India's finance ministry has asked banks to start work on a sector-wide quantum transition and an artificial intelligence resilience framework, signalling that the government wants the financial system to prepare early for a new generation of cyber risk, according to an official familiar with the discussions.
The directive comes as policymakers and industry executives increasingly worry about so-called "harvest now, decrypt later" attacks, in which cyber adversaries steal encrypted data today and store it for future decryption once quantum computers become powerful enough to break widely used cryptographic systems. In banking, that threat is especially serious because transaction histories, customer credentials, payment records and other sensitive data often have long shelf lives and high intelligence value.
The official, who asked not to be identified, said the ministry has urged banks to assess their post-quantum vulnerabilities and begin mitigation measures. "Each bank can prepare its internal strategy, but there has to be some common industry parameters," the official said, underscoring the need for coordination across lenders rather than a fragmented, institution-by-institution response.
Quantum Risk Rising
The warning lands at a time when the global financial sector is beginning to confront the practical implications of quantum computing. While large-scale quantum machines capable of breaking modern encryption are not yet commercially available, security planners say the migration problem cannot wait until the threat is fully realised. The reason is simple: once encrypted data is captured, it can remain useful for years, especially in banking, where records may need to be retained for compliance, audit and dispute resolution.
Industry experts have long argued that financial institutions are among the most exposed sectors because they depend heavily on public-key cryptography for secure communications, digital signatures, authentication and key exchange. If those systems are eventually undermined, the impact could extend beyond customer privacy to payment infrastructure, interbank messaging, digital lending platforms and insurance data flows.
The ministry's push suggests that India wants banks to begin mapping where cryptographic dependencies exist, how deeply they are embedded in legacy systems, and which applications would require the earliest upgrades. That kind of inventory is often the first step in a post-quantum migration, but it is also one of the most difficult, given the complexity of large banking technology stacks and the use of third-party vendors across core systems, mobile apps and cloud services.
AI And Cyber Resilience
Alongside quantum preparedness, the ministry has also asked banks to develop an AI resilience framework, reflecting another fast-moving risk area. Artificial intelligence is increasingly being used by both defenders and attackers: banks are deploying it for fraud detection, customer service and anomaly monitoring, while criminals are using it to automate phishing, impersonation, malware development and social engineering.
An AI resilience framework would likely require banks to assess how AI tools are trained, deployed and monitored, and how they respond to model manipulation, data poisoning, prompt injection and other forms of adversarial abuse. It would also need to address governance questions, including human oversight, auditability and accountability when AI systems influence credit decisions, fraud flags or security alerts.
For regulators and policymakers, the challenge is to ensure that the financial system can benefit from AI without becoming more brittle. That is particularly important in India, where digital banking adoption has surged and where the scale of retail transactions leaves little room for systemic weaknesses. A failure in one institution's AI controls can quickly become a broader trust issue if it affects payments, customer access or fraud response.
The ministry's request for common industry parameters indicates that officials do not want banks to invent incompatible standards. A shared framework could help lenders align on cryptographic migration timelines, testing protocols, vendor requirements and incident-response expectations. It could also make it easier for regulators to compare preparedness across institutions and identify gaps before they become operational risks.
Sector-Wide Migration Ahead
The likely next phase will involve detailed assessments by individual banks, followed by industry coordination on standards and sequencing. Smaller lenders may need support to modernise systems that were never designed with quantum-era threats in mind, while larger banks may be expected to lead pilot migrations and set reference models for the market.
The broader message from the ministry is that cyber resilience can no longer be treated as a narrow IT issue. In the coming years, it will increasingly be a strategic balance-sheet concern, tied to customer trust, regulatory compliance and the stability of India's digital financial architecture. By asking banks to prepare now, the government is effectively trying to compress what could otherwise become a disruptive and expensive emergency transition into a managed, sector-wide upgrade.
For the banking, fintech and insurance ecosystem, the instruction is a clear signal: the next wave of cyber preparedness will not be limited to stronger passwords or better firewalls. It will require a fundamental rethink of how data is encrypted, how AI is governed, and how quickly the financial system can adapt to technologies that are still emerging but already reshaping the risk landscape.