NIST Sets a 2035 Cutoff for ECDSA as the OCC Tells Banks to Plan for Quantum Risk

The U.S. government now has a firm end date for the signature algorithms that secure most of today’s internet and financial systems, including ECDSA. And the main regulator of national banks is telling lenders to get ready.

The Office of the Comptroller of the Currency (OCC) flagged quantum computing in its Fall 2026 Semiannual Risk Perspective, published Nov. 12. The report says post-quantum cryptography “represents a critical shift in the financial sector.”

The reason is spelled out plainly. Future quantum computers “could create capabilities to break encryption protocols that currently protect financial data,” the OCC wrote.

NIST Puts Dates on Post-Quantum Cryptography

The OCC points banks to a document that turned a long-running debate into a schedule. The National Institute of Standards and Technology (NIST) finalized NIST IR 8547, “Transition to Post-Quantum Cryptography Standards,” in October 2026. It replaces a draft first published in November 2024.

The final version sets out two key steps. NIST will deprecate quantum-vulnerable digital signature algorithms, including ECDSA, EdDSA and RSA, after 2030. It will then disallow their use under NIST standards and guidelines after 2035.

“Deprecated” does not mean banned. Under NIST’s definitions, a deprecated algorithm may still be used, but with some security risk, and the data owner must decide whether to keep relying on it. “Disallowed” means it is no longer allowed for the stated purpose.

The same 2030 and 2035 dates apply to quantum-vulnerable key-establishment schemes, including elliptic curve Diffie-Hellman and RSA-based methods. That covers the way two parties agree on secret keys, not just how they sign messages.

The plan also replaces an older schedule. NIST’s earlier guidance had projected disallowing public-key schemes with 112 bits of security on Jan. 1, 2031. NIST now says it will instead move all quantum-vulnerable signatures through the 2030-2035 window.

The replacements are already standardized. The report names ML-DSA, a lattice-based signature scheme, and SLH-DSA, a hash-based one, as the post-quantum signatures organizations should move to.

Federal Agencies Face Earlier Deadlines

For the government’s most sensitive systems, the clock runs faster. NIST says Executive Order 14412 and OMB Memorandum M-26-15 require those systems to adopt post-quantum cryptography for key establishment by Dec. 31, 2030, and for digital signatures by Dec. 31, 2031.

Agencies must also support TLS 1.3 by Jan. 2, 2030. The broader target of finishing the federal migration by 2035, first set in National Security Memorandum 10, stays in place.

NIST is candid about why the timeline is tight. Past cryptographic transitions, from standardization to full integration, “can take 10 to 20 years,” the report says. Measured against that, the new deadlines “leave little margin.”

It also explains the urgency even though no cryptographically relevant quantum computer exists yet. Attackers can collect encrypted data now and decrypt it later, a threat known as “harvest now, decrypt later.”

What the OCC Wants From Banks

The OCC did not set new rules. It noted that several federal agencies have already published resources to help banks and service providers prepare for post-quantum cryptography migration. Instead of mandates, it said staying aware of quantum developments lets banks and their service providers “anticipate evolving threats and manage future investments in technological infrastructure.”

The quantum warning sits inside a wider cybersecurity section focused on artificial intelligence. The OCC said advanced “Super Intelligence” models can find and exploit vulnerabilities faster, while also helping defenders patch them. It urged basic controls such as multifactor authentication, timely patching, network segmentation and air-gapped backups.

The rest of the report paints a healthy picture of the banking system. The OCC said profitability for federal banks and community banks rose in the first half of 2026 to levels not seen in more than two decades.

Why Bitcoin Has a Head Start on the Debate

Bitcoin is not bound by NIST guidelines, which govern federal systems and validated products. But the signature families NIST is phasing out matter to the network: Bitcoin uses ECDSA and, since the 2021 Taproot upgrade, Schnorr signatures, both built on elliptic curves.

That makes the new timeline a useful reference point rather than a threat. The dates give the ecosystem years of runway, and the work is already under way. Developers have tested post-quantum signatures on Bitcoin-linked systems, and much of today’s exposure comes from address reuse that holders can reduce on their own, as we covered in our look at Bitcoin’s public key exposure.

The trade-offs are real but manageable. A signature under ML-DSA-44, the smallest ML-DSA option in NIST’s FIPS 204 standard, is 2,420 bytes, compared with 64 bytes for a Bitcoin Schnorr signature, so any future design will need to weigh security against block space.

Bitcoin’s open, consensus-driven upgrade process has handled major changes before, including SegWit and Taproot. A clear government schedule for the wider financial system helps frame the timing for the next one.

For now, the message from Washington is consistent. Banks should take inventory of their cryptography, plan migrations and start deploying quantum-resistant tools well before the post-2030 deprecation begins.