From Curiosity to Infrastructure: how banks are wiring quantum into finance

Inside the roadmaps: how BBVA, Wells Fargo and Mastercard are wiring quantum and PQC into banking.

When banks stand up at Quantum.Tech World and present quantum roadmaps, they are telling the market something fundamental - quantum is transitioning from scientific curiosity to critical infrastructure.

BBVA shows how to prove business value with focused pilots on real finance problems and reusable adoption frameworks. Wells Fargo shows how to run a long‑term, governed programme covering both quantum advantage and post‑quantum security. Mastercard shows how to lead on industry‑wide post‑quantum cryptography standards and migration, turning security into a strategic differentiator for an entire ecosystem. Regulators in the UK, EU and APAC are turning these corporate strategies into system‑wide expectations, with explicit timelines and milestones. For founders, the task in hand is to -

align technology and narrative with this reality,

design for hybrid quantum+classical architectures,

build for crypto‑agility,

lead with concrete use cases, and

position your solution as part of a bank’s quantum‑safety and quantum‑advantage story.

Done well, you are not just selling a product, you are helping wire quantum into the plumbing of the global financial system.

---

How Quantum.Tech Boston framed quantum for banks.

Quantum.Tech Boston 2026 brought together investors, enterprise technologists and financial institutions for a wide‑ranging assessment of where quantum computing stands and where it is headed and three voices specifically Michael Baczyk (HeartCore Capital), John Licata (ServiceNow) and Esco Sanchez Martinez (BBVA) anchored this narrative well.

Last year was marked as the International Year of Quantum Science, and 2026 is being opened as the “century of Quantum Industry,” with quantum penetrating adjacent domains such as photonics and semiconductors and, increasingly, being framed as future infrastructure for finance rather than a laboratory curiosity. Across investors, enterprise technologists and banks, the message is consistent. that the science era of quantum is giving way to an industry era in which quantum sits alongside photonics, semiconductors and high‑performance classical computing as part of the technology stack that underpins financial systems.

The strategic shift is also visible in how enterprises talk about quantum.

It is now a boardroom‑level topic rather than a niche R&D concern, driven by market movements that financial institutions can no longer ignore. More than 300 organisations already fund quantum programmes with multi‑million‑dollar budgets, spanning proofs of concept, co‑invested development and long‑term research lines. This is not because the hardware is “ready” in a general sense, as current platforms still exhibit error rates on the order of one in every 1,000 to 10,000 operations, far from the one‑in‑a‑billion reliability demanded by many production workloads - but because banks have concluded that they must build capabilities early if they want credible quantum‑advantage and post‑quantum security positions by the 2030s.

On the technical side, the reality remains that truly practical quantum algorithms are concentrated in specialised domains such as number theory, cryptography and physics simulations, and that the path to commercial impact runs through direct experimentation on real financial problems.

This is driving a move towards modular, hybrid architectures in which quantum processors act as co‑processors alongside HPC and edge systems, supported by more advanced error correction and careful selection of “quantum‑amenable” subroutines.

Crucially, this system‑level thinking is already visible in the financial sector. At Quantum.Tech, Banks did not present isolated pilots or science projects. instead they presented roadmaps. Those roadmaps link concrete use cases (portfolio optimisation, risk simulation, fraud detection, routing), structured experimentation frameworks and post‑quantum cryptography migration plans into a single narrative about how quantum becomes part of a bank’s infrastructure over the next decade.

In the coming sections we unpack what those roadmaps actually contain, how they intersect with global regulatory timelines, and what they mean for founders and technologists who want to plug into this shift rather than watch it from the sidelines.

How banks actually operationalize quantum

Behind the phrase “quantum roadmap” in the BBVA, Wells Fargo and Mastercard examples is a structured transformation programme, not a slide with buzzwords. Across institutions, the pattern is consistent and aligns with global guidance from the Bank for International Settlements and the G7 Cyber Expert Group. Here’s a deeper look at a few of them.

BBVA: Proving business value with real use cases

BBVA’s role in this story is to demonstrate how quantum can move from conceptual promise to measured business value in finance.

In collaboration with Multiverse Computing, BBVA has run proof‑of‑concept projects on portfolio optimisation using real market data. The objective is to identify allocation strategies that maximize risk‑adjusted returns (Sharpe ratio) under constraints such as risk limits, liquidity and regulatory requirements. Instead of working with toy models, the joint team benchmarks quantum and classical technologies on realistic portfolios to test whether quantum or quantum‑inspired methods can achieve better outcomes.

Beyond specific results, BBVA’s collaborations is focussing on building a reusable framework for quantum adoption. In documented work with partners, BBVA has benchmarked quantum and classical algorithms on representative CVA (Credit Valuation Adjustment) workloads, identified subroutines that are most “quantum‑amenable,” and designed a workflow to integrate quantum hardware as it becomes available, supported by systematic evaluation and integration practices. The impact is that BBVA now has a credible quantum adoption roadmap anchored in quantitative analysis, not just aspiration. They can reuse the workflow for new assets, new hardware generations or new vendor stacks, making quantum exploration a structured process rather than a sequence of disconnected pilots.

