Financial Services & Payments PQC
Card authentication, tokenization, authorization networks and POS terminals; interbank settlement rails, bank key management and key blocks; and the sector regulation that sets the migration pace.
Why this matters: Cards, banking rails and retail checkout share cryptography, share vendors, and increasingly share deadlines — but are usually migrated by different teams reading different documents. One un-migrated link is a fraud vector at scale, and no single institution can fix a correspondent chain alone.
Start here: Step through an EMV flow in the Transaction Simulator — online, offline DDA/CDA, contactless or mobile — and see which messages are quantum-vulnerable.
For your role
- Researcher / Academic
- Eight steps cover the stack: payment network comparison, EMV transaction flows, card personalisation with RSA against PQC, tokenisation, DUKPT key management, a severity-effort matrix of ten components, HNDL exposure for settlement rails and the sector regulation timeline.
Choose your learning path
No path selected — every section and workshop step counts toward completion. Pick a path to scope the module to one audience.
(Europay, Mastercard, Visa) is the global standard for chip-based payment card authentication. Originally developed in the 1990s, EMV is now managed by EMVCo, jointly owned by the six major payment networks. With 14.7 billion EMV cards in circulation at the end of 2024 — EMVCo’s own figure, reported at the 2025 EMV User Meeting, and still growing — it is the largest deployed PKI ecosystem in the world.
Major Payment Networks
Five of EMVCo’s six owners are profiled below. JCB, the sixth, is not — its published PQC position and card-fleet figures are not sourced to the standard the other five rows meet, and this module does not assert what it cannot cite.
| Network | Region | Cards | Volume | PQC Posture |
|---|---|---|---|---|
| Visa | Americas | 4.6 billion | $14.8 trillion | Published Guidance |
| Mastercard | Americas | 3.3 billion | $9.0 trillion | Prototype Testing |
| American Express | Americas | 140 million | $1.6 trillion | Readiness Program |
| China UnionPay | Asia-Pacific | 9.4 billion | $21 trillion | Shared Standards Work |
| Discover / Diners Club | Americas | 70 million | $200 billion | Shared Standards Work |
Four-Party Payment Model
Every transaction traverses this chain. Cryptography protects each link.
Related Resources
This sector, elsewhere in the hub
Products shown here are a representative selection — not an exhaustive list. For the full vendor landscape with PQC readiness status, visit the Tools & Products tab in this module or browse the Migrate catalog →
Check off all sections and mark this reading done.
Related modules
- Automotive PQCSame track · Industries · Same migration phase · Shares Falcon, ML-DSA, ML-KEM
- Digital AssetsSame track · Industries · Same migration phase · Shares Falcon, ML-DSA, ML-KEM
- Cryptographic APIs & Developer LanguagesShares Falcon, ML-DSA, ML-KEM
- Aerospace PQCSame track · Industries · Same migration phase · Shares Falcon, ML-DSA, ML-KEM
In the Industry Landscape
- Finance & BankingInterbank payments & settlement (SWIFT/RTGS) · Digital banking channels · HSM key management & wrapping · +1 more
- Payment Card IndustryCard authentication (EMV offline auth) · Terminal PIN security & key injection · E-commerce payment data (PCI DSS) · +1 more
- Retail & E-CommerceOnline checkout & POS · POS/PIN symmetric key management · Digital wallet & strong customer authentication
Check your understanding
25 questions on Financial Services & Payments PQC, each with its answer and the reason.
Take the quizNext step
Produce the artifact: Data-at-Rest StrategyThis module belongs to phase 5 (Pilots & Migration); Data-at-Rest Strategy produces a deliverable of that phase in the Command Center.
Learning module content can be inaccurate. Please double-check its information. Report inaccuracies in PQC Today GitHub Discussions.