Treasury Launches a Quantum-Readiness Task Force, and Vendor Assessment Is One of Its Three Pillars

The Treasury Department’s new Quantum-Readiness Task Force brings together government officials, financial institutions, market infrastructure operators, and technology providers to coordinate the financial sector’s shift to post-quantum cryptography. It builds directly on a roadmap the G7 Cyber Expert Group released in January 2026, co-chaired by Treasury and the Bank of England, which already called on financial institutions to inventory their cryptography, assess their most sensitive systems, build migration plans, and test quantum-resistant technology. That roadmap orients critical financial systems toward migration in the 2030 to 2032 range, with 2035 serving as a broader reference point drawn from existing national guidance, and it explicitly states it does not set regulatory expectations on its own.

The task force’s work splits into three areas:

The task force also names cryptographic agility, the ability to swap encryption methods as standards and threats evolve, as a goal it intends to actively promote across the sector, not just measure.

Most PQC policy so far has been written from the institution’s own vantage point: know your own cryptography, build your own migration plan, brief your own board. The vendor and third-party readiness stream is a meaningful shift, because it puts an official federal lens on a problem that has, until now, been left to each institution’s own third-party risk management program to figure out on its own terms.

That doesn’t mean a new rule or standard is imminent. It does mean the question of how to assess whether your fintech vendors are quantum-ready is no longer just a best practice institutions are encouraged to adopt independently. It is now explicitly on a federal task force’s agenda, alongside participants from financial institutions and technology providers who will be shaping how that assessment gets defined.

…a present-day risk control.

Deborah Guild, chair of the Financial Services Sector Coordinating Council and head of technology at PNC Financial Services Group, describing post-quantum readiness as no longer a matter of future-proofing.

That framing matters. A present-day risk control is not language reserved for things an institution can plan to address later. It’s the same posture examiners eventually apply to any other active risk category, and it’s a strong signal for where FFIEC and NCUA examination expectations are likely headed once formal guidance arrives.

Two more G7 documents followed the January roadmap since this piece was first published, an operational migration statement in June and a broader, all-sectors call to action in September, including a sharper warning about procurement eligibility for organizations that delay. We’ve covered that part separately, since it deserves its own space.

1. Jan 2026

   G7 Cyber Expert Group roadmap released

   Financial-sector specific. Orients critical systems toward 2030–2032, with 2035 as a broader reference point. Explicitly non-regulatory.

2. Jun 1, 2026

   G7 Cybersecurity Working Group migration statement

   The operational document: inventories, dependency mapping, phased plans, a named vendor and supply chain engagement team.

3. Jun 22, 2026

   Executive Order 14412 signed

   Sets deadlines for federal high value assets; covered in our earlier examiner brief.

4. Jun 24, 2026

   OMB M-26-15 issued

   Five-phase civilian migration framework running to 2035.

5. Aug 24, 2026

   Treasury Quantum-Readiness Task Force launched

   Public-private body; vendor and third-party assessment named as one of three core work streams.

6. Sep 3, 2026You are here

   G7 “Call to Action” published

   All seven G7 cyber agencies, widened to every sector, includes a procurement exclusion warning. Full detail in our dedicated post.

7. Mar 19, 2027

   CISA CBOM minimum elements due

   The standard for cryptographic inventories is expected to land, independent of this task force's own timeline.

8. 2027–2028

   FFIEC examination guidance expected

   This task force's output is a plausible input into what that guidance eventually says.

1. 01

   Don't wait for a formal standard to start assessing vendors. The task force's own charter treats vendor readiness as an active work stream, not a settled question, which means institutions building their own assessment process now are building ahead of the standard, not behind it.

2. 02

   Add this to board-level PQC briefings. A named federal task force with sector executives at the table is a stronger, more concrete talking point than a general reference to regulatory direction.

3. 03

   Watch for task force output, not just the launch announcement. The real substance, whatever framework or expectations eventually emerge for vendor assessment, will follow this initial announcement, likely over the next several quarters.