As financial institutions prepare for a potential the ability to rapidly adapt cryptographic systems is becoming as vital as the strength of those systems themselves. Money20/20 USA 2026 is being positioned as a key event for vetting vendor claims of solutions, with enQase outlining a four-part framework, Identify, Protect, Govern and Adapt, to assess genuine crypto-agility. The company frames true agility as being able to achieve a non-disruptive transition for long-term security, enQase says. This shift, they argue, is a lasting capability for an evolving threat landscape, not a one-time project.
enQase Framework: Identify Crypto Assets & Harvest Now Risk
The enQase framework centers on a four-part approach, Identify, Protect, Govern and Adapt, designed to address the escalating threat of quantum computing to financial institutions and their data. Recognizing that banks, processors, and fintechs maintain sensitive information for years, the framework prioritizes a shift from one-time cryptographic projects to a repeatable, ongoing process. This proactive stance acknowledges that the transition to post-quantum cryptography will not be a singular event, but rather a lasting capability necessary for navigating an evolving threat landscape.
A key component of the framework is the assessment of “Harvest Now, Decrypt Later” attacks, a scenario where encrypted data is collected with the intention of decrypting it once sufficiently powerful quantum computers become available. According to the company, this risk is no longer an abstract concern, but a present danger for systems holding long-lived sensitive data.
Mosca’s theorem underpins this urgency; if data’s required secrecy exceeds the time needed for migration plus the anticipated arrival of practical quantum attacks, a vulnerability exists immediately. A robust quantum risk assessment, enQase claims, applies this principle to an institution’s specific systems to prioritize remediation efforts. The enQase platform itself combines cryptographic inventory, risk prioritization, centralized governance and crypto-agile encryption into a single system. It aims to identify cryptographic assets and systems vulnerable to quantum attacks, map those vulnerabilities to business risks, and facilitate migration to NIST-standardized post-quantum algorithms.
This is achieved through flexible encryption controls integrated with existing infrastructure. Organizations evaluating the platform are encouraged to assess how its capabilities align with each of the four pillars: Identify, Protect, Govern, and Adapt.
The “Identify” pillar focuses on cryptographic discovery and quantum risk assessment, while “Protect” centers on NIST-aligned post-quantum cryptography and entropy strength. “Govern” emphasizes compliance-focused reporting and continuous readiness evidence, and “Adapt” highlights policy-driven crypto-agility management and performance planning. Crypto-agility, the framework explains, is an organization’s ability to update and replace cryptographic algorithms, keys and protocols without extensive application rewrites or business disruption.
The analogy of replacing every lock in a large office building while employees continue working illustrates the ideal outcome: a non-disruptive transition despite significant underlying changes. The framework explicitly distinguishes crypto-agility from cryptocurrency, clarifying that it concerns the algorithms protecting data, applications and transactions, and has no relation to digital assets or blockchain investments.
The company suggests that organizations should begin planning for the post-quantum transition now, citing draft NIST guidance indicating quantum-vulnerable cryptography will be deprecated after 2030 and disallowed after 2035, according to enQase. “Organizations should begin now,” the company states, emphasizing the importance of a clear post-quantum migration roadmap to maintain realistic timelines. The framework’s developers believe institutions that treat quantum security as an ongoing program, built on the four pillars of Identify, Protect, Govern, and Adapt, will be best prepared for future challenges. The company asserts, framing a lasting capability as essential for long-term security.
Crypto-Agility: Policy-Driven Algorithm Replacement, Not Rewrites
The company emphasizes that a robust evaluation requires consistent criteria, suggesting a scoring system weighted most heavily toward discovery, standards support, and algorithm replacement capabilities. Medium weighting should be assigned to prioritization, hybrid cryptography, infrastructure integration, compliance reporting, ongoing monitoring, performance and entropy management, allowing for a review across the four pillars of their framework.
