Welcome to the latest edition of The Quantum Leap, our quarterly update on the AES Migration Program.
Each quarter, we bring you a high-level update on the progress of the Program and what’s ahead. We also provide updates on developments in Australia and globally, and focus on cyber security, cryptography and the impacts of classical and quantum computing.
Your suggestions for topics in future publications and feedback on this edition are welcomed. Feel free to email us at aesmigrationprogramteam@auspaynet.com.au.
We hope you enjoy this edition.
Riaz Hussain Head of Security, Standards & AES Transition
Our focus in 2026
The current phase of the Program is focused on Pilot execution, currently scheduled for this year. Key deliverables from this phase include:
Preparation for and execution of Vanguard Industry Testing (VIT) and Pilot with the first two acquirers.
The finalisation of IAC Code Set amendments, which describe Members’ obligations arising from the Program, such as adhering to sunrise and sunset dates.
The setting of sunrise and sunset dates, which are the key milestones for the Program.
Finalisation with Standards Australia of the changes to the relevant Australian Standard, AS2805.
An update to the migration handbook.
Updates to key program artefacts to encapsulate lessons learnt from VIT and Pilot.
An uplift in communications and change activities as the industry mobilises.
Member insights webinar – An introduction to the Migration Strategy
We recently held our third member insights webinar, presented by Dr. Ramtin Shams, AusPayNet’s AES Migration Lead, and Riaz Hussain.
Previous webinars provided an introduction to the Program and the Technical Blueprint.
This webinar delved into the strategy for implementing the migration, our approach to managing coexistence, and the key milestones and timetable for the Program.
A recording of the webinar and a copy of the presentation are available to AusPayNet Members on the Member Portal.
What are we seeing in Australia?
The Reserve Bank of Australia talked about the need for migration to AES late last year. Specifically, the Payments System Board articulated their intention to “consult on using the RBA’s standard-setting powers under the [Payment Systems Regulation Act (1998)] to support the migration”.
At the AusPayNet Summit in December, Dr Brad Jones, RBA Assistant Governor (Financial System), indicated that this consultation is expected to take place around the middle of 2026.
The Department of Home Affairs has been consulting on Horizon 2 of the 2023-2030 Australian Cyber Security Strategy. Submissions to that consultation and recordings of town halls held with industry are available on the Department’s website.
We look forward to continued support from the RBA, the next version of the Government’s Strategic Plan for Australia’s Payments System, and ongoing engagement with the Department of Home Affairs and Australian Signals Directorate on the 2023-2030 Australian Cyber Security Strategy and security standards more broadly.
Industry Testing Strategy overview
A robust, repeatable industry testing regime is foundational to the success of the Program. The purpose of the Industry Testing Strategy is to provide a structured approach to industry testing, outlining how testing will be carried out and ensure that Program participants meet the requirements and mitigate program risks.
The Industry Testing Strategy provides:
A testing assessment, which outlines the benefit of the industry testing and certification model and sets out how the model is to be applied to the AES Migration Program to achieve maximum value.
A testing approach that is guided by the testing assessment outcomes, which detail the focus of testing and how testing will be managed and executed.
An initial list of industry testing scenarios and their application to participant roles. These scenarios have been detailed in a subsequent test plan.
Test environment and tooling expectations on program participants and card networks.
A testing governance approach, including the roles and responsibilities of key stakeholders and reporting requirements.
Testing considerations for the AES Program Pilot phase, including qualification through VIT.
A key aspect of the Industry Testing Strategy is to focus not just on individual components (e.g. ATMs or switches), but also on the interfaces between them. This approach is designed to ensure that each interface operates effectively on its own, and that interoperability risks are addressed across the whole card payments system.
The Industry Testing Strategy builds on card network testing and certification regimes and makes efficient use of their facilities. It expands existing testing efforts by ensuring a holistic scope of interfaces is identified across all the card networks and extends to merchant terminals and ATMs.
The Industry Testing Strategy is complementary to the card network regimes, which focus on functional testing, by including non-functional testing (performance and network infrastructure) and coexistence testing between AES and TDES interfaces.
The Industry Testing Strategy has been further developed through the creation of test plans and associated processes and supporting tooling to effectively support Members as they move through the various testing phases.
All testing artefacts are available to IAC Participants through the AusPayNet Member Portal.
Looking forward
The major task for 2026 is the execution of VIT and Pilot.
As mentioned above, our early adopters are planning to enter VIT and Pilot in 2026. The Pilot phase will initially focus on acquirers with involvement of each of the card schemes. The Pilot will use AES on the acquiring side, with a step-down to TDES by each scheme for the issuing banks. The plan will be for issuers to ask a small number of their cardholders to make payments at nominated acquiring terminals throughout the pilot period.
We expect VIT to commence in Q2 2026 and Pilot soon thereafter. This will be the first time that the Program’s testing and certification approach is used, with valuable learnings expected for future participants.
Staying up-to-date
We will build on our communications in 2026, with a program of newsletters, webinars, open days and other activities. Specific priorities for 2026 include:
An increased focus on participant support, with an emphasis on identifying and resolving issues and bottlenecks.
Ongoing engagement with government, regulators and industry bodies, with a key focus on the mandate position for AES.
Sharing lessons learnt and experiences from early adopters to inform subsequent implementations, particularly through VIT and Pilot.
Supporting participant success through the Migration Success Framework.
Reporting and status tracking, and ongoing maintenance of industry timelines and roadmaps.
Monitoring international developments and sharing learnings where available.
Ongoing engagement with external stakeholders, particularly on the effectiveness and timeliness of the industry’s approach to the management of security risks.
A broadening of communications activities to non-Members and other stakeholders.
Increasing the public profile of the Program, particularly in relevant media.
This is the fourth edition of The Quantum Leap newsletter, which is produced quarterly and is available on the AusPayNet website.
