Quantum Computing And Capital Markets Opportunities Risks And Timelines Readiness

Quantum computing is a form of computing that uses the principles of quantum mechanics to process information, enabling certain types of calculations that may be infeasible or impractical for classical computers. 1 While quantum computing has not yet delivered a production-capable economic advantage for capital markets, it has made significant progress in hardware and proof-of-concept applications.

Quantum computing offers medium and long-term opportunities for capital markets, but also creates short-term risks relating to cryptography. 2

Ontario is well positioned to take advantage of quantum technologies, with strengths across quantum computing, cryptography, and financial services. The Ontario Securities Commission (OSC) can support coordination with provincial, federal and international counterparts, and engage market participants to support a consistent and timely transition to quantum-ready practices.

Financial institutions and quantum computing companies are increasingly exploring capital market applications and have demonstrated advances in areas such as derivatives pricing, portfolio optimization, and risk analysis. Institutions that delay evaluating potential applications of quantum computing risk missing opportunities, reducing competitiveness, and potentially having to manage a crisis response to cryptographic threats as the technology matures.

The primary challenge of the advances in quantum computers is the vulnerability of current cryptographic systems, which underpin the integrity and operation of financial markets. Mature quantum computers are expected to have the capability to compromise widely used cryptographic systems, impacting the integrity of personal information, transactions, and financial records, as well as the availability and reliability of critical systems.

This risk may not be observable as it happens, and could result in real-time manipulation, unauthorized asset transfers, and disruption of market operations. These could even be amplified by reliance on automated systems and accelerated cyber attacks driven by concurrent advances in capabilities enabled by artificial intelligence (AI), before quantum applications become widely available.

Implications for market participants

Market participants should consider the need to develop a migration plan to a quantum-safe environment, which may include establishing organizational readiness, updating internal capabilities and skills, as well as coordinating plans with partners and the broader financial community. As a result, organizations may also need to improve their cryptographic governance framework.

Building cryptographic resilience is a prerequisite for confidently capturing the quantum opportunity while building resistance to the known quantum risk. Establishing, and acting on, strategic goals for cryptographic agility, diversity, and defence-in-depth approaches will contribute to the long-term effectiveness of these efforts.

As quantum computing hardware and software rapidly improve, theoretical capital market use cases are emerging. Several financial use cases have even been proven in principle, putting the industry on a path toward adoption. Market participants may consider the extent to which these advancements affect their business and develop an internal understanding of where quantum methods may be relevant to their business functions.

Forward-looking organizations can gain a competitive edge and reduce business risks by being proactive, building organizational readiness, including talent and internal capability, and engaging with the quantum technology ecosystem.

The OSC is actively collaborating with domestic and international regulators in examining the implications of quantum computing for capital markets. This report is the first in a series of publications, called OSC Q-Bits, that focus on the latest developments in quantum computing. This work is part of the OSC’s commitment to being proactive and forward-looking in its response to emerging trends.

Publication of Technical Report

The OSC partnered with softwareQ Inc., evolutionQ Inc., and the Institute for Quantum Computing at the University of Waterloo to prepare the report titled “Impact of Advancements in Quantum Computing on its Potential Use in Capital Markets”, which is being published concurrently with the publication of this article. This work is part of the OSC’s ongoing consideration of emerging technologies and their potential implications for Ontario’s capital markets. The initiative brought together the OSC’s regulatory and capital markets perspective with the specialized technical expertise of softwareQ Inc., evolutionQ Inc., and the Institute for Quantum Computing at the University of Waterloo.

softwareQ Inc. led the research and preparation of the report, drawing on the quantum-computing and cryptographic expertise of evolutionQ Inc. and the Institute for Quantum Computing. By publishing the report, we are providing market participants with detailed technical insights into the current state and anticipated development of quantum computing, its potential applications across capital market activities, and the operational, cybersecurity, and systemic risks that may arise as the technology matures.

The OSC is an independent Crown agency whose mandate is to provide protection to investors from unfair, improper or fraudulent practices, to foster fair, efficient and competitive capital markets and confidence in the capital markets, to foster capital formation, and to contribute to the stability of the financial system and the reduction of systemic risk.

softwareQ Inc. is a Waterloo-based quantum software company that develops tools and platforms for designing, simulating, optimizing, and executing quantum-computing workflows.

evolutionQ Inc. is a Waterloo-based cybersecurity company focused on quantum-safe technologies, cryptographic risk management, and the transition to resilient cryptographic systems.

