SAMA circular 482021280 · in force

Your cryptographic inventory is due this quarter.

Every financial institution SAMA licenses must identify and classify all of its cryptographic assets by the end of Q4 2026. The enterprise quantum risk assessment follows a quarter later. The hard part was never the migration — it is knowing what you hold.

Take the free readiness check Speak to our team

Cryptographic assets · classified by 31 December 2026

—Days

—Hours

—Minutes

—Seconds

Of the runway SAMA allowed between issuing the circular and this date

SAMA Q4 2026 cryptographic assets classified SAMA Q1 2027 enterprise quantum risk assessment NIST IR 8547 2030 112-bit RSA and elliptic curve deprecated NIST IR 8547 2035 quantum-vulnerable public key disallowed EU roadmap 2030 critical infrastructure migrated UK NCSC 2031 priority migrations complete G7 Cyber Expert Group 2030–32 critical systems

What the circular asks for

Four requirements. Two of them are dated.

SAMA issued circular 482021280 on 27 August 2026 to banks, finance companies, payment services companies, credit information companies and licensed finance-support entities. In our own words, in the circular's own order.

Due by the end of Q1 2027

An enterprise quantum risk assessment

Carried out inside your existing enterprise risk management process, with action plans for whatever it finds.

Operational, legal, regulatory and strategic risk, at minimum
The people who will do the work — skills and staffing are named explicitly
Action plans, not findings alone

Why this one is second in practice: an assessment written before the inventory exists is an assessment of what you remember. The classification work below is dated earlier for a reason.

Due by the end of Q4 2026

Accurate, comprehensive cryptographic classification

Procedures that identify and classify all cryptographic assets — accurately and comprehensively, in SAMA's own framing.

Map the data, systems and services each asset protects
Classify by sensitivity, and by priority for migration
Assess the cryptographic resilience of the priority set
Record the constraints, the challenges and the third-party dependencies

This is the requirement with a date inside the current quarter, and everything after it depends on the answer.

No date given

Plans to reach the required resilience

Plans and initiatives for every priority asset, following from what the classification found.

Quantum-resistant cryptography, or a suitable alternative where it is not available
Scoped to the priority set the previous requirement produced

SAMA names no algorithms. In Saudi Arabia those come from the National Cybersecurity Authority; the international reference set is NIST's.

Continuing

A standing item at committee and board

Quantum risk monitored periodically, and reported upward.

The Information Security Supervisory Committee
The board's Risk Committee, where you have one
Challenges and recommendations reported to the board or its equivalent

There is no submission to SAMA and no prescribed format. The reporting is internal — which means the evidence has to satisfy your own governance rather than a template.

Paraphrased for brevity; the circular is the authority. Read it on the SAMA Rulebook.

Why the inventory is the hard part

You cannot classify what you have not found.

Cryptography is not held in one place. It is in certificates nobody renewed, a library three versions behind, a protocol a vendor chose for you, hardware bought before anyone asked this question.

A declared list finds the assets people remember. The circular asks for all of them — so the work runs in that order: discover, map each asset to what it protects, rank by sensitivity and migration priority. Only then does the argument about algorithms matter.

Cryptographic estate · discovery in progress

Not yet discoveredClassifiedQuantum-vulnerable

An illustration, not your data.

Harvest now, decrypt later

Data copied today is decrypted on somebody else's schedule.

Traffic and records captured now can be stored until the cryptography protecting them is retired. Your retention period is what decides your urgency.

This data must stay confidential for

14 years — until 2040

1 year15 years30 years

At risk

Dates from NIST IR 8547, which deprecates 112-bit RSA and elliptic curve after 2030 and disallows quantum-vulnerable public-key cryptography after 2035. These are standards timelines for withdrawing algorithms. Nobody on this page is predicting when a quantum computer will arrive — that is the point: the dates do not depend on it.

—Days until cryptographic assets must be classified

—Days until the enterprise assessment is due

0Questions in the free readiness check

0Domains scored separately

Consult · Transform · Secure

Five steps to quantum-ready.

Consult

Learn

Your board, your risk committee and your engineers are briefed on what quantum risk is, what the circular requires, and what it does not. Nobody can own a risk handed to them as a headline.

Consult

Assess

Discovery across the estate, each asset mapped to the data, systems and services it protects, classified by sensitivity and migration priority — then the enterprise quantum risk assessment inside your own ERM process.

Consult

Plan

A migration roadmap for the priority set: target algorithms or suitable alternatives, dated against the published timelines, with constraints and third-party dependencies named rather than discovered later.

Transform

Implement

Quantum-safe cryptography put in place: migration, integration, certificate and key lifecycles shortened, and crypto-agility built so the next algorithm change is configuration rather than a release.

Secure

Become quantum-ready

Long-term resilience: the inventory stays current, vendors are held to their own migration plans, and quantum risk reaches the committee and the board as a standing item with evidence behind it.

How the two fit together

AHAD does the work. Conscious keeps the record.

AHADServices · KSA

Briefing your board and your engineers
Discovery and classification across the estate
The enterprise quantum risk assessment and its action plans
Migration, integration and crypto-agility engineering
Staying with it until the resilience holds

ConsciousPlatform · global

Assess — the cryptographic inventory and maturity record, held as evidence
Manage — priority, ownership and migration tracked against the dates
Report — what the committee and the board see, with the trail behind it
Third-party dependencies asked for, recorded and reviewed
Every judgement signed by a named person, never asserted by a machine

Questions

What institutions ask us first.

Does this circular apply to us?

SAMA addressed it to banks, credit information companies, finance companies, payment services companies and licensed finance-support entities. Insurers are not on the distribution list. If you are licensed by SAMA and unsure, the circular's own distribution list settles it — and SAMA names the Executive Department of Operational Resilience Control as the contact.

Do we have to send anything to SAMA?

No. The circular prescribes no submission and no format. The reporting it requires is internal: challenges and recommendations go to your board or its equivalent, and quantum risk becomes a standing item for the Information Security Supervisory Committee and the board's Risk Committee where you have one. That does not make it lighter — it means the evidence has to satisfy your own governance rather than a template.

Which algorithms does SAMA require?

SAMA names none. It asks for migration to quantum-resistant cryptographic solutions, or suitable alternatives where those are not available. In Saudi Arabia the algorithm choices come from the National Cybersecurity Authority; the international reference set is NIST's — ML-KEM, ML-DSA and SLH-DSA. Deciding what applies to which asset, and recording why, is part of the planning work.

Can we make the Q4 2026 date from a standing start?

The dated part this quarter is the procedures for identifying and classifying cryptographic assets accurately and comprehensively, with priority assets assessed for resilience. That is reachable in weeks with the right discovery, and everything later depends on it. The enterprise assessment has until the end of Q1 2027. Starting with the inventory means working in the circular's own order.

What does the free check actually give us?

A score out of four for each of seven domains, an overall level, your weakest domain named, and the two dates set against where you stand. It is a self-assessment: it is honest about being what you told it, and it is not a substitute for discovery across your estate. It is a useful hour before a longer conversation.

Where does Conscious come in?

AHAD does the consulting and the engineering. Conscious is the platform underneath: the inventory, the maturity record, the migration tracking and the board reporting live there, so the assessment is not a document that goes stale after the engagement. It is used outside Saudi Arabia too, which is why the same record answers other regulators when you need it to.

Find out where you stand before the quarter closes.

Twenty-one questions across the seven domains the circular touches. A score for each, your weakest named, and what is due when. About eight minutes, no account, and your answers stay on your device until you ask for the record.

Start the readiness check Email our team