Quantum computing in finance: what banks can do today

Banks and insurers can run quantum experiments today, and a few large ones do, but no financial institution has shown a quantum computer beating classical systems on a production task. The honest 2026 answer for a CIO or head of quant research: fund small, well-measured experiments if you have the people, and put real money into post-quantum cryptography, because that part has deadlines.

The rest of this article separates the two, with the evidence behind each claim.

What can quantum computing do for banks today?

Today, quantum computing in finance is a research activity. Banks use cloud access to IBM, Quantinuum and other machines to test algorithms on small versions of real problems, mostly optimization, sampling and machine learning. None of these tests has produced an advantage that holds up in daily operations.

That doesn’t make the experiments pointless. They build internal skills, they tell you which problems might benefit later, and they give you a way to judge vendor claims. But you should budget for them as research and development, not as a cost-saving project.

Here is where the main use cases stand in September 2026:

The last row is different from the others. It doesn’t need a quantum computer at all. It’s the defense against one.

What did HSBC and IBM show?

On 25 September 2025, HSBC announced that a trial with IBM gave up to a 34% improvement in predicting whether a quote in the European corporate bond market would be filled, compared with common classical techniques. The work ran on IBM’s Heron processors combined with classical computing, on real, production-scale trading data.

The announcement got wide press coverage, and it was challenged the same day. Scott Aaronson, a computer scientist at the University of Texas at Austin, pointed out that the paper’s own results showed the gain disappearing when the quantum circuits were simulated without noise. His reading: the improvement came from the hardware’s noise acting as a kind of random feature, not from quantum computation, and he called it a “qombie” (a zombie claim of quantum advantage).

You don’t have to pick a side to learn from this. A result that shrinks under a noiseless simulation is not yet something to build a trading desk around. If a vendor shows you a similar percentage, ask three things: what the classical baseline was, whether the result survives replication on different hardware, and how many other configurations were tried and not reported.

What did JPMorganChase and Quantinuum demonstrate?

In a Nature paper published on 26 March 2025, JPMorganChase, Quantinuum and US national laboratories used Quantinuum’s 56-qubit H2-1 trapped-ion processor to produce random numbers that a classical computer could certify as fresh. The team generated more than 70,000 certified random bits, and checking them took over 1.1 exaflops of classical supercomputing.

This result is more solid than the HSBC one because it rests on a task with a formal argument that classical machines struggle to fake. It is also narrow. Certified randomness matters for cryptography and for proving that a draw or an allocation was fair, but the verification cost means it is not a product you can buy today. JPMorganChase is also listed as a launch customer of Quantinuum’s Helios machine (November 2025), which tells you the bank is keeping a research line open, not that it has a production use.

When could quantum speed up Monte Carlo and derivative pricing?

Not with current hardware, and probably not before the 2030s. A widely cited estimate comes from researchers at Goldman Sachs and IBM, published in the journal Quantum in 2021: pricing certain derivatives faster than classical methods would need about 8,000 logical qubits and a T-depth of 54 million, finishing in about one second.

Compare that with one of the most detailed public hardware plans. IBM’s roadmap targets Starling in 2029, a fault-tolerant machine with 200 logical qubits able to run 100 million gates. That is a big step, and it is still well short of the derivative-pricing threshold. Algorithms will improve and estimates may come down (the estimate for breaking RSA-2048 dropped sharply between 2019 and 2025), so this gap can shrink. But anyone telling a risk committee that quantum Monte Carlo will cut compute costs in 2027 is not working from published numbers.

Where do insurers fit?

Insurers have the same two stories as banks, with different weights. On the opportunity side, pricing and capital models rely heavily on Monte Carlo simulation, so the derivative-pricing analysis above applies: the speedup is real in theory and needs fault-tolerant hardware in practice. Catastrophe and climate models are also candidates for future quantum simulation, but there are no published insurance results comparable to the HSBC trial.

On the risk side, insurers are often more exposed than banks. Life and health policies can run for decades, and the personal and medical data behind them has to stay confidential for that long. Data encrypted with RSA or elliptic-curve keys and copied today could be read once a large enough quantum computer exists, which is why harvest now, decrypt later attacks worry security teams now. Our page on quantum risk for insurers goes into the specific systems.

Which part has a deadline: post-quantum cryptography

For financial institutions, the only quantum topic with dates attached is the move to post-quantum cryptography (PQC). NIST published the first three standards, FIPS 203, 204 and 205, on 13 August 2024, and its draft IR 8547 (November 2024) proposes deprecating RSA and elliptic-curve algorithms at the 112-bit security level after 2030 and disallowing them after 2035.

The financial sector now has its own reference. In January 2026, the G7 Cyber Expert Group, which advises G7 finance ministers and central bank governors, published a roadmap for the sector. It is explicitly non-binding. It points to 2035 as the overall target for moving to quantum-resistant cryptography and suggests addressing the most critical systems around 2030 to 2032. It lays out six phases: awareness and preparation, discovery and inventory, risk assessment and planning, migration execution, migration testing, and validation and monitoring.

Large technology providers are moving faster than that. Google set 2029 as its own migration deadline on 25 March 2026, putting authentication and digital signatures first, and Microsoft moved its program target to 2029 on 30 June 2026. When your cloud, browser and operating system vendors finish in 2029, the older systems inside your bank become the weakest link. Our post-quantum migration deadlines tracker lists the dates by jurisdiction.

What does this mean for Latin American banks and insurers?

No G7 document binds a bank in Bogotá, Mexico City or Santiago. But Latin American institutions inherit these timelines through correspondent banks, card networks, cloud providers and parent companies abroad.

Preparation is low. IBM Institute for Business Value data reported on 3 June 2026 showed that only 33% of Colombian executives surveyed are putting quantum-resistant cryptography in place, and 71% of Latin American organizations name the shortage of specialized skills as a major barrier to quantum adoption. In Mexico, the Asociación Mexicana de Internet (AIMX) set up the Consejo Consultivo Quantum Safe México on 22 September 2026 to issue recommendations to authorities, regulators and companies. We cover the regional picture in more depth in the roadmap for Latin American banks.

How should a bank split its quantum budget in 2026?

Most of it should go to cryptography, and a small, bounded part to experiments. A reasonable split for a mid-sized bank looks like this:

1. Cryptographic inventory first. Find where RSA and elliptic-curve algorithms protect long-lived data: core banking links, card processing, HSMs, backups, partner APIs and vendor products. Every roadmap, from the G7’s to the UK NCSC’s, puts this step near the start. Our post-quantum cryptography migration service is built around this step.
2. One or two scoped experiments, only if you have quantitative staff to run them. Pick a problem with a clean classical baseline (a portfolio construction task, a sampling problem), set a success threshold before you start, and publish the result internally even if it is negative. A structured use case discovery keeps this from turning into a demo for the board.
3. A watch list with triggers. Decide in advance which external signals would change your plan, for example a vendor delivering logical qubits at a stated error rate, or your regulator publishing a PQC deadline.
4. Skills. Train a few people in security and quantitative teams so you can read papers and vendor claims yourself.

If you run a bank or an insurer and want to see where quantum touches your systems, start with the banking and finance overview, then look at the quantum readiness assessment: it ranks your cryptographic exposure against how long your data must stay secret, and it tells you which experiments, if any, are worth funding this year.