Industry Use Case · Banking · Post-Quantum Ready, Continuously™
Post-Quantum Readiness for a Commercial Bank
A buyer-controlled readiness brief for commercial banks that hold long-life customer financial data, move money over wire and SWIFT, and clear cross-border flows through correspondent relationships.
Company-reported · not independently audited
01 / Executive Summary
What a commercial bank buys, and why
A composite mid-size state-chartered commercial bank we call Biscayne Commerce Bank carries the same quantum-cryptography exposure as every institution that holds long-life customer financial data, moves money over wire and SWIFT, runs commercial-real-estate and trade-finance lending, and clears cross-border flows through correspondent relationships.1Biscayne’s data does not age out: a mortgage file, an account number, and a wire-authorization key harvested today are still valuable in 2035.
Qtonic Quantum Corp engages a bank under a phased, buyer-controlled program that runs 12 to 18 months and begins with a scoped paid proof-of-concept. Deliverables include a cryptographic bill of materials, a modeled forward-threat demonstration and resource-estimate analysis against the bank’s deployed primitives, a five-phase migration roadmap built around hybrid X25519+ML-KEM-768 deployment, and an independent attestation from the QLab signed with ML-DSA-65, the NIST FIPS 204 signature family.
Regulatory pressure
PCI DSS v4.0 12.3.3 cryptographic-inventory obligations and FFIEC crypto-control expectations are active today. The G7 Cyber Expert Group identified ~2034 as a finance-sector PQC planning marker.
Threat signal
A March 31, 2026 neutral-atom resource estimate places ECC P-256 discrete log within ~26,000 physical qubits at a fast-architecture point. A resource estimate, not demonstrated capability.
Field baseline
18/100 — Company-reported composite from governed Qtonic Quantum engagements, normalized and banded for public communication — not an independently audited census of the Fortune 1000.
The compliance window is already closing.The cryptographic primitives protecting Biscayne’s core ledger, online and mobile channels, payment HSMs, SWIFT messaging, and correspondent links are inside the NIST 2030–2035 transition window. The engagement retires them in order of risk, on a sequence that respects core-conversion windows and examination calendars.
1Biscayne Commerce Bank is a composite, illustrative commercial bank — not a real institution and not based on any single operator. Industry incidents referenced relate to named, real organizations and are sourced solely to SEC filings, state attorney-general notifications, court records, and reputable public reporting. See Notices. This page covers commercial banking specifically; for the broader financial-services sector see /industries/finance.
02 / The Signal
Three papers, three regulators, one calendar
The trigger for board-level urgency is not a single paper. It is independent signals against regulatory clocks already running. On March 30, 2026, Google Quantum research team and co-authors published a resource estimate cutting the cost of breaking ECDLP-256 to fewer than 500,000 physical qubits on a superconducting architecture. The next day, a neutral-atom estimate (Caltech / Oratomic) placed P-256 discrete logs within roughly 26,000 physical qubits under fast-architecture assumptions, with RSA-2048 one to two orders longer. Both are resource estimates, not demonstrated capability against production systems. Harvest-now, decrypt-later collection is pegged to that trajectory.
PCI DSS v4.0 Requirement 12.3.3 became mandatory on March 31, 2025; the FFIEC Cybersecurity Assessment Tool sunset on August 31, 2025 with supervision pivoting to NIST CSF 2.0 and the CRI Profile 2.0; and the EU’s DORA is in force for cross-border banks. NIST IR 8547 (initial public draft) describes deprecating quantum-vulnerable public-key cryptography after 2030 and broadening disallowance after 2035.2
Milestone 1 of 6· select a marker to advance the timeline
2025
PCI DSS v4.0 12.3.3 (mandatory Mar 31) · FFIEC CAT sunset (Aug 31) · EU DORA in force.
2026
G7 Cyber Expert Group PQC roadmap · supervision pivots to NIST CSF 2.0 / CRI Profile 2.0.
2029
Qtonic Quantum planning assumption — a planning marker, not a NIST date and not a prediction.
2030
NIST IR 8547 (draft): 112-bit deprecation · EU PQC high-risk end-2030.
~2034
G7 finance-sector PQC guidance — guidance, not a regulatory mandate.
2035
NIST IR 8547 (draft) broadens disallowance · EU PQC full 2035.
