Saudi Arabia's Central Bank Put Dates on Quantum Risk: Cryptographic Assets by December, a Risk Assessment by March

· Compliance · 5 min read

What SAMA published

On 27 August 2026 the Saudi Central Bank issued circular No. 482021280, "Enhancement of Operational Resilience to Address Quantum Computing Risks". It is in force, and it is addressed to the financial institutions SAMA supervises: banks, finance companies, payment service providers and the rest of its rulebook.

Most supervisors have spent 2026 publishing expectations and recommendations. SAMA's text says financial institutions "are required to" take four measures, and two of them have dates.

The four requirements

  1. An enterprise-level quantum risk assessment by the end of Q1 2027. It sits inside the institution's own enterprise risk management and covers operational, legal, regulatory and strategic risk, including people. It ends in action plans for what it finds.
  2. Complete, accurate procedures for identifying and classifying all cryptographic assets by the end of Q4 2026. At a minimum, that means knowing which data, systems and services each cryptographic asset protects, classifying them by sensitivity and by priority for migration, and assessing the priority assets for their cryptographic resilience, constraints and dependencies on third parties.
  3. Plans and initiatives for every priority asset to reach the required level of cryptographic resilience, or an appropriate alternative. No date is attached; it follows from the second item.
  4. Quantum risk as a standing item for the Information Security Supervisory Committee and the Board's Risk Committee, with challenges and recommendations reported to the Board.

Why the December date is tighter than it looks

The end-2026 requirement is about procedures, not a spreadsheet. A procedure that is "accurate and comprehensive" has to find cryptography where it actually is: in application code, library defaults, certificates, key stores, cloud key management and vendor products, not only on the internet-facing perimeter. And it has to be repeatable, because the March 2027 risk assessment and every plan after it depend on it.

Two months is not long to build that from nothing. An institution that starts in November with a questionnaire to application owners will have a list by December, but not a procedure it can defend.

What to do before the end of the year

  1. Scan what faces the internet first. Portals, APIs, payment endpoints and mail. It is quick, and it is what an attacker records today.
  2. Read code, configuration and binaries for internal systems instead of relying on self-reported answers. Hard-coded algorithms and library defaults are where questionnaires fail.
  3. Record who controls each item: your own code, a vendor product, a cloud service or a partner link. SAMA asks for third-party dependencies explicitly.
  4. Classify by the data each asset protects and how long it must stay confidential. That classification is the migration priority SAMA asks for.
  5. Write the procedure down with owners and a refresh cycle, so the inventory is a process the committee can monitor, not a one-off export.

Where this sits in the region

The UAE's National Encryption Policy asks government entities for approved transition plans, and no PQC rule has yet been published for UAE banks. SAMA has gone further for its own sector, with dated, binding requirements that land in the next five months. For groups that operate in both markets, the Saudi timetable is now the one to plan around.

Qypher builds the cryptographic inventory across your public perimeter, code, cloud and binaries, records who controls each item and what data it protects, and keeps it current. Run a free scan →

Source: SAMA Rulebook, circular No. 482021280, "Enhancement of Operational Resilience to Address Quantum Computing Risks" (27 August 2026, in force), English translation.