SAMA's New Quantum Computing Circular: What Saudi Banks and Payment Companies Must Do Before December 31, 2026

This article is provided for general informational and educational purposes only and does not constitute legal, regulatory, or professional advice. Institutions should consult SAMA's official circular and their own legal and compliance advisors before taking action. Saudi Compliance Institute is not affiliated with SAMA, the National Cybersecurity Authority, or any Saudi government body.

Why this matters now

On August 27, 2026, the Saudi Central Bank (SAMA) issued Circular No. 482021280, Enhancement of Operational Resilience to Address Quantum Computing Risks. It is one of the first instances of a Gulf financial regulator setting hard, dated requirements for quantum-computing preparedness rather than leaving the subject as general guidance.

The circular does not ask institutions to deploy new encryption tomorrow. It asks for something narrower and, in some ways, harder: a complete, accurate inventory of where an institution already relies on cryptography, and a documented plan for what happens to that cryptography as quantum computing matures. For a sector that has spent two decades treating cryptographic algorithms as an implementation detail buried inside vendor systems, that is a meaningful compliance shift — and the first deadline is now fewer than eleven weeks away.

Source: PostQuantum — “SAMA Quantum Circular: Crypto Inventory by December 31”; corroborated by Codegic — “SAMA's Cryptographic Inventory Deadline Is December 2026” and Wultra — “Saudi Central Bank Sets Quantum Readiness Deadlines for Financial Institutions.”

Who the circular covers

SAMA Circular 482021280 applies to every entity SAMA licenses for banking or payment activity, specifically:

• Banks operating in the Kingdom

• Payment services companies (including fintechs licensed under SAMA's payment regulations)

• Finance companies

• Credit information companies

• Financing support entities licensed by SAMA

Source: Codegic — “SAMA's Cryptographic Inventory Deadline Is December 2026.”

Notably, the circular does not name specific cryptographic algorithms or require institutions to submit inventory outputs to SAMA directly. Algorithm-level technical standards remain the responsibility of the National Cybersecurity Authority (NCA) — so an institution's existing NCA ECC (Essential Cybersecurity Controls) compliance programme is the natural foundation to build this work on, not a separate workstream. Readers who need a refresher can see our guide on what the NCA ECC framework requires and our walkthrough of NCA's ECC-1 controls for private-sector entities.

The two dated requirements

Source: PostQuantum — “SAMA Quantum Circular: Crypto Inventory by December 31”; deadlines independently confirmed by Wultra.

The circular sets no single date for completing migration itself. Remediation and migration plans for an institution's “priority assets” are expected to follow directly from the December inventory and feed into the March 2027 risk assessment's action plans — institutions treating the two dated requirements as a formality, rather than sequential inputs to each other, risk having to redo the risk assessment once gaps in the inventory surface later.

What a compliant cryptographic inventory must cover

Based on the circular's requirements as reported across multiple independent sources, a cryptographic inventory that would satisfy the December 31, 2026 deadline needs to:

1. Identify every cryptographic asset in use — encryption keys, certificates, hashing implementations, and the algorithms behind them — across production systems, not only flagship customer-facing platforms.

2. Map each asset to the data, systems, and services it protects, so the business impact of a given cryptographic asset is traceable, not just its technical location.

3. Classify assets by sensitivity and by migration priority, distinguishing long-lived customer data encryption (high priority) from short-lived session tokens (lower priority).

4. Assess the cryptographic resilience of priority assets specifically — an asset-by-asset judgment, not a blanket organization-wide rating.

5. Identify constraints, challenges, and third-party dependencies, including where a core banking vendor, payment switch, or cloud provider controls the cryptographic implementation.

Source: PostQuantum; cross-checked against Codegic.

This is often described in the cybersecurity industry as building a cryptographic bill of materials (CBOM) — a structured, asset-level record of what cryptography a system actually uses, maintained the same way a software bill of materials tracks open-source dependencies.

Governance: who inside the institution owns this

• Quantum computing risk as a standing item for periodic monitoring by the Information Security Supervisory Committee and, where applicable, the board risk committee.

• Challenges and recommendations reported to the Board or its equivalent governing body — this cannot sit entirely within the information security function without senior management visibility.

• No set date for migration itself — the circular leaves the pace of remediation to each institution's own risk-based judgment, provided it is documented and defensible to SAMA examiners.

Source: Wultra; corroborated by PostQuantum.

SAMA examiners retain the right to request the inventory, the classifications, and the priority-asset assessments at any time — so the expectation is that this documentation exists and is current. This mirrors the audit posture institutions already know from SAMA's broader Cybersecurity Framework compliance expectations, and overlaps materially with the risk-register discipline covered in our guide to cybersecurity GRC frameworks.

What happens if an institution is not ready

The sources reviewed for this article do not report SAMA specifying financial penalties or enforcement actions tied to missing either deadline — the circular is framed around supervisory oversight rather than a published fine schedule. That should not be read as low-stakes. SAMA's examination posture across its other circulars treats an inadequate or undocumented compliance programme as a standing supervisory finding, which can affect an institution's risk rating, trigger follow-up examinations, and factor into broader relationship-management decisions with the regulator. An institution that cannot produce a credible cryptographic inventory on request is effectively unable to demonstrate compliance with a binding regulatory requirement, regardless of whether a specific fine is attached.

There is also a narrower technical risk the circular is designed to address directly: “harvest now, decrypt later” attacks, where encrypted data intercepted today is stored by an adversary until quantum computing capability catches up, then decrypted retroactively. For data with a long confidentiality lifespan — customer financial histories, KYC records, long-term contracts — this risk exists today even though the decryption capability does not yet exist, which is precisely why SAMA's inventory-first approach targets long-lived, high-sensitivity data as the priority category.

Readiness checklist: getting from zero to a defensible inventory

1. Assign an executive owner — typically the CISO or Head of Information Security — with a direct reporting line to the Information Security Supervisory Committee.

2. Scope the inventory exercise in writing: which systems, business lines, and third-party relationships fall inside the boundary, and document any explicit exclusions.

3. Pull cryptographic configuration data from systems of record, not outdated documentation — core banking platforms, payment switches, API gateways, HSMs, certificate authorities, and key management systems.

4. Classify each asset against sensitivity and migration priority.

5. Document third-party and vendor dependencies separately, since remediation timelines will differ from in-house systems.

6. Brief the Information Security Supervisory Committee and board risk committee before December 31, 2026 with inventory status, known gaps, and a proposed timeline toward March 31, 2027.

7. Build the quantum risk assessment working group now, not after the inventory deadline passes.

Institutions that have already built a mature cryptographic GRC programme under SAMA's Cybersecurity Framework and the NCA's ECC controls will find much of the governance structure for this circular already in place. The gap for most institutions will be the asset-level cryptographic detail itself, which security teams frequently have not tracked at this granularity before.