2 The 2029 reference is a Qtonic Quantum planning assumption, not a NIST date and not a prediction. NIST IR 8547 is an initial public draft as of the document date; deprecation timing and scope are subject to change in final publication. The G7 roadmap is guidance, not a regulatory mandate. Sources: PCI SSC v4.0 (Apr 2025); FFIEC CAT sunset (Aug 2025); G7 Cyber Expert Group PQC Roadmap (Jan 2026); NIST IR 8547 initial public draft; EU DORA; EU NIS Cooperation Group PQC Roadmap (Jun 2025). Market statistics: Verizon 2026 DBIR; Datadog State of DevSecOps 2026.
03 / Exposure
Where classical cryptography touches a bank
Four cryptographic domains, every one running on classical RSA / ECC primitives today. A cryptographic bill of materials is the prerequisite for any defensible migration plan.
01Core Banking & Customer DataCore banking platform & ledger · Online / mobile channels · Long-life PII & account data · Loan & mortgage records
Mortgage files and account data live for decades, which makes harvest-now, decrypt-later the operative risk. In one January 2024 public mortgage-lender incident, the company disclosed in an SEC 8-K that roughly 16.6M individuals' data was accessed; ALPHV/BlackCat claimed responsibility, and an $86.6M class-action settlement followed.
Public sources — SEC filing, public reporting. Not a Qtonic Quantum client.
02Payments, Wire & SWIFTWire & SWIFT messaging · Payment HSMs & key ceremonies · Card rails & PCI DSS 4.0 scope · ACH & FedNow settlement
Payment rails run on classical RSA / ECC primitives inside an enforceable PCI scope. The 2024 LockBit ransomware attack on Evolve Bank & Trust exposed names, Social Security numbers, account numbers, and ACH records, and was followed by an $11.85M settlement.
Public sources — public reporting, settlement records. Not a Qtonic Quantum client.
03Cross-Border & CorrespondentCorrespondent banking links · Cross-border remittance flows · Trade finance & letters of credit
Correspondent traffic is the clearest harvest-now, decrypt-later target: encrypted flows captured today can be held until a cryptographically relevant quantum computer exists. The CBOM inventory is the prerequisite for sequencing this domain by risk.
04Regulatory SurfaceFFIEC / FDIC / OCC exam scope · PCI DSS 4.0 cryptographic inventory · BSA/AML & OFAC · NYDFS 500 · GLBA · EU DORA
The regulatory surface converges on one point: cryptographic primitives must be auditable, deprecation-aware, and forward-compatible. Third-party exposure is real — Bank of America customer data was affected via the Infosys McCamish breach (2024), and a 2025 incident at vendor Marquis Software illustrates the supply-chain path.
Public sources — public reporting, vendor disclosures. Not Qtonic Quantum clients.
04 / Counterparty
Why Qtonic Quantum
Qtonic Quantum Corp is a Florida profit corporation headquartered at 1000 Biscayne Blvd, Miami FL 33132. SAM.gov UEI FRYFAD3GW5W5. CAGE 14E99. A procurement officer can verify the counterparty in minutes. The company is buyer-controlled — no HSM, no PKI product, no TLS appliance for sale. Governance and defense adjacency are provided by the Defense Innovation Council, chaired by Lt. Gen. Mark E. Weatherington, USAF (Ret.), and the Allied Defense Council, founding-chaired by Lt. Gen. Roger L. Cloutier Jr., USA (Ret.).
“I spent my career in environments where encryption failure means mission failure. Qtonic Quantum applies that standard to enterprise systems.”
Four tools, one closed loop
QScout — Find
External-first cryptographic risk and vulnerability intelligence. CycloneDX 1.6 CBOM across 15 compliance frameworks. Scope depth: QScout public intake, QScout Surface, Silver, Gold, and Pulse. QScout is not a penetration test; deeper scope runs under written authorization.
QStrike — Prove
Modeled forward-threat demonstration and resource-estimate analysis against a bounded 2030–2031 quantum-equipped adversary model. It does not claim present-day RSA-2048 or ECC-256 break capability. $2M QStrike Challenge, subject to published terms and review conditions.
