La banca española ante el riesgo de la computación cuántica

The Spanish banking sector faces potential risks due to the advent of quantum computing, which could undermine the security of digital asset systems. Spain currently has six financial entities offering cryptoassets under the MiCA regulatory framework, including BBVA, CECAbank, Openbank, Renta 4, CaixaBank, and Kutxabank. Crypto Finance, a subsidiary of Deutsche Börse, warns that financial institutions must incorporate this threat into their technological planning.

Entities that have advanced most rapidly in digitizing their financial services without integrating post-quantum security into their technological roadmap are the most exposed to quantum risks. In Spain, this includes entities that have significantly expanded their digital asset activity as well as cryptoasset service providers operating under the MiCA regulatory framework.

Currently, no Spanish entity is considered prepared for the quantum risk, as the threat has not yet become operational reality, according to Crypto Finance.

While some institutions have begun the preparation process, including various banks, international regulators such as the ECB, BIS, and the US Federal Reserve, the level of preparedness remains embryonic in Spain. This early-stage readiness presents a competitive advantage for those who anticipate the changes ahead. The quantum risk is a long-term threat, but it is also a near-term danger, adding to the uncertainty in managing it.

The primary immediate threat is the "harvest now, decrypt later" strategy, where adversaries collect currently encrypted data, such as customer records, transactions, or authentication credentials, and store it until they have the quantum computing power to break the encryption. This risk is already endangering thousands of entities and intensifies the need for proactive action.

To address this, banks should first identify where cryptography is used within their systems, such as processes relying on digital signatures, data requiring long-term protection, and technology providers in their chain. Based on this analysis, their actions should focus on three main areas: adopting a cryptographic agility framework to update security mechanisms without rebuilding the entire infrastructure, reviewing contracts and dependencies with technology providers to ensure they also incorporate post-quantum standards, and initiating evaluations, verifications, and preparing for the integration of standardized post-quantum algorithms.

Delaying this preparation will prove costly, as it involves multiple providers, legacy systems, and governance levels, making it a non-miracle overnight task.