Three Regulators and Two Banks Start Testing for a Quantum Break

Abu Dhabi, Bhutan and Malta's financial regulators are observing a post-quantum custody pilot using the NIST signature standard finalised two years ago. The reason to care is not the cryptography. It is which regulators turned up.

• A cross-regional pilot announced on 24 August will test post-quantum cryptography for digital asset custody, convened by the Responsible Fintech Institute with Safeheron leading protocol and engineering work
• Abu Dhabi Global Market, Bhutan's Gelephu Financial Services Office and the Malta Financial Services Authority are taking part as regulatory stakeholders, alongside Bison Bank and DK Bank
• The work centres on a multiparty computation protocol supporting ML-DSA-65, the digital signature algorithm in NIST's FIPS 204 standard finalised in August 2024
• Testing covers wallet generation and on-chain transfer activity on the NEAR testnet, with a white paper and an open-source protocol release to follow on dates not yet set
• Responsible Fintech Institute chairman Chia Hock Lai said "No single bank, vendor, or regulator solves this alone"

A Standard Exists, and Almost Nobody Has Moved to It

The cryptography underpinning digital asset custody assumes that deriving a private key from a public one is computationally impractical. A sufficiently capable quantum computer removes that assumption. The standards response has already happened: NIST finalised FIPS 204 in August 2024, and ML-DSA-65 is the signature algorithm it specifies. What has not happened is migration.

The pilot announced on 24 August is an attempt to work out what migration involves for regulated institutions rather than for protocols. The Responsible Fintech Institute is convening it and handling governance and cross-jurisdiction coordination. Safeheron is leading the protocol and engineering work. The technical core is a multiparty computation protocol supporting ML-DSA-65, so that several parties can sign a transaction without any one location ever holding the complete private key. Participants will test wallet generation and on-chain transfers on the NEAR testnet.

Two banks are participating, Bison Bank and DK Bank, with others described as in discussion. Banking access remains the sector's binding constraint, which is why operators keep reaching for crypto rails where banking is expensive. Three regulators are involved as stakeholders: Abu Dhabi Global Market, the Gelephu Financial Services Office in Bhutan, and the Malta Financial Services Authority.

The wider timetable is set by others. The Bank for International Settlements published a quantum migration roadmap in July 2025. The Algorand Foundation targets broad quantum resilience by 2027. The Hong Kong Monetary Authority has set 2030 as a preparedness deadline. Against those, a pilot testing wallet generation on a testnet in 2026 is early, which is the point of it.

The Regulators Are the Story, Not the Algorithm

ML-DSA-65 is a settled standard and testing it is unremarkable. What is unusual is three financial regulators sitting inside a vendor-led proof of concept before any rule requires them to. Regulators normally arrive after an industry has built something, which is why supervisory expectations so often arrive shaped by whatever the first movers happened to do. Participating at the pilot stage is a bid to shape the operational and interoperability questions before they harden into practice, and Chia Hock Lai's line about no single party solving it alone is the honest version of that. The commitment on offer is attention rather than rulemaking, but attention this early is what makes later rules implementable.

Malta's Involvement Is Not the One This Industry Should Assume

For readers in this sector the Malta name will jump out, and it needs care. The participant is the Malta Financial Services Authority, which supervises financial services. It is not the Malta Gaming Authority, which licenses the operators. The two are separate bodies with separate remits, and nothing in this pilot touches gambling licensing.

The connection is real but indirect, and it runs through custody. Operators that take crypto deposits hold customer balances in digital assets, and every one of those balances rests on the same signature assumptions. Europe's largest licensing hub having a financial regulator that understands post-quantum custody is worth more to operators based there than it looks, because the safeguarding standards that eventually apply to operator-held crypto will be written by people with or without that grounding.

Early Work on a Distant Risk Is How Migration Actually Happens

Nobody credibly claims a quantum computer will break these curves this year, and the honest position is that the timeline is unknown. That is precisely why the work has to start now. The migration problem for custody is not swapping one algorithm for another; it is that assets secured under today's signatures may need to move before the threat arrives, which is an operational and governance problem involving every counterparty at once. A pilot that produces a white paper and an open-source protocol, as this one says it will, is worth more than a policy statement, and worth considerably less than a completed migration. The dates for both remain unannounced.

Three regulators have joined a test rather than waiting for a rule. On a risk this slow and this total, that is the correct order to do things in.