AFM's Trendzicht 2026: The Dutch Conduct Regulator Names Quantum Risk to Encryption

On 13 November 2025, the Autoriteit Financiële Markten, the Dutch conduct-of-business regulator for financial markets, published Trendzicht 2026 (Trend Outlook 2026), its annual overview of the trends and risks it expects to shape supervision in the coming year. Under the "Digitalisering" (Digitalization) trend, immediately after a paragraph on generative AI, the document states plainly that quantum computers could in principle eventually break the non-quantum-proof encryption algorithms financial institutions use to safeguard the confidentiality of data, and that addressing this risk will require considerable effort and investment. It is a risk-awareness acknowledgment in a strategic outlook document, not a supervisory mandate, deadline, or inventory requirement, but it is a real and dated instance of a Dutch financial regulator putting quantum-related cryptographic risk in writing.

What Trendzicht actually is

Trendzicht is not a one-off white paper. It is AFM's recurring annual publication, with editions going back to at least 2020, that sets out the trends and related risks AFM expects to affect the financial sector, explicitly framed as an input to next year's supervisory agenda. The 2026 edition puts it this way in its own introduction: early identification and understanding of changes in the sector contributes to a risk-driven, forward-looking, and preventive approach to supervision. Trendzicht sits alongside AFM's annual report and its formal strategy documents as one of AFM's periodic "verantwoording" (accountability) publications, so it functions as a public statement of what AFM is watching, not an internal memo.

The 2026 edition organizes its content around five cross-cutting trend categories: Algemene ontwikkelingen (General developments, largely geopolitical and macroeconomic), Digitalisering (Digitalization), Verduurzaming (Sustainability), Internationalisering (Internationalization), and Integriteit en crimineel gedrag (Integrity and criminal behavior). Each of those five trends is then worked through separately across AFM's four supervisory domains: Financiële dienstverlening (Financial services), Kapitaalmarkten (Capital markets), Assetmanagement (Asset management), and Accountancy en verslaggeving (Accountancy and reporting). A one-page "Trendkaart" (trend map) on page 11, before the sector chapters begin, condenses those trends into a short list of the specific risks AFM says it is watching.

Where the quantum passage sits, and where it doesn't

The quantum passage appears in the general, cross-cutting "Digitalisering" section near the front of the document (page 6 of the PDF), not inside a dedicated quantum or cryptography chapter, and not repeated inside any of the four sector-specific Digitalisering subsections later in the document. It follows directly after a paragraph on the acceleration of AI and agentic AI adoption in finance, and precedes a paragraph on Europe's dependency on non-European cloud providers. Structurally, quantum risk is presented as one of three linked digitalization themes AFM is naming for 2026: AI adoption, quantum-related cybersecurity risk, and digital dependency on non-European infrastructure.

The full passage, translated from the Dutch:

"The development of quantum computing promises unprecedented computing power in time, but simultaneously creates new challenges around cybersecurity... Although quantum computing offers important benefits (e.g. for running stress tests or pricing assets), it can also lead to increased cybersecurity risks. In principle, quantum computers could eventually be able to break the (non-quantum-proof) encryption algorithms of financial institutions used to safeguard data confidentiality. Addressing these risks will require considerable effort and investment."

AFM footnotes this passage to a 2024 Bank for International Settlements paper on quantum computing and the financial system, rather than to any AFM-original research or a Dutch national source. The passage also notes, correctly, that only a handful of quantum computers are currently in use worldwide and that their computing power remains relatively limited today, framing the risk as one that grows "in the coming years" rather than one that is already live.

When the document condenses its findings into the one-page Trendkaart, the quantum passage does not survive as its own line item. The Digitalisering section of the trend map collapses to three bullets: continued acceleration of AI adoption, growing discomfort with digital dependency on non-European providers, and a general statement that increasing digitalization requires sustained attention to cybersecurity in the financial sector given the current geopolitical situation. Quantum-specific risk is folded into that third, general cybersecurity bullet rather than named on its own. That is a meaningful signal about how AFM itself is currently weighting the topic: real enough to spell out in the body text with a citation, but not yet distinct enough, in AFM's own editorial judgment, to warrant a standalone line in the risks it says it is tracking for the year ahead.

What AFM is, and isn't

AFM is the Netherlands' conduct-of-business regulator: it supervises the behavior of financial market participants across savings, investment, insurance, lending, pensions, capital markets, asset management, and accountancy and financial reporting, with a stated mission of fair and transparent markets and, per Trendzicht's own introduction, "duurzaam financieel welzijn" (sustainable financial wellbeing) for consumers and investors. That is a materially different mandate from De Nederlandsche Bank (DNB), the Dutch central bank, which is the prudential supervisor responsible for the soundness of individual financial institutions and the stability of the financial system as a whole. The two regulators cooperate closely and jointly supervise several EU frameworks, but they are legally distinct bodies with distinct statutory remits, and Trendzicht is AFM's document, not a joint AFM/DNB publication.

That distinction matters for how much weight to put on this passage. DNB, as this tracker has separately documented, has gone considerably further on cryptographic risk in its own supervisory material: DNB's "Good Practice Information Security 2023" directs institutions to maintain an inventory of their cryptographic landscape, conduct an annual Cryptography Risk Assessment, and analyze cryptographic risk over multi-year horizons that explicitly account for the development of quantum computing. That is prudential supervisory guidance with inventory-equivalent expectations attached to it. AFM's Trendzicht passage, by contrast, is a conduct regulator naming a risk in its own forward-looking trend analysis, with no accompanying expectation, deadline, or inventory requirement directed at the firms it supervises. Both are real; they are not the same kind of document, and conflating them overstates what AFM has actually done.

Separately, AFM does co-supervise the EU's Digital Operational Resilience Act (DORA) alongside DNB, and has published its own guidance explaining DORA's ICT risk management requirements to firms since DORA took effect in January 2025. DORA's ICT risk management framework requires financial entities to take a risk-based approach to cryptographic controls, but Trendzicht 2026 itself does not tie its quantum passage back to DORA, and this tracker did not find any AFM-published guidance that names post-quantum cryptography, a cryptographic bill of materials, or a migration timeline specifically. AFM's quantum-computing statement, at this point, stands on its own as a trend observation rather than as part of a wider quantum-specific supervisory program.

How this fits with other regulators

AFM's Trendzicht passage is best read as a second, independent confirmation that the Dutch financial sector's regulatory apparatus has quantum risk on its radar, alongside DNB's considerably more concrete cryptographic-inventory expectations and the AIVD/NCSC joint guidance recommending organizations begin quantum migration planning. None of the three amounts to a binding mandate with a compliance deadline. See the Netherlands country page for how this tracker scores the combination of AFM, DNB, and AIVD/NCSC activity, and how that compares to binding-mandate jurisdictions elsewhere in this tracker.

Primary source: AFM, "Trendzicht 2026" (13 November 2025), quantum-computing passage on page 6, citing BIS Papers No 149, "Quantum computing and the financial system: opportunities and risks" (October 2024). Additional sources: AFM, Trendzicht overview page; AFM, "Getting ready for DORA: ICT Risk Management" (Update 3); DNB, "Good Practice Information Security 2023".