The Clock Is Now Visible: What McKinsey's 2026 Quantum Technology Monitor Means for Financial Institutions

May 20, 2026 | Joel Van Dyk

McKinsey released its Quantum Technology Monitor for April 2026 (https://www.mckinsey.com/capabilities/mckinsey-technology/our-insights/mckinsey-quantum-technology-monitor-2026-a-commercial-tipping-point), and if you are a senior technologist or risk executive at a financial institution, several data points in this report deserve your undivided attention. Not because McKinsey has discovered something new — the underlying dynamics have been visible for years to those paying close attention — but because this report marks the moment when the trajectory became undeniable at the board level.

The clock is ticking

Let me focus on what matters most for finance and banking, and add some practitioner perspective that consulting reports, by their nature, tend to leave out.

The Investment Signal You Cannot Ignore

Quantum technology start-up investment grew 6.3x in a single year, from $2.0B in 2024 to $12.6B in 2025. Over 90% of that capital went into quantum computing specifically. This is not a marginal uptick — it is a phase transition in how capital allocators perceive near-term commercial viability.

For financial institutions, the implication is not that you need to invest in quantum hardware companies. The implication is that the ecosystem accelerating toward cryptographically relevant quantum computing is now substantially better funded than it was twelve months ago. Every dollar flowing into error-correction research, logical qubit development, and fault-tolerant architecture is compressing the timeline to Q-Day. IBM has publicly committed to a credible fault-tolerant system by 2029. Quantinuum launched Helios with 99.921% two-qubit gate fidelity. IonQ has published a road map targeting 80,000 logical qubits by 2030.

These are not aspirational press releases anymore. These are funded engineering programmes with measurable milestones.

Finance Is the High-Stakes Vertical — On Both Sides of the Ledger

McKinsey estimates the value at stake for quantum computing in financial services at $400B–$600B by 2035. That number spans investment banking, asset and wealth management, payments, retail banking, corporate banking, and risk and cybersecurity. The value hypotheses include faster Monte Carlo simulations for derivative pricing, collateral optimisation, fraud detection at scale, and real-time credit decisioning.

HSBC and IBM demonstrated what McKinsey describes as the world's first quantum-enabled algorithmic trading in 2025. JPMorgan Chase ran a certified quantum randomness protocol on Quantinuum's 56-qubit H2 system in collaboration with Argonne, Oak Ridge, and UT Austin. These are not proof-of-concept curiosities. They are the leading indicators of a co-development model that is now the dominant commercial engagement pattern between financial institutions and quantum technology companies.

So the opportunity side is real and the timeline is compressing. But the security side of this equation is the one that should be driving board-level urgency today — not in 2028.

Q-Day Is the Existential Risk, Not the Opportunity

The report makes a point that practitioners in this space have been making for years, now stated plainly in a McKinsey publication: "With the accelerated approach of Q-Day, pressure is increasing to migrate to quantum-safe solutions, driven by attention to systemic cyber risk."

There it is. Systemic cyber risk. For a globally systemically important financial institution, that language should land differently than it does for a pharmaceutical company or an automotive OEM.

Financial institutions hold three categories of data that make the harvest-now-decrypt-later (HNDL) threat uniquely dangerous:

Long-dated encrypted transaction records. Settlement records, loan documentation, cross-border payment instructions, and structured finance data encrypted today may still be commercially and legally sensitive in 2030–2035, precisely when cryptographically relevant quantum computers are most likely to be accessible to well-resourced adversaries.

Authentication and identity infrastructure. The PKI underpinning everything from customer authentication to interbank settlement relies on RSA and ECC — both broken by Shor's algorithm at sufficient qubit scale. The migration complexity here is not trivial. It involves hardware security modules, certificate authorities, API gateways, legacy mainframe interfaces, and vendor dependencies that most institutions have not fully inventoried.

Interconnection risk. Financial market infrastructure — payment systems, central securities depositories, central counterparties — operates on a web of bilateral and multilateral cryptographic trust. A single weak link in that web is a systemic risk, not just an institutional one. NIST's ML-KEM, ML-DSA, and SLH-DSA standards are final. The migration clock started the moment those standards were published. It has not stopped.

