Financial services firms need to map their cryptography now, Andrew Gault argues, because the systems that move money and verify identities are exposed to post-quantum risk. NIST finalized its first post-quantum cryptography standards in 2024, and Gault says the response starts with crypto-agility rather than a wholesale rewrite.
Andrew Gault and ZeroTier
Gault, the CEO of ZeroTier, wrote that the financial services industry depends on cryptography to move money, protect customer and transaction data, verify digital identities, and connect banks with processors, cloud providers, and other third parties. He said a sufficiently capable cryptographically relevant quantum computer, or CRQC, will be able to break much of the public-key cryptography that protects those functions, exposing sensitive data, disrupting trusted communications, and undermining the digital signatures financial systems rely on.
He also warned that adversaries can collect encrypted financial and personal data today and attempt to decrypt it later, a practice known as “harvest now, decrypt later” or HNDL. That risk starts before Q-Day, because data gathered and stored now can still be valuable after stronger quantum tools arrive.
NIST and White House Executive Order 14412
The pressure on institutions increased as the White House issued Executive Order 14412 in June 2026, directing the transition of federal information systems to NIST-approved post-quantum cryptography standards. In August 2026, the U.S. Treasury announced a Quantum-Readiness Task Force to identify critical dependencies, improve cryptographic agility, and address third-party implementation challenges.
Gault defined crypto agility as a system or organization’s ability to adapt cryptographic algorithms and standards as threats, technology, and regulatory expectations change, without repeatedly replacing major hardware or rewriting critical applications. In his framing, that is the practical difference between a one-time upgrade and a transition that can be managed across systems, vendors, and policy changes.
QBOM and third parties
His guidance points institutions toward a cryptographic bill of materials, or QBOM, that shows where cryptography is used across the institution and its external connections. That review should separate data at rest from data in transit, and it should pay particular attention to data moving between applications, branches, cloud environments, and external services.
One complication is that older protocols may still be allowed even when a system supports stronger cryptography. That leaves room for a downgrade attack, in which an attacker can force a weaker connection and bypass the stronger option already in place.
The Citi Institute’s quantum-readiness guidance follows a sequence of identifying exposure, prioritizing critical systems and long-lived data, enabling crypto-agility, and managing the migration over time. For financial services firms, the work is less about waiting for Q-Day than about inventorying what must change before that day arrives.