The Institute for Quantum Computing, University of Waterloo is an interdisciplinary research institute at the University of Waterloo focused on advancing quantum information science and technology through research, training, and collaboration.

Read full technical report

1 Most computers in existence today are classical computers. They process information in bits that only exist in one of two states: 0 or 1, while quantum computers use qubits governed by the rules of quantum mechanics.

2 Cryptography is the practice of protecting information by using mathematical techniques to keep it confidential, verify its authenticity and integrity, and prevent unauthorized access or alteration.

The Potential of Quantum Computing

The Potential of Quantum Computing

Advances in computing capabilities have consistently reshaped the functioning of financial markets. Historically, improvements in digital communications led to automated trading, innovative ways of managing and pricing risk, and the development of new ways for retail investors to access capital markets. This evolution has empowered investors to invest in and relate to markets differently. As computational capabilities have evolved, so too have the opportunities. For example, modern high-frequency traders now have business models built on rapid processing of millions of orders sent back and forth to exchanges, for example.

Quantum computing represents a new stage in this evolution. Unlike developments, quantum computers are not simply faster. They process information in a fundamentally different way than the traditional circuitry in a server, laptop, or phone.

Quantum computing is not a technology that accelerates all forms of computation. Rather, it is a set of tools that change how computational cost scales for specific situations. Three broad types of computational bottlenecks are particularly relevant in finance:

Simulation and estimation, where cost grows with the number of scenarios required for accuracy;

Optimization, where cost grows with the size and complexity of the solution space; and

Large-scale numerical computation, where cost grows with the size of models and data.

These bottlenecks have traditionally been approached with more computational power and incremental improvements to algorithms over time, but classical computers still require too much time (decades, centuries, even millennia) to solve these problems.

Quantum computing could transform that timescale, turning years-long calculations for classical computers into tasks that could be completed in significantly shorter periods of time, though the actual speedup depends heavily on the specific problem, algorithm, and implementation. This ability presents opportunities, yet the power of quantum computing also introduces new risks—including to foundational technologies like public-key cryptography that underpin trust in market infrastructure.

Quantum computers excel at a certain class of problems, but not all. The transition to quantum is not likely to encompass all aspects of financial computing because classical computers may remain competitive for certain tasks, especially relating to pre- and post-processing work. A key question for financial institutions is to determine where quantum computing could materially change the economics of important workflows and how to prepare for the risks and opportunities associated with this new technology.

3 A classical bit has a definite value at any given time: either 1 or 0. It can be compared to a coin that has already landed as either heads or tails. A quantum bit, or qubit, can instead exist in a superposition, represented as a combination of the 0 and 1 states until it is measured. This is sometimes compared to a coin spinning in the air, although the analogy is imperfect. Quantum algorithms manipulate these superposed states through interference, enabling quantum computers to approach certain problems differently from classical computers and, in some cases, potentially more efficiently.

Ontario and Canada’s Leadership in Quantum Computing

Ontario and Canada’s Leadership in Quantum Computing

Ontario is to a large quantum computing community and one of Canada’s leading quantum technology ecosystems, with significant activity across the Ottawa-Toronto-Waterloo corridor. The province accounts for roughly half of all Canadian quantum companies and brings together a diverse ecosystem of established technology firms, cybersecurity providers, cloud service platforms, and specialized post-quantum cryptography vendors.

Ontario benefits from globally significant research institutes including the Institute for Quantum Computing at the University of Waterloo, the Perimeter Institute for Theoretical Physics, the Centre for Quantum Information and Quantum Control at the University of Toronto, and the Nexus for Quantum Technologies at the University of Ottawa. These institutes are complemented by entities supporting research and commercialization opportunities, such as the Vector Institute and the Creative Destruction Lab. The quantum ecosystem also houses a growing constellation of startups, public and private companies, incubators, and venture investors.

The co-location of a world-class quantum ecosystem with a world-class capital market center could make Ontario’s market participants leaders in harnessing the potential of quantum technologies.

Quantum computing has equally been an area of focus of the Government of Canada. Canada launched its National Quantum Strategy in 2023, which sets out three key missions to ensure Canada stays on the path of quantum innovation and leadership: 4

Make Canada a world leader in the continued development, deployment and use of quantum computing hardware and software—to the benefit of Canadian industry, governments, and citizens;

Ensure the privacy and cyber-security of Canadians in a quantum-enabled world through a national secure quantum communications network and a post-quantum cryptography initiative; and

Enable the Government of Canada and key industries to be developers and early adopters of new quantum sensing technologies.

In June 2025, the Canadian Centre for Cyber Security published Roadmap for the Migration to Post-Quantum Cryptography for the Government of Canada , requiring federal departments to submit initial post-quantum cryptography migration plans by April 2026, with high-priority systems migrated by end of 2031 and all remaining systems by 2035. 5

4 Innovation, Science and Economic Development Canada. (n.d.). Canada’s National Quantum Strategy . Online: ised-isde.canada.ca/site/national-quantum-strategy/en/canadas-national-quantum-strategy .

5 Canadian Centre for Cyber Security. (2025). Roadmap for the migration to post-quantum cryptography for the Government of Canada (ITSM.40.001) . Online: cyber.gc.ca/en/guidance/roadmap-migration-post-quantum-cryptography-government-canada-itsm40001 .

Consistent with the OSC's strategic goal of quickly delivering effective regulatory actions in anticipation of emerging trends, the OSC continuously identifies and monitors trends that impact capital markets. Quantum computing is one such trend, which represents both a potential source of innovation and a source of risk for Ontario's capital markets. Strengthening the OSC’s understanding of quantum computing helps us support responsible innovation and information sharing with market participants.

This article is the first in a series of publications, called OSC Q-Bits, that focus on the latest developments in quantum computing and implications for capital markets and market participants in “bit”-sized pieces. The series will examine emerging opportunities and use cases, as well as associated risks and impacts of this novel technology on Ontario’s capital markets and economy. This work is part of the OSC’s commitment to becoming more proactive and forward-looking in its response to emerging trends. 6 We hope this article and the accompanying technical report contributes to building industry knowledge a technology that could impact the competitiveness of Ontario's capital markets, the evolution of financial services, and the risks faced by regulated entities.

Addressing the implications of quantum computing for capital markets requires collaboration across the regulatory ecosystem. The OSC works with other provincial regulators through the Canadian Securities Administrators (CSA) and internationally through the International Organization of Securities Commissions to information and align policy responses. We also collaborate with other departments and agencies, institutes, and self-regulatory organizations. As quantum technologies continue to evolve, ongoing dialogue across different levels of government and government agencies will support responsible innovation, while mitigating associated risks.

6 OSC. (2025). Notice 11-7101 – Statement of Priorities – Request for Regarding Statement of Priorities for Fiscal Year 2026-2027 . Online : osc.ca/en/securities-law/instruments-rules-policies/1/11-7101/osc-notice-11-7101-statement-priorities-request- -regarding-statement-priorities-fiscal .

1. Quantum computing is advancing rapidly, with a credible path to future impact on capital markets.

Quantum computing represents an evolution of what is computationally feasible. While not expected to improve all computations, it has the potential to significantly change what is feasible for specific classes of problems that are central to financial markets. These classes of problems include areas where current methods are constrained by simulation cost, optimization complexity, or model scale.

2. Prioritize cryptographic migration.

Quantum computing could render existing cryptography standards ineffective and challenge the current cryptographic systems that underpin the integrity and operation of financial markets. In practical terms, nefarious actors could be able to bypass existing security protections and access confidential information, impersonate legitimate parties, alter financial records or authorize transactions without permission. Given advances in quantum computing and the time required to develop quantum-safe cryptographic infrastructure, this vulnerability poses an important and concrete risk to capital markets. Building infrastructure for a world with fault-tolerant quantum computers is a multi-year process. Creating and implementing post quantum migration plans that prioritize critical systems and incorporate ongoing risk assessment and clearly defined objectives and timelines will limit potential failures in the future that could lead to real-time operational and system-wide disruption.

3. Monitor the fault-tolerant timeline.

Development of quantum technologies able to support commercial use cases is at an early stage. Quantum algorithms providing a comparative advantage over classical methods require reliability, something that is difficult for current quantum approaches. A reliable quantum computer is called fault-tolerant. One of the necessary elements for a fault-tolerant quantum computer is the ability to detect and correct errors when they arise, and while some quantum chips have demonstrated this capability, the commercialization of these efforts is still in the future. Institutions would benefit from tracking the timeline for the emergence of fault-tolerant quantum computers and build capability and resilience in parallel, given the high-potential and multi-year nature of this transition.

