josh.pearson@t…
Thu, 09/17/2026 – 07:35
The Hong Kong Monetary Authority (HKMA) has put a figure on the banking sector’s current level of quantum preparedness: 2.3 out of 10. The score comes from the new Quantum Preparedness Index (QPI), released alongside the Whitepaper on Quantum Preparedness of Hong Kong’s Banking Sector. The index looks at four areas: awareness, planning, pilots, and practical preparedness. Around 68% of banks surveyed are aware of quantum risks or have begun planning or running pilots. The remaining 32% have yet to begin their transition, and around half of banks lack a formal post-quantum plan. The HKMA has committed to supporting the banking sector's transition toward quantum readiness by 2030 through practical guidance, training, industry collaboration, and capability-building initiatives.
Data Security
Encryption Key Management
Key Management
Regulation and compliance
Sabrina Ma | Regional Sales Director, Hong Kong, Macau & Mongolia
More About This Author >
The Hong Kong Monetary Authority (HKMA) has put a figure on the banking sector’s current level of quantum preparedness: 2.3 out of 10.
The score comes from the new Quantum Preparedness Index (QPI), released alongside the Whitepaper on Quantum Preparedness of Hong Kong’s Banking Sector. The index looks at four areas: awareness, planning, pilots, and practical preparedness.
Around 68% of banks surveyed are aware of quantum risks or have begun planning or running pilots. The remaining 32% have yet to begin their transition, and around half of banks lack a formal post-quantum plan. The HKMA has committed to supporting the banking sector's transition toward quantum readiness by 2030 through practical guidance, training, industry collaboration, and capability-building initiatives.
The whitepaper builds on HKMA's Fintech 2030 strategy, which identifies quantum resilience as a strategic priority for Hong Kong's financial sector. It expands that vision by providing Authorized Institutions (AIs) with a practical four-stage roadmap – from Awareness and Planning to Pilot and Practical Preparedness – to prepare for their transition to post-quantum cryptography (PQC). Here’s what Hong Kong banks should know.
Start With a Cryptographic Inventory
Before deciding what to migrate, banks need to know where vulnerable cryptography is in use. That includes algorithms, keys, certificates, cryptographic libraries, and protocols, as well as the applications and infrastructure that depend on them.
Some will be relatively easy to find. Others may sit inside older applications, cloud services, payment systems, network connections, or products supplied and maintained by third-parties.
Once banks know what they have, they can work out what needs attention first. A system processing high-value transactions or protecting information that must remain confidential for many years may need to take precedence over a lower-risk application.
The inventory – often referred to as a Cryptographic Bill of Materials (CBOM) – should be treated as a living record. It provides the visibility needed to prioritize migration activities and manage cryptographic risk over time. As applications evolve, certificates are renewed, infrastructure is modernized, and new services are introduced, the CBOM must be continuously updated to ensure banks retain visibility into the cryptography they will eventually need to replace.
Build Cryptographic Agility
PQC algorithms will replace cryptography that quantum computers could eventually break, but banks also need a practical way to implement those changes across large, complex environments.
HKMA's Fintech 2030 strategy identifies cryptographic agility as one of the sector's priorities. The Authority is also working with the Hong Kong University of Science and Technology and the banking industry on a PQC toolkit to support transition planning and cryptographic agility.
Banks are unlikely to switch every application and system to PQC at the same time. Classical and post-quantum algorithms may need to coexist during migration. Providing cryptographic services through an infrastructure that supports multiple algorithms gives banks more flexibility to make changes without redesigning every application that uses them.
There are practical issues to test as well. PQC algorithms can have different key, signature, and certificate sizes, as well as different performance characteristics. Banks need to see how those differences affect their own applications, infrastructure, and transaction volumes.
Protect Long-Lived Sensitive Data
The
[…]
Content was trimmed to protect the source. Please visit the original article for the full text.
Read the original article: