Post-Quantum Migration Readiness for African Financial Institutions
Abstract
Financial institutions depend on RSA, elliptic-curve cryptography, and Diffie-Hellman key exchange for authentication, transaction integrity, and confidentiality: algorithms a sufficiently large quantum computer would break outright rather than merely weaken. No cryptographically relevant quantum computer exists yet, but the harvest-now-decrypt-later threat means data intercepted today remains at risk once one does, and financial data's long retention obligations make this a present-day planning problem rather than a distant one. This paper assesses the readiness of financial institutions in Africa to adopt post-quantum cryptography (PQC) and develops a framework for transitioning to quantum-resistant cryptographic systems. Five specific objectives drive that work: examining PQC awareness among African financial institutions, assessing current cryptographic exposure, identifying technical, financial, organizational, regulatory, and skills-related adoption barriers, evaluating the suitability of finalized PQC algorithms for financial applications, and developing a readiness and migration framework fitted to African constraints. The study's design is literature-based and conceptual: it synthesizes verified secondary evidence rather than reporting original fieldwork, and no institution was surveyed or interviewed. Its contributions include an integrated Technology-Organization-Environment/Diffusion-of-Innovation model with crypto-agility as a mediating capability, a six-dimension readiness instrument, and an algorithm-evaluation framework. The central contribution, a six-phase migration framework addressing three gaps found in every existing precedent, is paired with an adapted risk-based prioritization matrix. Headline recommendations call on institutions to name a single accountable owner and begin scoped discovery now, on regulators to extend draft cybersecurity guidance to address cryptographic agility explicitly, and on future research to empirically test the proposed model against real institutions.
Related
- Caught between financial and psychological distress: a call for integrated financial readiness and community-based mental health interventions in the U.S.
- The role of financial development on carbon emissions in Sub-Saharan African countries in a nonlinear framework
- Strengthening Childhood Cancer Care in Nepal (DECAN-CHILD): Protocol for Evaluating Quality, Financial Burden and Health System Readiness Through a Prospective Cohort Study
- Artificial intelligence awareness, usage, and readiness among fellows of the West African college of physicians.
- Structural and Social Disadvantage and Post-Migration HIV Vulnerability among African, Caribbean, and Black Communities in Ontario
BibTeX
@misc{kasile2026postquantum,
title = {{Post-Quantum Migration Readiness for African Financial Institutions}},
author = {Josephat Kasile and Isaac Shaban and Dominick Joseph and Mariam Slim and Edward Fadhili and Daniel Makange and Allan Jada and Elina Kassabaje and Swirtbert Shija and Joshua Mushi and Angel Mmari and Mrisho Lukamba and Sarah Kamwela},
howpublished = {Zenodo},
year = {2026},
month = oct,
doi = {10.5281/zenodo.23542185},
url = {https://zenodo.org/records/23542185},
note = {CC BY 4.0},
}
RIS
TY - UNPB
TI - Post-Quantum Migration Readiness for African Financial Institutions
AU - Josephat Kasile
AU - Isaac Shaban
AU - Dominick Joseph
AU - Mariam Slim
AU - Edward Fadhili
AU - Daniel Makange
AU - Allan Jada
AU - Elina Kassabaje
AU - Swirtbert Shija
AU - Joshua Mushi
AU - Angel Mmari
AU - Mrisho Lukamba
AU - Sarah Kamwela
PY - 2026
DA - 2026/10/21
PB - Zenodo
DO - 10.5281/zenodo.23542185
UR - https://zenodo.org/records/23542185
AB - Financial institutions depend on RSA, elliptic-curve cryptography, and Diffie-Hellman key exchange for authentication, transaction integrity, and confidentiality: algorithms a sufficiently large quantum computer would break outright rather than merely weaken. No cryptographically relevant quantum computer exists yet, but the harvest-now-decrypt-later threat means data intercepted today remains at risk once one does, and financial data's long retention obligations make this a present-day planning problem rather than a distant one. This paper assesses the readiness of financial institutions in Africa to adopt post-quantum cryptography (PQC) and develops a framework for transitioning to quantum-resistant cryptographic systems. Five specific objectives drive that work: examining PQC awareness among African financial institutions, assessing current cryptographic exposure, identifying technical, financial, organizational, regulatory, and skills-related adoption barriers, evaluating the suitability of finalized PQC algorithms for financial applications, and developing a readiness and migration framework fitted to African constraints. The study's design is literature-based and conceptual: it synthesizes verified secondary evidence rather than reporting original fieldwork, and no institution was surveyed or interviewed. Its contributions include an integrated Technology-Organization-Environment/Diffusion-of-Innovation model with crypto-agility as a mediating capability, a six-dimension readiness instrument, and an algorithm-evaluation framework. The central contribution, a six-phase migration framework addressing three gaps found in every existing precedent, is paired with an adapted risk-based prioritization matrix. Headline recommendations call on institutions to name a single accountable owner and begin scoped discovery now, on regulators to extend draft cybersecurity guidance to address cryptographic agility explicitly, and on future research to empirically test the proposed model against real institutions.
ER -