4. Inventory all cryptographic assets and identify vulnerable data.

Under a strategy called “harvest now, decrypt later”, actors are intercepting and storing encrypted data with the intent to store it until a quantum computer is sufficiently robust and powerful to decrypt it. Market participants hold datasets that may remain sensitive for decades, well past when such a computer may exist. This emerging risk highlights the importance of inventorying all cryptographic assets and adopting a risk-based approach that prioritizes mitigation efforts on systems storing these datasets. See "Why the Risk Matters Today" under the "Quantum Security in Capital Markets" tab.

5. Develop expertise and awareness .

Organizations that understand quantum algorithms will have first-mover advantage when hardware matures. Building institutional "quantum muscle memory" will allow organizations to build the organizational capability to identify quantum-relevant problems, evaluate them, and deploy quantum solutions when they become practical. Starting this process in 2029 or 2030 may be too late given the steep learning curve.

6. Implications regarding third-party service providers and business continuity planning .

Most financial infrastructure relies on a small set of widely adopted cryptographic approaches where the failure of a single class of cryptographic algorithms does not result in isolated breaches but rather can lead to simultaneous degradation of security guarantees across the system. This concentration is further amplified by cryptographic supply chain dependencies. Financial institutions rely on hardware vendors, cloud providers, software platforms, and network operators whose products embed common cryptographic libraries and protocols. Effective oversight of third-party service providers and thoroughly developed business continuity plans can mitigate risks tied to overreliance on any one system.

A transition to post-quantum cryptography should be a coordinated transformation across an interdependent ecosystem. Governments, regulatory bodies, and industry associations can play a role in supporting an orderly, coordinated transition. This may involve aligning on target timelines for high-priority use cases with accountability across the ecosystem. The overall security of the financial system becomes constrained by its least-prepared components—whether a legacy system, a third-party vendor, or a cross-border dependency. A large-scale cryptographic failure would undermine the trust mechanisms that enable financial transactions themselves.

Quantum Security in Capital Markets

Quantum Security in Capital Markets

Quantum computing technology has made significant advancements, and capital markets participants are just beginning to understand the benefits it could deliver. However, it also introduces a credible and time-sensitive risk to the cryptographic methods that secure the digital economy and provide trust to those who rely on it.

As traditional computers and the internet developed, so too did the need for computer security. Commercial research, national secrets, and financial information became digitized, necessitating the development of encryption, authentication, and other methods for secure communication. Without cryptography protecting this information, and associated digital communications, it is unlikely that trust would have evolved to support the wide range of activities conducted today over public networks. Cryptography has been so successful that it has become embedded in a variety of systems and security devices, going largely unnoticed except by those who directly support it. Today’s computers can perform billions of large-scale mathematical operations per second. Yet traditional computers, as powerful as they are, still have limitations in what they can calculate. These limitations form the basis of many information security methods in use today through approaches like RSA cryptography.

Quantum computing could change that, undermining the foundation of some implementations of computer security with the ability to solve problems in seconds that would otherwise take years. While this possibility has not yet materialized, researchers are already working to harden current approaches against quantum attacks. Understanding the nature, impact and probability of this quantum threat, and determining when and how to act on it will support risk mitigation efforts. The quantum threat represents a more strategic challenge with no quick and easy solution.

Many cybersecurity incidents exploit errors in how technology is implemented, configured, understood or used. These incidents can often be addressed by identifying and correcting the underlying error. The quantum threat is different because it does not stem from a discrete implementation or configuration error that can be resolved through a simple patch. It arises from weaknesses in the fundamental mathematics that underpins commonly used cryptography.

Consider potential cybersecurity threats to be a stream of water, and our cybersecurity defences form a dam that keeps these threats from flooding our systems. Periodically, someone finds a way to poke a hole in the dam, creating a cyber event. Security specialists arrive and patch the hole to minimize the impact. The development of a sufficiently powerful and error-corrected quantum computer would mean the collapse of the entire dam. Unless a new dam has already been constructed, the resulting flood of cybersecurity events will become a crisis that impacts everyone.

