FDIC's 2025 Report on Cybersecurity and Resilience: What It Actually Says About Quantum Computing

The Federal Deposit Insurance Corporation's "2025 Report on Cybersecurity and Resilience," submitted to the House Committee on Financial Services and the Senate Committee on Banking, Housing, and Urban Affairs as required annually under Section 108 of the Consolidated Appropriations Act, 2021, covers FDIC's cybersecurity activity through 2024 and into 2025 (its latest internal references are dated August 2025). Buried in a 26-page report otherwise dominated by ransomware, supply-chain compromise, and generative-AI fraud, quantum computing appears three separate times: named as one of only two "strategic" cybersecurity threats facing the sector, disclosed as a specific focus of 2024 horizontal examinations of significant service providers, and traced back to a non-public 2022 forum FDIC ran jointly with CISA. This is the most detailed public confirmation to date of what US banking regulators are actually doing about post-quantum risk behind closed doors, and it is worth reading precisely, because it is not a rule.

What kind of report this is

This is not a one-off white paper. Section 108 of the Consolidated Appropriations Act, 2021 requires the FDIC to report annually to both congressional banking committees on its cybersecurity posture and its supervision of the financial sector's cybersecurity. The report is addressed to Congress, not to banks, and it functions as an accountability document: it describes what the FDIC did on cybersecurity, both internally (its own systems, FISMA compliance) and externally (rulemaking, guidance, and examination of FDIC-supervised institutions and their service providers), over the preceding period. It carries no compliance obligations for banks in its own right. It is a report about supervision, not an instrument of supervision.

That framing matters for how to read the quantum content. The report covers a wide sweep of real, current priorities: ransomware and triple-extortion tactics, nation-state-affiliated threat groups increasingly blurring lines with cybercriminal groups, supply-chain compromise (citing Verizon's 2024 DBIR finding that supply-chain attacks caused 15 percent of breaches), and generative AI being used for deepfakes, voice cloning, and synthetic-identity fraud during account opening. The report's own Threats section splits these into "Tactical" (near-term: ransomware, geopolitical cyberattacks, supply chain) and "Strategic" (longer-term but requiring current preparation: generative AI and quantum computing). Quantum computing is not a footnote among dozens of items. It is one of exactly two threats the FDIC classifies as strategic, alongside AI-driven fraud, which is a meaningful signal of how seriously examiners are weighing it relative to the sector's other real problems.

The strategic-threat framing, in FDIC's own words

The report's Threats section states the case directly:

"Another example of a strategic cybersecurity threat for financial institutions is the ongoing development of quantum computing technology. Quantum computers use a different computing architecture that can solve certain types of problems, including some encryption algorithms, much faster than traditional computer models... A significant strategic risk is that quantum computing is expected to make existing encryption used by financial institutions and other organizations obsolete, thereby enabling malicious actors to decrypt sensitive data. There is also a concern that malicious actors may be harvesting data now in anticipation of being able to decrypt the data in the future using quantum computers. This process is commonly referred to as 'harvest now, decrypt later.'"

The passage cites NIST's public "What Is Post-Quantum Cryptography?" page as its authority, not an FDIC-originated technical standard. That is consistent with the report's overall register: it is FDIC describing a threat landscape and its own supervisory response to it, not FDIC promulgating cryptographic requirements.

2024 examinations actually looked at this

The more consequential disclosure sits in the report's discussion of service-provider examinations, not the threats section. Under the Bank Service Company Act, the FDIC has authority to examine bank service providers jointly with the Federal Reserve and OCC. The report states plainly:

"...examinations frequently include a review of service provider controls designed to defend against advanced cyber threats. During 2024, these examinations included evaluations of risks associated with privileged account access and developments in quantum computing."

It then goes further, describing a specific, named work-program activity: FDIC's Division of Risk Management Supervision (RMS) runs periodic "horizontal reviews," risk-targeted examinations conducted across multiple institutions or significant service providers within a defined period, rather than institution-by-institution. The report discloses that this was one of RMS's stated 2024 performance goals:

"During 2024, FDIC RMS undertook horizontal reviews on issues related to cyber risk, including (i) significant service providers' consideration of risks associated with developments in quantum computing, and (ii) the effectiveness of the significant service providers' identity and access management controls for privileged accounts."

