration is the rare infrastructure project whose deadline is unknowable and whose first deliverable is certain: know what you encrypt with, and where. The institutions that treated August 2024 as the starting gun for the inventory — not the shopping — will meet whatever timeline physics and committees eventually set, with their archaeology already done.
The skills footnote belongs in the budget: cryptographic engineering capacity is the migration's scarcest input, and institutions that began training security staff on the new primitives in 2025 report pilot lanes staffed from within, while late starters are competing for the same twelve consultants as everyone else's 2027.
The closing frame is architectural: every migration in financial-technology history — tokenization, EMV, TLS versions — ended with crypto-agility as the lesson learned too late. This is the first one where the lesson is documented in advance: systems built to swap algorithms on schedule will treat the next migration as maintenance, which is the destination worth building toward while nobody is rushing.
What should vendor contracts say now?
Roadmap commitments with dates and lane definitions — which products, which order, hybrid support windows — plus the CBOM export that tracks the vendor's estate inside the institution's own inventory. The clause that ages worst is the aspirational quantum-ready label; the one that holds is dated, with delivery teeth.
Frequently asked questions
Is quantum risk real enough to fund now?
The harvest-now-decrypt-later argument is what moves budget: traffic captured today, whose confidentiality must survive into the quantum era, is exposed today in the relevant sense. For most institutions, the long-lived identity and contract archives settle the funding question without any crystal ball about cryptographically relevant quantum computers.
What happens to existing TLS and PKI?
Hybrid modes carry the transition: classical and post-quantum together, then post-quantum alone as the ecosystem retires classical paths on the 2030s calendars. Certificate chains re-root when the CAs do — plan the application inventory for that re-root now, because its blast radius is wider than cryptography's.
The board reporting note closes the funding argument: phase gates — inventory complete, pilot live, high-lifetime data migrated — are the three sentences a technology committee tracks quarterly, and the CBOM's coverage percentage makes progress visible without first teaching the committee lattice mathematics.
Do blockchain and digital-asset systems need the same migration?
Yes, and more urgently in one respect: signatures on ledgers are permanent and verifiable forever, so a signature scheme's longevity is the asset's longevity. The industry's standards work on quantum-resistant curves and lattice signatures tracks the same FIPS destination on a faster internal clock.
For more context, read Consent Receipts and Audit Logs: Designing Exam-Ready Evidence for Open-Banking Authorization.
For more context, read remote online notarization requirements.
For more context, read iso 30107 presentation attack detection.