Guest Post by By Somtochukwu Igwegbe
More than two trillion dollars moved through mobile money worldwide in 2025, and roughly two-thirds of that value flowed through sub-Saharan Africa, according to GSMA’s State of the Industry Report on Mobile Money 2026. For a fifth of adults in the region, a mobile money account is the only financial account they will ever hold. Behind every transfer sits ordinary public-key cryptography, the same RSA and elliptic-curve math that a sufficiently powerful quantum computer would eventually break.
That threat hasn’t arrived yet, but data doesn’t need it to arrive today to be at risk. Encrypted traffic captured now can be stored and decrypted later, once the right hardware exists, a problem cryptographers call “harvest now, decrypt later.” The White House’s June 2026 executive order on post-quantum migration cites this same risk as the reason federal agencies can no longer treat the transition as a distant deadline. For identity records, health data, and financial archives that need to stay confidential for a decade or more, the clock is already running.
A Room full of Cryptographers, Arguing About Everything but Cryptography
On June 26, the Africa Quantum Consortium (AQC), the pan-African body founded by Farai Mazhandu to coordinate the continent’s quantum strategy, convened a roundtable titled “Securing Africa’s Digital Backbone”. The session drew registrations from more than twenty countries, with more sign-ups in the final day than in the three months prior. In the room: Professor Çetin Kaya Koç, founder of the field’s leading cryptographic hardware conference, and Michael Osborne, who has led IBM’s quantum-safe cryptography effort since 2018, alongside African bank technologists, regulators, and students.
Asked where an African institution should start, panelists kept giving an answer that had little to do with cryptography itself. “There’s not enough budget in the world to make everything we have today quantum safe,” Osborne told the room. Two decades into building IBM’s cryptography practice, he said his job now consists almost entirely of business problems and organizational change management. The hardest part of migration, in his experience, is rarely the math. More often, nobody inside an institution knows where its cryptography actually lives.
Aditya Koranga, who chairs the technical advisory committee of the Post-Quantum Cryptography Alliance, made a similar point from a different vantage point. On live bank migrations across Southeast Asia, he said, “nobody knew who to point us to.” No single team owned a map of where the organization’s cryptography actually sat.
Four days before the roundtable, the White House had signed an executive order tying post-quantum migration deadlines to federal procurement, using the purchase order rather than a research mandate as the lever to bring vendors and contractors into compliance. The African practitioners in that room reached a similar conclusion independently, for a structural reason: because so much of Africa’s digital backbone is bought rather than built, procurement contracts are where the migration will actually be won or lost. Professor Koç put the vendor risk plainly. “Companies want to sell, sell, sell, and you have to be very careful, because you will get the blame for purchasing the wrong equipment,” he said.
Building the Framework Instead of Waiting for One
That insight did not stay in the room. AQC has since published “Securing Africa’s Digital Backbone,” a practitioner-facing guide that translates NIST’s post-quantum standards, the ML-KEM and ML-DSA algorithms finalized in August 2024, into concrete guidance for African central banks, mobile money operators, telecoms, and digital identity authorities. The guide does not simply restate NIST or GSMA guidance. It covers ground those documents leave out, addressing constraints particular to the region: SIM cards without enough memory to hold new post-quantum keys, rural agent terminals that cannot absorb the latency of a heavier handshake, and hardware security modules waiting on firmware nobody has written yet.
That same instinct for building rather than importing runs through the wider organization behind the guide. AQC’s November 2025 white paper, “State of Quantum Science and Technology in Africa,” frames the continental strategy around what it calls a “continental quantum commons,” pooling resources across the continent’s countries rather than duplicating fragmented national programs, an approach the authors argue turns Africa’s late entry into an advantage rather than a liability. South Africa’s national quantum initiative, SA QuTI, already coordinates several universities under a shared government mandate. AIMS Rwanda’s Quantum Leap Africa trains graduate students in quantum information science. University hubs in Egypt, Ghana, Morocco, and Tunisia are standing up master’s programs and research groups of their own. AQC’s newer coordinating body for communications and security, AQCSA, exists to keep these efforts from working in isolation, sharing inventory tooling, training, and a common negotiating position before international standards bodies finish writing the rules.
Why this Matters Beyond Africa
That is the quieter version of this story. A region often treated as a downstream recipient of global technology standards is instead trying to help write some of them. Whether it succeeds will be decided less by cryptographers than by the procurement officers and regulators the AQC roundtable kept returning to: the people who will decide, contract by contract, whether Africa enters the post-quantum era on terms it helped set. AQC formally launched in August 2025, and this roundtable is the clearest sign yet of what that launch was meant to build toward.
