HKMA Gives Hong Kong Banks Post-Quantum Cryptography Toolkit

The Hong Kong Monetary Authority (HKMA) and the Hong Kong University of Science and Technology (HKUST) on November 2, 2026 launched a Post-Quantum Cryptography (PQC) Toolkit to help post-quantum cryptography banks plan their move away from vulnerable encryption.

The toolkit follows the HKMA’s Quantum Preparedness Index (QPI), which scored the banking sector 2.3 out of 10 in July. The HKMA wants the sector at a score of 10 by 2030. The circular that accompanies the toolkit is addressed to all authorized institutions in Hong Kong.

For compliance, risk and technology teams, the toolkit turns a measured gap into a work plan. It covers governance, the inventory of cryptography, supplier engagement and timelines, areas that supervisors and boards will expect to see documented.

What the HKMA toolkit sets out for banks

The HKMA said the toolkit sets out “a structured and comprehensive framework” to guide banks through their post-quantum cryptography transitions. It supports banks in establishing governance and accountability, assessing cryptographic exposure, identifying transition needs and monitoring implementation progress.

It also includes a set of practical tools. These help banks take stock of their cryptographic assets and dependencies, define transition priorities, strengthen engagement with suppliers and develop transition timelines. The HKMA said the toolkit brings together planning considerations to support an orderly, risk-based transition.

The toolkit is published in the Fintech Knowledge Hub section of the HKMA website. It was developed with support from industry participants. The HKMA said it will be updated over time to reflect technological developments, international standards and industry implementation experience.

Post-quantum cryptography banks start from 2.3 out of 10

The HKMA launched the QPI and a whitepaper on the quantum preparedness of Hong Kong’s banking sector on July 27, 2026. The index scores banks on four dimensions: awareness, planning, pilots and practical preparedness.

The survey behind it was run in early 2026. About 68% of surveyed banks were aware of quantum issues, planning or piloting, and about 32% had not started their transition. About half had no formal PQC planning, and about half had discussed quantum computing at board level.

The HKMA said the 2.3 score showed the sector had begun to address quantum developments but remained at an early stage. The toolkit is meant to help banks turn awareness into action.

“The Quantum Preparedness Index has established a clear starting point for the sector. The next step is to help banks translate that understanding into clear responsibilities, informed priorities and practical plans.”

Arthur Yuen, Deputy Chief Executive, Hong Kong Monetary Authority

Yuen said the toolkit provides a common foundation that banks can adapt to their own circumstances. The aim, he said, is to make it easier for banks to begin the work and sustain progress through the transition.

What it means for compliance and risk teams

The release lists four workstreams that map onto familiar control functions. Governance and accountability sit with the board and senior management. Cryptographic exposure and transition needs belong to technology and information security risk. Supplier engagement falls to third-party risk. Timelines feed the program reporting that boards and supervisors see.

The inventory step is the foundation. A bank cannot rank systems for migration without knowing where it uses cryptography, in which applications and with which vendors. Teams that already keep a third-party inventory will find that many cryptographic dependencies sit inside supplier products, which is why the toolkit includes supplier engagement.

That link to suppliers matters for any supplier risk assessment. A vendor’s plans for quantum-safe algorithms become a question for due diligence, contract terms and ongoing monitoring, alongside the usual security attestations.

Quantum exposure is also a board topic. RegTech Post has covered the cybersecurity priorities for boardroom executives, and the HKMA’s focus on governance and accountability places quantum readiness in that conversation. HKUST’s Frederik Anseel framed it the same way.

“Banks can build the knowledge and organisational capability they need even while the timing of the threat remains uncertain.”

Prof. Frederik Anseel, Dean of the School of Business and Management, HKUST Business School

Anseel said preparing for the quantum era is a leadership challenge. He said that by starting with manageable steps and learning from trials, banks can strengthen their preparedness over time.

Timelines and standards for post-quantum cryptography

The HKMA’s stated target is a QPI score of 10 by 2030. That is a sector-wide goal for the index, and the press release does not set individual deadlines for banks. The circular and toolkit are the places to check for any expectations of individual institutions.

The release does not name specific algorithms or standards. Elsewhere, the US National Institute of Standards and Technology (NIST) approved three post-quantum standards on August 13, 2024: FIPS 203 for key establishment, FIPS 204 for digital signatures and FIPS 205 for stateless hash-based digital signatures. The HKMA has said the toolkit will track international standards as they develop.

The UK National Cyber Security Centre (NCSC) takes a dated approach. Its migration timelines call for discovery and an initial plan by 2028, early high-priority migration and a full roadmap by 2031, and complete migration of all systems, services and products by 2035.

The European Commission published a coordinated implementation roadmap for the transition to post-quantum cryptography on June 23, 2025, through the NIS Cooperation Group. The HKMA’s route to post-quantum cryptography for banks differs in form: it measures a sector score and offers a toolkit, rather than setting end dates for each institution.

What comes next for Hong Kong’s post-quantum push

The July whitepaper announced a workshop series to build bank capability and explore responsible future uses of quantum technologies. The HKMA said the toolkit will be revised as standards and implementation experience develop.

The next marker is the QPI itself. The HKMA has set 2030 as the year it expects the banking sector to reach a score of 10, up from 2.3 at the first reading.