Hong Kong’s banks now have a shared playbook for replacing the encryption that a future quantum computer could break. The Hong Kong Monetary Authority (HKMA) and the Hong Kong University of Science and Technology (HKUST) launched a Post-Quantum Cryptography (PQC) Toolkit on 2 November, the regulator said, to guide banks as they plan and carry out the switch.
The launch is the next step after a sobering benchmark. In July the HKMA gave the banking sector a score of 2.3 out of 10 on its new Quantum Preparedness Index (QPI), and it wants the sector at 10 by 2030. The PQC Toolkit is meant to turn awareness into action, the HKMA says.
What the PQC Toolkit asks banks to do
According to the HKMA and the HKUST Business School release, the toolkit helps banks set up governance and accountability, assess their cryptographic exposure, identify what needs to change and monitor progress. It includes practical tools for taking stock of cryptographic assets and dependencies, setting transition priorities, working with suppliers and drawing up realistic timelines.
At its core is a reference manual called PACT, short for PQC Accountability and Controlled Transition. The manual organises the work into four pillars: govern the transition, assess and plan, implement and retire, and maintain and adapt. It groups related uses of cryptography into “estates”, each with an accountable owner, and says work on the pillars can run at the same time.
The manual is candid about its limits. It says it “does not itself create or amend regulatory requirements or supervisory expectations”, and that its effectiveness, cost and scalability across banks “have yet to be established empirically”. It thanks HSBC for sharing industry perspectives.
Arthur Yuen, Deputy Chief Executive of the HKMA, said the index “has established a clear starting point for the sector”, and that the next step is to help banks “translate that understanding into clear responsibilities, informed priorities and practical plans”. Frederik Anseel, Dean of HKUST Business School, called preparing for the quantum era “a leadership challenge”.
Why a 2.3 score worries the regulator
The QPI came out of a survey of banks in early 2026, published with a whitepaper on 27 July. It measures four dimensions: awareness, planning, pilots and practical preparedness. About 32% of surveyed banks had not yet started their transition, and around half had no formal post-quantum planning in place, the HKMA said. About half reported that quantum computing had been discussed at board level.
The risk the toolkit targets is well understood, even if its timing is not. The PACT manual explains that an attacker can collect encrypted data today and decrypt it later, once a quantum computer can defeat the public-key methods that protect the encryption keys. This “harvest now, decrypt later” problem means data that must stay confidential for years is already exposed. For digital signatures, the threat is future forgery and impersonation. Symmetric encryption and hash functions face a smaller effect and, with adequate key lengths, are not considered broken, the manual says.
Hong Kong is not alone in setting dates. In the US, NIST has finalised its post-quantum transition plan, which deprecates RSA and ECDSA after 2030. Estimates of how close the threat is keep shifting: Alice & Bob recently put a Bitcoin key attack at under 30,000 cat qubits.
A planning tool, not a rulebook
The most useful thing about the PQC Toolkit is that it starts from the problem banks actually have, which is not choosing an algorithm but finding where cryptography sits. Encryption is buried in payment links, mobile apps, vendor software and back-office systems that nobody has listed in one place. A tool that asks who owns each piece, and what a supplier delay would mean, addresses the slowest part of any migration.
It also fits a pattern in how the HKMA works. Rather than issue hard rules first, it publishes a benchmark, offers shared guidance and measures again. It took a similar path with its ART framework for responsible AI in banking. The approach lets smaller banks borrow structure they could not build alone, while the QPI gives the regulator a way to see who is falling behind.
The weak point is the clock. A move from 2.3 to 10 in about four years is a steep climb, and the manual itself admits its framework is untested at scale. Banks also depend on suppliers whose own upgrade dates sit outside their control. Hong Kong’s banks are busy elsewhere too, with launches such as Standard Chartered’s tokenised deposits competing for the same engineering teams.
The HKMA says the toolkit will be updated over time to reflect technological developments, international standards and industry experience. The next QPI reading will show whether a playbook was what the sector was missing.
Sources
- Hong Kong Monetary Authority, “HKMA and HKUST launch PQC Toolkit to support banks’ quantum preparedness”, 2 November 2026
- HKUST Business School, “HKUST and HKMA Launch PQC Toolkit to Support Banks’ Quantum Preparedness”, November 2026
- HKUST and HKMA, “PACT: PQC Accountability and Controlled Transition”, reference manual, November 2026 (PDF)
- Hong Kong Monetary Authority, “HKMA launches quantum preparedness whitepaper and index to support banking sector’s readiness for quantum era”, 27 July 2026
- Hong Kong Monetary Authority, Quantum Preparedness page, Fintech Knowledge Hub
Related stories
- NIST Finalises Post-Quantum Plan, Deprecating RSA and ECDSA After 2030
- Alice & Bob Puts a Bitcoin Key Attack at Under 30,000 Cat Qubits
- Hong Kong’s HKMA Unveils ‘ART’ Framework for Responsible AI in Banking, With an Agentic-AI Paper Still to Come
- Standard Chartered Launches Tokenised Deposits for Hong Kong Firms
Follow @tsnmediahub on X for breaking AI news as it happens.
Follow on X
