There's a lot of interest in quantum computing in the banking world, but outside specialized teams at large institutions that have invested in it, there is a lack of clarity on what it is, how it works and whether the promises of the technology will come to fruition.
Quantum computing is emerging as a technology with the potential to revolutionize industries, including finance. JPMorgan Chase, Wells Fargo, HSBC and Citigroup are among the banks already investing in it today, believing it will give them a competitive advantage when it is available for everyday use.
While classical computers have been the backbone of computing for decades, quantum computers leverage principles of quantum mechanics to solve complex problems at unprecedented speeds.
In banking, quantum computing promises major advancements in portfolio optimization, fraud detection and risk assessment. It also presents a serious challenge to current encryption methods, potentially rendering some traditional cryptographic protocols obsolete. Financial institutions must navigate both the opportunities and risks associated with this technology to stay ahead.
Here are the basics of how quantum computers work, and what they will eventually offer to banks.
A bit about qubits
Classical computers — laptops, phones, wireless earbuds and every other piece of tech in your home or office — handle information using bits. Each bit can have the value 0 or 1.
Quantum computers — machines inside specialized labs that few businesses bother to experiment with — handle information using qubits.
In one major respect, a qubit is like a bit; every time it is measured, it takes the value of either 0 or 1. However, before being measured, the state of a qubit can be a superposition of both values. Being in a superposition means the qubit's value is a combination of both 0 and 1.
A useful way to understand superposition is through probability. A qubit might have a 100% probability of being measured as 1 or a 100% probability of being measured as 0. It could also have a 10% probability of being measured as 1, or a 40% chance, or any other probability. For these percentages between 0% and 100%, the qubit exists in a superposition of 0 and 1.
A key difference between bits and qubits is something called wavefunction collapse. A classical bit retains its value after being measured, but a qubit loses its superposition upon measurement. In other words, measuring the qubit causes it to collapse into a definite state. This means its pre-measurement superposition cannot be directly observed.
One of the most important properties of qubits is entanglement. When two qubits are entangled, their states are correlated and can be measured together. In that scenario, if one is measured as 1, the other must also be 1. If one is 0, the other must also be 0.
In other cases, qubits can be entangled such that one always has the opposite value of the other, or one qubit might have a 50% chance of being observed in the same state as another.
Some quantum computers can manipulate qubits using quantum gates. These quantum gates change the superposition of qubits, sometimes based on the superposition of other qubits. These quantum gates are much like the logic gates that underpin classical computers.
There is also so-called quantum annealing. Rather than using quantum logic gates, quantum annealing creates a simulation that evaluates numerous potential solutions at the same time using quantum fluctuations.
While this explanation might make quantum annealing sound like a silver bullet — a way of exploring every possible solution to a problem to find the correct one — it has its limitations.
Unlike general-purpose quantum computing, annealing is best suited for specific types of optimization problems, and its effectiveness depends on the specific nature of the problem being addressed. Additionally, the current scale of quantum-annealing machines limits the complexity of problems they can solve.
The properties of superposition and entanglement enable quantum computers to perform operations that are impossible for classical computers. But, classical computers will still have a role even when quantum computing becomes more ubiquitous.
Don't get rid of your laptop yet
Quantum computing does not stand to replace classical computing as a general-purpose technology. Today, the technology is largely experimental and, in the near term, it is likely only to excel at specific tasks.
Over the long term, academic theory about quantum computing suggests it might never outperform classical computing in many areas, according to Konstantinos Karagiannis, director of quantum computing services at global consulting firm Protiviti.
Today, quantum computers can only operate in highly controlled conditions that require specialized equipment. These machines often rely on cryogenic temperatures and specialized shielding to protect qubits from electromagnetic interference and minuscule vibrations, which can introduce errors.
In addition to the costs required to maintain and operate a quantum computer, leading academic theory suggests they will only ever offer performance improvements in specific applications.
