Europol has published a new scoring framework that gives financial institutions a practical method for prioritizing their transition to quantum-safe cryptography. The tool ranks systems based on quantum risk and migration complexity, helping banks decide where to focus resources first.
The framework uses a two-pronged scoring system. The Quantum Risk Score combines three factors: shelf life (how long data remains sensitive), exposure (accessibility of cryptographic material), and severity (business impact of compromise). Each factor scores 1-3. The Migration Time Score assesses solution availability, execution costs, and external dependencies like vendors and regulators.
Point-of-sale systems emerged as high priority targets despite medium quantum risk, due to long-lived keys, broad physical exposure, and multi-year hardware replacement cycles. Public websites, meanwhile, qualify as early migration candidates because hybrid post-quantum TLS already exists in major browsers.
The research also flags cryptographic antipatterns that complicate migration: manual certificate management, hard-coded credentials, and inconsistent TLS configurations. These issues must be resolved before quantum-safe algorithms can be deployed effectively.
With NIST mandating full deprecation of quantum-vulnerable encryption by 2035 and the EU requiring transition plans by end of 2026, banks face mounting pressure to act. Fault-tolerant quantum computers capable of breaking current encryption could arrive between 2028 and 2033.