FCA urges brokers to inventory encryption risks now, citing 2028–2035 post-quantum milestones

The Financial Conduct Authority urged financial firms on 4 November to begin detailed preparations for post-quantum cryptography, warning that a sufficiently capable future quantum computer could undermine widely used authentication and encryption methods. The regulator says it does not know when such a machine will become viable. Its message is therefore about managing a foreseeable migration risk, not claiming that present-day customer accounts are already being decrypted by quantum computers.[1]

The FCA highlighted three milestones recommended by the UK National Cyber Security Centre: complete a migration plan by 2028; carry out high-priority migration by 2031; and move all systems, services and products to post-quantum cryptography by 2035. The FCA expects firms to act now with inventories, risk-based objectives, controlled implementation, testing and ongoing validation. These dates come from a recommended roadmap; the blog does not announce a newly enacted universal statutory deadline applying identically to every broker and technology vendor.[1]

For brokerages the cryptographic estate extends well beyond websites. Customer login and identity systems, APIs, FIX sessions with trading counterparties, order-management gateways, custody instructions, encryption of archived communications and secure software updates can all rely on cryptographic mechanisms. Some functions can be replaced through a controlled software upgrade, while embedded hardware or vendor-managed components may need long procurement cycles. A generic assurance that a cloud platform is secure does not inventory these dependencies.[1]

The regulator emphasised change-management risk as well as future cryptographic risk. Around one fifth of incidents reported to the FCA in 2025 arose from failed change projects, according to its blog. Rushing a complex security migration without end-to-end testing may therefore create the disruption it was designed to prevent. Financial firms should map high-priority services and coordinate upgrade windows with venues, banks, connectivity suppliers and counterparties.[1]

The FCA is trialling a supervisory self-assessment tool with an initial sample of firms and intends to expand the exercise. It also plans to consult on cyber resilience guidance. Those are still supervisory-development steps, not proof of every firm’s readiness or a final new detailed rule. Firms should distinguish a mandatory resilience obligation they already have from the nonbinding implementation milestones set out in government guidance.[1]

Why the broker–provider supply chain makes cryptography migration difficult

The FCA's post-quantum discussion is principally a planning warning. A firm should map its long-lived client secrets, identity credentials, vendor dependencies and encrypted transaction records before choosing which cryptographic systems to replace. The 2028, 2031 and 2035 milestones referenced from the UK's National Cyber Security Centre form migration guidance, not a finding that today's trading network has already been compromised by a quantum computer. The regulator's point is that delayed inventory and testing can make a future migration harder than the underlying algorithm change.[1]

The practical starting point is a tested inventory tied to essential business services, with vendor accountability and recovery plans. The future security objective is serious, but effective execution must not degrade today’s trading availability or client protections.[1]

Report an error or submit an update