← All articles

Post-quantum in Canada: who has said what

On this page

1. The short version
2. Who has said what
3. The federal roadmap
4. What OSFI has published
5. Broader federal direction
6. International work with Canadian involvement
7. What isn't there
8. How to use this page
9. Sources and further reading

There's no single Canadian law telling banks or other private organisations to move to post-quantum cryptography by a set date. Instead, several public bodies have published roadmaps, bulletins and best practices that carry very different weight. This page sets out who has said what, who it applies to and which dates are actually in it, using only public primary sources. It reflects what was published as of 12 October 2026 and will change as new documents appear.

The short version

• The federal government has deadlines for itself. Departments must finish migrating high-priority systems by the end of 2031 and the rest by the end of 2035.
• OSFI has published best practices, not a deadline. Its 2026 bulletin sets out five phases of quantum readiness and notes that outside guidance generally points to 2035.
• 2035 keeps coming up. It appears in federal, US and international guidance as the horizon for finishing the move, which makes it the practical planning date even where it isn't binding.

Who has said what

Source	What it is	Who it's for	Dates in it
Canadian Centre for Cyber Security, ITSM.40.001 (June 2025)	Roadmap for migrating Government of Canada systems	Federal departments and agencies, for unclassified and Protected A and B systems	First departmental plans by April 2026, then annual progress reports; high-priority systems by end of 2031; the rest by end of 2035
Canadian Centre for Cyber Security, ITSAP.00.017 (February 2025)	Practical advice on preparing for the quantum threat	Any organisation	None
OSFI, Technology Risk Bulletin: Quantum Readiness Phases and Timelines (dated March 2026)	Best practices in five phases, following a 2024 bulletin on quantum risk	Federally regulated financial institutions	No OSFI deadline; notes that outside guidance generally recommends quantum readiness across all systems by 2035
OSFI Guidelines B-13 and B-10	Technology and cyber risk, and third-party risk	Federally regulated financial institutions	No post-quantum dates; the general obligations apply
National Quantum Strategy roadmap on quantum communication and post-quantum cryptography (2025)	Federal plan for Canada's transition	Government, industry and research	Aims to complete Canada's transition in the 2030s
Canadian Forum for Digital Infrastructure Resilience, Quantum-Readiness Best Practices (version 4, July 2024)	Public-private best practices, updated periodically	Critical infrastructure organisations	None binding
Critical Cyber Systems Protection Act (Bill C-8, royal assent June 2026)	Cyber security obligations for designated operators	Operators of vital systems, including banking and clearing and settlement	Doesn't mention quantum; its list of vital systems wasn't yet in force when last checked

The federal roadmap

The Cyber Centre's roadmap is the only Canadian document with firm migration dates, and it binds federal departments, not banks. It's still useful as a model. It asks each department for a migration plan with a cost estimate and named accountable people, an inventory of where cryptography is used, post-quantum requirements in new contracts, and yearly progress reports. It's also explicit that "done" means quantum-vulnerable algorithms are disabled, isolated or tunnelled, not merely running alongside new ones.

What OSFI has published

OSFI raised quantum risk with institutions in a 2024 bulletin and followed it with a public bulletin, dated March 2026, setting out five phases: build competency and awareness; inventory cryptographic assets; assess risk and create a migration plan; execute the transition; and test, validate and anticipate. It frames these as practices institutions can consider. It sets no OSFI deadline, though it notes that experts and standard-setting bodies generally recommend reaching quantum readiness across all systems by 2035. OSFI's existing guidelines on technology and cyber risk (B-13) and third-party risk (B-10) continue to apply.

For a Canadian bank, the defensible summary is: there's no hard post-quantum deadline aimed at banks, but the regulator has published what good preparation looks like, and 2035 is the horizon everyone points to.

