Quantum computing has emerged as a potential long-term challenge to the cryptographic algorithms that currently secure digital financial systems. As financial institutions rely extensively on cryptography to protect communications, transactions, authentication processes, and sensitive information, the prospect of quantum computing has raised concerns about the future security of existing cryptographic infrastructures. This has created a need to better understand how organisations perceive and approach the transition toward post-quantum cryptography (PQC). This study explores how financial organizations in the United Arab Emirates perceive and approach the transition toward PQC. Guided by the Technology–Organization–Environment (TOE) framework,the study examines how technological, organizational, and environmental factors influence organizational perspectives and approaches toward future cryptographic transition. A qualitative research design was adopted using semi-structured interviews with nine participants in cybersecurity, technology, governance, and compliance roles across banks, financial service providers, payment organizations, and a regulatory authority within the UAE financial sector. The findings show that awareness of quantum-related risks is increasing across the sector; however, most organisations remain in the early stages of assessment and monitoring. Organisational approaches were shaped by technological, organisational, and environmental factors, including cryptographic visibility, governance, resource constraints, regulatory expectations, international standards, and ecosystem coordination. The study concludes that financial organisations in the UAE recognise PQC as an important future cybersecurity challenge but currently approach the transition through awareness-building, assessment, and monitoring rather than active implementation.Organizational responses were shaped by technological, organisational, and environmental factors, indicating that PQC transition extends beyond a purely technical challenge.
Quantum computing has emerged as a potential long-term challenge to the cryptographic algorithms that currently secure digital financial systems. As financial institutions rely extensively on cryptography to protect communications, transactions, authentication processes, and sensitive information, the prospect of quantum computing has raised concerns about the future security of existing cryptographic infrastructures. This has created a need to better understand how organisations perceive and approach the transition toward post-quantum cryptography (PQC). This study explores how financial organizations in the United Arab Emirates perceive and approach the transition toward PQC. Guided by the Technology–Organization–Environment (TOE) framework,the study examines how technological, organizational, and environmental factors influence organizational perspectives and approaches toward future cryptographic transition. A qualitative research design was adopted using semi-structured interviews with nine participants in cybersecurity, technology, governance, and compliance roles across banks, financial service providers, payment organizations, and a regulatory authority within the UAE financial sector. The findings show that awareness of quantum-related risks is increasing across the sector; however, most organisations remain in the early stages of assessment and monitoring. Organisational approaches were shaped by technological, organisational, and environmental factors, including cryptographic visibility, governance, resource constraints, regulatory expectations, international standards, and ecosystem coordination. The study concludes that financial organisations in the UAE recognise PQC as an important future cybersecurity challenge but currently approach the transition through awareness-building, assessment, and monitoring rather than active implementation.Organizational responses were shaped by technological, organisational, and environmental factors, indicating that PQC transition extends beyond a purely technical challenge.
Quantum computing is advancing rapidly and is expected to reshape the cybersecurity foundations of the financial sector. Modern financial systems rely heavily on classical public-key cryptography such as Rivest-Shamir-Adleman (RSA) and elliptic-curve cryptography (ECC), which are vulnerable to quantum algorithms capable of breaking current encryption schemes. As these technologies mature, financial institutions face growing pressure to transition toward quantum-resistant security frameworks that can preserve the confidentiality and integrity of financial data. This paper reviews the role of quantum cryptography in finance and describes how governments, regulators, and financial institutions are preparing for the transition to quantum-resilient security systems. Drawing on academic literature, institutional reports, and organizational case studies, the analysis explores the technical, regulatory, and economic factors shaping the adoption of post-quantum security measures across global financial networks. Particular attention is given to hybrid security strategies that combine post-quantum cryptography (PQC) with quantum key distribution (QKD), which are emerging as practical solutions for strengthening communication security while maintaining operational performance. The findings highlight substantial disparities in national and institutional readiness, with higher-income countries and large financial organizations leading pilot programs and infrastructure investments while lower-capacity systems remain dependent on legacy encryption. These differences create uneven levels of protection across interconnected financial networks and increase the risk of systemic vulnerability. The paper concludes that coordinated standards, phased implementation strategies, and sustained investment in technical capacity will be essential for maintaining secure and stable financial systems in the quantum era.
The emergence of quantum computing poses a significant threat to modern encryption standards, with the potential to render widely used cryptographic protocols obsolete. To mitigate this risk, organizations must transition to post-quantum cryptography (PQC), a process that requires technical, operational, and strategic adjustments. However, the pace and approach to adoption vary across industries and organizational size, influenced by both external pressures and internal capabilities. This study employs a mixed-methods approach, incorporating 14 expert interviews and survey responses from 37 cybersecurity professionals to examine the factors driving and inhibiting PQC adoption. The findings reveal that while regulatory mandates play a role, organizations are increasingly guided by risk exposure and reputational concerns. Key challenges include resource constraints, reliance on third-party vendors, and the complexity of cryptographic inventory assessments and legacy systems. Despite these challenges, the study found that PQC adoption will accelerate as risk awareness grows and implementation guidelines become available. It emphasizes the importance of a strategic, resilience-focused approach to cybersecurity, incorporating cryptographic agility, continuous assessments, and hybrid encryption solutions to navigate the evolving threat landscape.
