Saudi Financial Firms Face a Year-End Test of Cryptographic Discovery Procedures

Problem

Saudi Arabia's financial institutions have until the end of 2026 to ensure their cryptographic-asset identification and classification procedures are accurate and comprehensive. The deadline applies to the discovery process, not completion of a full inventory or migration. By the end of March 2027, the institutions must complete an enterprise quantum-risk assessment and develop action plans for the risks it finds.

Those are regulatory dates, not an estimate of when a useful quantum computer might arrive. The Saudi Central Bank circular, issued on August 27 and marked in force, says institutions are "required" to act. It also orders them to turn quantum risk into a standing item for the information-security supervisory committee and the board risk committee, where applicable.

The scope extends beyond locally incorporated banks. The original circular's distribution list covers all banks operating in the kingdom, credit-information companies, finance companies, payment-services companies and support entities licensed by SAMA for finance activity.

The wording creates a narrower deadline than the headline shorthand suggests. Institutions do not have to finish migrating every system this year. They must ensure that the process used to identify and classify all cryptographic assets is accurate and comprehensive. The risk assessment and action plan follow one quarter later.

That distinction does not make the order light. A migration plan built on a partial inventory is a timetable for surprises.

Analysis

Cryptography is not one line in an asset register. It sits in certificates, keys, code-signing systems, software libraries, hardware security modules, network protocols, device firmware, authentication services and data flows. The latest NIST migration guidance says an inventory can include all of those layers, plus the owner, purpose and lifecycle of each key without recording the key material itself.

Visible internet services are the easy part. A scanner can inspect supported TLS ciphers or find public certificates. It will not, by itself, expose cryptography embedded in source code, a mainframe application, a mobile software development kit, a vendor appliance, an internal private-key infrastructure or a cloud service outside the security team's direct control.

NIST's cryptographic discovery practice guide makes the ownership problem explicit. Its enterprise example combines managed hardware and software inventories, network-traffic analysis, source-code scanning and cloud-service discovery. It concludes that multiple products may be necessary. NIST also notes that system owners often do not know which components contain cryptography or how it is used.

SAMA's circular is designed around that gap. The inventory must link cryptographic assets to data, systems and services, then classify them by sensitivity and migration priority. Priority assets need an assessment of cryptographic resilience, constraints, challenges and third-party dependencies.

The result is closer to a cryptographic bill of materials than a certificate spreadsheet. A bank must connect a vulnerable algorithm to the business service it protects, the data's useful life, the team that owns the service, the supplier that controls the component and the replacement path. Without that map, "crypto agility" is an architecture slogan.

The circular itself names no bespoke fine, attestation form or public disclosure schedule. It still sits inside SAMA's supervisory system. The central bank separately states that publication on its circular portal does not relieve supervised institutions of compliance with instructions sent through official channels. For banks, the Banking Control Law implementation rules allow SAMA to demand corrective measures and escalate its response when a bank does not follow instructions.

That is more concrete than the current US financial-sector programme. In January, the G7 Cyber Expert Group, co-chaired by the US Treasury and Bank of England, published a six-phase migration roadmap. The document explicitly says it does not set regulatory expectations and its timelines are not prescriptive. Treasury then launched a public-private Quantum-Readiness Task Force in August, focused on sector coordination, vendors and digital assets. Its announcement imposes no inventory deadline on private banks.

US federal agencies face separate inventory and migration requirements. That is not legal equivalence with private financial institutions. Saudi Arabia's distinction is simpler: SAMA has attached dates and board governance to the discovery work for the institutions it supervises.

Implications

The first deadline tests management control more than quantum expertise. A credible dashboard should show inventory coverage by critical service and asset owner, unresolved discovery gaps, third parties that have supplied cryptographic evidence, priority assets without a replacement path and exceptions accepted by accountable executives.

Vendor evidence will be the hardest column. Banks can change an internal library. They cannot rewrite a payment appliance, cloud control plane or managed security service on demand. SAMA's requirement to identify third-party dependencies before the risk plan is due prevents procurement uncertainty from being filed under "later."

The board requirement also changes the failure mode. An incomplete map is no longer only a security team's technical debt. It becomes a recurring risk report with named challenges and recommendations.

Saudi regulators have not ordered an overnight algorithm swap. They have ordered institutions to make the swap governable. By year-end, the useful answer is not a declaration of quantum readiness. It is a defensible inventory that shows what the institution still does not control.