Quantum Bill and the financial sector: why banks and fintechs must act today

While the Italian bill on quantum technologies and the EU Quantum Act remain industrial policy initiatives, most cryptographic security obligations for banks and fintechs are already in force under DORA. An operational reading for CFOs and Compliance officers.

2026-06-04 — Studio LX20 Law Firm

The threat that quantum computers pose to current encryption systems is not a futuristic scenario: it is a risk that European and national supervisory authorities are already pricing in. For banks, payment institutions, and crypto-asset service providers, most of the relevant obligations do not depend on the approval of new quantum laws, but are already in force under DORA.

Why quantum is a regulatory issue today

The ability of quantum computers to compromise public-key encryption is not theoretical in the sense of being irrelevant. On sufficiently powerful hardware, Shor's algorithm can solve in polynomial time the integer factorization on which RSA is based and the elliptic-curve discrete logarithm problem on which ECC is based, both of which are widespread in the banking and financial sector today. The window within which this capability could become operational—estimated by multiple technical sources to be between five and fifteen years—is sufficient to justify preventive action, especially for data with a long useful life ("harvest now, decrypt later").

This technological trajectory is being met with an institutional response that is already underway: the NIST post-quantum cryptography standards, the European Commission's Recommendation for a coordinated transition roadmap (April 2024), and the work of the National Cybersecurity Agency (ACN) on quantum-safe.

On the standards front, in August 2024, NIST published the first three post-quantum standards, released on August 13, 2024, and effective the following day:

• FIPS 203 (ML-KEM) — key-encapsulation mechanism;
• FIPS 204 (ML-DSA) — lattice-based digital signature;
• FIPS 205 (SLH-DSA) — hash-based digital signature.

They are the technical reference available today for planning the migration, along with the equivalent standards that the European Union will eventually recognize.

National and European quantum laws: industrial policy, not cryptographic compliance

A recurring misconception must be clarified immediately. Legislative interventions dedicated to "quantum"—the Italian bill and the future European regulation—are centered on industrial policy, not on cryptographic security obligations for financial operators. Confusing the two leads to interpreting what is actually support for research, infrastructure, and the supply chain as "new obligations."

On the European level, in July 2025, the Commission adopted a *Strategy for a Quantum Europe*, structured around five action areas: research and innovation; infrastructure; strengthening the ecosystem and supply chains; dual-use technologies for space and defense; and skills. Furthermore, an EU Quantum Act is in preparation, with an open consultation and adoption planned for 2026, built around three objectives: promoting research and innovation; increasing industrial capacity (including pilot lines and a design facility); and strengthening supply chain resilience and governance. Neither of these instruments, at present, introduces a cryptographic inventory regime, binding migration plans, or penalties for banks and fintechs.

On the national level, the main bill on quantum technologies presented in the Senate has a similar promotional focus: support for research, financing for start-ups, training, and resources to make strategic infrastructures "quantum-safe." The text is evolving, and its regulatory content is not consolidated; any hypothesis of a mandatory inventory, binding plans, or revenue-based penalties should be treated as a direction of travel, not as current law.

The practical consequence is clear: the cryptographic security obligations already actionable for the financial sector do not stem from quantum laws, but from the framework on cybersecurity and operational resilience—DORA, NIS 2, and the Commission's Recommendation (April 2024). That is where compliance is at stake, today.

The intersection with the European framework: DORA, MiCA, NIS 2

The relevant question is not when a new quantum law will come into force, but which obligations are already actionable.

• DORA — Regulation (EU) 2022/2554. Applicable from January 17, 2025, it requires financial entities to have an ICT risk management framework that includes the identification and protection of information assets. The related regulatory technical standards (Delegated Regulation (EU) 2024/1774) detail controls on cryptography and key management, including the periodic assessment of the adequacy of algorithms. The inventory of cryptographic systems is therefore part of a current obligation, not a future one.
• MiCA — Regulation (EU) 2023/1114. Crypto-asset service providers (CASPs) are subject to obligations for the custody and safeguarding of crypto-assets and client funds (Articles 70 and 75), which presuppose robust security systems for the protection of cryptographic keys. The quantum threat is precisely the type of prospective risk that these safeguards must address.
• NIS 2. For entities within the scope of the NIS 2 Directive, transposed in Italy by Legislative Decree 138/2024 (following Legislative Decree 65/2018 implementing the first NIS Directive), the obligations for cyber risk management and adequate technical measures form the further framework in which post-quantum preparation is situated.
• DAC8 — Directive (EU) 2023/2226. It does not impose direct cryptographic obligations, but the integrity and confidentiality of data transmitted to tax authorities depend on the robustness of communication channels, which are also exposed to the 'harvest now, decrypt later' logic.
• Anti-Money Laundering. Suspicious transaction reports to the UIF (Financial Intelligence Unit) (Art. 35 et seq. of Legislative Decree 231/2007) are transmitted over infrastructures for which confidentiality and integrity are implicit prerequisites: these, too, fall prospectively within the scope of a quantum-safe assessment.

Operational implications: why act now

Waiting for the outcome of legislative processes before acting would be a managerial mistake, for three reasons.

1. DORA is already in force. The obligation to assess cryptographic risk within the ICT risk management framework is current: an intermediary that has not inventoried its systems is already potentially exposed during an inspection.
2. The technical timeline for migration is long. Replacing algorithms in a medium-complexity banking or fintech infrastructure typically takes between eighteen and thirty-six months. Those who start today will be aligned with any future deadline; those who wait risk having to adapt in an emergency.
3. Reputational risk precedes regulatory risk. Institutional clients, family offices, and international counterparties already include checks on cryptographic robustness in their due diligence. Being unable to present a post-quantum roadmap can become a commercial obstacle before it becomes a sanctionable one.

Checklist for CFOs and Compliance officers

• Mapping. Initiate an inventory of systems using RSA, ECC, or Diffie-Hellman, indicating the data processed and its lifecycle.
• 'Harvest now, decrypt later' risk. Identify data that, if exfiltrated today and decrypted in the future, would cause significant damage: customer data, signing keys, confidential communications.
• Suppliers. Verify the post-quantum update roadmaps of key technology suppliers (core banking, custody, payment gateways).
• Governance. Bring the issue to the management body with a dedicated information note, documenting the awareness of the strategic supervisory body.
• Legal. Review contracts with critical ICT suppliers to identify clauses on security updates and assess whether the post-quantum transition is covered.

Conclusion

The transition to post-quantum cryptography is not a niche technical project, but a component of the current compliance program. Read in conjunction with DORA, MiCA, and the NIS 2 regulation, it reveals a framework of obligations that are already actionable today, regardless of the timing and content of the upcoming national and European quantum laws. For CFOs, General Counsels, and Compliance Officers, the prudent approach is to treat post-quantum preparation as a current fulfillment, not a future deadline.

*This contribution is for informational purposes only and does not constitute legal advice. References to the Italian bill on quantum technologies and the EU Quantum Act relate to initiatives currently under review, the content of which may change: it is recommended to verify the texts in force at the time of any operational decision.*