A core distinction lies in the approach to implementation; enQase advocates for policy-driven algorithm selection and centralized administration, enabling configuration-based updates with rollback capabilities, rather than application-by-application rewrites, the firm reports. This method, they contend, directly impacts future migration costs, staffing requirements and operational disruption, offering a significant advantage over solutions reliant on custom consulting projects or lacking a centralized policy engine.
This is fundamentally different than cryptocurrency, which concerns digital assets, tokenization, or blockchain investments. “A cryptographic inventory for banks is the foundation of any crypto-agility strategy,” the company asserts, highlighting the primacy of knowing where cryptography currently resides within an organization’s infrastructure. Performance considerations are also central to a successful implementation, as post-quantum keys and signatures are generally larger than their classical counterparts, potentially slowing down payment transactions.
However, enQase suggests that a well-designed implementation can minimize latency through careful algorithm selection, testing and architecture planning, emphasizing the importance of benchmark data for quantum-safe payments. The company’s platform aims to address this through its capabilities within the “Protect” pillar, which focuses on NIST-aligned post-quantum and hybrid cryptography, alongside integration with existing infrastructure and entropy strength.
NIST Standards: ML-KEM, ML-DSA, and Future Adoption Roadmaps
Support for the NIST FIPS 203 ML-KEM, FIPS 204 ML-DSA and FIPS 205 SLH-DSA standards is a key indicator of a vendor’s preparedness for the post-quantum era, as these algorithms represent the agency’s initial selections for public-key cryptography. Beyond current support, a documented roadmap for the inclusion of Hamming Quasi-Cyclic (HQC) algorithms signals a commitment to adapting to evolving standards, as the ongoing refinement of post-quantum cryptographic techniques requires flexibility. Vendors lacking such a roadmap, or relying on outdated draft standards, may present significant long-term risks for organizations seeking sustained security.
For technical teams, assessing handshake latency figures, throughput results and message-size impacts in realistic payment environments is critical to understanding the performance implications of ML-KEM post-quantum protection at scale. A vendor’s ability to demonstrate support for hybrid cryptography, combining classical and post-quantum algorithms, is a strong indicator of their commitment to a phased, risk-mitigating approach, enQase reports. Multiple red flags should prompt deeper investigation when evaluating vendors, including the presence of proprietary cryptographic algorithms, a lack of cryptographic inventory capability, and reliance on manual spreadsheet-based tracking.
Rip-and-replace deployment models, a lack of hybrid cryptography support, missing standards roadmaps, weak compliance mapping, a lack of benchmarking data, and limited monitoring after deployment all suggest a vendor may not be truly crypto-agile. “A single red flag does not automatically disqualify a vendor, but multiple red flags should trigger deeper investigation,” according to the source.
The ideal workflow integrates visibility, prioritization, migration and governance, moving beyond isolated projects to create an ongoing quantum security strategy. This strategy should also encompass physics-based encryption practices and quantum randomness security, strengthening entropy and reducing key-prediction risk. Many organizations now view cryptography and entropy as complementary parts of one quantum security strategy, recognizing the need for multiple layers of protection. “The goal is a workflow where visibility, prioritization, migration, and governance work together rather than as separate projects,” the source states.
Money20/20 USA 2026 provides a critical venue for financial institutions to vet vendor claims of solutions, demanding concrete evidence of capabilities beyond marketing labels. Before the event, organizations should identify their priorities, build a scorecard and determine the evidence they expect vendors to provide. During meetings, the focus should be on demonstrations, implementation details, integration capabilities and long-term roadmaps, followed by proof-of-concept testing to validate top choices. This rigorous evaluation process is essential to ensure that selected solutions genuinely deliver the crypto-agility needed to navigate the evolving threat landscape.
Protecting Payments: Hybrid Cryptography & Ecosystem Interoperability
Financial institutions assessing post-quantum cryptography solutions should prioritize vendors demonstrating hybrid key exchange capabilities, aligning with guidance from the Internet Engineering Task Force (IETF). A successful transition to quantum-resistant systems will not be instantaneous. Most organizations will operate with both traditional and post-quantum cryptography for years, necessitating interoperability. Evaluating vendors at Money20/20 USA 2026 requires specific scrutiny of their ability to support phased adoption, rather than demanding immediate, disruptive overhauls of existing systems.
