Israel's Banks Already Missed -- or Met -- Their First Quantum Deadline. Here's What It Actually Required.

Israel has the highest-scoring PQC regulation on this entire tracker -- 80 out of 100 -- and the deadline attached to it already passed nine months ago. Most coverage of global PQC regulation hasn't caught up to what actually happened when it did.

The letter that reads like a mandate because it is one

On 7 January 2025, the Bank of Israel's Banking Supervision Department sent a letter -- signed by Daniel Hahiashvili, Supervisor of Banks -- to every banking corporation and licensed payment service provider in Israel, issued under Proper Conduct of Banking Business Directive 364. It names NIST's PQC standardization process, Quantum Key Distribution, and the "harvest now, decrypt later" threat model directly, and then does something most national PQC guidance stops short of: it tells supervised institutions exactly what to produce, and gives them a date.

Supervised institutions were required to:

• Map encrypted information assets at rest and in motion, recording for each one: the encryption algorithm and key length, the data owner, which systems and applications use it, how long the data needs to stay protected (explicitly tied to harvest-now-decrypt-later risk), and its sensitivity or criticality level
• Submit an initial preparedness and migration plan to the Head of the Technology, Innovation and Cyber Division by 7 January 2026 -- one year from the letter's date
• Address staff training, vendor and supply-chain PQC readiness, testing infrastructure, and migration planning for vulnerable algorithms

Strip away the banking-letter format and that asset-mapping requirement is a cryptographic bill of materials, named field by field, even though the word "CBOM" never appears. It's the most detailed, most concrete CBOM-equivalent requirement on this tracker, issued under a real numbered directive rather than general guidance.

The deadline already happened

Here's what most summaries of Israel's PQC posture miss: 7 January 2026 isn't a future date anymore. It passed over nine months before this was published. Banking corporations have been submitting their plans, and the Banking Supervision Department is reviewing them "against requirements and emerging trends in this area," per reporting on the process.

That makes Israel's directive meaningfully different from the roadmap-style mandates most of this tracker covers -- the EU's 2030/2035 milestones, the UK's 2028/2031/2035 timeline, even Germany's newly-discovered 2026/2030/2035 dates. Those are all still ahead of their first checkpoint. Israel's banking sector has already been through one.

What the Bank of Israel found in those submissions -- whether banks' crypto-asset maps were accurate, whether migration plans were credible, whether any bank missed the deadline outright -- hasn't been published as a primary document as of this writing. That's the open question worth tracking next, not whether the mandate exists.

What the directive doesn't tell you

Neither the Bank of Israel's letter nor the parallel guidance from INCD (Israel's National Cyber Directorate) names a specific post-quantum algorithm or parameter set. Banks are required to map what they currently run and plan for migration -- not told which standard to migrate to. That's consistent with most national regulation on this tracker, which tends to name NIST's FIPS 203/204/205 family in passing at most, but it means Israeli banks are making real algorithm decisions without a government-endorsed shortlist.

It's worth being precise about INCD's document here, because it gets miscited. "Organizational Cyber Readiness to the Post-Quantum Age" is broader best-practices guidance aimed at CISOs and technical leadership generally -- not banking-specific, not binding, and no deadline attached. It's also dated January 2022, more than two years before NIST finalized its PQC standards in August 2024. Its concrete recommendations are classical hardening measures -- longer keys, AES-256 and SHA-512 in GCM mode, shortened key lifespans, Perfect Forward Secrecy -- because the standards it would otherwise point to didn't exist yet when it was written.

One specific trap worth flagging: INCD's guidance includes an appendix table listing RSA-2048, AES-256, and SHA-256 against web, database, and VPN servers, headed "An example for mapping of Cyber assets." Read quickly, it looks like an approved-algorithm list. It isn't -- it's an inventory template, showing what an organization might currently be running, not what INCD endorses for the post-quantum transition. There is no Israeli-approved PQC parameter set in either document.

What to do with this

If you're a banking corporation or licensed payment service provider in Israel, your plan was due months ago -- the question now is whether what you submitted actually matches what the Bank of Israel asked for: a real, field-by-field map of your cryptographic assets, not a narrative description of your intentions. If you're outside the banking sector, nothing in Israeli regulation currently requires the same of you, though the Securities Authority's own cyber-disclosure rules remain silent on PQC specifically, so banking sits well ahead of the rest of the regulated economy here.

Either way, the underlying work the Bank of Israel's directive demands -- an accurate, current inventory of encryption algorithms, key lengths, and the systems that use them -- is the same work every PQC-adjacent regulation on this tracker eventually asks for, just stated here with unusual specificity.

The Israel country page tracks both documents with their primary sources.