This risk is compounded by the fact that modern financial systems are increasingly automated and data-driven, including the growing use of AI systems in trading, risk management, fraud detection, and operational decision-making. These systems depend on the integrity and authenticity of data and system interactions, which are enforced through cryptographic mechanisms. A breakdown in these mechanisms could result in corrupted inputs, spoofed signals, or unauthorized actions being propagated through operational workflows, potentially at scale and at machine speed, with limited opportunity for human intervention. The technology for this remains theoretical, but there are still current risks that warrant attention.

The “Harvest Now, Decrypt Later” Threat

Figure 1 Diagram showing the harvest now, decrypt later attack timeline. It is estimated that adversarial actors are currently in step 2, as they wait for a quantum computer capable of running Shor’s algorithm. Credit: Palo Alto Networks (source: .).

While sufficiently powerful and robust quantum computers are years or even decades away, the most immediate risk is that adversaries are already intercepting and storing encrypted data with the intent to store it until such a machine is available. This strategy, known as “harvest now, decrypt later” means that data encrypted today is at risk if it retains value beyond the arrival of cryptographically relevant quantum computers 7 . For capital markets, examples include information that may remain sensitive for several years including trade secrets, M&A communications, proprietary trading strategies, client data, and regulatory correspondence.

A cryptographic asset inventory is a comprehensive record of where and how cryptography is used across an organization, including the algorithms, keys, certificates, protocols, libraries, and hardware that protect data and systems. Developing and maintaining this inventory allows an organization to identify quantum-vulnerable cryptography, understand dependencies across applications and third-party services, and assess which sensitive data and critical functions are most exposed. This visibility is a first step in developing a risk-based migration plan, enabling organizations to prioritize high-impact systems, coordinate upgrades with vendors, and replace vulnerable cryptography with quantum-safe alternatives in a timely and orderly manner. These measures help prevent malicious actors from using future quantum capabilities to decrypt data they intercept and store today. However, these measures will only reduce risks relating to data harvested after they have been implemented; they cannot retroactively protect data harvested prior to migration.

7 Palo Alto Networks. (n.d.). What Is Harvest Now, Decrypt Later (HNDL)?. Online: paloaltonetworks.com/cyberpedia/harvest-now-decrypt-later-hndl .

There is no consensus on when a cryptographically relevant quantum computer will come into existence, a milestone often referred to as “Q-Day”. Estimates range from the late 2020s to 2045 or later. The Global Risk Institute’s annual expert survey has tracked a gradual shift toward earlier timelines, with a growing minority of experts assigning significant probability to a cryptographically relevant quantum computer over the 5 years. 8 Certain global technology vendors have publicly announced that they are targeting the creation of such a computer on faster timelines. The implication of harvest now, decrypt later attacks means that expected date is less critical than the time for market participants to migrate to post-quantum cryptography and the shelf life of sensitive data.

Estimates of when quantum capabilities may emerge should be treated as inputs to risk assessment rather than precise forecasts.

The more practical question is when the likelihood of a specific quantum capability, combined with the potential impact, exceeds an organization’s acceptable risk threshold. Different organizations may therefore arrive at different timelines for action, depending on their exposure, the sensitivity and longevity of their data, and the consequences of a delayed response.

Once quantum computers cross key technical thresholds in solving current cryptographic approaches, systems that appear secure will become vulnerable over a relatively short period. Perhaps most significantly, the development of a cryptographically relevant quantum computer may not be publicly disclosed until sometime after the event. The security of deployed systems may appear intact, with the harm only becoming apparent later.

Market participants may not fully appreciate the extent of the effort required to address the quantum threat. In many cases, comprehensive inventories of cryptography do not exist, cryptographic dependencies by applications and systems are undocumented, and the implications of making widespread changes to cryptographic algorithms are not understood. An enterprise would benefit from addressing these gaps before it is ready to begin mitigating the risk represented by quantum technology.

8 Mosca, M., & Piani, M. (2026). Quantum threat timeline report 2025 . Global Risk Institute. Online: globalriskinstitute.org/mp-files/pdf-quantum-threat-timeline-report-2025.pdf/ ; Mosca, M., & Piani, M. (2024). Quantum threat timeline report 2024 . Global Risk Institute. Online: globalriskinstitute.org/mp-files/quantum-threat-timeline-report-2024.pdf/ .

