NBB's Swift Oversight: Why One Belgian Regulator's PQC Checklist Matters Everywhere

The National Bank of Belgium's Financial Market Infrastructures and Payment Services Report 2025 states plainly that "monitoring the development by Swift of post-quantum cryptography capabilities fits in with the objectives of long-term security planning and data confidentiality, thereby helping to future proof the environment in which Swift operates and ultimately ensure trust in the global financial industry." That single sentence is worth pausing on. NBB is not issuing a national PQC mandate here. It is describing its ongoing oversight of one company, Swift, headquartered in La Hulpe, Belgium, whose messaging network underpins the vast majority of the world's cross-border interbank payments. A Belgian central bank's oversight checklist, in other words, has a blast radius that extends to essentially every bank on earth that sends or receives an international wire.

Why a Belgian regulator oversees a "global" institution

Swift, the Society for Worldwide Interbank Financial Telecommunication, is a Belgian cooperative society, and that fact of incorporation is what gives NBB its role. In 1997, the G10 central banks formalised a cooperative oversight arrangement for Swift specifically because of its emerging systemic importance to the global financial system. Because Swift is headquartered in Belgium, NBB acts as lead overseer and chairs the international oversight meetings, a role that has continued unbroken since. The Bank for International Settlements and the European Central Bank are also represented in the Swift oversight working groups, but the chair, and the daily monitoring function, sits with NBB.

The oversight arrangement runs through four working groups. The Technical Group conducts fieldwork. The Cooperative Oversight Group is the decision-making body that sets oversight strategy. The G10 central banks are represented on all four groups: the National Bank of Belgium (as lead overseer), the Bank of Canada, the Deutsche Bundesbank, the European Central Bank, the Banque de France, the Banca d'Italia, the Bank of Japan, De Nederlandsche Bank, the Sveriges Riksbank, the Swiss National Bank, the Bank of England, and the Federal Reserve System. The Executive Group communicates overseers' conclusions and recommendations to Swift's board and executive management. Because Swift's importance extends well beyond the G10 footprint, a fourth body, the Swift Oversight Forum, was established to share oversight information with a broader group of central banks whose membership corresponds to each country's share of total Swift traffic volume and to CPMI membership, in practice a G20-weighted group. NBB, as lead overseer, is the entry point for channelling information to all of these other overseers and coordinates reporting between the working groups.

What the 2025 report actually says about post-quantum cryptography

The report addresses PQC directly in its cybersecurity section, describing it as one emerging issue among the standing topics on the oversight agenda: "One emerging issue in the area of cybersecurity is post-quantum cryptography, which addresses the future threats posed by quantum computers to current encryption methods. Quantum computers, if sufficiently advanced, could break widely used public-key cryptographic systems, which are critical to secure digital communications and financial transactions. Post-quantum cryptography involves developing and implementing encryption algorithms resistant to quantum attacks, ensuring the long-term security of sensitive information." The oversight framing that follows is specific: NBB is not asking Swift to adopt PQC on a deadline, it is monitoring Swift's own development of PQC capabilities as part of long-term security planning and data confidentiality objectives.

That framing is reinforced structurally. NBB's oversight planning for Swift is organised around five High Level Expectations, non-binding criteria that the Cooperative Oversight Group uses to select topics for review each year, based on the prior year's risk-based assessment. The five are Risk Identification and Management, Information Security, Reliability and Resilience, Technology Planning, and Communication with Users. The post-quantum cryptography roadmap sits as a named bullet point under the second: "HLE 2 - Information security. [...] Data confidentiality, integrity and availability, including the post-quantum cryptography roadmap." Alongside it under the same HLE are cybersecurity controls (preventive and detective) and threat-led penetration testing at Swift. That placement matters: PQC readiness is being tracked by NBB in the same oversight category, and with the same seriousness, as Swift's red-teaming programme, not as a speculative footnote.

The report's broader threat-landscape section, in a themed article on digital operational resilience, situates PQC within a wider acceleration of risk: "Cyber threats continue to evolve and are expected to become increasingly sophisticated, fuelled by geopolitical tensions, the rapid development of artificial intelligence and quantum computing." That sentence pairs quantum computing with AI as a joint driver of a more sophisticated threat landscape, a pairing increasingly common in supervisory literature but still notable coming from a lead overseer of critical payment infrastructure rather than a general cybersecurity commentator.

