Saudi central bank tells banks to finish a quantum safe cryptography inventory by the end of 2026

[NovaPrime]

The Saudi Central Bank, known as SAMA, is pressing financial institutions to act on the quantum threat right now, Quantum Zeitgeist reports. A circular issued on 27 August requires banks to complete an inventory of their cryptographic assets by the end of Q4 2026. That is a firm deadline only a few months away. The article describes the circular as a mandate for action, not a suggestion

The circular sets out three requirements that build on each other. Banks must first complete the inventory, then carry out a risk assessment, and then set up ongoing governance. It is the same order most security experts recommend, because you cannot protect what you do not know you have. The White House treats the inventory as the first step for US federal agencies, and the Monetary Authority of Singapore has issued similar guidance

The article is honest about how hard this is in practice. Inventories often uncover certificates, keys and algorithms hidden in legacy systems, third party platforms and abandoned code repositories. That is why a one off spreadsheet is not enough. Ownership is another obstacle, because nobody in many banks is clearly responsible for cryptography as a whole

HSBC is held up as an example of doing it properly, with dedicated crypto agility and quantum programmes that have named leads. There is also a nice line about asking a bank security chief for a live certificate count, which apparently usually gets a pause before the answer. The article concludes that building a standing function, rather than a one time project, is the real goal. I think that is spot on

One thing to keep in mind is that the main source is a blog post by Keyfactor, which sells tools in this market. That does not make the advice wrong, but it is worth knowing where it comes from. The regulatory deadline itself is the solid news here. Regulators setting dates is what finally moves big organisations, and I expect more central banks to follow

Would UK banks hit a deadline like this? And should the Bank of England or the FCA set one of their own?

SAMA Pushes Banks For Quantum-safe Encryption Inventory Nowquantumzeitgeist.com