This paper aims to examines the governance of post-quantum cryptography (PQC) transition in Gulf Cooperation Council (GCC) banking, identifies structural gaps in existing regulatory frameworks and proposes a regulatory readiness framework for orderly migration to quantum-resistant standards.
A qualitative policy-analytical methodology combines structured literature synthesis with comparative regulatory analysis of six GCC banking frameworks – Saudi Arabian Monetary Authority, Central Bank of the UAE, Central Bank of Kuwait, Qatar Central Bank, Central Bank of Bahrainand Central Bank of Oman – against five PQC governance dimensions, stress-tested across three cryptographically relevant quantum computer timeline scenarios.
None of the six frameworks explicitly addresses PQC transition requirements and all show critical gaps in cryptographic agility, quantum threat timeline awareness and harvest-now-decrypt-later (HNDL) risk assessment. National Institute of Standards and Technology (US)’s PQC standards (Federal Information Processing Standard 203, 204, 205) supply the technical foundation but not the regulatory coordination and supervisory capacity GCC banking requires.
The framework gives GCC banking regulators actionable guidance for introducing HNDL risk assessment, mandating cryptographic agility and establishing PQC transition planning before migration becomes compressed and disruptive.
This is among the first systematic PQC governance analyses of GCC banking, best characterised as a theoretically grounded contextual adaptation rather than a new governance theory. The proposed three-phase framework – inventory, prioritised migration, continuous resilience – is framed through a socio-technical transition lens, translating generic quantum-risk identification into a governance architecture grounded in the six GCC supervisors’ regulatory landscape.