The report does not name which service providers were reviewed, which is consistent with how FDIC handles all service-provider examination findings: results are communicated confidentially through supervisory letters and reports of examination, shared with the service provider and, in redacted or summary form, with the financial institution clients of that provider, but not published. So this tracker can confirm that a named, budgeted 2024 supervisory work program specifically evaluated significant service providers' quantum-computing risk posture. It cannot confirm which providers, what the examiners found, or whether any resulting findings led to matters requiring attention or enforcement action, because none of that is disclosed in a public report of this kind.

The September 2022 CISA/FFIEC forum

The report also retroactively confirms an episode that had previously been difficult to source precisely. In its list of technical-assistance activities over the past four years, FDIC discloses:

"Preparing for Post-Quantum Cryptography. The FDIC collaborated with CISA through the FFIEC to provide all FDIC-insured institutions with the opportunity to participate in a non-public virtual forum on September 23, 2022, to discuss developments in quantum information science. Content addressed the potential to drive innovation across the economy, while highlighting the potential risk to the economic and national security of the United States."

This dates and attributes a specific event: a joint FDIC-CISA forum, convened under FFIEC's umbrella, open to all FDIC-insured institutions, held on a specific day in September 2022. It was non-public (no transcript or slide deck has surfaced), and its stated content framed quantum computing in dual terms familiar from national-level PQC discourse: an innovation driver and a risk to economic and national security. It is a briefing, not a rule, but it establishes that federal banking regulators were coordinating on PQC awareness with the nation's cybersecurity agency nearly three years before this report was filed.

What this is not

It is worth being precise about the limits of this disclosure, because the report's language is easy to over-read. FDIC's 2025 Report on Cybersecurity and Resilience:

• Does not create a cryptographic inventory or CBOM requirement for FDIC-supervised institutions or their service providers.
• Does not set a PQC migration deadline of any kind for banks.
• Does not amend the Safety and Soundness Standards, the Computer-Security Incident Notification Rule, or any other binding FDIC rule to reference quantum computing or post-quantum cryptography.
• Does not name which service providers, systems, or findings resulted from the 2024 horizontal reviews.

What it does establish, with unusual specificity for a document of this type, is that quantum-computing risk has moved from a background topic into FDIC's actual 2024 examination work program, budgeted and reported as a stated performance goal, sitting in the same threat tier as generative-AI fraud, and years past the point of a single conference briefing. That is real supervisory attention. It is not yet a rule banks must comply with.

How this fits with other US regulators

This report should be read alongside, not instead of, the other financial regulators covered on the United States country page. The Federal Reserve's only public document on this topic is a FEDS staff research paper, "Harvest Now Decrypt Later": Examining Post-Quantum Cryptography and the Data Privacy Risks for Distributed Ledger Networks (FEDS 2025-093, September 2025, authored by Jillian Mascelli and Megan Rodden), which is explicitly disclaimed as not representing the views of Board staff generally or the Board of Governors. Using Bitcoin as a case study, the paper argues that even if a distributed ledger network migrates to post-quantum cryptography going forward, previously recorded transaction data remains permanently exposed to future decryption by anyone who harvested a copy of the ledger today, a narrower and more academic framing of the same "harvest now, decrypt later" concern FDIC's report raises for the banking sector generally. Neither the Fed's paper nor FDIC's report is binding guidance; both are exploratory, one from a research desk and one from a supervisory reporting function.

The OCC reportedly referenced quantum computing in a 2022 Semiannual Risk Perspective, but that citation could not be independently verified against the source document and should not be treated as confirmed. The SEC's 2023 cybersecurity disclosure rule does not mention post-quantum cryptography at all. FFIEC itself, despite co-hosting the September 2022 forum FDIC's report now confirms, has not published any standalone PQC guidance of its own. Set against that backdrop, FDIC's 2025 report is currently the single best-documented piece of evidence that any US banking regulator is doing sustained, dated, examination-level work on quantum risk, even though none of it yet rises to a binding PQC or CBOM mandate. See the United States country page for how this tracker scores the overall US position, currently anchored by OMB Memorandum M-26-15's federal civilian agency mandate rather than by any financial-sector-specific rule.

Primary source: FDIC, "2025 Report on Cybersecurity and Resilience" (2025). Additional source: Federal Reserve, "Harvest Now Decrypt Later": Examining Post-Quantum Cryptography and the Data Privacy Risks for Distributed Ledger Networks, FEDS 2025-093 (September 2025).