India's finance ministry has asked banks to start work on a coordinated transition toward quantum-resistant cybersecurity, while also building an artificial intelligence resilience framework for the financial system, an official said, underscoring the rising urgency around next-generation digital threats.
The direction comes as policymakers and industry participants increasingly worry about so-called "harvest now, decrypt later" attacks, in which cyber adversaries steal and store encrypted data today with the expectation that future quantum computing capabilities could break current cryptographic protections. In banking, that threat is especially sensitive because financial institutions hold vast volumes of payment data, customer identities, transaction histories and interbank communications that must remain secure for years, not merely months.
The official, who declined to be identified, said the finance ministry has asked banks to assess their exposure to post-quantum vulnerabilities and begin mitigation measures. "Each bank can prepare its internal strategy, but there has to be some common industry parameters," the official said, indicating that the government wants the sector to move in a more coordinated fashion rather than through isolated institution-by-institution responses.
Quantum Risk Grows
The warning arrives at a time when India's banking and payments ecosystem is deeply digitised and highly interconnected. Core banking systems, mobile payments, card networks, cloud-hosted services and third-party technology vendors all expand the attack surface. That connectivity is a strength for efficiency and inclusion, but it also means that a weakness in one institution can cascade across the broader financial architecture.
Quantum computing remains an emerging technology, but its long-term implications for cryptography are widely regarded as profound. Current public-key encryption methods underpinning secure banking communications, digital signatures and authentication protocols could eventually become vulnerable once sufficiently powerful quantum machines mature. Even if that capability is not imminent, the risk is not purely theoretical because sensitive data stolen today may retain value for years.
For banks, the challenge is not simply replacing algorithms. A quantum transition requires inventorying where cryptography is used across legacy systems, payment rails, vendor integrations, mobile applications, hardware security modules and archival data stores. It also requires testing new post-quantum cryptographic standards, ensuring interoperability and avoiding operational disruptions in a sector where even minor technology changes can affect millions of transactions.
AI Adds New Pressure
The ministry's parallel focus on AI resilience reflects another fast-evolving risk. Banks are increasingly deploying artificial intelligence in fraud detection, customer service, underwriting, compliance monitoring and internal operations. But the same tools can be manipulated through adversarial attacks, model poisoning, synthetic identity fraud and deepfake-enabled scams.
That makes AI resilience a governance issue as much as a technology issue. Financial institutions must not only secure the data feeding AI systems, but also ensure that automated decisions remain explainable, auditable and resistant to manipulation. In a sector where trust is central, a failure in AI controls could quickly become a reputational and regulatory problem.
The ministry's request suggests that policymakers are thinking beyond isolated cyber incidents and toward systemic preparedness. A common framework could help banks align on minimum standards for quantum-safe migration, AI model governance, incident response, vendor oversight and data protection. It could also reduce fragmentation, which is a recurring challenge in large financial systems where institutions vary widely in size, technical maturity and risk appetite.
Industry executives are likely to view the directive as both a warning and an early planning signal. Quantum-safe migration is expected to be expensive and technically complex, especially for older systems that were not designed with cryptographic agility in mind. Smaller banks and financial firms may struggle to absorb the cost without shared guidance, pooled expertise or phased implementation timelines.
Still, the ministry's intervention indicates that the government wants the sector to begin now rather than wait for a crisis. In cyber security, delayed preparation can be costly because infrastructure upgrades, testing and staff training take time. The message from policymakers is clear: the financial system must prepare for a future in which both quantum computing and AI reshape the threat landscape, and it must do so in a coordinated way that protects customers, payments and market confidence.