Spain and Portugal Central Banks Join on Post-Quantum

Spain’s and Portugal’s central banks have agreed to work together on moving their financial systems to encryption that can withstand quantum computers. Banco de España and Banco de Portugal signed a memorandum of understanding at a high-level meeting in Lisbon on 22 and 23 October, committing to a joint Post-Quantum Cryptography Cooperation Programme, Banco de España said.

The aim, according to both banks, is to respond “more effectively” to the cyber-security and financial-stability risks that quantum computing poses. The announcement sets out a structure but no money and no dates: neither bank has published a budget, a timeline or the text of the memorandum.

In brief

Banco de España and Banco de Portugal signed an MoU in Lisbon to run a joint post-quantum cryptography programme in three phases.
Both banks warn that an uncoordinated move to quantum-safe technology could create systemic risks for the financial sector.
No budget, timetable, list of participating firms or choice of algorithms has been published.

The banks say an uncoordinated switch is a systemic risk

In near-identical statements, the two central banks said that a lack of coordination in migrating to quantum-resistant technologies “can pose systemic risks”, calling for close joint work between financial institutions and supervisors. Banco de Portugal’s release adds that risks arising from shared service providers, common market infrastructure and existing interoperability dependencies “could be tackled more efficiently through coordinated action” (TSN translation).

The worry behind any post-quantum migration is that a large, error-corrected quantum computer could break the public-key encryption that protects payments, banking sessions and stored data. No such machine exists, but estimates of how big it would need to be keep falling, as Iceberg Quantum’s simulation-based claim that RSA-2048 could fall to fewer than 100,000 qubits showed on 23 October.

Three phases, with industry joining for the last two

Banco de España’s press release says the programme is planned in three phases:

Phase one: sharing information, good practice and common methods.
Phase two: possibly analysing shared dependencies, how ready the ecosystem is, and migration priorities.
Phase three: possibly carrying out tests, interoperability assessments and analysis of emerging technologies.

To push forward the second and third phases, the banks plan to set up a working group with industry. They have not said which firms will take part or when it will start.

The programme was presented to senior managers from some of the two countries’ main financial institutions during the Lisbon meeting, which also covered the competitiveness of the financial sector and the risks and opportunities of recent advances in artificial intelligence, according to Europa Press. It was the third high-level meeting between the two banks this year. Governors José Luis Escrivá and Álvaro Santos Pereira led their delegations, and Banco de Portugal’s team included Susana Barbosa, director of its information systems and technology department.

Other regulators have already set dates

The Iberian plan arrives as other authorities move from awareness to deadlines. Germany’s national guideline says high-risk systems should switch by the end of 2030 and the whole changeover should be largely done by 2035, in line with an EU roadmap. Singapore wants exposed organisations to have quantum-safe migration plans by end-2027 and to finish by 2035.

For UK readers, the National Cyber Security Centre’s migration timelines ask organisations to carry out discovery and build an initial plan by 2028, finish their highest-priority migrations by 2031 and move all systems, services and products by 2035. On the vendor side, Cloudflare has started wrapping customers’ keys with post-quantum protection.

Shared suppliers are the risk the banks are pointing at

The most telling line in the statements is the one about shared providers and market infrastructure. A bank can upgrade its own systems, but it still depends on card networks, payment rails, cloud services and software vendors that serve its rivals too. If those move at different speeds, a migration can break links between firms or leave a weak point that every institution relies on. That is a supervisory problem, not just an IT one, and it explains why two central banks rather than individual lenders are leading.

For compliance and risk teams, the practical effect is that post-quantum readiness is becoming something supervisors will ask about. The first phase, sharing methods, points towards common ways of taking an inventory of where cryptography is used, the step that national timetables such as the NCSC’s put first.

The plan has a shape but no deadline

What is missing matters as much. Without a budget, dates or named participants, the programme is a commitment to coordinate rather than a migration order. The cautious “may” attached to phases two and three suggests the banks have agreed the direction before agreeing the workload. That contrasts with Germany’s end-2030 target for high-risk systems, and with a US audit that found none of 24 major federal agencies fully prepared.

The next concrete sign will be the industry working group: who sits on it, when it first meets, and whether the banks publish the dates that today’s announcement left out.