QSolve — Fix
Five-phase migration roadmap (Inventory, Risk & Debt, Prioritization, Hybrid Deployment via X25519+ML-KEM-768, QStrike Validation). The hybrid primitive is already in production at Cloudflare, Google Chrome, and AWS KMS.
The QStrike modeled profile set
QStrike models bounded forward-threat validation across six provider-aligned profiles spanning four physical modalities — superconducting, trapped-ion, neutral-atom, and annealing. Provider and access-route names describe model context and published calibration inputs; current public status is zero connected quantum hardware and no live-hardware execution.
| Platform | Modality | Published model context | QStrike role |
|---|---|---|---|
| IBM Quantum | Superconducting | Direct (IBM Quantum Platform) | Modeled gate-system calibration context; no provider job implied |
| Rigetti | Superconducting | AWS Braket | Modeled superconducting calibration context; no provider job implied |
| IonQ | Trapped-ion | AWS Braket; direct | Modeled trapped-ion calibration context; no provider job implied |
| Quantinuum | Trapped-ion | Direct (Quantinuum Nexus) | Modeled trapped-ion calibration context; no provider job implied |
| QuEra | Neutral-atom | AWS Braket | Modeled neutral-atom calibration context; no provider job implied |
| D-Wave | Annealing | D-Wave Leap (direct); AWS Marketplace | Modeled annealing calibration context; no provider job implied |
Six provider-aligned modeled profiles span four physical modalities. Provider and access-route names describe model context and published calibration inputs; they do not establish provider access or execution. Google Quantum research team’s Willow and other non-commercial research processors are used only as published-benchmark calibration inputs to the adversary model; they are not part of the QStrike modeled profile set, and QStrike does not run customer workloads on them.
Company-reported · not independently audited
05 / Engagement
Find → Prove → Fix readiness
Each phase produces a discrete artifact the next phase consumes, usable as input for an FFIEC examiner, a PCI assessor, a cyber insurer, or a board. Continuous re-attestation feeds the cycle.
01 · Find — QScout
CycloneDX 1.6 CBOM · 15-framework compliance map · finding-level register
02 · Prove — QStrike
provider-calibrated modeled evidence report against a bounded 2030–2031 adversary model; no present-day break claim
03 · Fix — QSolve
Sequenced migration plan on hybrid X25519+ML-KEM-768, mapped to fiscal quarters and core-conversion windows
04 · Prove — the Lab
Buyer-controlled score; ML-DSA-65-signed attestation; re-attestation cadence
Mid-size commercial bank scale; four phases over 12 to 18 months from a scoped proof-of-concept. Scope drivers: asset size, branch and channel count, core-platform scope, and vendor cooperation. Commercial terms are provided under NDA at scoping. The Lab’s assessment spans 200+ reference implementations (company-reported).
06 / Outcomes
Business outcomes
The engagement produces a cryptographic inventory, a validated migration plan, and a signed attestation that support FFIEC examination, PCI DSS 4.0 12.3.3 assessor review, cyber-insurance renewal questionnaires, and board risk reporting against the 18-of-100 company-observed baseline. These artifacts are technical inputs; they do not determine compliance or guarantee any examination outcome. The business case is a comparison, not a promise.
$5.56M
Average financial-sector breach cost (IBM, 2025). Industry benchmark, not a Qtonic Quantum figure.
$86.6M
2024 mortgage-lender class-action settlement; ~16.6M individuals. Public sources — SEC filing, public reporting; not a Qtonic Quantum client.
$11.85M
Evolve Bank & Trust 2024 settlement; exposed ACH records. Public sources — public reporting; not a Qtonic Quantum client.
The full engagement is a fraction of one sector breach. Exposure framing, not a savings guarantee. Settlement figures are from public sources and do not represent Qtonic Quantum clients.
07 / Honest Pushback
Devil’s advocate
The strongest version of QStrike is not that quantum computers can break production cryptography today. The defensible claim is narrower and more valuable: QStrike shows which current implementation defects, weak protocol choices, leakage patterns, and migration gaps are likely to matter first when quantum-capable adversaries arrive.
Vendor non-cooperation
Where a payment processor or core vendor cannot supply hybrid X25519+ML-KEM-768 in the window, QSolve sequences compensating controls and gives procurement the evidence to require a contractual deprecation date. The CBOM is the leverage instrument.
