The European Union’s three financial supervisors have added quantum computing to their autumn 2026 risk assessment, expanding regulatory attention on how banks, exchanges, and custodians prepare for future cryptographic threats.
The European Banking Authority, the European Insurance and Occupational Pensions Authority, and the European Securities and Markets Authority issued the assessment through their Joint Committee on September 23. Core findings had already reached the EU Economic and Financial Committee’s Financial Stability Table on September 10.
The update places quantum computing alongside two other major concerns: reliance on providers and infrastructure outside the EU, and rapid growth in private credit markets.
Why quantum risk matters for finance
Supervisors said quantum computing could transform several areas of finance, including process optimization, fraud detection, compliance monitoring, pricing, and financial simulations. Yet the same technology could weaken cryptographic systems that institutions use at scale to protect communications, transactions, databases, and blockchains.
The assessment does not claim that quantum computers can currently break Bitcoin, Ethereum, or modern financial encryption. Nor does it describe an active quantum attack on European financial infrastructure. Instead, it focuses on preparation for a potential technological shift.
‘Harvest now, decrypt later’ raises the stakes
A central concern is timing. The supervisors warned that quantum risks could emerge before commercially viable quantum applications become widely available, creating a security challenge before many firms gain practical economic benefits from the technology.
The threat also extends beyond future data. Attackers could collect encrypted information today and attempt to decode it years later when stronger computers become available—a method known as “harvest now, decrypt later.” Information intercepted now could therefore face future exposure if it retains financial or security value for many years.
Existing EU rules push cryptographic migration
European rules already provide a framework for dealing with emerging technology risks. The Digital Operational Resilience Act requires financial entities to use state-of-the-art cryptography against developing threats. The EU’s NIS Cooperation Group has also recommended that member states adopt a post-quantum cryptography migration strategy by the end of 2026.
The September risk update arrives during a broader push toward digital resilience. On September 23, ESMA also named digital innovation as a new supervisory priority beginning in 2027.
Bitcoin exposure illustrates the preparation gap
For blockchain networks, some exposure can already be measured. Glassnode reported in May that 6.04 million BTC had public keys visible on-chain, representing 30.2% of Bitcoin’s issued supply. Glassnode valued those coins at more than $469 billion at the time of its assessment.
According to the risk discussion, those visible public keys could become potential targets if a sufficiently advanced quantum computer gained the ability to defeat the cryptography protecting them. Such exposure would not necessarily require holders to make a new transaction.
Estimates for so-called Q-Day—the point when quantum computers could break cryptographic protections underpinning networks including Bitcoin and Ethereum—vary. The material cited ranges from 2030 to 2032 and later.
What it means for investors and custody providers
For investors, the September assessment does not change the status of existing holdings today. It does, however, change the standards against which exchanges, banks, and custodians can increasingly be measured.
Users can examine whether custody providers track post-quantum risks, maintain cryptographic migration plans, and explain how they intend to adapt security systems. Those checks rely on current provider practices rather than waiting for quantum technology to reach cryptographic-breaking capability.
Bottom line
EU supervisors now treat quantum computing as a financial security risk that requires preparation rather than immediate alarm. DORA and the 2026 migration timeline add pressure for stronger planning, while Bitcoin’s visible public-key exposure shows why crypto custodians must prepare before quantum capabilities mature.
