RBI asks payment operators to start quantum-proofing

The Reserve Bank of India (RBI) has urged payment system operators in India to commence efforts towards quantum-proofing the country's financial infrastructure. The warning highlights the 'harvest now, decrypt later' threat, where encrypted data captured today could be deciphered by future quantum computers.

Speaking at the Global Fintech Fest in Mumbai, RBI Deputy Governor Shirish Chandra Murmu acknowledged that quantum computing is not an immediate threat. However, he stressed that the long technology cycles and deeply embedded cryptographic dependencies within payment systems necessitate proactive measures. The 'harvest now, decrypt later' risk means adversaries can store intercepted data today and decrypt it once quantum computing capabilities become available.

Murmu emphasized that quantum readiness should be integrated into India's broader cybersecurity strategy rather than treated as a standalone initiative. He stated that quantum resilience is an ecosystem capability requiring collaborative action from banks, payment operators, fintech companies, and technology providers. The sheer volume of transactions processed by systems like the Unified Payments Interface (UPI) underscores the scale of this challenge.

The deputy governor cited Project LEAP, an initiative involving the Bank for International Settlements (BIS) and partner central banks, as a precedent for the time and effort required for such cryptographic transitions. However, no specific timelines or migration standards were announced, leaving the directive as an exhortation rather than a mandate.

Beyond quantum concerns, the RBI is also examining responses to its discussion paper on safeguarding digital payments against fraud. The central bank is developing platforms for fraud detection and emphasizes that while technology can facilitate services, ultimate responsibility for financial decisions and their consequences rests with regulated institutions and their leadership.