Washington's Signal to Banks: No Mandate Yet, but Inventory First. What Treasury and NIST Said This Month.

· Industry · 6 min read

Two signals, one direction

Treasury's task force (late August 2026). The US Treasury, which is the sector risk management agency for financial services, announced a Quantum-Readiness Task Force. It follows Executive Order 14412, which directs those agencies to help critical-infrastructure owners build migration plans. Treasury said it will convene financial institutions, market infrastructures and technology providers around three themes: cryptographic inventory, cryptographic agility and interoperability, building on the G7 Cyber Expert Group roadmap.

NIST at the Quantum World Congress (25 September 2026). NIST Director Arvind Raman said NIST's post-quantum standards are "being implemented at scale as we speak," citing Apple, Google, IBM and Amazon, including ML-KEM in Chrome. He said NIST is working to scale adoption across all critical sectors, with 60 companies taking part through the National Cybersecurity Center of Excellence.

What neither of them said

Be precise about this when you brief a board. US financial regulators have not issued post-quantum requirements for supervised institutions, and Treasury's announcement did not signal any are coming. It also did not name members, set a first meeting, or describe what the task force will produce.

So this is not a compliance deadline. It is a statement of priorities from the people who will eventually shape one.

Why "inventory first" keeps coming back

Every framework now opens the same way: CSA and MAS in Singapore, the UAE national policy, the G7 roadmap, the EU roadmap, and now Treasury. Inventory is also the step institutions find hardest, for a reason analysts keep pointing to: most of a bank's cryptography arrives inside technology it bought. It lives in vendor products, legacy systems, acquired platforms and third-party APIs, some of it older than the algorithms now being deprecated.

That has an uncomfortable consequence. A bank can do everything right internally and still be held back by payment processors, cloud providers, custodians and software vendors moving at different speeds. In payments and settlement, where interoperability failures are not acceptable, that dependency is the real schedule.

The platforms are not waiting

NIST's "at scale" remark is worth taking literally. The browser your customers use and the cloud you run on already negotiate post-quantum key exchange. Microsoft, Google and Cloudflare have all set 2029 completion targets. When the platforms around you finish first, the weakest link in the chain is whoever has not started.

A practical response for APAC and Gulf banks

  1. Inventory including suppliers. Map not just what you run, but which vendor each cryptographic dependency comes from.
  2. Ask vendors for dates, in writing. Put post-quantum roadmaps into contract renewals and RFPs now.
  3. Separate what you control from what you do not. Migrate your own key exchange and signing while vendor timelines catch up.
  4. Build agility, not a one-time swap. Treasury named agility as a pillar for a reason. The next algorithm change should be a configuration change.

Qypher inventories your cryptography across your own systems and third-party dependencies, maps each finding to the regulator that cares, and generates the post-quantum migration artifacts your team deploys. Get a free assessment →

Sources: US Treasury Quantum-Readiness Task Force announcement, as reported by BankInfoSecurity (28 Aug 2026); MeriTalk report on NIST Director Arvind Raman's Quantum World Congress remarks (25 Sep 2026); G7 Cyber Expert Group financial-sector roadmap (Jan 2026).