About Author
Somtochukwu Igwegbe is a Research & Development member at Quantum Africa and African Quantum Consortium Correspondent. His work focuses on quantum computing, post-quantum cryptography, and the growth of Africa’s quantum ecosystem. He writes on emerging quantum technologies, digital sovereignty, and the intersection of science, cybersecurity, and public policy across the continent.
Facts Only
* Two trillion dollars moved through mobile money worldwide in 2025.
* Roughly two-thirds of that value flowed through sub-Saharan Africa.
* A mobile money account is the only financial account for a fifth of adults in the region.
* Encrypted traffic captured now can be stored and decrypted later once the right hardware exists.
* The White House executive order ties post-quantum migration deadlines to federal procurement.
* African practitioners concluded that procurement contracts determine success in migration due to infrastructure being bought rather than built.
* The Africa Quantum Consortium (AQC) published a guide translating NIST post-quantum standards into regional guidance.
* The AQC's strategy frames the approach around a "continental quantum commons" to pool resources across African countries.
* South Africa’s national quantum initiative, SA QuTI, coordinates university programs.
* AIMS Rwanda trains graduate students in quantum information science.
* University hubs in Egypt, Ghana, Morocco, and Tunisia are establishing master’s programs and research groups.
Executive Summary
Mobile money transactions globally reached over two trillion dollars in 2025, with approximately two-thirds of that value flowing through sub-Saharan Africa. A mobile money account is the sole financial account for one-fifth of adults in the region. The risk associated with current encryption methods is the "harvest now, decrypt later" threat, where captured encrypted traffic can be stored and decrypted later once quantum computers arrive. This risk is pressing for data requiring long-term confidentiality, such as identity records, health data, and financial archives.
A roundtable convened by the Africa Quantum Consortium (AQC) addressed securing the continent's digital backbone, bringing together technologists, regulators, and students. Participants noted that the primary barrier to migration is not the mathematics itself but organizational inertia and budget constraints. Practitioners highlighted a lack of centralized knowledge regarding where existing cryptography resides within institutions. Furthermore, procurement contracts are identified as the critical point for driving post-quantum migration due to how much of Africa's digital infrastructure is purchased rather than built.
The AQC has developed guidance translating post-quantum standards into concrete regional advice, addressing specific constraints like SIM card memory and hardware limitations. The continental strategy also focuses on creating a "continental quantum commons" by pooling resources across nations, supported by existing national initiatives and university research hubs to coordinate efforts before international standards are finalized.
Full Take
The narrative pivots on a systemic failure of distributed knowledge and the structural control exerted by procurement over technological transition. The central tension is between a decentralized reality—where diverse national and institutional efforts exist to build quantum-safe infrastructure—and a centralized, top-down migration mandate dictated by external policy levers like federal procurement. This dynamic suggests that security implementation is less about cryptographic capability and more about organizational governance.
The pattern observed is the attempt to shift decision-making power from technical experts (cryptographers) to administrative actors (procurement officers and regulators). The focus on vendor risk, as articulated by Professor Koç, reveals an underlying mechanism where ownership of the physical infrastructure dictates compliance, rather than pure mathematical adherence. This suggests that resistance to migration may be less about the mathematical infeasibility and more about managing institutional liability during a mandated transition.
The push for building frameworks regionally—the quantum commons—suggests a corrective pattern against fragmentation. This collective approach attempts to leverage regional autonomy as a strength, transforming latency into an advantage by pooling resources before global standards lock in disadvantageous terms. The implication is that cognitive sovereignty in this context relies on organizing the political and contractual structures around technical realities, ensuring that regional development dictates the pace and terms of technological adoption, rather than simply reacting to external deadlines.
Bridge Questions: If procurement controls the outcome, what mechanisms can be established to ensure public-interest alignment within contractual specifications? How can regional bodies effectively bridge the gap between cutting-edge cryptographic standards and the complex, decentralized institutional realities of mobile money and digital identity management across Africa? What are the long-term effects of prioritizing organizational change management over pure mathematical optimization in large-scale security transitions?
Sentinel — Human
This article is a sophisticated analysis that effectively synthesizes technical risk with institutional strategy, exhibiting a strong human editorial voice focused on systemic implications.