India's finance ministry has asked banks to begin work on a sector-wide quantum transition and to frame an artificial intelligence resilience strategy, underscoring the mounting cybersecurity pressure on the financial system as both quantum computing and AI reshape the threat landscape.
The direction, according to an official who did not wish to be identified, comes amid rising concern over so-called "harvest now, decrypt later" attacks, in which cyber adversaries collect encrypted banking data today with the expectation that future quantum systems could break current cryptographic protections. For a sector that handles vast volumes of sensitive customer, transaction and settlement data, the risk is not theoretical. It raises the possibility that information considered secure under present standards could become exposed years later if institutions fail to migrate to quantum-resistant encryption in time.
Quantum Risk Grows
The official said the finance ministry has asked banks to assess post-quantum vulnerabilities and begin mitigation measures. The emphasis, he added, is not merely on internal preparedness but on a coordinated industry response. "Each bank can prepare its internal strategy, but there has to be some common industry parameters," the official said.
That framing is significant because banking infrastructure is deeply interconnected. Payment rails, clearing systems, correspondent banking links, cloud services, vendor ecosystems and regulatory reporting channels all depend on shared technical assumptions. If one institution moves faster than another, or if different banks adopt incompatible cryptographic migration paths, the result could be operational fragmentation rather than stronger security. A common baseline would help reduce that risk and make it easier for regulators, vendors and lenders to align on timelines, testing and implementation.
The push also reflects a broader shift in cybersecurity planning. Traditional security programs have focused on defending against immediate intrusions, ransomware and data theft. Quantum readiness adds a longer horizon: institutions must now think about the lifespan of encrypted records, the durability of digital signatures and the possibility that today's secure archives may become tomorrow's liabilities. That is especially relevant for banking, where records often need to remain protected for long periods because of compliance, audit and dispute-resolution requirements.
AI Adds New Pressure
Alongside quantum preparedness, the ministry has asked banks to work on an AI resilience framework, signalling that policymakers are treating artificial intelligence as both a tool and a threat. Banks are increasingly using AI for fraud detection, customer service, credit analysis and compliance monitoring, but the same technology can also be used by attackers to automate phishing, generate convincing impersonation attempts, probe systems at scale and adapt malware more quickly than human defenders can respond.
An AI resilience framework would likely need to address model governance, data integrity, human oversight, vendor risk and incident response. It would also need to consider how banks verify the reliability of AI outputs, prevent manipulation of training data and ensure that automated systems do not amplify errors during periods of stress. In a sector where trust is central, even small failures in AI-driven decision-making can have outsized consequences.
The ministry's move suggests that India is preparing its financial sector for a more complex security environment in which quantum and AI risks are converging. The challenge is not only to upgrade technology, but to do so in a coordinated way that preserves interoperability across the industry. That will require investment, technical guidance and likely a phased roadmap that allows banks of different sizes to transition without disrupting core services.
For now, the message from policymakers is clear: banks cannot wait for quantum computers to become commercially disruptive before acting, and they cannot treat AI security as a separate issue. The two are increasingly part of the same resilience agenda, and the sector is being asked to prepare accordingly.