India's finance ministry has asked banks to start work on a coordinated quantum-security transition and an artificial intelligence resilience framework, in a signal that policymakers are moving to harden the financial system against next-generation cyber risks, according to an official familiar with the discussions.
The directive comes as the banking industry increasingly warns of so-called "harvest now, decrypt later" attacks, in which cyber adversaries collect encrypted financial data today with the expectation that future quantum computers may be able to break current cryptographic protections. The concern is not theoretical: banks, payment firms and insurers handle vast volumes of sensitive customer records, transaction histories and authentication data that could remain valuable for years, even if they are not immediately exploitable.
The official, who did not wish to be identified, said the finance ministry has asked banks to assess their post-quantum vulnerabilities and begin mitigation measures. "Each bank can prepare its internal strategy, but there has to be some common industry parameters," the official said. That framing suggests the government wants a baseline approach across the sector, rather than a fragmented response in which larger institutions move faster while smaller lenders lag behind.
Quantum Risk Rising
Quantum computing remains an emerging technology, but its implications for banking are already being folded into security planning. Current public-key cryptography underpins digital banking, secure messaging, payment authentication and internal data protection. If quantum systems mature to the point where they can defeat widely used encryption methods, the consequences could extend far beyond data theft, potentially undermining trust in digital transactions and long-term record integrity.
For banks, the challenge is compounded by the long shelf life of financial data. Loan files, KYC records, account statements, insurance contracts and interbank communications may need to remain confidential for many years. That makes the "harvest now, decrypt later" threat especially acute: data stolen today may not be useful immediately, but it could become readable later if encryption standards are not upgraded in time.
The ministry's push indicates that India's financial authorities are treating quantum readiness as a strategic infrastructure issue, not merely an IT upgrade. A sector-wide transition would likely require banks to inventory cryptographic dependencies, identify vulnerable systems, test post-quantum algorithms and coordinate migration timelines with vendors, payment networks and regulators.
AI And Cyber Defence
The request for an AI resilience framework adds another layer to the policy response. Banks are increasingly deploying artificial intelligence for fraud detection, customer service, credit assessment and internal monitoring, but the same technologies can also be used by attackers to automate phishing, generate synthetic identities, probe systems at scale and evade conventional controls.
An AI resilience framework would likely need to address both defensive and offensive uses of the technology. That could include model governance, human oversight, data integrity checks, adversarial testing and controls to prevent manipulation of AI systems used in risk management or fraud screening. In a sector where speed and automation are central to operations, the resilience question is no longer limited to uptime; it now includes whether AI-driven systems can be trusted under attack.
The dual focus on quantum and AI underscores a broader shift in cyber policy. Regulators are no longer asking only whether banks can withstand today's malware or phishing campaigns. They are asking whether the sector can survive the cryptographic and machine-learning threats that may define the next decade.
Sector Coordination Needed
The emphasis on common industry parameters reflects a practical challenge: India's banking system is highly interconnected, and security weaknesses in one institution can ripple across the ecosystem. Payment rails, correspondent banking links, cloud services and third-party technology providers create shared exposure, meaning a piecemeal transition could leave gaps even if individual banks strengthen their own systems.
A coordinated approach would also help avoid duplication and reduce the cost of migration. Post-quantum cryptography is still evolving, and banks will need clarity on standards, implementation priorities and acceptable timelines. For smaller lenders and insurers, the transition could be expensive and technically complex, especially if legacy systems must be upgraded without disrupting customer-facing services.
The ministry's intervention is likely to accelerate internal planning across the sector, even if formal deadlines are not yet public. For now, the message is clear: India's financial institutions are being told to prepare for a future in which both quantum computing and AI may reshape the cyber threat landscape, and to do so in a way that is coordinated, measurable and resilient.
In practice, that means banks will need to move from awareness to inventory, from inventory to testing, and from testing to phased migration. The institutions that begin early will be better placed to protect customer data, preserve operational continuity and avoid a rushed transition later, when quantum threats are no longer a distant prospect but a compliance and security imperative.