Key Highlights
- SEBI’s 2025-26 annual report details an expanded “quantum resiliency” strategy, including formal directions for regulated entities to inventory cryptographic assets and plan a transition to post-quantum cryptography, aligned with India’s National Quantum Mission.
- SEBI disclosed it has been appointed Vice-Chair of IOSCO’s Quantum Computing Working Group and is also a member of the global body’s Tokenisation Working Group, giving India’s regulator a role in international standard-setting on both fronts.
- The report also lists the corporate bond tokenization pilot, which The Crypto Times reported when SEBI’s Chairman first announced it in May, among the regulator’s forward priorities, without providing a further timeline.
The Securities and Exchange Board of India (SEBI) has set out a detailed strategy to prepare India’s securities market for the risks that quantum computing poses to financial cryptography, according to its Annual Report for 2025-26. The report spells out formal directions for its regulated entities, an internal transition roadmap, and a newly disclosed global leadership role.
The theme is relevant to crypto and blockchain because quantum computing could eventually threaten cryptographic systems used for digital signatures and other security functions across financial and blockchain networks. While SEBI’s report contains no new policy on cryptocurrencies themselves, which sit outside its securities mandate, its work on quantum resilience and, separately, on tokenization touches the foundational technologies underpinning digital assets.
A Detailed Quantum-Resilience Strategy
The report’s most substantial new technology disclosure concerns quantum resilience, the effort to protect market cryptography against the future threat that powerful quantum computers could break the encryption underpinning secure communications and transactions. SEBI said it has embedded quantum resiliency as a core pillar of its cybersecurity strategy, aligned with India’s National Quantum Mission (NQM).
Concretely, the report states that SEBI has issued directions requiring its regulated entities (REs) to take five specific steps: maintain a comprehensive cryptographic asset inventory; assess post-quantum cryptography (PQC) and quantum key distribution; enhance “cryptographic agility”; continuously monitor the ecosystem; and develop transition roadmaps alongside workforce upskilling. SEBI described its own internal transition as following a three-phase approach it labels “discover, observe, and transform.”
The report is also specific about the threat models it is preparing for, using terminology familiar to the security community. It names “Harvest-Now-Decrypt-Later,” in which adversaries collect encrypted data today in the hope of decrypting it once quantum computers mature, and “Trust-Now-Forge-Later,” involving the future forgery of digital signatures. For financial markets, the report notes, such risks could compromise the confidentiality of sensitive data, the integrity of transactions and signatures, and the availability of systems during rushed cryptographic changes.
To build awareness, SEBI said it ran a “Quantum Cohort” session and workshop with the Data Security Council of India (DSCI), in which participants assessed the potential impact of quantum computing on market infrastructure and discussed migration strategies, along with separate quantum-resiliency workshops attended by more than 100 representatives of regulated entities.
SEBI Chairman Tuhin Kanta Pandey reinforced that approach on August 17 at SEBI’s Symposium on Cyber Defence in Mumbai, saying organizations first need to identify where their cryptographic vulnerabilities lie. Pandey described this inventory as a “cryptographic bill of materials” and said regulated entities need to establish where gaps exist before moving toward post-quantum standards.
Pandey outlined the process as moving from awareness and assessment to the use of post-quantum cryptographic standards and, subsequently, addressing vulnerabilities in legacy systems once the cryptographic inventory is established. His remarks provide a current explanation of how SEBI expects organizations to approach the transition described in its annual report.
At the same symposium, Pandey also said cyber defence should no longer be treated solely as an IT issue, but as a board-level concern linked to business continuity and market integrity. He pointed to the interconnected nature of financial markets, where weaknesses at one institution can affect vendors, technology platforms, and other connected entities.
A Global Leadership Role on Quantum
Beyond its domestic program, SEBI disclosed a notable international appointment: it has been named Vice-Chair of the Quantum Computing Working Group (QWG) of the International Organization of Securities Commissions (IOSCO), the global standard-setter for securities regulators. In that role, according to the report, SEBI has contributed to work on assessing global capacity in quantum computing and quantum preparedness, and reviewed international best practices on risk assessment and PQC transition methods.
The report frames this as helping “position India’s securities market to be future-ready and quantum-resilient against emerging quantum computing threats.” Combined with SEBI’s membership of India’s National Quantum Mission task-force sub-groups, the appointment gives SEBI a role in IOSCO’s work on how securities regulators assess quantum-related risks and prepare for post-quantum cryptography.
Tokenization: The Pilot Moves to the Forward Agenda
On tokenization, the annual report largely formalizes an initiative already in motion rather than announcing a new one. In the Chairman’s Statement, SEBI lists a pilot project on the tokenization of corporate bonds using distributed ledger technology (DLT) among its priorities for 2026-27. As The Crypto Times reported in May, SEBI Chairman Tuhin Kanta Pandey first announced this pilot at the CareEdge Debt Market Summit, describing it as an early-stage effort to test whether DLT-based tokenization could deliver faster settlement, greater transparency, and improved liquidity in the corporate bond market, on a timeline he then estimated at six to nine months.
Its inclusion in the annual report’s forward-looking agenda indicates that the pilot remains on SEBI’s forward agenda, positioned alongside a new “SEBI Setu Portal” for the market intermediary interface. The report does not provide an updated timeline, scale, or list of participating entities, suggesting the initiative is progressing but has not yet reached implementation.
SEBI’s engagement with tokenization also has an international dimension. The report notes that SEBI is a member of IOSCO’s Tokenisation Working Group (TWG), where it participated in a survey assessing tokenization adoption in India for an IOSCO report on the “tokenization of financial assets.” The working group is now developing a second-phase report covering tokenization adoption and “equity tokens,” with SEBI contributing to the analysis, placing India within the global conversation on how tokenized securities should be supervised.
Blockchain in the Longer-Term Roadmap
The report signals that DLT features in SEBI’s longer-term planning as well. A working group chaired by Dr. D.B. Phatak, Professor Emeritus at IIT Bombay, has been constituted to formulate short-term (five-year) and long-term (ten-year) technology roadmaps for market infrastructure institutions (MIIs), the exchanges, clearing corporations, and depositories that form the market’s backbone. The report says the group will take a forward-looking view on the adoption of emerging technologies by MIIs, explicitly including distributed ledger technology, tokenization, and “quantum-safe systems,” alongside AI/ML, cloud computing, and regulatory and supervisory technology.
The Bottom Line
SEBI’s 2025-26 annual report shows a regulator moving to get ahead of long-term technological risk rather than react to it. The clearest new development is the depth of its quantum-resilience program, formal directions to regulated entities, an internal transition roadmap, and a global Vice-Chair role at IOSCO, which matters to the crypto world because quantum computing threatens the same cryptography that secures blockchains. Pandey’s August 17 remarks add a more immediate operational focus, with the SEBI chairman calling on organizations to inventory their cryptographic systems, identify vulnerabilities and prepare to adopt post-quantum standards.
On tokenization, the report reaffirms rather than expands SEBI’s corporate bond pilot, keeping a modest but real blockchain experiment on the agenda. What the report does not do is signal any shift on cryptocurrencies as investments, which remain outside SEBI’s purview. None of these initiatives are finalized frameworks, and this article is informational, not investment advice.
Also Read: India’s UP Police Adds Crypto Crime Training for 4,000+ Officers