What McKinsey Gets Right — and What Deserves More Nuance

The report correctly identifies North America as showing strong quantum adoption in finance, reflecting early ecosystem development. It correctly notes that Europe leads quantum readiness across most industries, with nearly half of the top three companies in most sectors being German. The geographic nuance matters: European institutions operating under DORA, ECB guidance, and NIS2 face a regulatory compliance vector for PQC migration that North American institutions are only beginning to feel from CISA and OMB directives.

Where I would push for more specificity is around the migration complexity inside financial institutions. The report frames the PQC transition as a matter of migrating to quantum-safe solutions — which is accurate but undersells the operational challenge. In practice, a large financial institution's cryptographic estate spans thousands of applications, dozens of HSM vendors, legacy COBOL-era mainframe stacks, real-time payment infrastructure with sub-millisecond latency requirements, and third-party vendor dependencies where the institution has no direct control over the migration timeline.

A Y2K-style enterprise transformation programme is the right mental model. And like Y2K, the institutions that succeed will be those that started their cryptographic inventory and risk classification work years before the deadline, not the ones waiting for regulators to mandate action.

The Talent Problem Nobody Is Talking About Loudly Enough

McKinsey's report mentions the shift from exploration to scaled value capture and references the importance of internal capabilities delivering competitive advantage. That is correct. What it does not fully surface is that the genuine scarcity constraining PQC and quantum security programmes at financial institutions is not budget — it is people.

The intersection of lattice-based cryptography, classical security architecture, financial infrastructure, and regulatory compliance is extraordinarily narrow. The number of practitioners who can meaningfully evaluate an ML-KEM implementation in a payment gateway, understand the TLS 1.3 hybrid key exchange implications for a real-time gross settlement system, and communicate the risk economics to a board-level audience in the same week — that population is very small.

Financial institutions that treat PQC migration as a procurement exercise — buy a tool, tick a box — will find themselves exposed. The institutions that build or acquire genuine human expertise now, before the demand peak, will have a structural advantage that compounds over the migration window.

What Should You Actually Do?

The McKinsey report is, correctly, descriptive rather than prescriptive for specific institutional action. For practitioners, the practical priorities are these:

First, complete a cryptographic inventory. You cannot prioritise migration without knowing what you have. Most large institutions have started; fewer have finished. The inventory needs to cover not just your own applications but your critical vendor and counterparty dependencies.

Second, classify your data by sensitivity lifetime. Data that needs to remain confidential beyond 2030 is already at risk from HNDL attacks by adversaries with the resources to store encrypted traffic at scale.

Third, engage your HSM and PKI vendors now. The migration window for hardware security modules is long. Lead times for FIPS 140-3 validated PQC-capable hardware are not trivial, and the queue is lengthening.

Fourth, run a hybrid deployment in at least one production system. ML-KEM hybrid key exchange is implementable today in TLS 1.3. Running it in production — even in a non-critical system — builds institutional knowledge and surfaces integration issues before you are doing this under deadline pressure.

Fifth, engage your regulators before they engage you. DORA, the ECB, the Bank of England's CQUEST guidance, and US federal frameworks are all moving in the same direction. The institutions that are already in dialogue with their supervisors on PQC migration timelines will have more flexibility in how and when they comply than those who arrive late to the conversation.

The McKinsey Quantum Technology Monitor is a useful benchmark document. The headline numbers — $12.6B in 2025 investment, $400B–$600B in potential value for financial services by 2035, a 6.3x year-on-year investment surge — confirm that quantum technology has crossed from speculative to strategic. For financial institutions, the message is the same one that practitioners in this space have been delivering for several years: the opportunity is real, the risk is real, and the migration window is shorter than it looks from the outside.

The clock is now visible. Act accordingly.

Joel Van Dyk is a cybersecurity architect with thirty years of experience at systemically important financial institutions including JPMorgan, DTCC, LSEG, and State Street. He is a member of the FS-ISAC Post-Quantum Cryptography Working Group and holds an MS in Physics from NYU. Views expressed are his own.