BBVA’s approach illustrates a core principle for the industry:

start with high‑value, well‑understood problems, measure business metrics rather than just technical ones, and codify the process into reusable frameworks so future hardware can plug in with minimal friction.

Wells Fargo: a long‑term quantum and PQC programme

Wells Fargo provides a complementary example, showing how a major bank can run quantum as a long‑term, governed programme.

Wells Fargo joined the IBM Quantum Network in 2019, giving it early and sustained access to IBM’s quantum hardware and software. It has dedicated internal teams working on quantum algorithms, has published multiple papers, and has tested its work on some of IBM’s largest processors, including the 433‑qubit IBM Osprey. Internally, the framing is not about immediate commercial advantage but about building a library of mathematical capabilities and quantum‑friendly algorithms that can be deployed as hardware becomes more capable. The recommended approach, as articulated by Wells Fargo’s leaders, is “low‑intensity but long‑term”: avoid putting all discretionary spend on quantum, but maintain consistent research, experimentation and partnerships.

On security, Wells Fargo has developed a post‑quantum cryptography risk model and a phased roadmap. It identifies and documents valuable information assets and how they are encrypted, researches the state of emerging quantum computers and quantum‑safe cryptography, estimates risk and prioritises assets by sensitivity and exposure, secures assets through mitigation such as stronger keys and hybrid schemes, and plans organisational migration to quantum‑safe cryptography, including continuous awareness and skills development. The bank stresses crypto‑agility, designing systems to pivot between encryption protocols without compromising continuity, and emphasises inventories and audits to map cryptographic dependencies and vendor exposure.

Wells Fargo’s programme shows how a bank can integrate quantum into risk management, cyber resilience and technology planning, treating both quantum advantage and quantum threats as part of its core governance responsibilities.

Mastercard: industry‑wide PQC leadership

Mastercard occupies a distinct position as a global payments network. Its imperative is less about running quantum algorithms for its own advantage and more about protecting the entire payments ecosystem while guiding others through the transition.

Mastercard has released a white paper that effectively serves as a roadmap for post‑quantum cryptography in the financial sector. It identifies cryptographic inventory as the immediate priority:

institutions must know what protocols are running,

where keys and certificates are stored, and

which data flows they protect.

It clarifies the risk boundary:

symmetric cryptography such as AES is considered secure against known quantum attacks, while public‑key cryptography used for key establishment and signatures is the vulnerable layer.

It recommends specific steps:

adopting hybrid TLS combining classical and post‑quantum algorithms to mitigate HNDL risks, and planning for digital signature migration with crypto‑agile solutions capable of swapping algorithms as standards mature.

The paper ties these technical recommendations to global mandates and frameworks such as the Quantum Computing Cybersecurity Preparedness Act and CNSA 2.0, pointing to compliance horizons around 2033 for certain systems.

Mastercard uses its position to provide guidance to the broader ecosystem. It encourages organisations to build crypto‑agility, monitor quantum hardware roadmaps and explore quantum applications like optimisation and fraud detection while keeping realistic timelines. It works with vendors and standards bodies to ensure that PQC algorithms and hybrid schemes can be deployed across complex, global infrastructure without fragmentation.

In essence, Mastercard’s roadmap is as much about translating technical standards into practical, actionable implementation plans for thousands of institutions as it is about securing its own network.

Taken together, BBVA, Wells Fargo and Mastercard show three facets of the same story: proving value on real portfolios, running quantum and post‑quantum as a governed, long‑term programme, and translating technical standards into implementation plans for thousands of institutions. Across these and other banks, quantum roadmaps are not marketing arte-facts, they are structured programmes that blend opportunity (optimisation, simulation, fraud detection) with obligation (PQC migration, crypto‑agility, regulatory timelines). Underneath the different brand narratives, the backbone of those programmes is remarkably consistent.

It begins with 1. awareness and inventory.

Banks raise internal awareness about quantum opportunities and risks, and conduct cryptographic inventories to identify which systems use which algorithms, where keys and certificates live, and what data flows they protect. In parallel, they map high‑value use cases where classical computing is hitting limits: portfolio optimisation, risk simulation, fraud detection, network routing.

2.risk assessment and prioritization.

Institutions assess quantum risk by data sensitivity, regulatory requirements and system criticality, prioritizing “high‑value, long‑lived” assets most exposed to “Harvest Now, Decrypt Later” attacks. They also rank candidate quantum‑advantage use cases by business impact, data availability and “quantum‑amenability.”

3. pilots and hybrid deployment.

Banks run time‑boxed proofs of concept with quantum vendors and partners on selected use cases, designing hybrid architectures where classical high‑performance computing is augmented by quantum or quantum‑inspired accelerators. Success is measured in business terms: Sharpe ratio improvement, false‑positive reduction, runtime and cost savings, not just technical benchmarks.

4. migration and scale.

