EU regulators flag foreign dependencies and quantum risks to financial stability

  • The NIS Cooperation Group published a post-quantum cryptography migration roadmap for EU member states.
  • All 27 EU member states must begin transition planning by Dec. 31, 2026.
  • The roadmap targets high-risk infrastructure by 2030 and broader EU systems by 2035.

Quantum computing could eventually undermine cryptography protecting financial transactions, communications, databases and blockchains, the Joint Committee of the European Supervisory Authorities said in its Sept. 23 Autumn 2026 risk update. The committee comprises the European Banking Authority, the European Insurance and Occupational Pensions Authority and the European Securities and Markets Authority. The supervisors warned that a quantum machine capable of breaking encryption could emerge before quantum computing has viable general-purpose commercial applications. They highlighted harvest-now-decrypt-later risks, in which adversaries collect encrypted data or exposed public keys now for future decryption or private-key derivation. Recent research, including work from Google, has led some estimates to place viable quantum attacks as early as 2029, while other estimates for Q-Day range from 2030 to 2032 and later. The NIS Cooperation Group's post-quantum cryptography roadmap requires all 27 EU member states to begin transition planning by Dec. 31, 2026, including stakeholder mapping, risk assessments and cryptographic inventories. It targets completion by the end of 2030 for high-risk infrastructure and by 2035 for broader systems. The EU has invested more than €11 billion in quantum technologies in recent years, while trailing the US and China in private-sector investment. Bitcoin and Ethereum rely on elliptic-curve cryptography, which a sufficiently capable quantum computer could target. Bitcoin holdings face varying degrees of exposure depending on whether a public key has been revealed onchain. Glassnode estimated in May that 6.04 million BTC, or 30.2% of issued supply and worth more than $469 billion at the time, had visible public keys; CryptoQuant founder Ki Young Ju separately estimated that 6.89 million BTC could face future exposure. NIST finalized its first set of post-quantum cryptographic algorithms in 2024, but no major Layer 1 blockchain has implemented quantum-resistant signature schemes at the protocol level. The EU initiative also supports the bloc's EuroQCI project for quantum-safe communications. The gap between estimates of possible quantum attacks and the 2035 broader migration target leaves governments, financial institutions and blockchain networks facing a prolonged transition challenge.

The information on this website is generated using AI and we cannot guarantee its accuracy. Please use it as reference information only.