The government has directed banks to develop a sector-wide quantum transition and adoption strategy, along with an artificial intelligence (AI) resilience framework. This follows the identification of the banking, financial services and insurance (BFSI) sector as critical information infrastructure, said people familiar with the matter.

“Banks are internally discussing the matter, and a working group under the State Bank of India chairman is looking into it,” an executive said on condition of anonymity, adding that other aspects under consideration are frontier AI models and associated risks, including development of a sectoral framework on AI-driven cyber threats.

According to the industry, major concerns in this segment include ‘harvest now, decrypt later’ threats, where cyber adversaries stockpile encrypted banking data for future quantum decryption.

The finance ministry has also asked banks to assess post-quantum vulnerabilities and initiate mitigation measures, said an official, who did not wish to be identified. “Each bank can prepare its internal strategy, but there has to be some common industry parameters,” he added.

Earlier, public sector banks were asked to explore quantum-resistant, advanced-level encryption as an additional security layer under the hackathon themes. Under the banks’ reforms agenda Ease 9.0, state-run banks are to assess and define a bank-specific approach for setting up a tech stack and infrastructure for generative AI implementation.

In May, the Department of Science & Technology said in a report, titled ‘Quantum-Safe Ecosystem in India’, that adversaries might already be intercepting and storing encrypted data under ‘harvest now, decrypt later’ (HNDL) and ‘trust now, forge later’ (TNFL) campaigns, intending to decrypt it once quantum capabilities mature.

“The transition to quantum-safe security is therefore a matter of strategic foresight, national security, and economic resilience,” it said, noting that by 2027, for critical information infrastructure, relevant ministries and regulators are to establish and maintain their cryptographic asset repositories to enable inventory, lifecycle management, risk assessment and the coordinated migration of cryptographic systems.

Failure to act within the current planning window may result in irreversible compromise of confidential data, erosion of trust in digital governance, exposure of financial systems and forced emergency migration under crisis conditions, it said.

In September, PwC said in a report that banks must begin preparing for post-quantum cryptography migration immediately. The report highlighted that most banking institutions remain in the early stages of quantum preparedness and that boards, chief information security officers and regulators would increasingly treat quantum readiness as a risk management priority.

Join the community of 2M+ industry professionals.

Subscribe to Newsletter to get latest insights & analysis in your inbox.

All about ETCISO industry right on your smartphone!