Successful pilots move into production where they show clear advantage. At the same time, banks begin phased migration to post‑quantum cryptography, starting with highest‑risk systems and expanding to core banking, payments and data‑at‑rest protection. Quantum workflows are integrated into existing MLOps and model‑risk frameworks: versioning, monitoring, A/B testing against classical baselines.

and Finally,

5. monitoring, agility and governance.

Institutions establish continuous cryptographic assurance and crypto‑agility, tracking system‑level metrics such as error rates, qubit overhead, cost per useful computation and security posture. Quantum is embedded into governance:

board reporting,

regulatory compliance,

crisis exercises.

None of these are possible in a one‑off project. They present a multi‑year transformation plan with budgets, governance structures and explicit timelines often stretching to 2030–2035.

Regulatory timelines for quantum‑safe finance

The banks’ roadmaps do not exist in a vacuum. They are anchored in a global regulatory horizon that sets expectations and timelines. for example,

The Bank for International Settlements published “Quantum‑readiness for the financial system, a roadmap” that defines three phases for the system:

Engagement & Awareness,

Planning & Coordination, and

Execution & Oversight.

It calls for system‑wide risk assessments, coordinated migration timelines and clear communication from authorities to institutions.

The G7 Cyber Expert Group has also issued a roadmap for migration to quantum‑resistant cryptography, outlining six activities:

Awareness & Preparation,

Discovery & Inventory,

Risk Assessment & Planning,

Migration Execution,

Migration Testing, and

Validation & Monitoring, and noting 2035 as a typical horizon for broad migration across government and private systems. These frameworks provide common scaffolding for national roadmaps.

In the UK, the National Cyber Security Centre has published a detailed roadmap with explicit phases and dates:

internal pilots and hybrid TLS in test environments (2025–2026),

priority systems such as customer auth and payments (2026–2028),

enterprise‑wide deployment and PQC‑only transitions (2028–2031), and

full PQC deployment for priority systems with legacy classical algorithms disabled (2031–2035).

It also recommends a five‑step methodology:

1. Discover (cryptographic inventory),

2. Assess (quantum risk),

3. Prioritise (systems by urgency),

4. Deploy (hybrid cryptography) and

5. Monitor (continuous assurance and crypto‑agility).

The Bank of England has signaled a forthcoming quantum computing roadmap focused on cybersecurity, risk management and data analysis to guide banks and fintechs in understanding quantum impacts and mitigation strategies.

In the EU, the Digital Operational Resilience Act introduces operational resilience and crypto‑agility expectations, while broader guidance encourages prioritising high‑risk use cases by 2030–2031 and widespread PQC adoption by the mid‑2030s.

Much of this guidance remains advisory, giving member states flexibility, but the direction is clear: financial institutions must prepare for quantum‑related cyber risks and embed crypto‑agility into ICT risk management.

In APAC and neighboring regions, the Monetary Authority of Singapore issued an advisory requiring financial institutions to assess and mitigate quantum‑related cybersecurity risks, pushing them to start inventories and risk assessments. The Bank of Israel has mandated that banks and payment providers submit quantum transition preparedness plans by early 2026, forcing formal internal roadmaps and readiness checks.

all these actions show that quantum risk is moving into the category of supervised risk, with regulators expecting structured plans and reporting.

Implications for founders: plugging into the roadmaps

For founders in quantum, AI or deep tech, the shift from curiosity to infrastructure is both an opportunity and a filter.

If you’re building in quantum, AI or infra, you want your product to sit inside the bank’s roadmap, not off to the side. a good place to start is by deciding where you naturally plug in:

Discovery (helping map systems and crypto),

Pilots (running and benchmarking quantum/AI experiments),

Migration (PQC tooling and integration), or

Monitoring (crypto‑agility and assurance).

Then talk in the language banks and regulators already use, for example NCSC’s 2028/2031/2035 phases, DORA, MAS, Bank of Israel, and show, very concretely, which milestones you’re helping them hit.

Next is to steal BBVA’s playbook.

Pick one or two high‑value problems you can explain in a sentence -

portfolio optimisation,

risk modelling,

fraud detection,

routing.

and show how your hybrid quantum+AI approach moves the numbers people care about and wrap that in a simple, reusable evaluation framework so a bank can test you once and then reuse the pattern across desks and regions. That’s how you become part of the commercial tipping point Esco talks about, not just a one‑off pilot.

On the technical side, if you assume hybrid from day one ie quantum as a coprocessor next to HPC and edge systems, and not a standalone magic box, it can help you design for crypto‑agility and PQC readiness, your product can live comfortably in the same world as Mastercard’s and Wells Fargo’s security roadmaps.

Quantum Safety first not just quantum advantage

this means you help banks see and manage quantum risk, stress‑test portfolios and systems more robustly, catch more fraud, and satisfy the emerging expectations around quantum‑related cyber and operational resilience. If you can tell that story clearly, you’re not just selling a tool, you’re helping build the systems, talent and use cases that let quantum function as critical infrastructure at scale.

Latest on Intelligent founder AI -

Ep.016 - Sovereign AI and Compliance: Infrastructure as a Regulatory Decision!

Latest on AI Unfiltered -

Letting AI Models Judge AI Models!