The longevity of financial data introduces a unique vulnerability known as Harvest Now, Decrypt Later, where encrypted information is captured and stored until quantum computers possess the power to break current encryption standards. This risk is especially pronounced for financial services due to the extended confidentiality lifespan of customer records and the interconnected trust relationships within payment ecosystems.
Organizations retaining sensitive data for years face a long-term confidentiality risk, a central component of what the source terms moving beyond an abstract concern to a defined potential failure point. Benchmark data is important for understanding the practical implications of implementing these new algorithms. A vendor’s cryptographic inventory should encompass certificates, keys, libraries, application dependencies, APIs, TLS configurations, hardware security modules (HSMs), cloud workloads, and third-party integrations, providing a comprehensive view of cryptographic assets.
A strong crypto-agility strategy begins with a detailed cryptographic inventory, establishing a foundation for any migration effort. This approach is essential for ensuring quantum-safe payments across the entire ecosystem. The ability to integrate with existing HSM platforms, public key infrastructure (PKI) and key management systems (KMS) is also critical, as financial institutions cannot afford to replace critical cryptographic infrastructure overnight.
Evaluating vendors requires a consistent scoring system, assigning a value from one to five for each of ten key questions, weighted by importance. The source frames the ideal workflow as one. The source highlights that “hybrid cryptography preserves compatibility with payment partners that move at different speeds, which is essential for quantum-safe payments across the ecosystem.” This compatibility is a technical detail and a key element of maintaining trust and stability within the financial system.
PCI DSS & DORA: Governing Crypto with Compliance and Resilience
The emphasis on ongoing visibility reflects a growing understanding that cryptographic agility is not a singular project, but a sustained program essential for mitigating the potential for widespread decryption of currently secured data once quantum computers reach sufficient scale. Beyond technical capabilities, strong governance is paramount, with vendors needing to demonstrate alignment with evolving regulatory landscapes. PCI DSS v4. 0. 1 now explicitly requires maintaining and reviewing cryptographic inventories, and the European Union’s Digital Operational Resilience Act (DORA) emphasizes operational resilience, signaling a shift towards proactive compliance.
A vendor’s ability to map its platform to milestones outlined in IR 8547, the Commercial National Security Algorithm Suite (CNSA) 2. “Boards want to know whether post-quantum readiness for banks is on track, and regulators will want evidence,” the source states, highlighting the need for documented control mapping and automated reporting. Effective governance also extends to proving ongoing readiness after initial deployment, demanding continuous monitoring and cryptographic policy enforcement.
The ability to detect and alert on the appearance of deprecated algorithms, coupled with comprehensive audit trails and executive dashboards, separates robust solutions from those offering only static assessments. This continuous oversight is important because the threat landscape, standards, and internal systems are all subject to change, necessitating a dynamic approach to cryptographic risk management.
The source frames a strong answer as one that provides and warns against solutions lacking these capabilities. This tiered approach allows financial institutions to focus on core capabilities while acknowledging the importance of a strong security posture. The source emphasizes that “spreadsheet-based inventories, one-time assessment projects, network-only scanning, limited visibility into partner connections, and no support for cloud-native environments” are red flags.
The guidance also highlights the importance of pairing post-quantum algorithms with physics-based encryption practices, creating a stronger defense-in-depth posture. For organizations evaluating enQase, the source suggests exploring its quantum security strategy in more detail, noting that the company’s framework is designed to boost crypto agility through four key components.
Source: https://enqase.com/articles/10-questions-to-ask-crypto-agility-vendors-at-money20-20-usa-2026
See today’s quantum computing news on Quantum Zeitgeist for the latest breakthroughs in qubits, hardware, algorithms, and industry deals.