Post-quantum cryptography refers to classical cryptographic algorithms that are believed to be resistant to attack by both classical and quantum computers. Transitioning to post-quantum cryptography is not a software patch. For many organizations, it represents a multi-year infrastructure transformation that begins with finding, mapping, and cataloging all cryptographic assets; identifying dependencies across systems, whether developed in-house or provided by third-party service providers; assessing the quantum readiness of third-party service providers; and modernizing certificates and cryptographic key management. It also affects encryption protocols, hardware security modules, network equipment, and applications. Migration timelines are often measured in years rather than months. Despite the prolonged timeline for the realization of quantum-related threats, acting in a timely manner could mitigate significant costs and promote organizational preparedness.

Despite apparent diversity in vendors and platforms, most financial infrastructure relies on a small set of widely adopted cryptographic approaches (i.e., RSA, ECC, Diffie–Hellman, and TLS-based protocols). This creates a form of hidden monoculture and cryptographic concentration.

Multiple systems that appear independent are, in practice, dependent on the same underlying security assumptions. This concentration reflects the deliberate use of widely vetted, standards-based mechanisms to ensure interoperability. The challenge is to preserve these properties while introducing sufficient diversity and agility within a managed set of high-quality, standards-based approaches to reduce systemic fragility.

In such an environment, the failure of a single class of cryptographic algorithms does not result in isolated breaches—it can lead to simultaneous degradation of security guarantees across the system. This includes impacts on:

• Secure messaging (e.g., communications between market participants);

• Payment system integrity;

• Clearing and settlement validation;

• Authentication of institutions and counterparties; and

• Legal enforceability of digitally signed transactions.

This concentration is further amplified by cryptographic supply chain dependencies. Financial institutions rely on hardware vendors, cloud providers, software platforms, and network operators whose products embed common cryptographic libraries and protocols. Effective oversight of third parties and thoroughly developed business continuity plans can mitigate risks tied to overreliance on any one system.

A transition to post-quantum cryptography is not just a unilateral upgrade, but a coordinated transformation across an interdependent ecosystem. 9 Governments, regulatory bodies, and industry associations can play a role in supporting an orderly, coordinated transition.

If this transition is uneven, incomplete, or delayed, systemic vulnerabilities may emerge. In practice, this implies aligning on target timelines for high-priority use cases, including when quantum-safe mechanisms must be available and when vulnerable cryptographic schemes must be deprecated, supported by clear milestones and accountability across the ecosystem. The overall security of the financial system becomes constrained by its least-prepared components—whether a legacy system, a third-party vendor, or a cross-border dependency.

Unlike traditional financial crises, which originate in credit, liquidity, or market exposures, a large-scale cryptographic failure could undermine the trust mechanisms that enable financial transactions themselves. In extreme cases, this could impair:

• Transaction integrity;

• Counterparty authentication;

• Confidentiality of sensitive financial data; and

• The operational continuity of payment, clearing, and settlement systems.

Cyber risk at the infrastructure level is not simply a future cybersecurity concern, it is a structural vulnerability in the shared trust fabric of the financial system. Given this infrastructure is globally interconnected and cryptographically interdependent, delayed or uncoordinated migration materially increases the risk of a system-wide disruption. Addressing this vulnerability requires coordinated action across institutions, vendors, and jurisdictions, as well as a shift toward cryptographic agility, diversification, and system-level resilience.

9 The Financial Services Information Sharing and Analysis Center. (2025). The Timeline for Post Quantum Cryptographic Migration. Online: fsisac.com/the-timeline-for-post-quantum-cryptographic-migration .

Considerable time is required to evaluate, test, and trust new cryptography, even before considering the cost and time required to acquire and install new hardware and software.

Those who proactively invest in quantum safe migration could achieve several possible benefits:

The ability to influence the development of cryptographic tools, providing the maximum assurance that they will meet the operational requirements of their organization;

Early access to the pool of talent and expertise that can guide the organization’s migration process;

Prepare for support contract renewals by developing clauses requiring post-quantum cryptography knowledge and expertise;

Demonstrate that they have earned the trust placed by clients, industry partners, and regulators to protect sensitive information; and

Time to develop strategic security solutions that address long-term cryptographic resilience and incorporate defence-in-depth approaches.