Swift's own PQC timeline, and why NBB is watching it

NBB's oversight role is only informative if Swift is actually doing something to track. It is. Swift's public interface release documentation describes Release 7.9 as focused on technology renewal and laying the foundations for SwiftNet 8.0 and post-quantum cryptography readiness. SwiftNet 8.0, targeted for end-July 2027, is described by Swift as its first PQC-enabled major network release, with no direct upgrade path from Release 7.7, meaning the bulk of Swift's user community will need to move through 7.9 first. That gives NBB's "monitoring the development by Swift of post-quantum cryptography capabilities" line a concrete, dated target to watch: whether Swift's PQC-enabled 8.0 release actually lands on schedule, and whether the 15-month post-8.0 support window for 7.9 gives the global bank community enough runway to migrate.

The Project Leap connection

NBB's oversight function is not the only channel through which Swift's PQC posture is being tested in practice. The BIS Innovation Hub's Project Leap, run through its Eurosystem Centre, has tested post-quantum cryptography against the Eurosystem's Target2 system, replacing traditional digital signatures with post-quantum cryptography when sending liquidity transfers. The testing was not done on live traffic: BIS states that "an existing T2 test environment was selected," configured to reflect "realistic operational scenarios while ensuring a secure and isolated space for validating the integration of PQC mechanisms without impacting live operations." Phase 2 involved Swift directly, alongside the Banca d'Italia, the Banque de France, the Deutsche Bundesbank, and Nexi-Colt, and its published results found significant performance differences between traditional and post-quantum algorithms, concluding that further testing and preparation is needed before the financial system can transition, and that the challenges involved extend beyond technical questions to awareness, resource allocation, competence development, inventory, pilots, and governance. Banca d'Italia's participation in Project Leap is covered on this tracker's Italy country page, so it isn't repeated in full here, but the connection is directly relevant: three of the four G10 central banks sitting on Swift's Cooperative Oversight Group (Italy, France, and Germany) are also the operational participants running PQC tests against the same infrastructure NBB oversees, which means NBB's monitoring role and the Eurosystem's hands-on testing are two views of the same underlying migration.

Why this matters far beyond Belgium

It's tempting to read a Belgian central bank's annual report as a domestic document. This one isn't, in the part that concerns PQC. Swift's messaging network carries the instructions behind the overwhelming majority of the world's cross-border interbank payments, which means its cryptographic posture is a dependency for every bank, corporate treasury, and correspondent-banking relationship that relies on it, regardless of jurisdiction. If Swift's PQC transition slips, stalls, or ships with unresolved performance problems (the exact kind of problem Project Leap's testing surfaced), the consequence isn't confined to Belgian financial institutions. It propagates to every SwiftNet-connected bank globally. NBB's lead-overseer role means it is, in effect, the closest thing to a dedicated PQC supervisor that Swift itself has, and its reports have named the roadmap as a review criterion for two consecutive years. The 2024 edition listed "Data confidentiality, integrity and availability, including the quantum cryptography roadmap"; the 2025 edition sharpens that to "post-quantum cryptography" — the terminology that actually describes the migration, rather than the technology being migrated away from.

How this fits with other regulators and countries

NBB's Swift oversight sits in an unusual category on this tracker: it is not a national PQC mandate, and it creates no compliance deadline for Belgian financial institutions generally, but it is real, dated regulatory activity directed at a single piece of globally systemic infrastructure. See the Belgium country page for how this tracker scores that distinction alongside the CCB's separate risk-tiered migration guidance for Belgian organisations at large. It's a different shape of oversight from India's RBI Q-SAFE committee, which is building a sector-wide cryptographic inventory mandate from scratch, and from Switzerland's SIX Group post-quantum disclosure, where a market-infrastructure operator rather than its regulator did the public accounting. NBB's report is closer in spirit to both at once: a regulator (not an operator) describing a live, named oversight criterion (not a voluntary disclosure) trained on one systemically important company rather than an entire sector. As Swift's own PQC-enabled SwiftNet 8.0 release approaches its 2027 target, NBB's oversight reporting is one of the more useful places to watch for whether that transition is actually on track, since it is one of the few regulatory documents anywhere that treats Swift's PQC roadmap as a named line item rather than an assumption.

Primary source: National Bank of Belgium, Financial Market Infrastructures and Payment Services Report 2025. Additional sources: BIS Innovation Hub, "Project Leap Phase 2: results of testing quantum-resistant cryptography in real-world payment systems"; Swift, Release 7.9 interfaces and integration documentation.