The banking sector's cryptographic cliff

The French National Bank Authority just let 1.2 million accounts leak into the wild. When a national regulator for the financial sector can't secure its own perimeter, it suggests that the "security" we see in banking is often just a thick layer of legacy paint over crumbling concrete.

This week, the pressure on financial institutions isn't coming from a single fine or a lone auditor. It's a pincer movement. On one side, you have the SEC tightening the leash on cross-border flows by banning capital market firms from dealing with North Korean and Iranian banks. On the other, there's a technical deadline that most C-suites are ignoring: the 2027 post-quantum migration window implied by Ethereum’s roadmap.

The core issue here is the confusion between certification and actual security. Union Bank recently touted its PCI DSS 4.0.1 certification. That's fine for a brochure, but certifications are snapshots of process, not guarantees of resilience. I've seen too many "privacy by design" frameworks where the only thing designed was the checklist used to satisfy an auditor.

The real danger is the cryptographic cliff. If banks don't move toward post-quantum cryptography (PQC) now, their current encryption becomes transparent. We aren't talking about a slow slide into obsolescence; we're talking about a sudden loss of confidentiality for every transaction and record held in encrypted vaults.

Some will argue that the transition to PQC is too premature or that the threat of quantum computing is theoretical. That's a dangerous gamble. In data protection, "harvest now, decrypt later" is a known strategy. Adversaries are already collecting encrypted banking data today, betting that they can crack it in three years. Waiting for a regulator to mandate the move is an invitation to be breached retrospectively.

The second-order effect here hits the auditors and insurers. The PCAOB recently noted that audit quality scores for the Big Four are rising. I find that hard to believe if those audits aren't questioning the underlying cryptographic viability of their clients' long-term data storage. If a bank is auditing its books against standards that will be useless by 2027, the auditor isn't providing assurance—they're providing cover.

When the encryption fails, the insurers are next. Most cyber insurance policies have exclusions for "systemic failure" or outdated software. A quantum-driven collapse of standard RSA or ECC encryption won't be treated as a freak accident; it will be seen as a failure to maintain industry-standard protections.

Banks aren't just managing money anymore; they're managing massive, cross-border data silos under intense geopolitical scrutiny. The SEC’s ban on specific state-linked banks shows that the "where" of data is now as important as the "how." You can't simply outsource your risk to a third-party provider and assume the compliance burden disappears with the contract.

The industry is currently obsessed with the optics of compliance. They want the certificate, the badge, and the clean report. But you can't certify your way out of a mathematical reality.

If I see one more bank announce a new "security framework" without mentioning their PQC migration timeline, I'll assume they've already given up on long-term confidentiality.