"A quantum processing unit (QPU) will be used for specific tasks in a workload, just like you'd select a [graphics processing unit] or TPU in a cloud workload today," Karagiannis said. "But you wouldn't run Microsoft Word on a QPU any more than you'd run it on a graphics card."
Mathematicians, computer scientists and other researchers are developing both the hardware of quantum computers, to make them real, and the theory behind them, to figure out how people can use them to their maximum potential. So far, one area that looks promising is portfolio optimization — a classic problem for banks of all sizes.
Quantum annealing for portfolio optimization
One bank has already used quantum computers to reduce the computing time of investment hedging solutions, according to Murray Thom, vice president of quantum business innovation at D-Wave Systems.
Investment hedging is a risk-management strategy used by financial institutions to protect against potential losses due to market fluctuations. It typically involves using financial instruments such as derivatives to offset potential risks in investment portfolios, ensuring more stable returns even in volatile markets.
"The number of possible configurations to optimize a portfolio when considering a pool of 300 assets is greater than the number of atoms in the known universe," Thom said. "Simple legacy solutions are available, but their quality suffers under real-world constraints."
In 2022, Spanish financial services company CaixaBank replaced its legacy investment hedging solution, which relied solely on classical computing time, with one that used a hybrid approach involving both quantum computing and classical computing. The hybrid approach, which took advantage of quantum annealing,
Just as quantum annealing promises to revolutionize portfolio optimization, it also offers to improve machine learning algorithms, which underpin many banking functions including credit scoring and fraud detection.
Quantum machine learning for credit scoring and fraud detection
Quantum machine learning algorithms have also demonstrated higher precision in credit scoring, outperforming classical methods by reducing false positives, according to Karagiannis.
The classical approach for predicting a so-called fallen angel — someone who has a great credit score but is likely to default on their debt — can involve using many classifiers to parse data, Karagiannis said. In computer science, a classifier is an algorithm that assigns data points to a range of categories or classes, and machine learning algorithms help to train these classifiers to be more accurate.
"Our partner Multiverse did an excellent experiment where they caught the same number of credit downgrades with more precision and fewer false positives" using a quantum-based approach, Karagiannis said.
As with annealing, quantum computing for machine learning purposes has its limitations, many of them tied to the physical restrictions on scaling quantum computers.
Despite the limitations, the trend in improving credit scoring is likely to continue, Karagiannis said, particularly with respect to the ability of quantum computing to manage power more efficiently when training AI models, an area of research for D-Wave and others.
This same trend stands to help banks improve their fraud detection, as well. While quantum computers might not speed up real-time fraud detection, they could help train the AI models that run on classical computers.
"Imagine feeding the most challenging edge cases from a classical fraud detection approach to a quantum computer, perhaps every hour, for better precision as a final pass," Karagiannis said. "A similar combination approach can spot new or novel indicators of compromise in a financial computer network where hacking or a zero-day exploit can lead to catastrophic losses."
While quantum computing is likely to help banks perform specific tasks, it also stands to undermine the encryption algorithms they use today.
Quantum computers threaten some current encryption
One example of how quantum computers threaten banks comes from
The card-capture process used at ATMs and points of sale today does not support quantum-proof encryption, according to the report. This means that a malicious actor with a quantum computer could theoretically recreate payment cards and PIN numbers en masse or create fake cards that are accepted at points of sale and ATMs. Similar exploits apply at other points in the payments process.
Banks will not need to change every encryption algorithm they currently use because there are a handful of algorithms that are expected to remain secure against quantum computers. The primary example is Advanced Encryption Standard (AES) algorithms, published by the National Institute of Standards and Technology (NIST) in 2001.
Systems that employ AES will remain safe for the foreseeable future, according to FS-ISAC and NIST. However, use cases that employ other common encryption algorithms, such as RSA (an initialism for Rivest-Shamir-Adleman, the three inventors of the algorithm) and elliptic-curve cryptography will not be safe against quantum computers.
