RBI's Q-SAFE Committee: What India's Central Bank Is Actually Asking About Quantum Risk

On 25 May 2026, the Reserve Bank of India constituted an expert committee with an unusually specific mandate for a central bank: evaluate India's financial sector's cryptographic inventory through a Cryptography Bill of Materials, and recommend a roadmap for the sector's transition to quantum-safe cryptography. RBI published this directly on its own website, in a press release titled "Quantum Secure and Adaptive Financial Ecosystem (Q-SAFE) – Setting up of an Expert Committee," naming the committee Q-SAFE, Quantum Secure and Adaptive Financial Ecosystem.

Who's on it

RBI's press release names Dr. Anil Prabhakar, Professor in the Department of Electrical Engineering at IIT Madras, as the committee's Convener — the release's own term, rather than chair. The membership tells you as much about RBI's intent as the charter does:

• Shri Dilip Asbe, MD & CEO of NPCI, the entity that operates UPI, RuPay, and IMPS, India's core retail payment rails.
• Shri Suvendu Pati, RBI's Chief General Manager in the FinTech Department, serving as Member-Secretary.
• Shri Satish Rao Nagesh, Deputy Managing Director at State Bank of India.
• Shri Vinayak Godse, CEO of the Data Security Council of India.
• Shri Sunil Kumar, Additional Secretary at the Department of Science & Technology, and Shri Manoj Kumar Jain, Scientist-G and Group Coordinator at MeitY, tying the committee back to the national quantum mission apparatus.
• Dr. L. Venkata Subramaniam, formerly head of IBM's Quantum India program, for direct technical depth on quantum computing itself.

Bringing NPCI's own CEO onto the committee is a deliberate signal: whatever Q-SAFE recommends, it's being shaped with input from the entity that would need to implement quantum-safe cryptography across India's payment infrastructure, not handed down to it afterward.

What it's actually been asked to do

RBI's press release sets out the committee's terms of reference directly: examine the benefits and risks of quantum technology to the financial sector, evaluate cryptographic vulnerabilities through a Cryptography Bill of Materials, conduct a cross-country regulatory analysis, assess industry preparedness, and recommend "a roadmap and framework to quantum-secure the Indian financial system." That's a broader remit than a one-time inventory exercise. The report is due within six months of the committee's first meeting and had not been published as of this article's last check. RBI's FinTech Department provides the committee's secretarial support.

Reading the tea leaves: how RBI typically regulates this

Q-SAFE's eventual output doesn't exist yet, but RBI's existing regulatory style gives a reasonable guide to its likely shape. RBI's Master Direction on IT Governance, Risk, Controls and Assurance Practices (issued November 2023, effective April 2024) is the closest existing template: a mandatory IT Governance Framework and IS Risk Management Framework, with a required Cyber Security Policy, applied uniformly across the banks and NBFCs it covers. RBI's master directions are binding on regulated entities and typically carry defined compliance timelines and reporting obligations, a meaningfully different posture than a purely advisory guideline.

If Q-SAFE's roadmap follows that same pattern, expect a binding direction with a compliance deadline and a required cryptographic inventory, not a voluntary best-practices document. That's a prediction, not a confirmed fact, and this tracker will update India's score once Q-SAFE's actual report is published rather than score against an expectation.

What RBI hasn't done yet

RBI's existing cybersecurity master directions are general IT-risk documents; none of them mention post-quantum cryptography or a cryptographic bill of materials specifically. Q-SAFE is, as far as this research can confirm, RBI's first quantum-specific regulatory action. Separately, IDRBT, the RBI-owned research institute, already runs a dedicated Quantum-Safe Cryptography Lab building NIST-standardized PQC implementations and a "Q-Safe" encrypted cloud storage prototype for banking use, work that predates and likely informs Q-SAFE's committee-level effort, but is a research initiative rather than a regulatory action in its own right.

How this fits with India's other regulators

Q-SAFE covers the financial sector specifically. Separately, CERT-In's Technical Guidelines v2.0 already define a detailed CBOM/QBOM schema for government and public-sector entities, and SEBI's Cybersecurity and Cyber Resilience Framework has a cryptographic-inventory clause already in force for securities-market participants. See the India country page for how this tracker scores the combination, and this page will be updated once Q-SAFE's report is actually published.

Primary source: RBI, "Quantum Secure and Adaptive Financial Ecosystem (Q-SAFE) – Setting up of an Expert Committee" (25 May 2026). Additional sources: RBI Master Direction on IT Governance, Risk, Controls and Assurance Practices; IDRBT Quantum Safe Cryptography Lab.