Report, 17 pages

Post-Quantum Readiness in MENA Banking 2026

The standards, the deadlines, what regional regulators now expect, and a migration plan banks can start this quarter

A research briefing for banks in Jordan, Iraq and the Gulf. It brings together the NIST standards and deadlines, the positions of regional central banks and cyber authorities, and published readiness surveys, then sets out a four-phase migration roadmap and a 90-day checklist. Every figure is referenced to its public source.

Key findings

  • NIST's draft transition plan deprecates RSA and elliptic-curve cryptography at 112-bit strength after 2030 and disallows them after 2035.

    Source: NIST IR 8547 (initial public draft), November 2024

  • Kuwait's central bank requires banks to develop a quantum readiness strategy with timelines and milestones for cryptographic migration, and the Central Bank of Jordan launched a sector roadmap for quantum-resistant encryption in January 2026.

    Source: Central Bank of Kuwait, Cyber and Operational Resilience Framework v1.0; Central Bank of Jordan announcement, January 2026

  • In key GCC markets, 84% of organisations plan a post-quantum transition, but only 35% have begun cryptographic discovery.

    Source: QuantumGate and UAE Cyber Security Council, State of Post-Quantum Readiness in Key GCC Markets, September 2026 (as reported)

  • Fewer than one in three organisations have completed a comprehensive cryptographic inventory.

    Source: IBM Institute for Business Value, Secure the post-quantum future, October 2025

  • The G7 Cyber Expert Group names 2035 as the overall target for the financial sector, with the most critical systems handled in 2030 to 2032.

    Source: G7 Cyber Expert Group, coordinated PQC roadmap for the financial sector, January 2026

What the report covers

  • Executive summary
  • Why post-quantum matters to banks now
  • The standards and the deadlines
  • What regional regulators expect
  • How ready organisations are: published data
  • A migration roadmap for banks
  • Checklist: the first 90 days
  • How QSafe supports the migration
  • Methodology and 45 references