India's finance ministry has asked banks to begin work on a sector-wide quantum transition plan and an artificial intelligence resilience framework, signalling that the country's financial system is being pushed to prepare for a new generation of cyber risk, according to an official familiar with the discussions.
The directive comes amid rising concern over so-called "harvest now, decrypt later" threats, where attackers intercept and stockpile encrypted banking and financial data with the expectation that future quantum computers could break current encryption standards. In practical terms, that means information considered secure today may become vulnerable years later, creating a long-tail risk for payment systems, customer records, transaction archives and interbank communications.
Quantum Risk Builds
The official, who did not wish to be identified, said the finance ministry has asked banks to assess their post-quantum vulnerabilities and begin mitigation steps. The emphasis is not merely on individual institutional readiness but on a common industry approach that can reduce fragmentation across the banking system.
"Each bank can prepare its internal strategy, but there has to be some common industry parameters," the official said, underscoring the need for coordinated standards rather than isolated responses.
That distinction matters. Banks operate through dense networks of vendors, payment rails, cloud services, core banking platforms and regulatory reporting systems. If one institution upgrades to quantum-resistant cryptography while its counterparties, processors or service providers do not, the weakest link can still expose the chain. The ministry's push appears aimed at preventing a patchwork transition that could leave the sector with uneven defences and operational incompatibilities.
The issue is especially relevant for India's banking and fintech ecosystem, which has expanded rapidly through digital payments, mobile banking and API-driven services. As more financial activity moves online and more data is retained for compliance, analytics and fraud monitoring, the volume of encrypted information that could be targeted for future decryption grows significantly.
AI Adds New Pressure
Alongside quantum preparedness, the finance ministry has also asked banks to develop an AI resilience framework. While the official did not elaborate on the exact contours of that framework, the instruction suggests regulators are treating artificial intelligence as both a defensive tool and a source of new operational risk.
Banks are already using AI for fraud detection, customer service, underwriting and transaction monitoring. At the same time, adversaries are using AI to automate phishing, impersonation, malware development and social engineering. That dual-use reality has made resilience a more urgent concept than simple adoption. Financial institutions now need controls that can withstand model manipulation, data poisoning, deepfake-enabled fraud and the misuse of generative tools by attackers.
The finance ministry's combined focus on quantum and AI risks reflects a broader recognition that cyber security in finance can no longer be built around static assumptions. Encryption standards, identity verification systems and threat detection models must all be designed for a threat environment that is evolving faster than traditional compliance cycles.
Sector Coordination Ahead
For banks, the immediate challenge will be to map where cryptographic dependencies exist across their systems and determine which assets are most exposed to future quantum threats. That includes customer data repositories, interbank messaging, digital signatures, authentication systems and archival records that may need to remain confidential for years.
A sector-wide transition would likely require common technical benchmarks, migration timelines and testing protocols. It could also demand coordination with technology vendors, payment infrastructure providers and regulators to ensure that upgrades do not disrupt day-to-day banking operations.
The move is likely to be watched closely by fintech firms and insurers as well, given their dependence on shared digital infrastructure and sensitive data flows. For the broader financial sector, the ministry's message is clear: quantum risk is no longer a theoretical concern reserved for future planning, and AI resilience can no longer be treated as a separate technology issue. Both are now part of core financial stability planning.
The official's comments suggest the government wants the industry to move early, before the transition becomes urgent under crisis conditions. In cyber security, that timing can be decisive. Once quantum-capable attacks become practical, the window for orderly migration may already have closed.