Allianz researchers wrote in a 12-page Allianz Research report published on July 29, 2026, that the quantum threat to the financial system’s cryptography could arrive before quantum computers pay off in financial applications. “Imagine two clocks ticking side by side,” wrote the six authors, who include Ludovic Subran, Allianz’s chief investment officer and chief economist.
The machine needed to break today’s encryption is also the smaller one, “needing roughly 1,250–1,450 logical qubits vs around 4,700–7,500 for leading financial applications,” the authors wrote. Logical qubits are error-corrected units, each built from many physical qubits.
Citing the Global Risk Institute’s 2025 Quantum Threat Timeline Report, a survey of 26 experts, the authors put the probability of a cryptographically relevant quantum computer within 10 years at 28–49%. Such a machine could break the public-key encryption in use today.
The cryptography figures
In the text, the authors gave the 1,250–1,450 range for attacking “the elliptic-curve cryptography behind a Bitcoin key,” depending on circuit design and on the trade-off between qubit count and runtime. In Figure 1, they drew a single bar labeled “Break ECC-256 and RSA 2048” at 1,200–1,600 logical qubits. They listed Babbush et al. (2026) and Gidney (2025) among the figure’s sources without tying a source to each bar. For the financial applications, Figure 1 shows 4,700–7,300 logical qubits, against 4,700–7,500 in the text.
Ryan Babbush of Google Quantum AI and his co-authors estimated in a March preprint that Shor’s algorithm could break 256-bit elliptic-curve keys with fewer than 1,200 logical qubits and 90 million Toffoli gates, or with fewer than 1,450 logical qubits and 70 million Toffoli gates. Shor’s algorithm is the quantum method a large enough machine could use to break RSA and elliptic-curve cryptography. A Toffoli gate is a three-qubit logic operation and the main cost measure in such estimates.
In a preprint posted on July 15, two weeks before the report, Han Luo and colleagues estimated 835 logical qubits and about 1.7 billion Toffoli gates for secp256k1, the elliptic curve Bitcoin uses.
For RSA-2048, Craig Gidney of Google Quantum AI estimated in 2025 that a machine with fewer than a million noisy physical qubits could factor a key in less than a week. In his cost table, he counted 1,399 logical qubits and about 6.5 billion Toffoli gates.
In its key-management guidance, NIST rates a 2,048-bit RSA key at 112 bits of security strength and 256-bit elliptic-curve keys at 128 bits. Security strength is NIST’s measure of the classical computing work an attack would take.
In Figure 1, the authors also placed “Today’s best machine” at 96 logical qubits, which they labeled a 2026 record, without naming the machine. “Gate counts, fidelities and circuit depth matter as much as qubits,” they wrote in the text.
Regulatory dates
NIST “plans to deprecate today’s vulnerable public-key algorithms after 2030 and disallow them after 2035,” the authors wrote. At the time, NIST’s transition plan was a draft from November 2024. In it, NIST proposed deprecating RSA and elliptic-curve algorithms at 112 bits of security strength after 2030 and disallowing all of them after 2035.
For Europe, “the EU requires critical financial infrastructure to migrate by the same year,” the authors wrote. In a coordinated roadmap issued in June 2025, EU member states, supported by the Commission, set the end of 2030 as the date by which “the PQC transition for high-risk use cases” should be completed. The Commission described the roadmap as a set of recommendations for member states to implement. The roadmap does not name financial infrastructure.
Investment, rewards, and losses
The authors wrote that quantum-technology startups raised $12.6 billion in 2025, more than 90% of it for computing. They credited PitchBook data in their charts. Of venture money committed to quantum, around 97% went to the technology stack and less than 1% to financial-services applications, they wrote. Europe drew about 5% of private quantum investment, against more than half for the United States, they wrote.
On the reward side, the authors wrote that quantum computing speeds up the Monte Carlo methods behind financial simulations, but they reported “no consistent advantage yet” over improving classical methods for portfolio optimization and financial machine learning.
Citing the Bank for International Settlements, the authors put expected financial-system losses at roughly 0.1% of GDP within five years of a quantum-enabled attack, rising above 1% over 15–20 years. The BIS published those estimates in BIS Papers No 149 in October 2024.
The authors also cited a Hudson Institute scenario of a quantum-enabled cyberattack on the Fedwire interbank payment system, with a central estimate of $2.0–3.3 trillion in GDP at risk. They wrote that Hudson called a separate, earlier estimate, $726 billion to $1.95 trillion for a single-day disruption, preliminary and imprecise.
Inventories and budgets
The authors wrote that only around 35% of large organizations have completed a comprehensive inventory of cryptographic assets, without giving a source for the figure. In their summary, they wrote that preparation for the threat “is purely an internal IT budgeting decision, competing resources with AI.” In the body of the report, they wrote that the competition is “largely fought within the same IT budget line.” The engineers, cloud spending, and board time that could fund a migration program are going to AI, “which offers more visible and immediate returns,” they wrote.
“Institutions do not need to know which clock will strike first to know that preparing for only one is the wrong strategy,” the authors wrote in their final sentence.
Update, November 12, 2026: In its final transition plan, published October 27, NIST deprecates RSA and elliptic-curve algorithms at every approved key size after 2030, closer to the report’s description than the draft was. On September 5, Luo and colleagues revised their estimate to about 2 billion Toffoli gates, with 835 logical qubits unchanged.