This is because of a set of algorithms published in 1994 by American mathematician Peter Shor. The most famous from this set is often simply called Shor's algorithm; it allows a powerful enough quantum computer to find the prime factors of a number, which is known as factoring a number.
Small numbers are relatively easy to factor, but RSA uses enormous numbers that are virtually impossible for classical computers to factor. This fact has made RSA an encryption algorithm of choice for decades, but quantum computers threaten to eventually make the algorithm obsolete by making it much faster to factor large numbers.
To create an RSA encryption key pair, a computer randomly generates two large prime numbers and multiplies them together. This product constitutes the primary part of the public key used in RSA encryption; the two large prime numbers are used to make the private key.
In theory, if a computer can take a public RSA key and factor it to get the two large prime numbers used to generate it, the computer could break the encryption, giving attackers a way of obtaining the private key.
This is exactly what Shor's algorithm does, but it can only run on a quantum computer, not a classical computer. Currently, there is no quantum computer powerful enough to actually run Shor's algorithm, so RSA remains safe for the time being.
Nonetheless, the next generation of encryption algorithms are now available, and the U.S. has encouraged banks to transition posthaste.
Quantum-proof encryption is available
In August, the NIST released a finalized standard for a new post-quantum encryption algorithm. The algorithm had been vetted for years before the agency published it in its final form, and NIST encouraged computer system administrators to begin transitioning to the new standard "as soon as possible," according to a press release from NIST.
Switching encryption standards is a gargantuan task, especially for banks, because encryption permeates nearly every aspect of a bank's operations and services. Encryption protects data when users access a banking application or website, their transaction histories stored in the bank's core banking software, communications internal to the bank, and every other piece of sensitive data.
Banks have struggled in the past to shift away from old, risky encryption standards. In 2016, researchers published an exploit of Triple DES, a major encryption standard at the time, which led NIST to deprecate the standard in 2019 and recommend its full replacement by the end of 2023.
More than a year later, some EMV chips embedded in credit and debit cards still use the Triple DES standard.
In cases like EMV, where deprecated or quantum-insecure encryption is in use, banks will need a plan for replacing the algorithm with a post-quantum option, like the one finalized by NIST last year. If they don't, they risk falling behind and finding themselves vulnerable when quantum computing becomes powerful enough to break classical encryption.
As such, FS-ISAC has encouraged banks to engage in "cryptographic agility," so they can switch to post-quantum encryption in the near future and to yet another standard if history repeats itself and the newest algorithm is broken or weakened.
The threat that quantum computers will break encryption looms, but it's the job of security-minded people to prepare for the worst possible scenario. What if quantum computers fizzle out? What if all the hype turns out to be just that — hype?
Are quantum computers a sure bet?
Computers get faster every year. In fact, microchip manufacturers improve their products at a strikingly predictable rate: The number of components on a single chip doubles roughly every two years. This is an observation that Gordon E. Moore, the co-founder of Intel, made in 1965 that still holds true today.
In the quantum computing world, there is no Moore's Law. There is no guarantee or promise that quantum computers will get larger or more efficient every few years.
Despite this, there is reason to believe that the existence of useful quantum computers is inevitable and that there is a chance they might be here in the next decade.
One way to predict how soon it will be before quantum computers are powerful enough to become useful is by asking experts for their opinions. This is what the Global Risk Institute (GRI) has done annually since 2019.
Each year, the nonprofit organization asks a panel of quantum computing experts: How long will it be before a quantum computer can crack an RSA key in 24 hours?
Leading theories indicate that a quantum computer capable of breaking RSA would need roughly 4,000 logical qubits. A quantum computer of this size would be useful for many other real-world applications, as well. By comparison, the most capable quantum computers in existence today have no more than 12 logical qubits.
The 32 experts GRI
It is impossible to predict whether useful quantum computers are inevitable, but a risk-based approach suggests that banks need to prepare for the possibility that they could become real in the next few decades as well as the small but significant risk (and opportunity) that they will be ready sooner than anticipated.