The rapid development of quantum computing is one of the most transformative technological developments of the twenty-first century with profound implications for cybersecurity, digital governance and the future of secure communication systems. Traditional cryptographic infrastructures have fundamentally underpinned digital trust in banking, healthcare, defense, cloud computing, and global communication networks, but the advent of quantum computational power has led to increasing concern about the future of existing standards for encryption. This qualitative study critically examines the changing relationship between quantum computing and post-quantum cryptography through an analysis of the technological, institutional, ethical and governance challenges in the transition to quantum-secure digital systems. The study adopts an interpretivist and exploratory qualitative orientation that aims to understand how governments, cybersecurity experts, technology institutions and policy frameworks are responding to the disruptive potential of quantum technologies. Data were collected using thematic analysis of academic literature, cybersecurity policy documents, archival technological reviews, expert commentaries, institutional reports, and emerging case studies related to the development of quantum-resistant cryptography. The results show that quantum computing presents serious threats to existing public-key cryptographic systems, especially in terms of theoretical abilities of Shor’s algorithm and future quantum decryption models. Meanwhile, the paper outlines post-quantum cryptography as a vital avenue for safeguarding digital privacy, institutional credibility, and cybersecurity robustness in an ever more networked society. The analysis also points to ongoing challenges around technological readiness, regulatory uncertainty, global standardization, resource inequality and ethical issues around surveillance, privacy and digital sovereignty. Yet, the research points to the potential for secure digital transformation, resilient cybersecurity governance, and the re-inventing of future communication infrastructure through post-quantum innovation. The research finds that the transition to quantum-secure systems is not just a technological challenge, but a multidimensional governance and policy challenge requiring international cooperation, ethical foresight and proactive institutional change.
The imminent emergence of quantum computers poses unprecedented challenges to the current cryptographic standards that secure vital digital communications and data worldwide. This paper addresses the vulnerabilities of existing cryptographic systems susceptible to quantum-based attacks and emphasizes a dedicated transition plan to post-quantum cryptography (PQC). We first examine the current state of cryptographic practices, highlight the quantum threat, and present the framework and need for PQC. In addition, a comprehensive strategy is presented that encompasses the identification, protection, detection, response, and recovery phases and integrates PQC into existing security infrastructures, specifically the Cybersecurity Framework Version 2.0 of the National Institute of Standards and Technology (NIST). Methods and technologies discussed include the development of robust PQC algorithms, tools for their large-scale implementation, and hybrid cryptographic systems that combine traditional and quantum-resistant techniques. Practical implementations on various hardware and software platforms are also presented in case studies that provide real-world insight into the challenges and innovations in using PQC. We conclude with a discussion of hybrid approaches, regulatory considerations, and recommendations derived from early adopters to guide future efforts to create a quantum-resilient digital landscape.
Purpose This paper aims to examines the governance of post-quantum cryptography (PQC) transition in Gulf Cooperation Council (GCC) banking, identifies structural gaps in existing regulatory frameworks and proposes a regulatory readiness framework for orderly migration to quantum-resistant standards. Design/methodology/approach A qualitative policy-analytical methodology combines structured literature synthesis with comparative regulatory analysis of six GCC banking frameworks – Saudi Arabian Monetary Authority, Central Bank of the UAE, Central Bank of Kuwait, Qatar Central Bank, Central Bank of Bahrainand Central Bank of Oman – against five PQC governance dimensions, stress-tested across three cryptographically relevant quantum computer timeline scenarios. Findings None of the six frameworks explicitly addresses PQC transition requirements and all show critical gaps in cryptographic agility, quantum threat timeline awareness and harvest-now-decrypt-later (HNDL) risk assessment. National Institute of Standards and Technology (US)’s PQC standards (Federal Information Processing Standard 203, 204, 205) supply the technical foundation but not the regulatory coordination and supervisory capacity GCC banking requires. Practical implications The framework gives GCC banking regulators actionable guidance for introducing HNDL risk assessment, mandating cryptographic agility and establishing PQC transition planning before migration becomes compressed and disruptive. Originality/value This is among the first systematic PQC governance analyses of GCC banking, best characterised as a theoretically grounded contextual adaptation rather than a new governance theory. The proposed three-phase framework – inventory, prioritised migration, continuous resilience – is framed through a socio-technical transition lens, translating generic quantum-risk identification into a governance architecture grounded in the six GCC supervisors’ regulatory landscape.
This study explores the factors influencing the transition to Post-Quantum Cryptography (PQC) within the Philippine banking industry, a critical sector at risk from the Year-to-Quantum (Y2Q) threat. The threat posed by Cryptographically Relevant Quantum Computers (CRQCs) challenges traditional cryptographic protocols, demanding urgent preparedness. Through the Cryptographic Agility Maturity Model (CAMM), this study evaluates the industry's readiness, revealing a prevailing “L0: Initial/Not Possible” to “L1: Possible” maturity level. Qualitative interviews with five senior bank cybersecurity officers identified key internal challenges, such as distant threat perceptions, lack of cryptographic inventories, and inadequate technical capabilities, alongside external barriers, including limited regulatory guidance and supply-chain unpreparedness. The study highlights actionable enablers, including regulatory guidance, sector-wide collaboration, and public-private partnerships, to accelerate PQC readiness. This foundational research aims to catalyze future initiatives and policies for a quantum-secure financial sector in the Philippines.