SAMA’s quantum circular, item by item.
Circular 482021280 of August 27, 2026 gives Saudi financial institutions two dates: December 31, 2026 for cryptographic asset procedures and March 31, 2027 for a quantum risk assessment. Reviewed October 30, 2026.
The four requirements.
Quoted from SAMA’s English translation, which the Rulebook lists as in force. The circular says financial institutions “are required” to take these measures.1
-
First
Due March 31, 2027“Conduct an enterprise-level assessment of the risks associated with quantum computing, in alignment with the financial institution’s enterprise risk management procedures, and develop action plans to address the risks identified through the assessment. Such assessment shall include, without limitation, operational, legal, regulatory, and strategic risks, including those related to human resources, by the end of the first quarter of 2027.”
-
Second
Due December 31, 2026“Ensure the accuracy and comprehensiveness of the procedures for identifying and classifying all cryptographic assets of the financial institution by the end of the fourth quarter of 2026, taking into consideration, at a minimum, the following:”
- “Identify the data, systems, and services associated with cryptographic assets and classify them in terms of sensitivity and priority for migration to quantum-resistant cryptographic solutions.”
- “Assess the level of cryptographic resilience of priority assets and identify constraints, challenges, and dependencies on third parties.”
-
Third
No date set“Develop plans and initiatives to achieve the required level of cryptographic resilience or appropriate alternative solutions for all priority assets, in line with the outcomes of item “Second” above.”
-
Fourth
Standing“Include quantum computing risks as a standing item for periodic monitoring within the activities of the Information Security Supervisory Committee and the Risk Committee emanating from the Board of Directors of the financial institution, where applicable, and report challenges and recommendations to the Board of Directors or its equivalent.”
Who it binds.
Financial institutions regulated by the Saudi Central Bank; the Rulebook lists the circular for banks, finance companies, payment service providers and credit bureaus. It was issued on August 27, 2026, 14/3/1448H, under the Saudi Central Bank Law.
- Number
- 482021280
- English title
- Enhancement of Operational Resilience to Address Quantum Computing Risks
- Arabic title
- رفع مستوى المتانة التشغيلية لمواجهة مخاطر الحوسبة الكمية2
- Enquiries
- SAMA’s Executive Department of Operational Resilience Control, named in the circular.
What it leaves open.
The circular sets duties and dates. These are the points an institution has to decide for itself.
- No algorithms named
- The circular names no algorithms and cites no NCA standard. The NCA’s binding National Cryptographic Standards, NCS-1:2020, still assume no quantum computers exist and defer post-quantum cryptography to a later version.1,3
- No finish date
- It dates the asset procedures and the risk assessment. It sets no date for completing a migration.1
- Suppliers
- Item Second asks institutions to identify “dependencies on third parties”. Much of a bank’s cryptography runs inside vendors’ products and services, where the bank cannot change it alone.1
- Alternatives
- Item Third allows “appropriate alternative solutions” for priority assets without saying what qualifies.1
How it compares.
SAMA is the only Gulf regulator we found with dated quantum duties. The full list is in our deadline tracker.
| Instrument | Applies to | Requires | Dates |
|---|---|---|---|
| SAMA circular 482021280 | Banks, finance companies, payment service providers and credit bureaus | Asset identification and classification procedures; enterprise quantum risk assessment with action plans; standing board item1 | December 31, 2026 March 31, 2027 |
| CBK CORF v1.0, 7.1.4 | CBK-regulated banks and financial institutions | Adopt quantum-resistant algorithms; assess cryptographic practices periodically; quantum readiness strategy with timelines and milestones4 | None set |
| UAE IA Standard v2.1, T3.4.4 | Federal entities and critical information infrastructure | Inventory of systems using public-key cryptography; lab testing of post-quantum standards; training5 | None set |
| US Executive Order 14412 | Federal civilian agencies | Post-quantum key establishment and signatures for high value assets and high impact systems6 | December 31, 2030 December 31, 2031 |
Questions to settle before December 31.
Our reading as testers, not legal advice. Where the circular and this page differ, the Arabic original governs.
- Does the inventory reach your suppliers?
- Cryptography that a cloud provider, card processor or software vendor runs for you is still your asset under item Second. The procedure needs a way to ask for it and record the answer.
- Which data must stay secret past 2030?
- That is what decides “sensitivity and priority for migration”. Records that stay confidential for a decade are exposed today to anyone recording traffic.
- How will you know the inventory is complete?
- Procedures that list what teams report miss the cryptography nobody registered: appliances, embedded devices, old scripts and integrations. Checking the list against what the network actually shows is the only test of it.
- Who owns the standing board item?
- Item Fourth puts quantum risk on the agenda of two board-level committees. Decide who reports, what they show each time and how challenges reach the board.
We run this work as a post-quantum readiness assessment: an inventory, a risk ranking and a plan traced to each item of the circular.
Sources.
Primary sources unless marked. Each shows the date we last opened it and confirmed what we cite.
- 1
- 2 رفع مستوى المتانة التشغيلية لمواجهة مخاطر الحوسبة الكمية, SAMA, August 27, 2026 (Arabic original) Checked October 28, 2026.
- 3 National Cryptographic Standards NCS-1:2020, National Cybersecurity Authority, Saudi Arabia Checked October 28, 2026.
- 4 Cyber and Operational Resilience Framework (CORF) v1.0, Central Bank of Kuwait, December 3, 2025 Checked October 29, 2026.
- 5 UAE Information Assurance Standard v2.1, UAE Cyber Security Council, November 2025 Checked October 28, 2026.
- 6 Executive Order 14412, Securing the Nation Against Advanced Cryptographic Attacks, June 22, 2026 Checked October 29, 2026.
Discuss an engagement privately.
Write from your organization’s email address. Tell us what is in scope, your deadline and who can authorize testing. Leave sensitive details out of the first message.