Are US and Gulf banks ready for post-quantum encryption?
In the United States, mostly yes. In the Gulf, fewer than half. Nearly all of it comes from the CDN in front of the bank. We tested the main websites of 159 US and Gulf banks and financial regulators on October 29, 2026.
main websites of US and Gulf banks and financial regulators we reached negotiate post-quantum key exchange1
of those sit behind a CDN or cloud provider’s edge, which does the post-quantum work. None did it on its own servers1
of the 50 largest US bank holding companies1
Gulf banks we reached, out of 79 locally incorporated banks1
What we found.
Group figures only. Every share gives its numerator and denominator; percentages are whole numbers.
-
93 of 148 front doors already use post-quantum key exchange.
Offered what a current browser offers, 93 of 148 (63%) of the main websites we could reach chose X25519MLKEM768, the hybrid standardized in RFC 10024. The United States is further along: 55 of 62 (89%), against 38 of 86 (44%) in the Gulf.1,3
-
The CDN did it.
All 93 sit behind a CDN or cloud provider’s edge, most of them Akamai (38) and Cloudflare (32). Of the 31 institutions that appear to serve their own front door, none negotiated it. A test from outside sees the edge, not the institution’s own servers behind it.1
-
The Gulf gap is mostly a CDN gap.
30 of the 86 Gulf institutions we reached serve their own front door, against 1 of 62 in the United States, and none of those 30 negotiated post-quantum key exchange. On a CDN or cloud-provider network, 38 of 56 (68%) of Gulf institutions did, against 55 of 61 (90%) in the United States.1
-
Every server that supports it prefers it.
The 93 hosts that accepted a hybrid group when only hybrids were offered also chose one when classical groups were offered beside it. All chose X25519MLKEM768; none chose the hybrids built on NIST P-256 or P-384.1
-
No post-quantum certificates yet, as expected.
Every certificate we saw is classical: RSA 2048 on 101 of 148 (68%), ECDSA P-256 on 36 and RSA 4096 on 11. No public certificate authority can issue a post-quantum web certificate yet: Chrome plans to onboard authorities for a new kind of certificate in the third quarter of 2027, and Let’s Encrypt plans production in 2027. Post-quantum key exchange protects confidentiality now; authentication is the next step.1,5,6
-
Old protocols linger at a few.
5 of 148 (3%) still accept TLS 1.0 or 1.1, and 33 did not negotiate TLS 1.3 with a current browser offer.1
By group.
“Reached” means a browser-like handshake completed. Every share below is out of the institutions reached.
| Group | Reached | Post-quantum key exchange | TLS 1.3 | Accept TLS 1.0 or 1.1 |
|---|---|---|---|---|
| US authorities | 12 of 12 | 9 of 12 (75%) | 11 of 12 (92%) | 0 |
| US banks | 50 of 50 | 46 of 50 (92%) | 46 of 50 (92%) | 1 |
| GCC authorities | 16 of 18 | 5 of 16 (31%) | 8 of 16 (50%) | 3 |
| GCC banks | 70 of 79 | 33 of 70 (47%) | 50 of 70 (71%) | 1 |
| All institutions | 148 of 159 | 93 of 148 (63%) | 115 of 148 (78%) | 5 |
Gulf banks by country.
Locally incorporated banks on each central bank’s register. Small groups, so read the counts, not the shares.
| Country | Reached | Post-quantum key exchange | On a CDN or cloud network | TLS 1.3 |
|---|---|---|---|---|
| Saudi Arabia | 7 of 14 | 3 of 7 | 3 of 7 | 4 of 7 |
| UAE | 24 of 24 | 10 of 24 (42%) | 19 of 24 (79%) | 19 of 24 (79%) |
| Qatar | 9 of 9 | 6 of 9 | 6 of 9 | 6 of 9 |
| Kuwait | 9 of 10 | 3 of 9 | 4 of 9 | 7 of 9 |
| Bahrain | 12 of 12 | 8 of 12 (67%) | 12 of 12 (100%) | 8 of 12 (67%) |
| Oman | 9 of 10 | 3 of 9 | 4 of 9 | 6 of 9 |
Who serves the front door.
The provider whose network answered, and how many of its institutions negotiated post-quantum key exchange. Being on a CDN is not enough by itself: of the 6 Cloudflare-fronted hosts without it, 5 had TLS 1.3 switched off.
| Front door served by | Institutions | Post-quantum |
|---|---|---|
| Akamai | 40 | 38 of 40 |
| Cloudflare | 38 | 32 of 38 |
| The institution, or not identified | 31 | 0 of 31 |
| Microsoft Azure | 9 | 0 of 9 |
| Imperva | 7 | 7 of 7 |
| Amazon Web Services | 6 | 3 of 6 |
| Amazon CloudFront | 4 | 4 of 4 |
| Sucuri | 3 | 3 of 3 |
| Fastly | 2 | 2 of 2 |
| F5 Distributed Cloud | 2 | 1 of 2 |
| Azure Front Door | 2 | 2 of 2 |
| Google Cloud | 1 | 1 of 1 |
| Radware Cloud WAF | 1 | 0 of 1 |
| DigitalOcean | 1 | 0 of 1 |
| AWS load balancer | 1 | 0 of 1 |
How we measured.
