India's finance ministry has asked banks to start building a coordinated transition plan for the quantum era while also strengthening their defences against artificial intelligence-driven cyber risks, according to an official familiar with the discussions. The directive signals that policymakers are no longer treating quantum computing as a distant theoretical issue, but as a strategic security challenge that could affect the confidentiality of banking data, payment systems and long-term customer records.
Quantum Risk Grows
The central concern is the emerging threat commonly described in industry circles as "harvest now, decrypt later." Under this scenario, cyber adversaries intercept and store encrypted banking information today, even if they cannot read it immediately, with the expectation that future quantum computers may be able to break widely used cryptographic protections. For banks, that creates a particularly serious exposure because financial records, identity data, transaction histories and interbank communications often have long retention periods and high value over time.
The official said the finance ministry has asked banks to assess their post-quantum vulnerabilities and begin mitigation measures. That includes identifying where legacy encryption is embedded across core banking systems, digital channels, cloud environments, vendor networks and archived data repositories. The challenge is not limited to replacing algorithms. It also involves inventorying cryptographic dependencies that are often hidden deep inside software stacks, hardware security modules and third-party applications.
The request comes as the financial sector globally begins to confront the possibility that quantum computing could eventually undermine current public-key cryptography, which underpins secure logins, digital signatures, payment authentication and confidential communications. While large-scale quantum machines capable of breaking modern encryption are not yet commercially available, the risk profile is already changing because data stolen now may remain sensitive for years.
Industry Coordination Needed
The ministry's approach appears to favour a common framework rather than a purely bank-by-bank response. "Each bank can prepare its internal strategy, but there has to be some common industry parameters," the official said. That is significant because the banking system depends on interoperability: payment rails, messaging standards, settlement networks and vendor ecosystems all require shared technical assumptions. If institutions move at different speeds or adopt incompatible security upgrades, the result could be operational fragmentation rather than resilience.
A sector-wide transition would likely need coordination across commercial banks, payment companies, technology vendors and regulators. It may also require phased adoption, since replacing cryptographic infrastructure in a live banking environment is complex and costly. Banks must preserve service continuity while upgrading systems that support millions of daily transactions. In practice, that means the transition cannot be handled as a one-time software patch; it will need governance, testing, procurement changes, staff training and long-term monitoring.
The finance ministry's emphasis on common parameters also suggests an effort to avoid a patchwork response in which larger institutions move ahead while smaller lenders lag behind. Smaller banks and niche financial firms may face greater difficulty in mapping their cryptographic exposure or funding a full transition. A shared framework could help standardise risk assessments, timelines and minimum controls, while still allowing individual institutions to tailor implementation to their own systems.
AI Resilience Also In Focus
Alongside quantum preparedness, the ministry has asked banks to develop an AI resilience framework, reflecting a second major shift in the threat landscape. Financial institutions are increasingly using AI for fraud detection, customer service, underwriting and compliance, but the same technology can also be used by attackers to automate phishing, generate synthetic identities, manipulate documents and probe systems at scale. Banks are therefore being pushed to defend not only against conventional cyberattacks, but against adversaries that use machine learning to increase speed, precision and persistence.
An AI resilience framework would likely cover model governance, data integrity, human oversight, adversarial testing and controls over automated decision-making. It may also need to address the risks of over-reliance on AI tools in fraud screening and customer verification, where false positives can disrupt legitimate transactions and false negatives can allow abuse to pass through.
The dual focus on quantum and AI underscores a broader policy shift: cybersecurity in finance is moving from perimeter defence to anticipatory resilience. Rather than waiting for a disruptive technology to mature, regulators and banks are being asked to prepare for the security implications now. That is especially important in a sector where trust is foundational and where even a limited compromise of encryption or automated controls could have systemic consequences.
For India's banking industry, the message is clear. The next phase of cyber preparedness will not be limited to patching vulnerabilities after they emerge. It will require a coordinated, forward-looking redesign of the security architecture itself, with quantum-safe encryption and AI resilience emerging as core priorities rather than optional upgrades.