G7 Central Banks' First Quantum Report Warns of 'Harvest Now, Decrypt Later' Risk and Calls for Preparation, While Stating It Gives No Operational Recommendations

On June 11, 2026, the Bank of Canada announced that a group of G7 central banks had published a report on quantum technologies and the financial system. The report, titled Preparing for Quantum Technologies: Key Considerations for Financial Sector Participants, is the first public deliverable of the G7 Central Bank Quantum Technologies Working Group. The report itself is dated May 2026 and is hosted by the Banque de France. This article uses the Bank of Canada's announcement and the report. The dates above are those shown by the sources.

Who is behind it

The working group was established in 2025. It is co-chaired by the Banque de France and the Bank of Canada, and its other members are the Deutsche Bundesbank, the Bank of England, the Banca d'Italia, the Bank of Japan, the Federal Reserve Board and the European Central Bank. Its stated purpose is to analyse the economic, financial and institutional implications of quantum technologies and to support dialogue among public authorities, financial institutions and technology stakeholders.

What kind of document it is

The report is deliberately modest in what it asks. The announcement describes it as institutional, analytical and non-prescriptive, with no operational recommendations, and the report itself says it does not anticipate regulation or prescribe actions. It gives a shared analytical framework and maps the landscape, including challenges, uncertainties and key questions. It builds on G7 central bank research, experiments and exchanges with academic and technology communities and says it will be updated as the group's work continues. It is therefore not a rule or a supervisory expectation. That distinction matters for firms wondering whether they have a new compliance obligation: on the evidence of these documents, they do not.

The security concern

The report's most concrete worry is about cryptography. Much of the encryption that protects digital communications, payments and financial data relies on mathematical problems that a sufficiently powerful quantum computer could solve. The report says no cryptographically relevant quantum computer exists yet. It cites expert assessments that put a non-negligible probability on one emerging within the coming decade, with estimates varying widely, and it gives no specific probability or date. The Bank of Canada's announcement likewise says the timing is uncertain while the potential impact is well understood.

The report highlights a threat known as harvest now, decrypt later. An attacker can copy encrypted data today and store it, planning to decrypt it once a capable quantum computer exists. Data that must stay confidential for decades is therefore at risk even though no quantum computer can break the encryption yet. The report adds that digital signatures could be affected over time, with possible consequences for tokenised assets, digital identity and distributed ledger systems.

Moving to new cryptography

The report notes that the U.S. standards body NIST has standardised several post-quantum cryptography schemes for key establishment and signatures. It stresses that migration is not a simple swap. It involves taking an inventory of cryptographic dependencies, testing compatibility, coordinating with counterparties and vendors, and building cryptographic agility, meaning the ability to change algorithms without rebuilding systems. There are trade-offs, including performance, larger keys and signatures, integration with older systems and interoperability during long transition periods. It also describes complementary approaches, including distributed symmetric key exchange and quantum key distribution, and says no single approach is universal.

The report points to a separate, earlier document: the G7 Cyber Expert Group published a quantum readiness roadmap in January 2026. According to a law-firm summary of that statement, it was published on January 13, 2026 by HM Treasury, is high-level and non-binding, sets out a phased approach covering awareness, inventory, risk assessment, migration and ongoing testing, and notes that many jurisdictions cite 2035 as the overall full-migration target, with the most important systems ideally upgraded around 2030 to 2032. The central bank report itself, as summarised here, does not set dates.

Opportunities in finance

The report is not only about threats. It says quantum computing may help with optimisation, simulation, sampling and risk analysis, and that it is best viewed as a specialised accelerator, similar to the way graphics processors are used. Possible uses include portfolio optimisation, pricing and risk modelling in markets, liquidity optimisation and anomaly detection in payments, and macroeconomic and financial stability modelling at central banks. The report is blunt about the present: applications are experimental, and classical methods still outperform quantum approaches in most practical settings. It adds that quantum-inspired methods can already run on conventional hardware.

Governance and system-level risks

The report raises several risks that go beyond cryptography. Reliance on a small number of providers, software stacks or hardware architectures could create correlated risks such as outages or supply-chain disruption. Advanced techniques may be hard to explain or validate, which challenges supervision and accountability. Adoption is likely to be uneven across institutions and countries, and skills are scarce. The Bank of Canada also notes that uneven preparedness across interconnected institutions could create system-wide vulnerabilities, which is why it says coordination matters.

The message from the Governor

Bank of Canada Governor Tiff Macklem said that, with continuing advances in quantum computing, the window to being quantum-ready is narrowing. He said the report reflects collective efforts to improve understanding and promote preparedness. The announcement gives no deadlines.

What it means

For banks, insurers and market infrastructure, plausible first steps, drawn from the issues the report raises rather than from any instruction in it, are to know where cryptography is used, identify data with long confidentiality needs, ask vendors about their plans and follow the standards work. For ordinary customers, nothing changes today, and the report does not suggest that accounts are at immediate risk. Whether and when a quantum computer capable of breaking current encryption will be built remains uncertain, and this article does not predict it. Readers who need the detail should read the report and the Bank of Canada announcement. This article is general information and not security advice.