Cyber Resilience Initiative: UK Financial Conduct Authority and World Economic Forum

The initiative has been recognised as the first global effort to co-ordinate industry and regulatory transition to quantum security

Q-Day, when quantum computers may be powerful enough to break through current encryption standards, demands being prepared for now.

Recognising this, the UK Financial Conduct Authority (FCA) and the World Economic Forum’s (WEF’s) collaboration on quantum security is the first global effort to unify industry and regulatory insights to develop a financial industry-wide transition road map.

“This world-first initiative combines regulatory and industry insight to establish a more collaborative, harmonised and secure financial services sector,” says Ian Phoenix, the FCA’s director of intelligence and digital.

Quantum computers have the potential to break widely used RSA encryption technology – named after Rivest–Shamir–Adleman, the surnames of its inventors – which exploits the difficulty of taking an extremely large number and working out its prime factors.

Instead, three post-quantum cryptography standards, published in August 2024 by the National Institute of Standards and Technology, use lattice – or 3D structure – and hash-based algorithms. Hash functions encrypt messages of any size into a fixed length.

Central banks, regulatory bodies and financial institutions continue to meet after the first FCA-WEF white paper, Quantum security for the financial sector: informing global regulatory approaches, was published in January 2024. Because of the difficulty of preparing for a technology that does not yet exist, the approach outlined in the white paper emphasises quantum “agility”.

“Quantum computing development is set to accelerate over the next decade and will trigger significant change in the cyber threat landscape,” Giuseppe Bruno, director of economics, statistics and research at the Bank of Italy, says in the white paper. “Acting in anticipation can improve policy effectiveness, and is of utmost relevance to provide an inclusive transition path accounting for the different economic burdens on different countries.”

Indeed, the Monetary Authority of Singapore issued an advisory to chief executives on quantum risks and recommended actions. The Bank of Italy has prioritised quantum security as part of its G7 leadership. The FCA shared key findings with Europol’s Quantum Safe Financial Forum – a new consortium of European entities focused on co-ordinating best practices for transitioning to post-quantum cryptography. The work was also showcased at the International Monetary Fund’s Spring Meetings and the annual European Telecommunications Standards Institute Conference.

The FCA itself continues to engage with the National Cyber Security Centre (NCSC), as Charlie Markham, senior associate of emerging technology and research at the FCA, tells Central Banking. The NCSC is the UK’s principal authority for managing and improving the country’s cyber security posture and has an ongoing programme on post-quantum cryptography. It plays a critical role in protecting the government, businesses and the public from cyber threats.

Since publishing the paper, Markham says the FCA held another joint roundtable with the US Financial Industry Regulatory Authority, once again bringing together around 20 different industry experts from quantum computing technology providers, as well as financial services and regulatory authorities. They held a more detailed discussion around the challenges individual stakeholders are facing, as cyber threats increase and become more complex.