Confianza digital a escala: Cómo los mayores bancos convierten la confianza en una plataforma de lanzamiento

In financial services, trust is more than a buzzword. Trust is the invisible infrastructure that supports everything from microlending and remittance to SWIFT transactions between multinational banks. But as digital ecosystems multiply and compliance mandates tighten, trust must evolve from a passive promise into a strategic, scalable foundation. 

Los responsables de seguridad actuales se enfrentan a esa evolución... en tiempo real.

Whether you’re enabling instant transactions, onboarding fintech partners, or integrating post-M&A systems, your ability to move fast depends on an often-overlooked layer: the public key infrastructure (PKI) that underpins digital trust.

This blog explores how the largest financial institutions are treating trust as a launchpad (not a liability!) and why doing so requires visibility, control, and post-quantum readiness at scale.

La infraestructura de confianza se resquebraja

La confianza solía ser sencilla: proteger la red, autenticar al usuario, cifrar el canal. Hoy se espera que la confianza lo sea:

• Continuous (available 24/7/365)
• Ubiquitous (in every API, cloud, app, and transaction)
• Provable (to auditors, regulators, and boards)
  
  

But legacy PKI systems weren’t built for this scale or scrutiny. They’re fragmented across cloud silos, tangled in manual processes, and vulnerable to one very human weakness: negligence, and its symptom, expiration.

In January 2024, the UK’s CHAPS real-time settlement system halted due to a single expired TLS certificate, disrupting high-value payments across one of the world’s most vital financial markets. A month later, it happened again. Microsoft 365 suffered a similar fate in June — taking down collaboration systems used across the industry.

These weren’t exotic zero-days. They were avoidable failures in trust governance.

From the outside, it looks like bad luck. But security leaders know better: these incidents reflect deeper issues in visibility, ownership, and resilience.

Por qué falla la confianza

Todo servicio digital depende de la confianza. Pero entre bastidores, muchas instituciones financieras confían en:

• Siloed certificate management across DevOps, app teams, and cloud units
• Outdated tools bolted onto decades-old CA hierarchies
• Manual renewals that can’t scale with the speed of cloud-native development

En resumen, las herramientas que generaron confianza ayer no pueden mantenerla mañana.

Mientras tanto, la innovación de FinServ se acelera:

• Pagos instantáneos y liquidación en tiempo real
• Detección de fraudes y verificación de identidad asistida por inteligencia artificial
• Consolidación de fusiones y adquisiciones y convergencia de plataformas
• Iniciativas que dan prioridad a la nube con arquitecturas de confianza cero
• High-throughput applications demanded by customers 

Cada una de ellas introduce nuevas dependencias criptográficas. Pero la mayoría de los equipos siguen gestionando la confianza como si estuviéramos en 2008.

De las tiritas a la resistencia empresarial

So how are leaders turning trust into a launchpad? Let’s look at what real institutions are doing.

🏦 M&T Bank: Escalando la confianza a través de entornos híbridos

M&T Bank necesitaba unificar el gobierno criptográfico tanto en la infraestructura heredada como en las plataformas modernas tras una importante transformación tecnológica. Con Keyfactor, ganaron:

• Centralized visibility over all digital certificates
• Automated lifecycle management across cloud and on-prem
• Improved resilience against service outages from expired or misconfigured certs
  
  

Trust became a strategic enabler for secure DevOps and API modernization. This case study shows how Keyfactor has become a critical component in M&T’s security infrastructure.

💸 EQ Bank: Impulsando la innovación fintech con PKI

EQ Bank, one of Canada’s most digitally advanced banks, adopted a cloud-native trust infrastructure to support its rapid innovation cycles. They needed scalable certificate issuance to support everything from mTLS between microservices to digital onboarding.

Con un enfoque flexible e independiente de las CA, el Banco EQ consiguió:

• Crypto-agility with support for hybrid classical + PQC certs
• Self-service automation for development teams
• Proactive controls to prevent outages and reduce support costs

For EQ, PKI was part of the product delivery engine. This case study demonstrates that, since running with Keyfactor Command, EQ Bank has not experienced a single certificate-related outage. 

El poder de la interoperabilidad

¿Cómo evitan estas organizaciones caer en la trampa del "quita y pon"?

They use interoperable, CA-agnostic PKI solutions that:

• Work across legacy and modern environments
• Support multiple certificate authorities, public or private
• Integración con plataformas en la nube, canalizaciones DevOps y herramientas de seguridad
• Enable visibility and control from a single pane of glass

This flexibility is crucial, especially during M&A events or platform transitions. It allows institutions to modernize without breaking what works today.

De la confianza a la gestión de la confianza

The biggest change? Forward-thinking banks are no longer treating PKI as background infrastructure. They’re putting it under governance — just like capital reserves, vendor risk, or insider threat controls.

It’s been argued that trust without governance is no trust at all. A patchwork of tools is not enough. Indeed, from the The Security Leader’s Digital Trust Playbook: Financial Services Edition:

"No se puede ofrecer confianza digital a gran escala sin tratar la PKI como una infraestructura crítica. Debe gobernarse, observarse, automatizarse y construirse para el cambio".

And increasingly, it must also be ready for post-quantum threats.

El próximo cambio criptográfico

La selección de algoritmos post-cuánticos por parte del NIST ha dado el pistoletazo de salida a una transformación global. Se espera que las instituciones financieras:

• Inventory where quantum-vulnerable algorithms are in use (RSA, ECC)
• Prepare systems for hybrid certificates (classical + PQC)
• Demonstrate crypto-agility to regulators before 2030

The real deadline isn’t when quantum computers arrive – it’s when regulators start asking if you’re ready. So what can you do now?

1. Get a full inventory of your certificates and keys across all environments
2. Establish ownership and lifecycle policy across teams and toolchains
3. Adopt crypto-agility principles that allow you to swap algorithms easily
4. Integrate PKI into your business strategy — not just your IT stack
   
   

With the right foundation, trust becomes a strategic advantage, one that accelerates transformation.

Próximos pasos: Visibilidad y preparación para el PQC

In Part 2 of this series, we’ll walk through a hypothetical quantum breach scenario, examine what crypto-agility really requires, and share a simple checklist to start your post-quantum readiness journey. (Spoiler: It’s not just about new algorithms…it’s about visibility, governance, and proving that your infrastructure is built for the next frontier…so stay tuned for part 2 in this new blog series!)

📥 Want the full roadmap now?
Curious what preparation looks like? Download The Security Leader’s Digital Trust Playbook: Financial Services Edition today. Have questions for our security team? Reach out here with any questions — we’re here to help!