up:: Doing the Work MOC
PQC for Asset and Investment Management
An asset manager, hedge fund, private-equity firm, or registered investment adviser has a post-quantum problem that looks nothing like a bank’s. Strip out the card rail, the retail payment infrastructure, and in most cases the public filing obligation, and what remains is a small firm holding three things of unusual and durable value: the models and trading logic that constitute the entire business, the position and transaction record that reveals those models to anyone who reads it, and investor identity and subscription data with a multi-decade sensitivity life. Almost none of that sits on infrastructure the firm owns, which changes what migration even means here.
This note is general education about a regulatory regime and market structure, not legal or investment advice. Which rules apply to a particular firm, and how, are determinations made with its own counsel and compliance officer.
The short version:
- The crown jewels are the model, the position, and the investor record. Two of the three keep their value long after the moment they were captured, which is what makes harvest now, decrypt later a live concern rather than a theoretical one.
- The binding federal rule for most buy-side firms is the amended Regulation S-P, not the cyber-disclosure rule. Its compliance dates have both passed.
- Regulation S-P names no cryptographic control anywhere. It sets an outcome and a clock, which means nothing in it will tell a firm when its cryptography has gone stale.
- The obligation follows the data into the vendor’s systems, because the rule covers customer information “handled or maintained by the covered institution or on its behalf.”
- So the lever is the custodian, prime broker, fund administrator, and market-data contract, and it is pulled at renewal rather than in a migration project.
Why is the buy-side exposure different from a bank’s?
Because the asset is information rather than a transaction. A bank’s quantum problem concentrates in the rails: card cryptograms, interbank messaging, and the certificate estate underneath them, which is the territory payments covers. A buy-side firm typically touches none of that. Its exposure concentrates in three places.
The model. Trading logic, factor construction, and portfolio-optimization parameters are the firm. They move over the network to a prime broker, an execution venue, a research vendor, and a cloud provider, and every one of those hops is protected by cryptography selected by somebody else. A strategy captured today and decrypted in a decade still explains how the firm made money, because method survives staleness in a way that a stolen card number does not.
The position and transaction record. Positions age into public knowledge slowly and unevenly, and the sequence of them reveals the method even when each individual holding is eventually disclosed. This is the part most firms underrate, because they reason about position data as though its confidentiality expires on the next disclosure date.
The investor record. Subscription documents, accredited-investor verification, wire instructions, tax identifiers, and beneficial-ownership detail have a sensitivity horizon measured in decades. On the vulnerability test, investor files score much closer to an insurance underwriting file than to a bank’s transaction log.
What actually binds a buy-side firm?
Regulation S-P, in its amended form, and it is worth being precise about it because the buy side is routinely pointed at the wrong rule.
| Adopted | 16 May 2024 |
| Who it covers | Brokers and dealers, funding portals, investment companies, investment advisers registered with the Commission, and transfer agents registered with the Commission or another appropriate regulatory agency |
| What it requires | Written policies and procedures for an incident response program reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer information |
| Scope of data | All customer information, meaning any record containing nonpublic personal information about a customer that is in the covered institution’s possession or that is handled or maintained by the covered institution or on its behalf |
| Customer notice | As soon as practicable, and no later than 30 days after becoming aware that unauthorized access has occurred or is reasonably likely to have occurred |
| Service-provider oversight | Written policies requiring providers to protect customer information and to notify the firm no later than 72 hours after becoming aware of a breach |
| Compliance dates | 3 December 2025 for larger entities, 3 June 2026 for smaller entities |
| Cryptographic controls named | None |
Source: all rows quoted or summarized from the SEC’s own Enhancements to Regulation S-P: A Small Entity Compliance Guide; adoption announcement, SEC press release 2024-58. The “cryptographic controls named” row records an absence verified by reading the guide: the word encryption does not appear in it.
Three consequences follow from that table, and the last one is the useful one.
Both compliance dates have passed. As of late 2026 the amended rule binds every covered institution including the smallest, so a firm that treated it as a future obligation is describing a current one.
The rule reaches your vendors, in writing. Customer information handled or maintained “on its behalf” is squarely inside scope, and the service-provider oversight requirement makes the vendor’s controls the firm’s responsibility. A fund administrator holding investor records is not outside the perimeter for this purpose.
And the rule will never tell you when your cryptography has expired. It sets an outcome standard and a notification clock, and leaves the algorithm, the key length, and the review cadence for cryptographic choices entirely unnamed. That is ordinary regulatory drafting and it has a specific consequence here: a firm that is fully compliant with Regulation S-P has learned nothing about whether its cryptography is current, and no examination will surface it. The obligation that would catch it lives in the contracts instead.
Isn’t the SEC cyber-disclosure rule the relevant one?
Usually not, and this is the most common misrouting on the buy side. The cybersecurity disclosure rules adopted in July 2023 bind U.S. public companies through Form 8-K Item 1.05 and Regulation S-K Item 106. Most asset managers, hedge funds, and private-equity firms are private, so no part of that regime touches them. A publicly traded asset manager does file under it, but even then the disclosure obligation attaches to the firm as an issuer rather than to the crown-jewel problem described above.
