EU banking and securities regulators put quantum computing on systemic risk map
CoinGape reports the EBA, EIOPA and ESMA put quantum computing on the EU systemic risk map on 23 September 2026, citing harvest-now-decrypt-later attacks.
Why it matters
All three bodies are EU-level rulemakers, so a joint listing of quantum risk can shape what banks, insurers and asset managers are told to prepare for, without any new legislation being cited. CoinGape puts named crypto firms and one country on a 2028-2029 post-quantum migration timetable, which implies engineering and spending work ahead of that window. With a single unconfirmed source, no near-term market effect is established.
Key facts
The European Banking Authority, the European Insurance and Occupational Pensions Authority and the European Securities and Markets Authority published their Autumn 2026 Joint Committee Risk Update on 23 September 2026.
Reported by CoinGape
The three authorities listed quantum computing on the EU financial system's systemic risk map alongside AI-driven cyber risk and private credit as emerging threats.
Reported by CoinGape
CoinGape reported that the authorities' stated concern is harvest now, decrypt later attacks, in which adversaries collect encrypted data and exposed public keys now and decrypt them once a sufficiently powerful quantum machine exists.
Reported by CoinGape
CoinGape stated the authorities noted that DORA, the EU's Digital Operational Resilience Act, already carries requirements in this area, but the article text available to the desk is truncated before the details.
Reported by CoinGape
What happened
CoinGape reported that the European Banking Authority, the European Insurance and Occupational Pensions Authority and the European Securities and Markets Authority published their Autumn 2026 Joint Committee Risk Update on 23 September 2026. The update placed quantum computing on the official systemic risk map for the EU financial system, listed alongside AI-driven cyber risk and private credit as an emerging threat. CoinGape said the central concern is harvest now, decrypt later: adversaries gathering encrypted data and exposed public keys today to decrypt them once a powerful enough quantum machine exists, which the outlet says could break the cryptography protecting wallets, blockchains and transactions and could arrive before quantum computing becomes commercially profitable. The article also states that the authorities noted DORA, the EU's Digital Operational Resilience Act, already imposes related requirements, but the text available to the desk stops mid-sentence before the specifics. CoinGape additionally named Coinbase, Ethereum, XRP and El Salvador as already moving on post-quantum defences ahead of 2028-2029 targets, without dates or detail on the work. No other outlet in the set covers the risk update, so the report and the companies' claims rest on that one unconfirmed account.
How the story developed
- Official statement
EBA, EIOPA and ESMA publish Autumn 2026 Joint Committee Risk Update listing quantum computing as an emerging systemic threat
The three EU authorities named quantum computing alongside AI-driven cyber risk and private credit, citing harvest now, decrypt later attacks.
- First report
First report by CoinGape
Bitcoin and Ethereum Face New Regulatory Clock After EU Flags Post-Quantum Migration Risk
- Update
CoinGape publishes the only account of the risk update in the evidence set
Single-source report; no other outlet in the set covers the authorities' update or the post-quantum work it describes.
- Update
CoinGape says Coinbase, Ethereum, XRP and El Salvador are moving on post-quantum defences against 2028-2029 targets
Undated in the article; no programme details, cost or confirmation from any of the named parties is given.
Affected entities
Also mentioned: Ripple, European Securities and Markets Authority, BlackRock, Vitalik Buterin, ARK Invest
Original sources
| Publisher | Report | Role | Published |
|---|---|---|---|
| CoinGape Crypto media | Bitcoin and Ethereum Face New Regulatory Clock After EU Flags Post-Quantum Migration Risk | Original |
Related events
El Salvador launches $2 stablecoin remittance app Sivar on Base while denying a bitcoin pivot
El Salvador and Modveon launched Sivar, a flat-$2 remittance app settling in stablecoins on Base, while the National Bitcoin Office denied the country is pivoting away from bitcoin.
El Salvador launches Sivar stablecoin platform with Palo Alto startup Modveon
Crypto News reports El Salvador picked Palo Alto startup Modveon to run and expand a national digital platform, Sivar, offering cross-border payments under a five-year deal.
Government Bitcoin holdings fell to 645,596 BTC in 2026; Kazakhstan and El Salvador added coins
Crypto News, citing an AMBCrypto tally, says tracked government Bitcoin holdings fell 1,635 BTC in 2026 to 645,596 BTC, with Kazakhstan and El Salvador the only states to add.
17 banks reported on Chainlink-Swift ledger as Blockchain.com targets 2026 US listing at $4-6 billion
A single aggregator says 17 banks are connected to Chainlink's Swift ledger integration and that Blockchain.com is weighing a 2026 US listing valued at $4-6 billion.
IMF waives El Salvador's Bitcoin breach and releases $138 million
The IMF waived El Salvador's breach of a Bitcoin accumulation limit and released SDR 101.96 million, about $138 million, after the second and third reviews of its $1.4 billion programme.
El Salvador Continues Daily Bitcoin Purchases Despite IMF Waiver Terms
El Salvador added 7 BTC over the past week, reaching 7,798 BTC in reserves, despite IMF expectations to halt direct state purchases.