up:: Doing the Work MOC
PQC for Capital Markets
An exchange, clearing agency, ATS or plan processor has a post-quantum problem shaped by one number that no other sector cares about as much: latency. Signature verification sits directly in the path of order handling and settlement messaging, and post-quantum signatures cost more time than the ones they replace. That turns migration into capacity planning, which is territory Regulation SCI already governs, and it means the compliance conversation and the engineering conversation are the same conversation here.
This note is general education about a securities regulation and market practice, not legal advice. Whether any system is an SCI system, and what any entity’s obligations are, are determinations made with counsel.
The short version:
- Regulation SCI already requires capacity planning and stress testing of the systems post-quantum would slow down, so the obligation exists before anyone mentions quantum.
- ⭐ 17 CFR 242.1001(a)(4) gives a safe harbor pegged to “current SCI industry standards” issued by a US governmental body, which is a moving reference that NIST moves.
- The only operational measurement available shows signature verification at 209.9 ms against 28.1 ms, taken in a large-value payment system rather than a matching engine.
- Broker-dealers and ATSs also sit under the amended Regulation S-P, whose compliance dates have both passed. That is covered at PQC for Asset and Investment Management.
- The distinctive work is measuring the latency cost on your own path, because nobody else’s number will transfer.
What does Regulation SCI actually require?
Written policies and procedures ensuring SCI systems have adequate “capacity, integrity, resiliency, availability, and security,” and specifically, at 17 CFR 242.1001(a)(2), “reasonable current and future technological infrastructure capacity planning estimates” and “periodic capacity stress tests of such systems to determine their ability to process transactions in an accurate, timely, and efficient manner.”
⭐ Read that against a change that makes signature verification slower and the connection is immediate. A cryptographic migration that alters processing time is a capacity-planning event under a rule the entity already complies with, which means it has an owner, a testing cadence and a documentation trail before the post-quantum conversation starts.
And the safe harbor is a moving reference. 17 CFR 242.1001(a)(4):
“such policies and procedures shall be deemed to be reasonably designed if they are consistent with current SCI industry standards, which shall be comprised of information technology practices that are widely available to information technology professionals in the financial sector and issued by an authoritative body that is a U.S. governmental entity or agency, association of U.S. governmental entities or agencies, or widely recognized organization”
Source: 17 CFR Part 242, Subpart Systems Compliance and Integrity, eCFR. Emphasis added.
⭐ A US governmental authoritative body issuing IT practices for the financial sector is NIST, which means the safe harbor tracks whatever NIST currently says. When the standardized algorithms become current practice, the standard an SCI entity is deemed reasonable against moves with them, without a rulemaking and without notice.
This is the third US financial regulator with that structure, and the pattern is worth seeing together, because each of them is frequently described as “not naming an algorithm” as if that meant the obligation were static:
| Rule | The moving reference |
|---|---|
| 17 CFR 242.1001(a)(4) | “current SCI industry standards” issued by a US governmental body |
| 16 CFR 314.2(f), the FTC Safeguards Rule | encryption “consistent with current cryptographic standards” |
| 23 NYCRR 500.15 | encryption “that meets industry standards” |
Source: 16 CFR Part 314; NYDFS Second Amendment to 23 NYCRR 500, dfs.ny.gov. Covered at PQC for Credit Bureaus and Consumer-Data Holders and PQC for Banks.
How much slower is it, actually?
The only published measurement from an operational financial system is the BIS Innovation Hub’s Project Leap Phase 2, December 2025, run with Banca d’Italia, Banque de France, Deutsche Bundesbank, Nexi and Swift. It measured post-quantum signature verification at an average 209.9 ms against 28.1 ms for the classical equivalent, a factor of 7.5.
⚠️ Do not carry that number onto a matching engine. It was measured in a large-value payment system, on software-generated keys, with the client-side HSM path explicitly not measured, using Round 3 CRYSTALS-Dilithium rather than standardized ML-DSA. It establishes that the cost is real and material. It does not establish what your path costs.
Source: BIS Innovation Hub, “Project Leap Phase 2: quantum-proofing payment systems,” December 2025, bis.org/publ/othp107.pdf.
The useful consequence is that this sector can measure it. An SCI entity already runs capacity stress tests, already has a performance baseline, and already documents both. Adding a post-quantum variant to an existing test regime is a smaller ask than starting a migration program, and it produces the one number that actually governs the decision.
Where does the cryptography sit in market infrastructure?
| Surface | Typical zone | Why it matters here |
|---|---|---|
| Order entry and matching path | Zone 1 | Where latency is measured in microseconds and any signature cost is felt |
| Market data dissemination | Zone 1 | High fan-out, so per-message overhead multiplies |
| Clearing and settlement messaging | Zone 1 and 2 | Scheme and counterparty terms, longer-lived messages |
| Member and participant connectivity | Zone 2 | Terms the venue usually sets, which makes it movable |
| Post-trade reporting and regulatory feeds | Zone 1 | Volume without latency sensitivity, so the easiest place to start |
| Vendor platforms and colocation providers | Zone 2 and 3 | Somebody else’s roadmap |
The last two rows are the practical starting points: regulatory reporting because latency does not bind there, and participant connectivity because the venue sets the terms.
Why is a hardware refresh the real schedule?
Because at this end of the market cryptography frequently lives in appliances and accelerators rather than in general-purpose software. An algorithm change that a bank absorbs in a library update can require a hardware replacement cycle for a venue, and hardware replacement is a budget cycle rather than a release. Hardware covers the general shape.
That makes procurement timing the load-bearing decision. Equipment bought this year on a 5 to 7 year refresh will still be in the path when the standardized algorithms are ordinary, which is why the questions in procurement language belong in the current purchasing round rather than the next one.
Common misconceptions
“We’re not a bank, so financial cyber rules don’t reach us.” Regulation SCI reaches SROs, registered clearing agencies, certain ATSs, plan processors and exempt clearing agencies directly, and it is where capacity and security obligations already live.
“Latency rules this out entirely.” It rules out doing it carelessly. The measured cost is real, and it is also unmeasured on the paths that matter here, which is an argument for testing rather than for waiting.
“The safe harbor protects us.” The safe harbor is defined against current standards. It protects an entity that keeps up, and it moves under one that does not.
“Our messages are short-lived, so harvest-now-decrypt-later doesn’t apply.” Order flow ages quickly. Participant identity data, connectivity credentials and settlement instructions do not.
Questions people ask
Where should an SCI entity start? With a measurement on its own path, added to the capacity stress testing it already performs. That converts an open-ended question into a number, and the number is what every subsequent decision needs.
Does Regulation SCI mention quantum? It does not, and it reaches the problem anyway. Its capacity, security and standards-tracking obligations are written generally enough to cover a cryptographic change that alters processing time.
What about SEC cyber disclosure? A publicly traded venue also files under the disclosure rules, which is a separate obligation attaching to the entity as an issuer rather than to its systems.
Is hybrid viable at this latency? That is exactly the thing to measure, because hybrid adds both operations rather than replacing one. Hybrid vs Pure PQC covers the tradeoff.
Who owns this internally? The same people who own capacity planning, which is the point. Post-quantum belongs inside the existing SCI program rather than beside it.
What is the single most expensive mistake available here? Buying path-critical hardware this cycle without an algorithm-agility clause, because the refresh interval outlasts the transition.
Everything here is the map, given freely. When a venue needs its post-quantum latency cost measured on its own path and written into its capacity planning, that’s the work I do.
Last verified 2026-09-07 · Updated 2026-09-07 · Maintained by Addie LaMarr, LaMarr Labs.