The Quantum Clock is ticking: what financial institutions need to do before 2027

The conversation about quantum computing in financial infrastructure has changed in the last eighteen months. Until recently, it was a theoretical concern, the kind of thing that appeared in security strategy documents under "long-term horizon" and rarely made it into procurement decisions. That framing is no longer accurate. The deadlines have arrived.

In August 2024, NIST published the first three finalised post-quantum cryptography standards, formally ending the eight-year evaluation process that began with the 2016 call for proposals. By January 2027, all new acquisitions for US National Security Systems must comply with the NSA's CNSA 2.0 suite, which mandates specific post-quantum algorithms. By the end of 2026, EU member states are expected to publish national post-quantum cryptography strategies, with critical infrastructure migration targeted for 2030 and broader transition by 2035. The Digital Operational Resilience Act (DORA), in effect across the European Union since January 2025, places cryptographic risk management squarely within the operational resilience requirements that EU financial entities must demonstrate.

The question for institutions is no longer whether quantum-resistant cryptography will matter to their procurement decisions. It is whether their current infrastructure is positioned for the transition that is already underway.

Why the threat is dated, not abstract

There is a specific reason why the quantum transition matters now rather than at the moment a quantum computer capable of breaking RSA-2048 actually exists.

The reason is captured in a phrase that has become shorthand in the security community: harvest now, decrypt later.

An adversary that captures encrypted data today, even if they cannot decrypt it now, can store it indefinitely. When a cryptographically relevant quantum computer becomes available, that stored data becomes decryptable retroactively. For most categories of data, this is a manageable risk: by the time the decryption becomes possible, the data may no longer matter. For financial records, settlement histories, trading positions, KYC documentation, beneficial ownership data, and counterparty relationships, which retain commercial and regulatory sensitivity for years or decades after the events they record, it is not manageable. Anything encrypted today with quantum-vulnerable cryptography and stored anywhere accessible is, in effect, on a delayed-disclosure timer.

For a regulated institution, this reframes the question. It is not "when will a quantum computer break our current cryptography?" It is "what data are we generating today that we cannot afford to have decrypted in 2035?" For most financial institutions, the honest answer to that second question is "most of it."

What "quantum-resistant" actually means

Post-quantum cryptography refers to a class of cryptographic algorithms believed to be secure against attacks by both classical and quantum computers. The current NIST-standardised post-quantum algorithms are:

ML-KEM (FIPS 203) for key encapsulation. ML-DSA (FIPS 204) for digital signatures. SLH-DSA (FIPS 205) for stateless hash-based signatures. HQC, added in March 2025, as an additional key encapsulation mechanism intended as a backup to ML-KEM.

The NSA's CNSA 2.0 suite specifies ML-KEM-1024 and ML-DSA-87 at the strongest parameter levels for national security systems. The European ETSI framework (TS 119 312) aligns with the NIST selections. Germany's BSI mandates hybrid key exchange combining classical and post-quantum algorithms, with FrodoKEM and Classic McEliece as conservative fallbacks. France's ANSSI requires hybrid for both key encapsulation and signatures.

These standards matter not because they are the final word, but because they are the ones procurement officers and compliance teams are being told to ask about. A claim of "quantum resistance" without a specific reference to which standardised algorithms are in use, and at which parameter levels, is not a substantiated claim. It is a label.

But here is where the analysis needs to get more honest than most vendors are prepared to be: a system is not "quantum-resistant" because one component of it uses ML-KEM. A system is quantum-resistant only when every cryptographic component the system depends on is quantum-resistant. A blockchain that uses ML-KEM for key exchange but still relies on ECDSA for transaction signing and on pairing-based zero-knowledge proofs has quantum-resistant elements, not a quantum-resistant architecture. The overall security of the system is determined by its weakest cryptographic link, not by its strongest.

This is the level of specificity at which procurement conversations need to be conducted.

The Enygma payment flow, component by component

A standard Enygma payment transaction involves seven distinct cryptographic components. Each one has its own quantum status. We have published this breakdown because we believe institutional procurement should be based on specifics, not on labels.

One: identity and key registration. Each participant in the Enygma network generates a spending key pair and a viewing key pair. The identity construction was historically based on the Baby Jubjub elliptic curve. In Enygma v2.5 and later, this has been upgraded to a quantum-resilient design. Status: addressed.

Two: shared secret generation between participants. Earlier designs used CSIDH, an isogeny-based key exchange, for auditor key exchange. This has been replaced with ML-KEM, the NIST-standardised post-quantum key encapsulation mechanism. Status: addressed.

Three: transaction data encryption. Transaction payloads are encrypted with AES-GCM. AES-256 is already considered quantum-resistant in practice. The strongest known quantum attack on symmetric encryption, Grover's algorithm, halves the effective key space, which leaves AES-256 with the equivalent of 128 bits of quantum security. That remains within acceptable bounds for the foreseeable future. Status: no action required.

