Three Australian Regulators Are Converging on the Same 2030 Deadline. None of Them Has Made It Binding Yet.

No single Australian regulator has made post-quantum cryptography migration mandatory. Three of them are independently converging on the same deadline from three different directions, which amounts to something close to a mandate without any one of them having written the rule.

The timeline that started as pure guidance

ASD's "Planning for post-quantum cryptography" -- PROTECT-level guidance within the ISM/ACSC suite, first published July 2022 and updated September 2025 -- recommends organisations cease using traditional asymmetric cryptography (RSA, DH, ECDH, ECDSA) by the end of 2030, with a refined transition plan due by end-2026 and migration commencing, starting with critical systems and data, by end-2028. It's explicitly framed as "ASD recommends," with no statutory force.

That would be the whole story in most countries on this tracker. In Australia, two more regulators have independently picked it up and are actively pushing it toward enforceability.

APRA: supervisory pressure, not yet a rule

At the AFIA Risk Summit on 24 June 2026, an APRA Member delivered an address titled "Fighting fire with fire," setting a real, specific supervisory expectation: regulated entities should begin mapping where cryptography is relied upon across their systems, data, and third-party providers. That's a cryptographic inventory in substance, stated as a supervisory expectation rather than tucked inside guidance.

More significant than the expectation itself is what APRA committed to doing about it: escalating supervisory engagement over the coming year, with boards expected to show progress against ASD's own timeline. APRA didn't invent a competing deadline -- it adopted ASD's 2026/2028/2030 structure and attached supervisory consequence to it. That's a meaningfully different posture than simply restating guidance: it's a regulator signaling that boards will be asked to account for their progress, even without a published penalty structure yet.

The RBA: openly discussing using its own enforcement powers

The Reserve Bank of Australia's Payments System Board went further at its June 2026 meeting. It broadened its remit from card-payment encryption specifically to system-wide cryptographic issues across the Australian payments system, reaffirmed a December 2030 industry cryptographic-uplift target, and -- the detail worth sitting with -- endorsed opening a formal consultation on strengthening cryptographic practices, "potentially using the RBA's own standard-setting powers under the Payment Systems (Regulation) Act."

That's a central bank publicly considering whether to convert an advisory deadline into something it has actual statutory authority to enforce. No instrument has been issued yet, and "potentially" is doing real work in that sentence -- but it's a different category of signal than guidance restated by an adjacent body. It's a regulator naming the specific legal mechanism it could use.

What hasn't moved

ASIC, Australia's securities and investments regulator, hasn't joined this pattern. Its most recent relevant output -- an 8 May 2026 open letter to AFS licensees on cyber uplift -- addresses frontier-AI-driven cyber risk and doesn't mention post-quantum cryptography, quantum computing, or cryptographic inventory anywhere. If you're an AFS licensee reading ASIC's cyber guidance for PQC content, there isn't any yet.

What this convergence actually means

Scored against this tracker's rubric, Australia still lands in "guidance" territory -- no single instrument carries a penalty clause, and the total reflects that. But the practical reality for a regulated Australian entity is different from a country where only one advisory document exists. ASD set the technical timeline. APRA is actively supervising progress against it, with board-level accountability. The RBA is weighing whether to make it a formal standard under existing legal authority. Three independent regulatory bodies pointing at the same dates is a stronger signal of where enforceable Australian PQC regulation is heading than any one of those documents would suggest in isolation.

What to do with this

If you're an APRA-regulated entity, "we're following ASD's guidance" is no longer a sufficient answer -- APRA has said directly it expects boards to show progress, and that's a supervisory conversation, not a voluntary best-practice discussion. If you're in payments specifically, the RBA's openness to using its Payment Systems (Regulation) Act powers means a binding instrument could arrive from that direction before ASD's own guidance ever becomes one.

Either way, the cryptographic mapping APRA is already asking for is the same foundational work every version of this regulatory convergence eventually requires: a real, current account of where cryptography runs in your systems, your data, and your third-party providers.

The Australia country page tracks all three regulatory tracks with their primary sources.