The G7 Roadmap Gives Finance Until 2034. The Phases in Between Are Where Banks Fall Behind.
· Industry · 6 min read
Who wrote it and what it is
The G7 Cyber Expert Group (CEG) advises G7 finance ministers and central bank governors on cybersecurity. It is co-chaired by the US Treasury and the Bank of England. In January 2026 it published a roadmap for moving the financial sector to post-quantum cryptography, developed by a task force of financial authorities and industry experts.
Two framing points first:
- It is not a regulation. The CEG says plainly that it does not set guidance or regulatory expectations.
- It is still the most useful planning reference a bank has, because it is written by the people who co-ordinate the supervisors who will eventually set those expectations.
The six phases
| Phase | Window | What it asks for |
|---|---|---|
| Awareness and preparation | 2025 to 2027 | Raise awareness across the organisation, map critical systems and sensitive data |
| Discovery and inventory | 2025 to 2028 | Build a complete inventory of systems and third-party dependencies, find the gaps |
| Risk assessment and planning | 2026 to 2029 | Plan the migration for all systems, including less critical ones |
| Migration execution | 2027 to 2034 | Migrate progressively, starting with priority functions |
| Migration testing | 2032 to 2035 | Test that migrated systems work, run ecosystem-wide resilience exercises |
| Validation and monitoring | 2033 to 2035 | Keep validating and adopt new standards as they appear |
Read the last row carefully. Even the finish line assumes new standards will keep arriving. The roadmap explicitly encourages building cryptographic agility into transition plans, so algorithms can be swapped without rewriting applications.
The phase that decides everything
Look at the overlap. Execution starts in 2027, but discovery is not meant to finish until 2028 and planning until 2029. That only works if discovery is largely done before execution begins at scale. You cannot migrate what you have not found.
This is where most banks are behind. Industry surveys in 2026 show the gap clearly: DigiCert found 87% of organisations planning, testing or implementing PQC but only 7% deployed at scale, and Axiad found 46% could not name the person responsible for leading the migration.
A self-check against the roadmap
It is September 2026. By the roadmap's own windows, a bank on track should be able to say yes to these:
- We have mapped our critical systems and sensitive data, with data lifetimes. (Phase 1, closes 2027.)
- We have started an inventory that includes third parties, not just what we host. (Phase 2, in progress now.)
- We have a named owner for the programme, reporting to the board.
- Our plan covers every system, not just the crown jewels. (Phase 3, underway.)
- Our architecture choices today make the next algorithm change cheaper.
If more than two of those are "no," the problem is not quantum computers. It is the calendar.
Qypher builds the inventory the G7 roadmap puts at the centre of phases one to three, includes third-party dependencies, maps findings to your regulators, and generates the migration artifacts your team deploys in phase four. Get a free assessment →
Sources: G7 Cyber Expert Group, "Advancing a Coordinated Roadmap for the Transition to Post-Quantum Cryptography in the Financial Sector" (Jan 2026), as reported by Infosecurity Magazine; US Treasury G7 CEG page; DigiCert Quantum Readiness Outlook 2026; Axiad PQC Confidence Gap report (Aug 2026).