Explainers

Is my NZ business affected by ASD’s 2030 PQC mandate?

by Simon McCorkindale

In short

Not directly. ASD’s timeline is Australian guidance: a refined transition plan by the end of 2026, migration commencing in 2028 and complete by the end of 2030. It reaches a New Zealand business indirectly, most often through an Australian parent company, an Australian customer, or systems shared with either.

What ASD’s guidance says

The Australian Signals Directorate sets the most aggressive general-purpose timeline among the Five Eyes: a refined post-quantum cryptography (PQC) transition plan by the end of 2026, migration under way in 2028, and full transition by the end of 2030. The United States, the United Kingdom and the European Union have set their own dates. They are compared in The quantum threat and Everyone else just set a date.

Why it still reaches New Zealand

New Zealand’s own instrument, NZISM Section 2.4, sets no migration date. That leaves three indirect routes.

  • Subsidiaries. If your parent is Australian, the decision is likely to be made there. Our big four banks are subsidiaries of Australian parents, so the cryptographic decisions protecting retail payments in Auckland are in practice made in Sydney and Melbourne.
  • Suppliers and customers. An Australian organisation working to a 2030 date will ask its suppliers where they stand. A full readiness snapshot includes the same kind of supplier readiness check, using industry-standard vendor questions.
  • Shared data and infrastructure. Retention obligations under the AML/CFT Act 2009 have the same seven-year shape as the Australian ones. The same data sits in the same data centres, governed by largely the same head offices.

The worked example is What an Australian payments paper says about NZ banks.

What to check

  • Whether a parent, customer or regulator outside New Zealand already has a date that covers you.
  • Which of your data has to stay confidential beyond 2030.
  • Which of your suppliers hold or carry that data, and what they have deployed.

What to do now

None of this means everything has to move. It means knowing which systems carry data that outlives the date, and who else has a say in them. Why get ready? sets out how to filter, and the answer for many systems is to leave them and watch.

See the readiness snapshot, or run the free external posture check.