Project Otto has brought together more than 25 GFIN financial regulators to explore how regulatory maturity can be measured across quantum security and quantum innovation. The resulting toolkit uses a framework built around observable and measurable regulatory parameters, structured around what  regulators say, what regulators do, and how regulators engage.

The toolkit provides a snapshot of global maturity trends, highlights areas where regulators are already making progress, identifies common capability gaps, and captures lessons from regulators' experiences in supporting both quantum security and emerging quantum innovation.

This roundtable marks the launch of the Project Otto Toolkit and seeks to move the discussion from maturity assessment to practical action. Bringing together regulators and industry participants, the session will explore:

\- Which regulatory activities have the greatest influence on industry awareness, investment, and preparedness.

\- Whether a small number of regulatory actions can drive disproportionate improvements in maturity and sectoral action.

\- What actions regulators, industry participants, and international networks such as GFIN should prioritise over the next 12 months.

\- How can regulators move from measuring quantum maturity to taking practical action that strengthens regulatory capability and supports industry readiness?

While AI is creating new opportunities across financial services, its effectiveness ultimately depends on access to high-quality and trusted data. Building on emerging open data sharing initiatives across the financial sector, this roundtable will explore how financial institutions can collaborate to unlock greater value from data while preserving privacy, security, and trust. Bringing together industry leaders, technology providers, AI practitioners, and policymakers, the discussion will examine practical approaches to data sharing, privacy-enhancing technologies, common data standards, and trusted data ecosystems that can accelerate AI innovation, enable the development of more capable and reliable financial AI models, strengthen risk management, and support the next generation of AI-enabled financial services.

As money becomes programmable, across central bank digital currencies, tokenized deposits, and stablecoins, a real question is emerging about where compliance should live: embedded directly in the asset as a rule that travels with it, layered on top through richer messaging and real-time screening, or enforced separately by whichever party touches the transaction last.

Players are all building credible but different answers in parallel, and none has converged on how these should interoperate across jurisdictions with different compliance regimes. The stakes are rising on every front — real-time cross-border settlement, tokenized securities, and increasingly, autonomous agents initiating transactions on their own — all of which need a compliance check at the moment value moves, not after. What would each of these approaches to programmable compliance actually need to interoperate, and which rules win when they conflict across borders?

Discussion questions:

1\.         Should compliance logic live in the asset itself, in the messaging/settlement layer, or in a separate real-time screening service, and does the answer change depending on whether it's a CBDC, a tokenized deposit, or a stablecoin?

2\.         When a transaction crosses borders, whose compliance rule actually governs — sender's jurisdiction, receiver's, or the rail's — and what happens when they conflict?

3\.         Retrofitting compliance onto existing settlement infrastructure and building it in from scratch are both live strategies right now — what would each need to prove to become the default, and is convergence between them actually possible?

4\.         As more transactions — including those initiated by autonomous agents — require a compliance check the moment value moves, what are the minimum interoperability standards needed for rules to actually travel with money across rails?