Broader federal direction

The National Quantum Strategy's roadmap aims to complete Canada's transition to post-quantum cryptography in the 2030s. Among its medium-term actions is developing guidelines or regulations for sectors at risk. The Canadian Forum for Digital Infrastructure Resilience, a public-private group convened by Innovation, Science and Economic Development Canada, publishes quantum-readiness best practices for critical infrastructure.

The new Critical Cyber Systems Protection Act will require designated operators of vital systems, a list that includes banking systems and clearing and settlement systems, to run cyber security programmes. It doesn't mention quantum or cryptography specifically, and when last checked its list of vital systems was not yet in force.

International work with Canadian involvement

• G7 Cyber Expert Group roadmap (2026). A coordinated, non-binding roadmap for the financial sector's transition.
• G7 central banks (May 2026). A report on preparing for quantum technologies, from a working group co-chaired by the Bank of Canada and the Banque de France. It sets no deadlines and says it doesn't prescribe courses of action.
• G7 Cybersecurity Working Group (August 2026). A call to action, joined by Canada, urging organisations to begin migrating now. It also sets no dates.

What isn't there

• No law requiring private organisations to adopt post-quantum cryptography by a set date.
• No OSFI post-quantum deadline.
• No public post-quantum timeline I could find from Payments Canada for Lynx or the Real-Time Rail. Banks that depend on them should ask the operator directly and record the answer as a dependency.

How to use this page

1. Plan to the 2035 horizon, and treat the federal 2031 date for high-priority systems as a sensible internal benchmark.
2. Use OSFI's five phases to describe your programme to your board and your regulator.
3. Record each regulator and network's position as a dependency with an owner and a review date, because these documents are changing quickly.
4. Quote dates with their scope: who a date binds matters as much as the date itself.

The banking guide's chapter on governance and the regulatory map covers how to turn this into board reporting.

Sources and further reading

Tags show what kind of source each one is. A standard or government guidance is an official document; a peer-reviewed paper has been checked by other experts; a preprint has not been peer-reviewed yet; an experiment reports a real-world demonstration; a company announcement is the company's own account. Dates and figures were checked against these sources on 12 October 2026. Spotted an error? Email hello@plainquantum.com and it will be corrected, with a note.

1. Government guidanceRoadmap for the migration to post-quantum cryptography for the Government of Canada (ITSM.40.001)Canadian Centre for Cyber Security, 2025
2. Government guidancePreparing your organization for the quantum threat to cryptography (ITSAP.00.017)Canadian Centre for Cyber Security, 2025
3. Government guidanceTechnology Risk Bulletin: Quantum Readiness Phases and TimelinesOffice of the Superintendent of Financial Institutions (OSFI), 2026
4. Government guidanceGuideline B-13: Technology and Cyber Risk ManagementOffice of the Superintendent of Financial Institutions (OSFI), 2022
5. Government guidanceGuideline B-10: Third-Party Risk ManagementOffice of the Superintendent of Financial Institutions (OSFI), 2023
6. Government guidanceNational Quantum Strategy roadmap: Quantum communication and post-quantum cryptographyInnovation, Science and Economic Development Canada, 2025
7. Industry guidanceCanadian Forum for Digital Infrastructure Resilience (including Quantum-Readiness Best Practices)Innovation, Science and Economic Development Canada
8. Government guidanceCritical Cyber Systems Protection Act, Schedule 1: vital services and vital systemsJustice Laws Website, Government of Canada, 2026
9. Government guidanceBill C-8 (45th Parliament): An Act respecting cyber securityParliament of Canada, LEGISinfo, 2026
10. Government guidanceG7 Cyber Expert Group: coordinated roadmap for the transition to post-quantum cryptography in the financial sectorG7 Cyber Expert Group (via US Treasury), 2026
11. Government guidancePreparing for Quantum Technologies: Key Considerations for Financial Sector ParticipantsG7 Central Bank Quantum Technologies Working Group, 2026
12. Government guidanceG7 Cybersecurity Working Group: call to action on preparing for the post-quantum eraCanadian Centre for Cyber Security, 2026