May 11, 2026 – The G7 central banks’ Quantum Technologies Working Group (QTWG) published its first report, “Preparing for Quantum Technologies: Key Considerations for Financial Sector Participants.” The QTWG was established in 2025 to analyze the economic, financial, and institutional implications of quantum technologies, and this report is its first public deliverable.
The report was published by the Banque de France, which co-chairs the QTWG alongside the Bank of Canada. The working group also includes the Deutsche Bundesbank, the Bank of England, the Banca d’Italia, the Bank of Japan, the Federal Reserve Board, and the European Central Bank.
The bottom line: this is the most comprehensive institutional treatment of quantum risk and opportunity for finance to date, and its significance lies less in any single finding than in the fact that all eight G7 central banks have now collectively acknowledged the quantum threat to the financial system, placed post-quantum cryptographic migration at the center of financial-sector quantum resilience, and begun mapping the broader implications of quantum technologies for financial markets, payments, and central banking operations.
The QTWG report follows the G7 Cyber Expert Group’s PQC migration roadmap published in January 2026, but serves a different purpose. Where the CEG roadmap focused specifically on coordinating the transition to post-quantum cryptography across the financial sector (with a 2030–2035 migration window), the QTWG report takes a wider lens. It covers quantum computing applications in finance and quantum sensing alongside cryptographic security, and examines the system-level dependencies that quantum adoption could introduce.
The report is explicitly non-prescriptive. It does not set regulatory expectations or recommend specific courses of action. Instead, it provides what the working group calls a “structured analytical framework” for assessing where quantum technologies intersect with financial infrastructures and activities. In the accompanying press release, Banque de France Deputy Governor Agnès Bénassy-Quéré framed the effort as part of central banks’ responsibility to anticipate transformations affecting the financial system.
The report’s treatment of quantum security threats occupies the first of its two major sections and covers ground that will be familiar to readers who have followed the G7 CEG roadmap or the broader PQC standardization discussion. But the framing carries weight precisely because it comes from the central banking community rather than cybersecurity specialists alone.
On the CRQC timeline, the report states that expert assessments suggest “a non-negligible probability that a cryptographically relevant quantum computer could emerge over the coming decade.” No specific year is offered, and the document explicitly avoids speculative timeline assertions. It acknowledges “substantial uncertainty regarding scientific progress, engineering constraints, scalability challenges and potential advances in quantum algorithm design and optimisation,” while noting that these risks “are no longer purely theoretical, particularly when considering the combined effects of hardware progress and algorithmic improvements.”
The Harvest Now, Decrypt Later (HNDL) threat is given prominent treatment. The report observes that financial data often must remain confidential for decades, creating exposure to scenarios in which encrypted data intercepted today is decrypted once quantum capabilities mature. This temporal dimension, the report argues, means that the threat is already active regardless of when a CRQC actually arrives.
On PQC migration, the report echoes the CEG roadmap’s core message: this is “not a simple substitution exercise.” The transition requires inventorying cryptographic dependencies, testing compatibility with existing systems, and coordinating updates with external counterparties and service providers. Extended transition phases where legacy and quantum-safe systems must coexist will increase complexity and coordination challenges across the financial sector.
The report also examines complementary approaches to PQC, including Quantum Key Distribution (QKD) and Distributed Symmetric Key Exchange (DSKE), but treats these as context-specific complements rather than alternatives. QKD is described as conceptually distinct in its security model but constrained by distance, cost, and scalability. DSKE introduces governance and third-party dependency considerations. The working group’s position is clear: PQC remains the primary pathway, with other approaches potentially layered in for specific high-assurance use cases.
The most interesting dimension of the QTWG report is what it covers beyond the now-familiar PQC migration discussion. Three areas merit attention.
The report addresses the threat to digital signatures alongside encryption. If signature schemes currently in use become vulnerable, this could enable the forgery of signatures or impersonation of trusted entities. The document calls out tokenized assets, digital identity frameworks, and distributed ledger systems as particularly dependent on cryptographic authentication. This is the Trust Now, Forge Later (TNFL) problem, and it is significant to see G7 central banks acknowledging it alongside the more commonly discussed HNDL scenario. While the encryption threat gets most of the headlines, the authentication threat may prove more disruptive for financial infrastructure, where non-repudiation and identity verification are foundational.
The report includes a section on quantum sensing that goes beyond the typical treatment. It acknowledges that quantum sensors could enable new forms of measurement and surveillance that challenge existing assumptions about privacy and interference resistance. The ability to detect weak electromagnetic signals or operate in jamming-resistant environments could have implications for secure communications and data protection. This is a dimension that most financial sector quantum assessments ignore entirely, and the QTWG deserves credit for flagging it. The implications for financial infrastructure are real: timing systems that underpin transaction timestamping and settlement synchronization already depend on precision measurement technologies that quantum sensing could both improve and threaten.