Scope creep in legacy systems
Branch infrastructure, ATM networks, legacy core modules, and building systems can absorb budget if scope is unbounded. The engagement scopes these explicitly at the Find phase, with QStrike validation focused where HNDL or signature-forgery risk is highest.
Throughput and legacy-protocol constraints
PQC primitives are larger (per FIPS 204, an ML-DSA-65 signature is 3,309 bytes with a 1,952-byte public key; per FIPS 203, an ML-KEM-768 public key is 1,184 bytes). Cloudflare's October 28, 2025 report notes the deployed X25519+ML-KEM-768 hybrid 'has already incurred a 4% slowdown in TLS handshake time.' This brief treats extrapolation to high-throughput payment systems as an engineering risk model, not a settled result; migration stages high-volume rails first, with payment-HSM and message-signing migration sequenced only after QStrike validation.
Four questions to ask any post-quantum vendor
| Question | Qtonic Quantum answer |
|---|---|
| Do you sell the cryptography you assess? | No. The Lab scores what is on the market, not Qtonic Quantum products. |
| How does QStrike evidence the threat work? | QStrike uses controlled demonstrations and resource modeling. It does not claim present-day RSA-2048 or ECC-256 break capability. |
| Will I receive a signed, third-party-readable attestation? | The Lab issues attestations digitally signed using ML-DSA-65 (NIST FIPS 204). |
| What is your scanner output format? | QScout produces CycloneDX 1.6 cryptographic bills of materials that ingest into existing SBOM tooling. |
08 / Next Step
Start with a scoped proof-of-concept
Scoped to a representative slice of corporate IT plus one payment or wire system. Commercial terms are provided under NDA at scoping. 30-day kickoff from countersignature.
Week 1 — Scoping & access
Scoping calls, NDA execution, dataroom access.
Weeks 2 & 3 — QScout deployment
NIST-aligned scan across agreed scope. CBOM generation.
Week 4 — Findings review
CycloneDX CBOM delivered. Decision point on the Find engagement.
Broader financial-services sector (asset managers, payments, SEC and NYDFS framing): see /industries/finance.
Post-Quantum Ready, Continuously™
Notices
Notices & disclaimers
Forward-looking statements. Future events, timelines, and capabilities are forward-looking and may differ materially. The 2029 reference is a Qtonic Quantum planning assumption, not a prediction. Cited resource estimates are resource estimates, not demonstrations against production systems.
Company-reported metrics. “100,000+ findings,” “widespread HNDL exposure,” “PQC readiness average 18/100,” “governed false-positive control,” and “200+ implementations evaluated” are company-reported, not independently audited. Request methodology before relying on them.
QStrike capability scope. QStrike provides modeled forward-threat demonstrations and resource-estimate analysis against deployed primitives. It does not claim, and should not be interpreted as claiming, present-day capability to break, decrypt, or forge signatures against production RSA, ECDSA, ECDH, or related classical primitives at full parameter sizes.
Standards. NIST IR 8547 is an initial public draft. FIPS 203 (ML-KEM) and FIPS 204 (ML-DSA) are published standards. Use of ML-DSA-65 for Lab attestations does not by itself imply FIPS 140-3 module validation.
Composite illustration; industry incidents. “Biscayne Commerce Bank” is a composite, illustrative commercial bank — not real, not based on any single operator, not a Qtonic Quantum client. Public banking, processor, and financial-software incidents are described solely from public sources (SEC filings, state attorney-general notifications, court records, and reputable trade media).
No public commercial terms; no binding offer. This page does not contain public commercial terms. Commercial terms are provided under NDA at scoping. No part constitutes a binding offer.
No warranty; no guarantee of compliance outcomes. Deliverables are advisory. They do not guarantee any FFIEC, PCI DSS, NYDFS, cyber-insurance outcome, or breach prevention.
Third-party trademarks & sources. All third-party marks are the property of their owners; reference is descriptive, not endorsement. Market statistics are attributable to their publishers, not to Qtonic Quantum.
Export control. Products and services may be subject to the EAR and possibly ITAR depending on configuration; classifications are confirmed at scoping.
Governing law. Florida law; disputes per the executed engagement letter. © 2026 Qtonic Quantum Corp.