Four: private transaction tagging. Private tags use SHA-256 hashing. Hash functions of this size are resistant to quantum attacks. Status: no action required.

Five: balance commitments. Token balances are hidden using Pedersen Commitments on elliptic curves. Despite being elliptic-curve-based, the specific binding and hiding properties of Pedersen Commitments remain quantum-safe in the context they are used in Enygma. Status: no action required.

Six: zero-knowledge proof generation. The current proving system is Groth16, which relies on pairing-based cryptography. There is no production-ready post-quantum replacement for pairing-based zero-knowledge proofs available today. This is an industry-wide gap, not a Rayls-specific limitation. Every blockchain using SNARK-based privacy is in the same position. The Rayls II paper acknowledges this explicitly. The Enygma protocol is designed to make the proving system modular and replaceable as the post-quantum ZK research field matures. Status: pending solution, designed for replacement.

Seven: wallet keys. Standard EVM wallet keys use ECDSA, which is not quantum-resistant. This is a constraint of the entire Ethereum ecosystem, not specific to Rayls. No EVM-compatible chain has a production-ready post-quantum wallet key solution today, and the path to one requires coordination across the ecosystem. Status: accepted limitation pending ecosystem-wide evolution.

Out of seven cryptographic components in a standard Enygma payment flow, five are already quantum-resistant. One (zero-knowledge proofs) is an open problem industry-wide, with Enygma designed for modular replacement when a viable post-quantum proving system becomes available. One (ECDSA wallet keys) is a shared constraint of the entire EVM ecosystem.

This is a defensible position. It is also a more specific position than most blockchain infrastructure can credibly claim today.

How institutions should evaluate quantum readiness in 2026

For institutions making procurement decisions in 2026, the right test is to ask vendors for component-by-component quantum status, not for a single "quantum-safe" claim. Six questions cover the ground that matters.

Which cryptographic primitives does the system use, and which of them are quantum-vulnerable today? A vendor that cannot answer this precisely is a vendor whose security claims have not been examined rigorously.

For each quantum-vulnerable component, what is the migration plan, and what is the timeline? The plan need not be complete. It does need to exist and to be specific.

Where the system uses NIST-standardised PQC, which specific standards are implemented, and at which parameter levels? ML-KEM at the 512 parameter level is not the same as ML-KEM-1024.

For any quantum-vulnerable component that cannot be migrated today, is the system designed for modular replacement? The honest answer to the ZK proof problem is "industry-wide gap." The right architectural response is to design the system so that the component can be swapped without a rebuild.

What hybrid options does the system support? Hybrid approaches that combine classical and post-quantum algorithms are increasingly being mandated, notably by Germany's BSI and France's ANSSI. Institutions operating in those jurisdictions will need hybrid support.

How is the system designed to handle the long tail of historical data? Records encrypted today need to remain confidential after a quantum computer arrives, which means key rotation, archival, and re-encryption strategies all need to be in scope.

These questions are not designed to fail any single vendor. They are designed to surface honest answers. The institutions best positioned for the 2026 to 2030 transition window are those whose procurement decisions today are guided by precision rather than by labels.

What this means for procurement decisions now

A blockchain infrastructure decision made in 2026 carries with it a quantum readiness profile that will define what your institution can support for years to come. Migration of cryptographic infrastructure is not a software upgrade in the ordinary sense. It involves changes to key management, hardware integrations, identity systems, signing operations, and audit trails, each of which has its own operational risk and cost.

Three principles are worth holding to when evaluating infrastructure for the transition window.

First, cryptographic agility of the underlying architecture matters more than any single algorithm choice. The standards will evolve. The algorithms recommended today may be superseded by stronger ones in five years. Systems designed for modular replacement of cryptographic components will adapt. Systems hardwired to specific algorithms will not.

Second, honesty about gaps is more valuable than blanket claims. A vendor that can articulate exactly which components are quantum-safe today, which are not, and what the plan is for each, is a more credible long-term partner than one marketing a single "quantum-safe" label. Specificity is a leading indicator of engineering discipline.

Third, the transition will happen in stages, not in one cutover. Hybrid approaches combining classical and post-quantum algorithms are increasingly the standard. DORA-regulated entities, in particular, will need to plan for living with hybrid for some time.

The Enygma protocol has been designed against this timeline. Five of seven components are already quantum-resistant. The remaining two are explicitly acknowledged: one is an industry-wide gap with a modular design for replacement, and one is a shared EVM-ecosystem constraint that no chain has solved alone. The academic specifications of both Rayls I and Rayls II on the IACR cryptology archive provide the technical detail that institutions need to validate these claims independently.

Quantum resistance is not a brochure feature. It is the property of a system that determines whether the data flowing through it today is going to remain confidential a decade from now. For institutions whose data carries that kind of sensitivity, the question is not whether to think about quantum. It is whether to think about it now, or to think about it after a regulator forces them to.