The distinction matters practically rather than academically. A compliance team that has read the disclosure rule and concluded the firm is out of scope may reasonably believe there is no federal cybersecurity obligation at all, when the one that binds took full effect in June 2026 and reaches every registered adviser.
Where does a buy-side firm’s cryptography actually live?
In other people’s systems, which is why sorting the estate with the three zones produces such a lopsided result here. A 40-person fund running $4 billion may own almost nothing in Zone 1.
| Surface | Typical zone | What the firm controls |
|---|---|---|
| Order and execution management systems | Zone 2 | Configuration, and the vendor’s roadmap by contract |
| Prime broker and custodian connectivity | Zone 2 or 3 | The contract, and little else |
| Fund administrator holding investor records | Zone 3 | The contract and the diligence questionnaire |
| Market-data feeds and research portals | Zone 2 | Which vendors, and what the agreement requires |
| Internal research and modeling environment | Zone 1 | Everything, and it is frequently the least inventoried |
| Investor portal and subscription documents | Zone 2 | The platform vendor’s cryptography |
| Firm email and document storage | Zone 2 | Cloud provider defaults |
The research environment is the row worth staring at. It is usually the only genuine Zone 1 surface a buy-side firm has, it holds the single most valuable asset in the business, and because it is internal it tends to fall outside the vendor-driven security review that covers everything else.
What does a firm do about it that is proportionate?
The binding constraint on this sector is headcount. A fund with 4 people in technology cannot run the migration program a bank runs, and advice that assumes otherwise gets ignored for good reason. Three moves fit the actual shape of the firm.
- Inventory the research environment first, because it is the one surface fully under the firm’s control and it holds the models. This is discovery scoped to a single environment rather than an estate, and it is a days-long exercise instead of a months-long one.
- Add the cryptographic questions to the vendor diligence you already run. Every buy-side firm already sends an operational due diligence questionnaire to administrators and brokers, and already answers one from its own investors. The questions in the vendor-claims checklist slot into a document that exists, goes to the right party, and has a renewal date attached. Procurement language covers what to ask for in binding terms.
- Set the retention horizon for investor records deliberately, because that number decides how much of the harvest exposure is real. A firm that keeps subscription documents indefinitely by default has chosen a multi-decade exposure without deciding to.
None of that is a migration. It is an inventory of one environment plus a change to a questionnaire, which is what proportionate looks like at this size.
Common misconceptions
“We’re private, so no cyber rules apply to us.” Registration with the Commission as an investment adviser is what triggers Regulation S-P, and being private has nothing to do with it.
“Our custodian handles security.” The custodian handles its own. Customer information handled on the firm’s behalf remains the firm’s obligation under the amended rule, and the oversight requirement is explicit about it.
“Our positions are disclosed anyway, so confidentiality doesn’t matter.” Disclosure is delayed, partial, and aggregated. The complete sequence reveals method, and method is the asset.
“We’re too small to be a target.” Concentration works against the firm here. A small manager holds a higher ratio of irreplaceable intellectual property to headcount than almost any other kind of financial institution.
“We’ll deal with it when the standards are final.” They are final. ML-KEM and ML-DSA are published standards, and the open question is vendor support rather than standardization, which is exactly why the lever is a contract.
Questions people ask
Which regulation should a private fund’s compliance officer actually be reading? The amended Regulation S-P, and specifically the service-provider oversight provisions, because that is where a fund’s real exposure sits and where its remedy is.
Does this reach a private-equity firm’s portfolio companies? Not through Regulation S-P, which reaches the firm’s own customer information. Portfolio-company cryptographic risk is a diligence and value-protection question rather than a compliance one, and it is frequently the larger exposure of the two.
What should we ask a fund administrator? Which algorithms protect investor records at rest and in transit, whether they can produce a CBOM for the platform holding those records, and what their dated support plan for the standardized algorithms is. Those three answers separate an administrator that has done the work from one that has not.
How does the 72-hour service-provider clock interact with the 30-day customer clock? The provider owes the firm notice within 72 hours of becoming aware of a breach, and the firm owes affected individuals notice within 30 days of becoming aware. The provider clock exists so the firm’s clock can be met.
Is any of this urgent for a firm with a 3-year fund life? The fund’s life is not the horizon that matters. Investor records outlive the vehicle, and the model outlives the strategy.
Do we need our own cryptographic inventory if everything is vendor-hosted? Yes, and it will be short, which is the point. The inventory’s job is to establish which surfaces are Zone 1 and therefore yours, and at a buy-side firm that answer is usually one environment and a handful of internal tools.
What about quantum for alpha rather than for risk? Out of scope here, and worth separating cleanly. Quantum computing as a portfolio-construction tool and quantum computing as a threat to the firm’s confidentiality are different subjects with different timelines, and conflating them is how the risk conversation gets postponed.
Everything here is the map, given freely. When a firm needs its research environment inventoried and its administrator and prime-broker agreements rewritten to carry real cryptographic terms, that’s the work I do.
Last verified 2026-09-06 · Updated 2026-09-06 · Maintained by Addie LaMarr, LaMarr Labs.