Light and passive by design, with the same population and discretion rules as the posture study in The Seam Report 2026.2
- Population
- The 159 confirmed institutions of the posture study in The Seam Report 2026: 12 US authorities (the nine federal agencies at the Financial Stability Oversight Council, plus NYDFS, FINRA and CISA), the 50 largest US bank holding companies by assets on the FFIEC list, 18 GCC central banks, market and free-zone regulators and national cybersecurity authorities, and the 79 locally incorporated banks on the six GCC central bank registers. One main web host each.
- When and where from
- October 29, 2026, 23:48 to 23:53 UTC, from a single vantage point in France (AS212238). One run; every answer cached.
- What we sent
- At most five TLS handshakes per host, one at a time with a one-second pause, each closed straight after the handshake. A browser-like offer (X25519MLKEM768 and X25519 key shares, then P-256 and P-384); hybrid groups only on TLS 1.3; TLS 1.2 only; TLS 1.0 and 1.1 only. A classical control ran only where the browser-like offer failed for a reason other than the certificate.
- What we did not do
- No web page was requested, no path, no login, no vulnerability check and no mail. Certificates were verified on the browser-like probe only; the others only read which algorithms the server chose.
- Who serves the front door
- Attributed by the CNAME chain (for example edgekey.net for Akamai, cdn.cloudflare.net for Cloudflare), then by the network that originates the address (Team Cymru origin ASN lookup). Plain cloud-provider addresses count as a cloud network. DDoS scrubbing that hands the connection to the institution’s own server does not. Anything unmatched counts as the institution or not identified. An independent check of every address confirmed that all post-quantum hosts sit behind an edge.
- DNS
- Through Cloudflare’s DNS-over-HTTPS resolver, never the institutions’ own servers.
- Tools
- Python 3.15.1, OpenSSL 4.0.3. A self-check against cloudflare.com had to negotiate X25519MLKEM768 before the run could start.
What this cannot tell you.
The limits matter as much as the numbers. Read them before quoting a share.
- Vantage
- We measured from outside the Gulf. 7 of the 14 Saudi banks did not answer, consistent with blocking of foreign addresses, so Saudi figures cover the 7 we reached. Of the 11 institutions that did not complete a browser-like handshake, 10 timed out. The other refused every forward-secret cipher suite; a follow-up check found it accepts only RSA key exchange over TLS 1.2, which current Chrome refuses and which leaves recorded traffic readable to anyone who later obtains the key.
- The edge, not the bank
- A CDN may speak post-quantum to visitors while the connection to the bank’s own servers stays classical. That leg, online banking subdomains, mobile apps and internal systems cannot be seen from outside. Our post-quantum readiness assessment measures every host you authorize and the systems behind them.
- Mail servers were not tested: outbound port 25 was blocked from the vantage network. Email is a separate path, often run by a different provider.
- One snapshot
- Cloud and CDN defaults change, sometimes without the customer doing anything. Results describe one evening.
- Shared hosts
- Two banking groups use one domain across two countries; each licensed bank is counted once, so those domains appear twice in Gulf totals, as in the posture study.
- Discretion
- We publish group figures only and never name an institution. An institution that wants its own record can write to security@bendings.com.
In context.
How this measurement sits next to browser data, earlier scans and the NIST deadline.
- Browsers
- 71% of human HTTPS requests to Cloudflare used post-quantum key exchange in the week to October 28, 2026, so most visitors’ browsers are ready.4
- Earlier scans
- The only earlier scan of banks we found, by F5 Labs in 2025, used a different sample and its own tables disagree, so the two do not make a trend.7
- Deadline
- NIST deprecates RSA and elliptic-curve key exchange after 2030.8
- Cite as
- Bendings (2026), Post-quantum readiness at US and Gulf banks and financial regulators, measured October 29, 2026, https://bendings.com/quantum/banks.Download CSVDownload JSON
Sources.
Primary sources unless marked. Each shows the date we last opened it and confirmed what we cite.
- 1 Post-quantum readiness at 159 US and Gulf banks and regulators, Bendings measurement, October 29, 2026 Checked October 30, 2026.
- 2
- 3
- 4 Post-quantum encryption adoption, Cloudflare Radar Checked October 28, 2026.
- 5
- 6 A post-quantum future for Let’s Encrypt, Let’s Encrypt, June 3, 2026 Checked October 28, 2026.
- 7 The state of PQC on the web, F5 Labs, June 26, 2025 Checked October 28, 2026.
- 8 NIST IR 8547, Transition to Post-Quantum Cryptography Standards, final, October 27, 2026 Checked October 30, 2026.
Find out what sits behind your front door.
Write from your organization’s email address. Tell us what is in scope, your deadline and who can authorize testing. Leave sensitive details out of the first message.