CYBERSECURITY | BANKING | QUANTUM

India’s banks begin the quantum-safe shift

The immediate move is not to run banking on quantum computers. It is to find and replace the encryption that a future quantum machine could put at risk. RBI has begun mapping the financial sector’s exposure; the expensive work will be in the systems customers never see.

By Biz Masala | 12 October 2026

The transition challenge is buried across payment rails, identity systems, data links and ageing bank technology—not in a single “quantum” switch.

India’s banking system is being asked to prepare for a security risk that has not yet arrived at full strength, but could make today’s encrypted data vulnerable in the future. The Reserve Bank of India has created an expert committee to map cryptographic assets and recommend a quantum-safe roadmap. Separately, The Economic Times reported this month that banks are discussing a sector-wide transition framework after a Finance Ministry request. The distinction matters: a committee and reported bank discussions are real, but they are not the same as a published RBI migration deadline for every lender.

The headline is quantum, the work is cryptography

A sufficiently capable fault-tolerant quantum computer could break some public-key cryptography used to establish secure connections and verify digital identities. The threat is not that a quantum computer will instantly read every bank account or defeat every encryption method. The immediate concern is narrower: systems built around vulnerable public-key algorithms may need new standards, implementations and keys, while symmetric encryption and other controls require their own assessment.

That is why the practical term is post-quantum cryptography (PQC): conventional software algorithms designed to resist attacks from quantum computers. Banks do not need to replace their servers with quantum machines to use PQC. Quantum key distribution (QKD), another area of research and deployment, uses quantum communication to distribute keys; it is different from PQC and cannot by itself modernise every legacy application or endpoint.

The risk has a long memory. “Harvest now, decrypt later” describes an attacker collecting encrypted information today in the hope that future computing power can unlock it. Data that must remain confidential for years—identity records, transaction histories, customer files, payment instructions and interbank communications—deserves priority based on its shelf life and exposure. The exact arrival date of a cryptographically relevant quantum computer is uncertain; the migration work is complex enough that waiting for a precise countdown would be a poor control strategy.

Where the hidden work sits: a bank’s cryptography is distributed across connected products, networks, vendors and infrastructure.

What is officially under way

RBI’s 25 May 2026 announcement established the Quantum Secure and Adaptive Financial Ecosystem (Q-SAFE) expert committee, convened by IIT Madras professor Anil Prabhakar. Its membership includes the Department of Science and Technology, SBI, NPCI, MeitY, Data Security Council of India and quantum-industry representation. The committee’s terms include reviewing the financial sector’s cryptographic inventory through a Cryptography Bill of Materials, assessing “crypto-agility,” identifying critical vulnerable systems, examining vendor readiness and recommending a roadmap. The report is due within six months of its first meeting; the RBI release does not state when that first meeting occurred.

A parliamentary committee report records RBI’s view that a coordinated approach is needed and says regulated entities have been advised to develop a Cryptographic Bill of Materials. That makes the work more concrete than a general technology forecast: banks first need to know which algorithms, certificates, hardware security modules, software libraries and service providers protect each critical function. You cannot replace what you cannot inventory.

MeitY and CERT-In published a quantum-cyber-readiness white paper in July 2025 to guide organisations’ shift to quantum-resistant algorithms. In February 2026, a government statement said a national quantum-safe concept paper recommended standards, regulatory frameworks, indigenous research and a task force to guide migration and testing. These are policy-building steps, not evidence that the entire banking system has already migrated.

There is already an international technical baseline to assess: the US National Institute of Standards and Technology finalised three post-quantum standards in August 2024—ML-KEM for key establishment and ML-DSA and SLH-DSA for digital signatures. The RBI committee is explicitly tasked with assessing the availability and maturity of vendor tools and recommending India’s financial-sector roadmap. That leaves a practical question for banks and regulators: how will global standards be tested, certified and made interoperable across Indian banking systems and suppliers?

The transition can be a long, costly systems project

The difficult part is rarely choosing an algorithm in isolation. A bank must trace where cryptography is embedded: customer-facing apps and websites, payment gateways, card and ATM networks, APIs, cloud connections, employee devices, branch systems, core banking platforms, digital signatures, data archives and outsourced services. Some components may be maintained by vendors with different upgrade cycles. Older hardware or software may not support larger keys, new handshake patterns or revised certificates without performance and compatibility testing.

That points to several cost centres: asset discovery, software and hardware upgrades, vendor contracts, testing environments, specialist staff, external assurance and operational contingency. No reliable public estimate of the total banking-sector bill has been disclosed in the sources reviewed for this feature. Any single rupee figure presented now would imply a precision that the public record does not support. The expense will differ by bank depending on legacy complexity, outsourcing, architecture and the amount of critical data retained.

The migration must preserve uptime. A change to digital certificates or key exchange can disrupt links between a bank and payment processors, merchants, fintech partners or government systems if implementations are not interoperable. Stronger cryptography may also change bandwidth, storage and processor requirements. The security upgrade therefore needs staged pilots, failover plans, independent testing and clear responsibility for suppliers—not a one-night switch.

