PQC Migration for Banks: A CISO's Playbook

Banking sits at the intersection of every quantum threat vector: massive volumes of encrypted data in transit, long-lived financial records, stringent regulatory requirements, and nation-state adversaries with enormous resources. The India PQC Task Force has designated BFSI as a "Priority 1" sector -- the first sector that must complete its cryptographic inventory and begin post-quantum migration.

This playbook is for banking CISOs, CTOs, and security architects who need to translate the Task Force mandate into concrete, actionable steps for their institutions. It covers every major banking system -- from SWIFT messaging to UPI transactions to internet banking -- and provides a prioritized migration approach aligned with RBI's Cyber Security Framework.

Why Banking Is Priority 1

Three factors place banking at the top of the quantum risk priority list:

• Data sensitivity and shelf life: Banking records, KYC data, transaction histories, and financial statements have confidentiality requirements extending 10-30 years. This makes them prime targets for Harvest Now, Decrypt Later (HNDL) attacks.
• Transaction volume: Indian banks process over 10 billion digital transactions monthly through UPI alone. Each transaction involves multiple cryptographic operations -- key exchange, authentication, digital signatures, and encryption. The quantum attack surface is enormous.
• Regulatory exposure: RBI's CSF, SEBI's cyber resilience framework, IDRBT guidelines, and now the PQC Task Force mandate create a multi-layered compliance requirement. Non-compliance risks regulatory action, penalties, and reputational damage.

The Banking Quantum Attack Surface

A typical Indian bank's cryptographic estate includes these quantum-vulnerable systems:

• Core Banking System (CBS): Database encryption, inter-module communication, API authentication -- typically using RSA-2048 or ECDSA P-256
• SWIFT Alliance: Message authentication, key exchange, certificate-based authentication -- RSA and ECDSA based
• UPI/IMPS/NEFT/RTGS: Transaction signing, session encryption, API authentication -- RSA and ECC
• Internet Banking: TLS certificates, session management, OTP encryption, form encryption -- RSA key exchange
• Mobile Banking: App pinning certificates, API encryption, biometric data encryption, session tokens
• ATM Network: EPP key injection, PIN block encryption, terminal-to-host communication -- 3DES and RSA
• HSM Infrastructure: Master key management, PIN generation, transaction signing -- dependent on HSM PQC support
• Card Systems: EMV chip cryptography, tokenization, 3D Secure authentication

SWIFT & Interbank Communications

SWIFT communications represent the highest-priority migration target for most banks due to the sensitivity of interbank messages and the HNDL risk to financial transaction data.

Current State

SWIFT Alliance uses RSA-2048 and ECDSA for message authentication and key exchange. The SWIFT PKI infrastructure issues certificates with classical algorithms. Individual bank connections to SWIFT use TLS 1.2/1.3 with RSA or ECDH key exchange.

Migration Path

1. Immediate: Deploy hybrid TLS for SWIFT Alliance Gateway connections using ML-KEM + ECDH
2. Short-term: Work with SWIFT to test PQC-capable message authentication codes
3. Medium-term: Migrate SWIFT PKI certificates to hybrid ML-DSA + ECDSA certificates
4. Coordinate: Engage with SWIFT's PQC working group and correspondent banks on interoperability testing

UPI & Payment Systems

India's Unified Payments Interface processes billions of transactions monthly, making it one of the largest real-time payment systems globally. UPI's quantum vulnerability stems from its reliance on RSA and ECC for transaction signing and API authentication.

Key Concerns

• UPI transaction data includes account numbers, IFSC codes, amounts, and timestamps -- all with regulatory retention requirements
• The API authentication between banks and NPCI uses digital certificates with RSA/ECDSA
• Transaction signing mechanisms rely on classical algorithms
• Merchant QR code authentication uses ECDSA

Migration Approach

UPI migration requires coordination between individual banks and NPCI. Banks should begin by implementing hybrid encryption for UPI API communications and work with NPCI on PQC certificate migration timelines. QuantumVault's SDK can wrap existing UPI API calls with hybrid encryption as a transparent overlay.

Internet & Mobile Banking

Internet and mobile banking represent the most customer-facing quantum-vulnerable systems. Modern browsers (Chrome, Firefox, Edge) already support hybrid TLS with ML-KEM, making this one of the easiest migration targets:

1. TLS certificates: Issue hybrid certificates (ML-DSA + ECDSA) for internet banking domains
2. Key exchange: Enable ML-KEM + X25519 hybrid key exchange on load balancers and web servers
3. Session management: Upgrade session token signing to ML-DSA
4. API layer: Implement hybrid encryption for mobile banking APIs using QuantumVault SDK

RBI CSF Alignment

RBI's Cyber Security Framework (CSF) provides the regulatory foundation for PQC migration in Indian banking. Key CSF areas that map to PQC requirements:

• CSF 3.1 (Network Security): PQC migration for network encryption directly addresses this control. Hybrid TLS, VPN upgrades, and network segmentation with quantum-safe encryption.
• CSF 3.3 (Application Security): PQC-capable application encryption, API security, and session management align with application security controls.
• CSF 3.5 (Cryptography): The most directly relevant control. CSF 3.5 requires "strong encryption algorithms" and will be updated to mandate PQC per the Task Force timeline.
• CSF 4.1 (Risk Assessment): QERA directly satisfies the risk assessment requirement, adding quantum risk to the existing framework.
• CSF 6.1 (Vendor Management): Requiring PQC readiness from technology vendors aligns with vendor risk management controls.

QuantumVault's Compliance Dashboard maps your PQC migration status directly to RBI CSF controls, generating audit-ready evidence for regulatory examinations.

The 12-Month Migration Playbook

Months 1-3: Discovery

• Deploy QuantumVault Quantum Scanner across all environments
• Generate complete CBOM
• Conduct QERA with banking-specific risk scoring
• Form PQC Migration Steering Committee with CISO, CTO, Head of Digital, Head of Compliance
• Submit M1 compliance report to RBI

Months 4-6: Quick Wins

• Enable hybrid TLS on internet and mobile banking platforms
• Upgrade SWIFT Gateway TLS to hybrid mode
• Deploy QuantumVault SDK for new application development
• Begin HSM vendor engagement for PQC firmware updates
• Update procurement policies to require PQC readiness

Months 7-9: Core Systems

• Implement hybrid encryption for CBS inter-module communication
• Migrate internal CA to hybrid certificates
• Deploy crypto-agility framework for API gateway
• Begin UPI API hybrid encryption testing with NPCI
• Upgrade VPN and SSH infrastructure to PQC-capable configurations

Months 10-12: Validation & Compliance

• Conduct PQC interoperability testing across all channels
• Perform penetration testing of PQC implementations
• Generate M2 readiness report
• Submit compliance evidence to RBI
• Establish continuous monitoring and algorithm governance

Conclusion

PQC migration for banks is not optional and it is not a future consideration. The Task Force has designated BFSI as Priority 1 for a reason: banking data is the highest-value target for HNDL attacks, and the regulatory framework demands immediate action.

The good news is that the migration path is clear, the tools are available, and the standards are finalized. QuantumVault provides the complete platform to take your bank from discovery through compliance -- supporting every system from SWIFT to UPI to internet banking.

The cost of delay far exceeds the cost of migration. Start your QERA today.