Luxembourg Wrote a National Quantum Strategy. Its Financial Regulator Hasn't Said a Word.

Luxembourg manages one of the largest fund industries in the world. Its national government has published a detailed, dated quantum strategy with real PQC content. The regulator that actually supervises the institutions managing that money has said nothing about quantum risk at all.

A real national strategy, genuinely detailed

The Ministère d'État published "Luxembourg's Quantum Strategy: Accelerating Digital Sovereignty 2030" in 2025, with a dedicated section on transitioning to post-quantum cryptography. It names eight concrete actions, including:

"Quantum threat analyses: Identify vulnerable assets and applications through comprehensive cryptographic inventories, enabling risk-based mitigation and cost-effective solutions."

"Comprehensive migration frameworks: Develop guidelines ensuring seamless PQC adoption with backward compatibility and minimal system disruption adopting a crypto-agility approach."

The strategy sets a genuine three-phase national roadmap -- Foundation (2025-2027), Scale-up (2027-2030), Commercial (2030 and beyond) -- covering both quantum computing and quantum communication infrastructure, and ties itself explicitly to the European Commission's April 2024 recommendation on a coordinated EU-wide PQC implementation roadmap. It references NIST's August 2024 PQC standards release and commits Luxembourg to "a phased, hybrid approach combining traditional and quantum-safe cryptography." For a strategy document, this is substantive -- named actions, dated phases, a stated technical approach.

The regulator that would actually matter hasn't moved

CSSF -- the Commission de Surveillance du Secteur Financier, Luxembourg's financial regulator, overseeing a fund industry that makes Luxembourg one of the world's largest domiciles for investment funds by assets under management -- has published nothing specific to post-quantum cryptography. We checked directly: CSSF's own site search for "quantum" surfaces only an unrelated 2022 press release. No circular, no FAQ, no supervisory letter.

That's the gap worth sitting with. A country whose entire economic identity is built on sophisticated financial regulation and supervision has a government quantum strategy addressed at the state level, while the specific regulator positioned to make any of it binding for the financial sector hasn't engaged with the topic at all. Compare this to Singapore (MAS actively building toward binding supervisory expectations), Israel (Bank of Israel's directive already past its first deadline), or Kuwait (CBK's binding CORF clause) -- jurisdictions with comparable financial-sector sophistication where the central bank or financial regulator is the one actually driving PQC requirements. Luxembourg's financial regulator is, on this specific issue, the quietest actor in the room.

What the strategy does and doesn't require

The strategy's "cryptographic inventories" language is real and specific, but it's framed as a recommended action for stakeholders pursuing quantum threat analyses -- not a mandated deliverable with a due date, and not something CSSF-regulated entities are required to produce. No compliance deadline, no penalty clause, no reporting requirement attaches to any part of the strategy for any private-sector entity, financial or otherwise.

What to do with this

If you operate a fund, bank, or financial institution in Luxembourg, the national strategy gives you a sense of where government priority is heading, but it creates no obligation you can point to, and your actual regulator -- CSSF -- hasn't told you anything about what it expects. That's a genuinely ambiguous position: a stated national direction with no sector-specific enforcement mechanism yet, in a jurisdiction where financial regulation is otherwise unusually mature.

The practical move is the same one that applies everywhere else on this tracker, just without a regulator asking for it yet: build a real cryptographic inventory now, informed by the national strategy's own framing, rather than waiting for CSSF to eventually catch up and ask for one on a shorter timeline than you'd like.

The Luxembourg country page tracks the strategy with its primary source.