FCA’s Quantum Readiness Push: Why Fintechs Need Evidence Before 2035

A fintech’s promise to complete its quantum transition by 2035 says little about whether it knows what must change. Which services depend on vulnerable cryptography? Who controls the upgrades? Can those services still work together after migration? Those are questions a completion date cannot answer.

The FCA’s 4 November 2026 blog announces a trial of a supervisory self-assessment tool, initially with a sample of firms, with wider use intended later. It also signals a consultation on cyber-resilience guidance covering post-quantum cryptography, or PQC, risks and cryptographic controls.

For UK-regulated fintechs, the important analytical implication is that preparedness needs to become demonstrable before the technology transition is complete. That does not mean the FCA has introduced a universal PQC filing obligation. It means a migration programme organised only around its final deadline risks overlooking the evidence needed to explain its progress.

A supervisory signal, not a new rule instrument

The legal status of the announcement matters. The FCA describes a supervisory trial, not an immediate sector-wide submission requirement. Its reference to an initial sample should not be read as confirmation that every FCA-regulated entity must now complete the tool.

The planned guidance consultation is also a separate step. The blog says the FCA will consult; it does not supply an opening date or a final implementation timetable. An announcement of a consultation is not final guidance, and the blog is not a newly published rule instrument.

There is a useful precedent for reading these communications carefully. In its Cyber Coordination Group insights 2025 publication, published on 24 April 2026, the FCA expressly said it was not introducing additional regulatory expectations. That document summarised industry discussions, including observations about ownership of cryptographic processes.

These distinctions do not make the publications irrelevant. They establish what each can support: evidence of supervisory attention and practical preparation themes, rather than a standalone basis for declaring a particular firm compliant or non-compliant.

The NCSC milestones are planning targets

The National Cyber Security Centre’s PQC migration guidance, published on 20 March 2025, sets out indicative milestones:

• By 2028: complete discovery and initial planning.
• By 2031: complete migration of the highest-priority systems or activities.
• By 2035: complete migration.

These are recommended technical planning milestones, not statutory commencement dates established by that document. They should not be presented as an FCA rule taking effect in three stages.

Their sequence nevertheless carries an important operational lesson. Discovery precedes prioritisation, and prioritisation precedes completion. Treating 2035 as the only meaningful date strips away the work needed to make the endpoint credible.

For fintech operational resilience, the more useful management question is therefore not simply whether a programme is scheduled to finish by 2035. It is whether the firm can explain the dependencies, decisions and tests on which that schedule rests.

Start with dependencies, not an algorithm decision

Choosing replacement cryptography cannot, by itself, establish migration readiness. The NCSC guidance explicitly addresses dependencies and calls for testing interoperability with other services, not just testing individual systems in isolation.

A practical response would be to connect a cryptographic inventory to the services it supports. As an illustrative planning approach—not an FCA-prescribed template—that record could identify the relevant application or component, its cryptographic function, the responsible owner, external dependencies and the available upgrade route.

The distinction is between a list and a decision-making tool. An inventory that identifies a component but not who can change it leaves a critical question unanswered. A migration date without an explanation of the dependencies behind it provides limited assurance.

Unknowns deserve a place in that record too. If a firm cannot establish which cryptographic components a supplier uses, that is a discovery gap to investigate. It should not disappear into a general statement that the supplier is handling migration.

Supplier readiness needs something testable

Supplier dependencies can turn an apparently internal technology project into a coordination problem. A fintech may control its own application changes while depending on another organisation’s upgrade timetable or testing environment.

The editorial recommendation is to seek evidence specific enough to support planning. Useful questions include:

• Which products and versions does the supplier’s migration plan cover?
• What changes will the fintech itself need to make?
• When will compatible versions or test environments be available?
• Which dependencies remain unresolved, and who owns their resolution?

These are suggested procurement and change-management questions, not additional regulatory requirements attributed to the FCA.

The important distinction is between a supplier’s stated intention and an executable migration path. A roadmap may be useful evidence of direction. It does not, by itself, demonstrate that the fintech’s particular configuration will work after the change.

Testing should follow the service across organisational boundaries

The NCSC’s emphasis on interoperability changes what a meaningful test programme should seek to establish. A component-level result is narrower than evidence that a connected service continues to operate as intended.

For example, a hypothetical fintech could successfully upgrade one component while remaining unable to complete a transaction through a dependent external service. The local test would still be informative, but it would not establish end-to-end readiness.

A sensible evidence record would distinguish what has been tested from what remains assumed. It could document the configuration, dependencies included, outcome, unresolved issues and subsequent decisions. This is an analytical recommendation, not a claim that the FCA’s trial mandates those fields.

Governance makes that evidence usable. The FCA’s earlier industry-insights publication identifies clear ownership of key cryptographic lifecycle processes as a feature of better-prepared organisations. For management, the practical extension is to make unresolved dependencies visible to someone able to decide priorities and resources.

A board does not need to select every technical component. It does need a way to distinguish progress supported by evidence from progress dependent on unanswered questions.

The central lesson of the FCA post-quantum cryptography push is therefore narrower than a new compliance deadline, but more immediate than a distant technology target: firms should be able to explain how their migration plan will work. A 2035 destination is useful. A documented route is what makes it credible.

Scope and limitations

This is desk-based analysis of the supplied verified research record for the FCA and NCSC publications cited below. It does not involve interviews, supplier verification, system testing or an assessment of any individual firm’s regulatory obligations. The proposed evidence records and management questions are editorial analysis, not prescribed contents of the supervisory tool. Participation arrangements and future guidance should be assessed against the relevant FCA communications as they develop. This article provides general information, not legal advice.

Sources and References

• FCA: Act now to be resilient in the quantum future, published 4 November 2026.
• NCSC: Timelines for migration to post-quantum cryptography, published 20 March 2025.
• FCA: Cyber Coordination Group insights 2025, published 24 April 2026.