Those who wait too long to begin their quantum migration may need to address it as a crisis response as they compete with other organizations for scarce hardware, software, and expertise. The emergence of a cryptographically relevant quantum computer will leave their sensitive information vulnerable to exploitation, which could undermine trust in the organization. In some cases, this could even lead to questions financial liability as once a cryptographically relevant quantum computer is developed, it may be impossible to prove that a quantum computer was not used to breach communications security.

Ultimately, those organizations that have completed their quantum migration before the arrival of a cryptographically relevant quantum computer will likely be better prepared to protect their reputation as a trustworthy custodian of sensitive personal and financial information. Others may be perceived as unaware of or unconcerned with the risks associated with emerging technologies.

Conclusion and Providing Feedback

Conclusion and Providing Feedback

Ontario capital market participants are uniquely positioned to engage in preparing for and embracing the benefits of quantum computing as well as the associated risks. Realizing this opportunity will require coordination between governments, agencies, industry, and research institutions to translate academic success into commercial capability, build quantum-ready talent and infrastructure, and to promote responsible quantum adoption in a way that strengthens trust, resilience, and competitiveness across the economy.

Quantum computing is an emerging technology that could one day significantly impact capital markets, but technical challenges remain before quantum technologies can support viable use cases. Industry roadmaps place the development of utility-scale fault tolerant machines in the early-to-mid 2030s, with certain technology vendors aiming to create such a machine on faster timelines. The precise timeline is uncertain, and any single breakthrough (or setback) can compress or delay Q-Day by years. However, capital market participants would benefit from considering the set of strategic decisions that they should take in advance of that horizon.

The cryptographic threat is a significant quantum-related risk that market participants would benefit from actively considering. Nefarious actors are likely storing encrypted information now for decryption after a cryptographically relevant quantum computer has been developed. This risk underscores the importance of proactively taking steps to inventory cryptographic assets to identify quantum-vulnerable cryptography, understand dependencies, and assess which sensitive data and critical functions are most exposed. Migration timelines for large institutions to adopt quantum-safe encryption technologies are consistently estimated at 5 to 15 years. Only a minority of organizations globally have begun. In this area, inaction, rather than action, carries the larger risk.

The OSC is already actively collaborating with domestic and international partners on quantum computing. Within Canada, the OSC is also co-leading an initiative of the CSA with the Alberta Securities Commission on the implications of quantum computing for Canadian capital markets. The initiative focuses on commercial and regulatory use cases of quantum computing, as well as risks and opportunities posed by advances in quantum computing technology. Internationally, the OSC is contributing to work by the International Organization of Securities Commissions on four key areas: (i) applications of quantum computing in financial markets, (ii) vulnerabilities in blockchain systems and firms’ data systems, (iii) capacity in quantum computing and quantum preparedness, and (iv) quantum preparedness measures being undertaken by jurisdictions globally. We hope to keep market participants informed of any learnings from these efforts in future publications in the OSC’s Q-Bits series.

The OSC recognizes that early movers will be better positioned to capture benefits of quantum computing and to protect against risks it poses, while laggards may be more exposed to disruption. Based on publicly available publications, today’s early movers are large globally active banks with large resources and in-house research capacity. Through initiatives like the OSC’s Q-Bits series, we hope to help all market participants focus their resources on areas that most impact their market activities. The OSC will consider how guidance and additional tools can also support this goal. Currently, market participants would benefit from focusing their resources on upgrading authentication methods, securing digital signatures and updating overall business continuity planning outlined in the "Quantum Security in Capital Markets" tab under “Structural Cryptographic Vulnerabilities”, as well as on the cryptographic risks outlined in the "Quantum Security in Capital Markets" tab under "Why the Risk Matters Today" and "Building Post-Quantum Cryptography”.

Topics of future publications in our OSC Q-Bits series on quantum computing may include:

Types of quantum algorithms and capital market use cases supported by these algorithms;

Challenges to adoption of quantum computing technologies;

Intersection of the use of AI systems and quantum computing; and

Quantum computing as a focus sector for economic growth and capital formation in Ontario.

The OSC welcomes feedback on how it can support market participants in their migration to post-quantum cryptography. If you have any questions or the OSC’s work relating to quantum computing, or would like to implications and risks relating to quantum computing that are not covered in this article, please the following:

Levin Karg Head of Modernizing Regulation Regulatory Transformation & Strategic Research (RTSR) Tel: 416-593-3661 [email protected]

Nick Hawkins Senior Policy Advisor, Legal RTSR Tel: 416-596-4267 [email protected]