Fintech Regulatory Brief
New Industry Data Places Finance at “Planning” for Post-Quantum Readiness, Not “Deployment”
September 11, 2026 · PQCClear · 5 minute read
A new industry maturity model, presented this week by an IBM quantum-safe networks lead, places financial services squarely in the planning stage of post-quantum readiness, ahead of most sectors, but not yet deployed. The more useful detail is a few rows down, and it’s a warning smaller institutions shouldn’t skip past.
At the Newton-Q 2026 workshop, hosted this week by Newcastle University, Zygmunt Łoziński, IBM’s lead for Quantum-Safe Networks and a co-founder of the GSMA Post Quantum Telco Network Task Force, presented an industry maturity model mapping sectors across two dimensions: the scale and structure of their infrastructure, and how far along they are in post-quantum migration. It is a useful, credible snapshot from someone who works across this exact problem for a living, not a formal published study, but a practitioner’s current read on where the world actually stands.
Where Finance Sits, and Why That’s Genuinely Good News
The model splits industries into two rows by infrastructure scale, sectors with smaller, more centralized systems (tens to thousands), and sectors with large, distributed footprints (hundreds of thousands to millions), and three columns by readiness stage: no readiness, planning, and deployment. Financial services lands in the centralized row, in the planning column. Not behind, not finished.
That is a meaningful, independent confirmation of something worth knowing plainly: the financial sector broadly is already moving, ahead of most industries mapped in the same model. If you needed a credible third-party signal that this isn’t a problem the sector can still treat as distant, this is a clean one, from someone with no reason to oversell urgency.
Why Finance Sits at “Planning,” Not “Deployment”
Łoziński’s own explanation, shared alongside the model, is worth more than the chart itself. He describes financial services as genuinely fragmented, not one coordinated effort but several separate ones running in parallel: central banks, regulators, payment networks, and retail banks, each working through post-quantum migration largely on their own terms. That is a meaningfully different situation from telecom, which he notes is standards-driven enough that a comparatively small number of bodies, GSMA, 3GPP, and NGMN, can set direction for the whole sector at once.
Finance doesn’t have that kind of single lever. No comparable body sets one direction that every bank, processor, and network simply adopts. Progress happens institution by institution and vendor by vendor, which is exactly why the sector shows up as planning rather than deployed, and exactly why a sector-wide label can’t tell you much about where any single institution actually stands.
The Detail That Actually Matters for Smaller Institutions
| Infrastructure scale | No readiness | Planning | Deployment |
|---|---|---|---|
| Centralized, smaller scale | Aviation, oil and gas, pharma | Finance, telecom, government | Mobile, cloud, web |
| Distributed, massive scale | Energy, healthcare, SME, OT/ICS | N/A | N/A |
If a fragmented sector is what planning actually looks like even among large, centralized institutions, that fragmentation only gets more pronounced further down. Look at where SME, small and medium-sized enterprises, actually sits in the model. Not next to finance. It is placed in the distributed, massive-scale row, in the no-readiness column, the same bucket as sectors that haven’t meaningfully started at all.
That is not a contradiction in the model. It is the model being consistent with its own logic. A community bank or credit union, smaller, more distributed in its footprint, more dependent on third-party vendors and platforms, may have far more in common with the SME row than with the large, centralized institutions actually driving finance’s placement at planning.
Your sector’s headline maturity stage is not your institution’s maturity stage.
What This Actually Means, Practically
01Don’t let sector-level reassurance substitute for institution-level assessment.
“Finance is planning” is true in aggregate. Whether your institution specifically has an inventory, a migration plan, and a vendor assessment program is a separate question with its own separate answer.
02If your institution leans heavily on vendors, weight that in your own self-assessment.
The more distributed and vendor-dependent your actual footprint, the more the SME row of this model may describe your real exposure better than the finance row does.
03Use this as a board-level talking point, not a source of comfort.
“Our sector is ahead of most industries, and here is how we specifically compare within it” is a stronger, more credible line than either panic or false reassurance.
Know where your institution actually stands, not just your sector
PQCClear helps banks, credit unions, and payment processors assess their own vendor portfolio’s quantum readiness directly, rather than relying on sector-wide averages that may not reflect their real exposure.
Request accessThis post represents the editorial analysis of PQCClear as of September 11, 2026. It should not be construed as legal or regulatory advice.
Key sources: Zygmunt Łoziński, IBM, “Making the World’s Networks Quantum Safe,” presented at Newton-Q 2026, University of Newcastle (September 10 to 11, 2026); Zygmunt Łoziński, LinkedIn post elaborating on the talk (September 2026). The maturity model and reasoning discussed are the author’s own original analysis and are described here, not reproduced.