A safe migration is a sequence of inventory, prioritisation, testing and replacement, with old and new systems interoperating during transition.

A useful action ladder for banks

Stage	What the bank needs to do
1. Discover	Build a cryptographic inventory across products, networks, data stores and suppliers. Record owners, algorithms, certificates, dependencies and replacement dates.
2. Prioritise	Rank assets by data sensitivity, how long the data must remain confidential, exposure to public networks, business criticality and supplier lead time.
3. Design for change	Adopt crypto-agile architectures: make algorithms and keys replaceable through controlled configuration rather than hard-wiring them into systems.
4. Pilot and test	Trial standards in representative payment, identity, network and archival workloads. Test interoperability, performance, recovery and downgrade risks.
5. Migrate and verify	Roll out in phases, monitor failures and latency, retire vulnerable paths, and maintain auditable evidence that suppliers and critical services have been upgraded.

Quantum-safe is not the same as quantum banking

There is also a genuine opportunity side. Quantum computing may eventually help with selected optimisation, modelling or risk problems, but the RBI has framed Q-SAFE to examine benefits as well as risks—not to announce production adoption by banks. Those possible uses face a separate maturity test: whether a quantum approach beats classical computing on a real financial task, at a cost and reliability level that justifies deployment.

India is building research and industry capacity. MeitY’s BISAG-N signed a collaboration and technology-transfer MoU with QNu Labs in January 2026 for quantum-resilient cybersecurity capabilities. A February government update described national thematic hubs, startup support and a proposed quantum-safe task force. These are ecosystem investments. They should not be confused with proof that a bank has shifted core operations onto quantum hardware.

Likewise, QKD demonstrations can be useful for specific high-security links, but PQC is designed to work through upgraded software and cryptographic protocols on conventional computing infrastructure. Financial institutions will need standards and testing that make the solutions interoperable across vendors and across borders. A patchwork of incompatible “quantum-safe” products could create fresh operational risk.

What customers should—and should not—expect

For customers, a well-managed transition should be largely invisible. It should not require people to buy new phones or change passwords solely because of quantum computing. Some upgrades could cause temporary service friction if compatibility is mishandled, but the customer-facing promise should be continuity: payments, log-ins and statements keep working while the cryptographic plumbing changes behind them.

Quantum-safe encryption will not stop phishing, stolen credentials, SIM swaps, malicious insiders or weak recovery controls. Those threats are active now. Banks still need to protect customers against present-day fraud while preparing for a different class of future cryptographic risk. Selling PQC as a cure-all would distract from both jobs.

The accountability test for government and banks

The next policy step should be a common, risk-based transition roadmap with clear milestones, test standards and reporting expectations. It should begin with an inventory mandate or supervisory baseline that is practical for smaller regulated entities as well as large banks, define how banks assess supplier readiness, and create shared test environments for payments and identity systems. Procurement rules should demand support for recognised, independently reviewed algorithms and give vendors a route to demonstrate compatibility.

Public reporting need not expose sensitive system maps. But banks can disclose aggregate progress: whether inventories are complete, what share of critical systems has a migration plan, how vendor dependencies are being handled and whether pilots have passed independent resilience tests. Without measurable milestones, “quantum readiness” risks becoming a new label in annual reports without evidence of operational change.

The forensic question is therefore not whether India’s banks have bought quantum computers. It is whether they can discover the cryptography embedded throughout their financial infrastructure, decide which exposures matter first, and migrate without interrupting the payment system on which households and businesses depend. RBI has started the mapping exercise. The cost, sequencing and accountability of the actual migration are now the tests to watch.

What is confirmed and what remains unfinished

Status	Evidence-based reading
Confirmed	RBI constituted the Q-SAFE expert committee on 25 May 2026 and published its terms of reference.
Recorded in a parliamentary report	RBI described coordinated PQC preparation and advised regulated entities to build cryptographic inventories.
Reported, not a published rule	Economic Times reported on 7 October 2026 that banks were discussing a sector-wide framework following a Finance Ministry request; it cited unnamed sources.
Still to be settled	The public materials reviewed do not establish a sector-wide migration deadline, a cost estimate, or that Indian banks have moved core banking onto quantum computers.

Sources and reporting notes

This feature distinguishes official measures, parliamentary records and media reporting. No bank-specific implementation claims or cost estimates are inferred where the public record does not provide them.

· Reserve Bank of India, Q-SAFE expert committee release, 25 May 2026

· Rajya Sabha Department-related Parliamentary Standing Committee report, sections 3.6.22–3.6.23 and recommendation 3.6.38

· MeitY/CERT-In, Transitioning to Quantum Cyber Readiness, 11 July 2025

· Ministry of Science & Technology / PIB, quantum-safe ecosystem and task-force update, 12 February 2026

· Economic Times, “Govt asks banks to develop a sector-wide quantum transition…”, 7 October 2026

· MeitY / PIB, BISAG-N and QNu Labs collaboration, 28 January 2026

· NIST, finalized post-quantum cryptography standards, 13 August 2024

— Biz Masala Editorial Desk