The report’s section on system-level implications is perhaps its most forward-looking. It warns that if quantum technologies deliver advantages in specific analytical or optimization tasks, this could reinforce existing asymmetries between institutions or concentrate capability around a limited number of technology providers. The working group notes that quantum computing resources will likely be accessed through a small number of cloud-based platforms, creating shared dependencies and common points of failure. Opacity and explainability challenges compound the problem when quantum techniques combine with advanced optimization or machine learning methods.
This is an underappreciated risk. The financial sector is already experiencing concentration dynamics in cloud computing and AI infrastructure. Quantum computing, with its extreme specialization and capital requirements, could amplify these tendencies further. A world where a handful of quantum cloud providers underpin critical financial computations introduces correlated failure modes that existing resilience frameworks were not designed to address.
For all its breadth, the QTWG report has notable gaps.
The most conspicuous is the absence of any concrete timeline or milestone framework for the financial sector’s quantum preparedness. The CEG roadmap at least offered a phased structure with approximate dates (awareness by 2027, inventory by 2028, critical system migration by 2030–2032, full transition by 2035). The QTWG report deliberately avoids anything this specific, instead emphasizing that “preparedness is best understood as an ongoing analytical effort rather than a fixed course of action.” This is intellectually defensible but practically insufficient. Financial institutions need actionable timelines, and the G7 central banks are among the few institutions with the authority to set them.
The report also treats quantum computing applications in finance with excessive caution, repeatedly noting that applications “remain largely experimental” and that quantum techniques have “yet to demonstrate production-ready performance.” This is accurate as of today, but the hedging is so thorough that a busy CISO could read the applications section and conclude that quantum computing is a distant academic curiosity with no near-term relevance. The hybrid classical-quantum approaches already being explored by major financial institutions deserve more substantive treatment.
Finally, the report is silent on how the QTWG’s work will intersect with existing regulatory frameworks. DORA, the Basel Committee’s operational-resilience principles, SEC cybersecurity disclosure rules, and national financial sector regulations are already creating compliance timelines that financial institutions are already working against. Understanding how quantum preparedness fits within these existing frameworks, rather than being treated as a standalone analytical exercise, is the question that financial sector practitioners most urgently need answered. As I have argued before, the debate about when a CRQC will arrive is increasingly beside the point. Regulators, insurers, investors, and counterparties are already setting their own quantum deadlines. The QTWG report acknowledges the need for coordination but stops short of contributing to the ecosystem-driven deadline pressure that is actually driving action.
The publication of this report alongside the CEG’s PQC roadmap from January creates an interesting institutional picture. The G7 now has two separate working groups addressing quantum risk in finance: the CEG (co-chaired by the U.S. Treasury and the Bank of England), which focuses on cybersecurity and PQC migration mechanics, and the QTWG (co-chaired by the Banque de France and the Bank of Canada), which takes a broader view of quantum technologies including applications and systemic effects.
The two bodies complement each other. The CEG provides the operational migration reference; the QTWG provides the broader analytical context. The CEG outlines how to approach the transition; the QTWG helps financial institutions understand why and what else to watch. Neither is a binding rulebook, but together they are shaping the vocabulary that supervisors and boards will use. For the financial sector, the practical takeaway from both reports converges on the same point: PQC migration is the priority, the timeline is measured in years rather than decades, and the scope of quantum-related risk extends well beyond cryptography.
What I find most significant about the QTWG report is not any single finding but rather the institutional signal it sends. Eight central banks, representing the world’s largest economies, have collectively stated that quantum technologies present material implications for the financial system. The HNDL threat is treated as a present-day risk factor, not a future hypothetical. PQC migration is framed as complex, long-horizon, and urgent. And the report goes further than previous G7 output by mapping quantum’s broader effects on market structure, concentration risk, and governance.
My company - Applied Quantum - helps governments, enterprises, and investors prepare for both the upside and the risk of quantum technologies. We deliver concise board and investor briefings; demystify quantum computing, sensing, and communications; craft national and corporate strategies to capture advantage; and turn plans into delivery. We help you mitigate the quantum risk by executing crypto‑inventory, crypto‑agility implementation, PQC migration, and broader defenses against the quantum threat. We run vendor due diligence, proof‑of‑value pilots, standards and policy alignment, workforce training, and procurement support, then oversee implementation across your organization. Contact me if you want help.
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。