Quantum computing, cybersecurity and financial sovereignty in Latin America

Progress in quantum error correction, together with binding policy action in the United States and a coordinated roadmap in the European Union, is shortening the practical planning horizon for migrating away from quantum-vulnerable public-key cryptography. This rapid expert consultation from QTC-CO examines what that means for Latin America — and what the region should do now.

The risk horizon is contracting

The most consequential development of the past year is not a new machine, but a change in what experts expect one to require. Recent estimates suggest factoring an RSA-2048 integer could become feasible with far fewer qubits than previously projected — a resource requirement that has fallen by more than an order of magnitude without a corresponding leap in deployed hardware. That is not evidence such a machine exists today, but evidence that planning assumptions anchored to older estimates may already be stale.

The Mosca inequality offers a more defensible planning framework than any single "Q-Day" prediction: if the required confidentiality lifetime of data, plus the time needed to migrate the systems protecting it, exceeds the time until a capable adversary obtains a CRQC, an institution is already outside a safe planning window. For institutions holding financial records, health data or state secrets, that window may be closer than it appears.

Major powers are treating quantum capability as infrastructure

In June 2026 the United States issued executive orders setting federal migration deadlines — post-quantum key establishment by the end of 2030 and post-quantum digital signatures by the end of 2031 — and extending those requirements to federal contractors. Quantum-safe cryptography is becoming a condition of doing business with the U.S. government, and by extension with the private counterparties that align to federal expectations.

The European Union has paired strategic ambition with a coordinated roadmap: Member States are asked to begin transition activities by the end of 2026, protect critical infrastructure by 2030, and complete broader migration by 2035, with a proposed amendment to the NIS2 Directive that would make post-quantum planning a named statutory component of national cybersecurity strategy.

What this means for Latin America

Post-quantum migration is not a routine software upgrade — public-key cryptography is embedded in identity systems, payment rails, digital signatures, VPNs, hardware security modules, certificates and connected devices. A region that adopts standards it did not help design, on timelines it did not help set, becomes a rule-taker in one of the defining infrastructures of the coming decade. For Latin America, sovereignty should mean informed participation: the capacity to evaluate standards, influence implementation profiles, build local assurance capability and negotiate procurement requirements.

An uneven transition could also divide financial institutions into those able to demonstrate quantum-safe controls and those unable to do so — a gradual repricing of counterparty risk through due diligence, insurance, correspondent-banking requirements and supervisory expectations, rather than a single disconnection event on "Q-Day." In Colombia, reporting points to a rising volume of attempted cyberattacks against the financial system, while formal quantum-specific migration requirements and guidance remain limited. Roughly seven in ten Latin American organizations surveyed regionally identified a shortage of quantum expertise as an obstacle to adoption — institutional preparedness matters as much as hardware maturity.

A regional action agenda

1. Discover the cryptographic estate — build shared, repeatable inventories of cryptographic assets and dependencies across academia, government and industry.
2. Prioritize by consequence and confidentiality horizon — rank migrations by service criticality, exposure and data lifetime, not just ease of replacement.
3. Align with finalized standards and preserve agility — adopt NIST's ML-KEM, ML-DSA and SLH-DSA as they mature, and design for algorithm substitution and rollback.
4. Use the transition window deliberately — national supervisors should publish sector-specific migration timelines and reporting requirements.
5. Establish continuous assurance — treat quantum readiness as an ongoing operating posture, not a one-off project.
6. Build the workforce and implementation commons — shared curricula, apprenticeships and double-degree arrangements across the region.
7. Use scientific diplomacy to coordinate the transition — a regional convening node connecting academia, government, defence, finance and telecom operators.

The role of QTC-CO

Quantum Think Centre Colombia (QTC-CO) positions itself as an evidence and coordination institution, articulating academia, national defence, industry and international diplomacy around an ethical and sovereign quantum agenda — anchored in its six pillars: science with purpose, technology with conscience, diplomacy with impact, sovereignty and cyberdefence, sustainability, and inclusion and equity. A practical mandate includes a regional cryptographic-inventory methodology, reference implementation profiles, independent readiness assessments, training pathways and a forum for scientific diplomacy.

Conclusion

The date of decisive cryptanalytic capability is uncertain, but the time required to replace vulnerable cryptography is long, and the confidentiality clock for captured data is already running. Latin America can reduce its exposure without predicting Q-Day: discover cryptographic dependencies as a shared regional effort, prioritize long-lived and critical assets, migrate toward finalized standards, engineer crypto-agility, give institutions supervisory timelines they can plan against, test continuously, develop specialist talent, and coordinate regionally — moving the region from rule-taker to co-author.