Harvest now, decrypt later is quickly becoming a known name in security circles. It refers to the act of adversaries stockpiling encrypted financial information that they cannot yet read today, but are betting to be able to when the right moment hits.
Why does this threat exist somewhat prematurely? According to The World Economic Forum’s latest report, The Top 10 Emerging Technologies of 2026, the threat is waiting for quantum computers to process information differently compared to the classic machines today.
“Once powerful enough, that capability could unravel the mathematical problems underpinning most encryptio in use today,” the report says.
This matters for finance especially, as the shelf life of its data is unusually long. Details like a 30-year mortgage, a decade-long derivatives book, sanctions files, and beneficial ownership records are information banks encrypt today. These will remain sensitive well into the window when quantum decryption is expected to become feasible.
The relevant variable is how long the data has to stay confidential relative to when the maths breaks.
The response the standards community has settled on is lattice-based cryptography. Rather than making existing locks harder to pick, it changes the underlying puzzle.
Data is embedded inside a high-dimensional geometric grid, and small random errors are seeded in during encryption.
Working backwards to the original message means picking the one true answer out of an enormous population of plausible wrong ones; a problem that stays hard for classical and quantum machines alike.
An arguably bigger implication sits inside the same mathematics. Lattice schemes support fully homomorphic encryption, meaning computations can run on ciphertext without ever decrypting it.
Fraud analytics across banks, sanctions screening across jurisdictions and joint credit modelling become conceivable without raw records leaving the institution that holds them. Data-sharing arrangements that today collapse under privacy law could survive it.
The policy scaffolding has hardened. The EU has set 2026 as the year public systems must begin quantum-safe migration. The US National Security Agency requires quantum-safe algorithms across new national security systems by January 2027.
Google has committed to completing its own transition by 2029. SWIFT, the messaging spine for more than 11,000 institutions across 200 countries, is actively engaged in post-quantum migration planning.
Coordinated migration timelines from Asia Pacific regulators are a matter of when, and they could possibly bind procurement, vendor contracts, and audit obligations.
The operational reality, however, is unforgiving. Wearables and embedded devices struggle with lattice-based workloads. Legacy core banking stacks were not designed for cryptographic agility.
Migration would then mean running hybrid classical-quantum encryption in parallel, without breaking the services that already depend on the old stack.
The near-term test for financial institutions is to identify which cryptographic assets across their business depend on encryption that quantum computing will eventually break.
Firms with that inventory in hand can plan their migration, sequence it against business priorities and negotiate timelines with vendors.
