The Saudi Central Bank (SAMA) told banks and the other financial institutions it supervises to ensure, by the end of the fourth quarter of 2026, that their procedures for identifying and classifying all of their cryptographic assets are accurate and comprehensive. The requirement is one of four in Circular No. 482021280, Enhancement of Operational Resilience to Address Quantum Computing Risks, dated August 27, 2026.
Cryptographic assets include the keys and algorithms that systems use to encrypt data and verify identities. Security teams call a catalog of those assets a cryptographic inventory.
In the same circular, SAMA required an enterprise-level assessment of quantum computing risk, with action plans, by the end of the first quarter of 2027. SAMA made quantum preparation a dated supervisory requirement for the institutions it oversees, with the inventory procedures due three months before the risk assessment.
The four requirements
Under the first requirement, each institution must assess quantum computing risk at the enterprise level, in line with its enterprise risk management procedures. Institutions must cover operational, legal, regulatory, and strategic risks in the assessment, including those related to human resources. They must also draw up action plans for the risks they identify.
Under the second, due by the end of the fourth quarter of 2026, institutions must at a minimum identify the data, systems, and services associated with their cryptographic assets. They must classify them by sensitivity and by priority for migration to quantum-resistant cryptography, assess the crypto-agility of priority assets, and identify constraints, challenges, and dependencies on third parties. Crypto-agility is the ability to switch cryptographic algorithms without rebuilding the systems that use them. Quantum-resistant, or post-quantum, cryptography refers to algorithms designed to withstand attacks by future quantum computers.
Under the third, institutions must develop plans and initiatives to bring all priority assets to the required level of crypto-agility, or to put appropriate alternative solutions in place, in line with the outcomes of the second requirement. SAMA set no separate date for this step.
Under the fourth, each institution’s Information Security Supervisory Committee and, where applicable, its board risk committee must monitor quantum computing risk periodically as a standing item. Institutions must report challenges and recommendations to the board or its equivalent.
Who is covered and who sets algorithms
SAMA addressed the circular to banks, finance companies, payment services companies, credit information companies, and support entities it licenses. SAMA said it issued the measures as an extension of its supervisory work on operational resilience in the financial sector.
The National Cybersecurity Authority (NCA) sets Saudi Arabia’s requirements for cryptographic algorithms through its National Cryptographic Standards. In NCS-2:2025, an update it put to public consultation in December 2025, the NCA included ML-KEM and ML-DSA, the standards formerly known as CRYSTALS-Kyber and CRYSTALS-Dilithium.
ML-KEM is a key-encapsulation mechanism, an algorithm two parties use to establish a shared secret key. ML-DSA is a digital signature algorithm, used to sign data and to verify who signed it. NIST published both algorithms as federal standards in 2024.
Other supervisors and the next dates
In a letter dated January 7, 2025, Israel’s Supervisor of Banks gave banking corporations a year to submit an initial quantum preparedness plan for discussion by their boards and management. In guidance published July 9, 2026, Switzerland’s Financial Market Supervisory Authority (FINMA) listed a strategy and roadmap for migrating to quantum-safe encryption among possible measures for the institutions it supervises.
Saudi institutions have about four months from the circular’s date to meet the December 31, 2026, deadline for inventory procedures and about seven months to meet the March 31, 2027, deadline for risk assessments and action plans.
