HKMA and HKUST Launch PQC Toolkit to Guide Banks Through the Post-Quantum Transition

#cybersecurity #fintech #security

📅 02 November 2026 • HKMA and HKUST

Banks get a practical map for the quantum transition
On 2 November 2026 the Hong Kong Monetary Authority (HKMA) and the Hong Kong University of Science and Technology (HKUST) launched the Post-Quantum Cryptography (PQC) Toolkit for banks, developed with support from industry participants. The initiative sits under the HKMA's Fintech 2030 strategy and gives the sector a structured framework for planning and advancing the transition to quantum-safe cryptography.

What is inside the Toolkit
The package is deliberately practical. It helps banks take stock of their cryptographic assets and dependencies, define transition priorities, strengthen engagement with suppliers, establish clear governance and accountability, and develop practical transition timelines while monitoring implementation progress. The Toolkit is available in the Fintech Knowledge Hub section of the HKMA website (circular 20261102-3-EN).

Where the sector stands - the QPI numbers
The Toolkit operationalizes the Quantum Preparedness Index (QPI), introduced by the HKMA in July 2026. The initial sector score was 2.3 out of 10, and the stated goal is full quantum readiness - a score of 10 by 2030. July survey data add context - around 50% of banks have no structured PQC transition plan, and for those that do, the average implementation timeline is 5.6 years. For international context, NIST finalized its first post-quantum encryption standard, ML-KEM (FIPS 203), in 2024.

Voluntary by design
The HKMA has set no hard deadlines and no sanctions - the Toolkit is voluntary reference material, applied with a proportionate approach that takes each institution's circumstances into account, and it will be updated over time to reflect evolving technology, international standards and industry experience. HKMA Deputy Chief Executive Arthur Yuen described it as a common foundation that banks can adapt to their own circumstances, making it easier to begin the work and sustain progress.

IMPACT
Who is affected - banks and financial institutions in Hong Kong, their CISOs and risk teams, and vendors of cryptographic infrastructure. What changes - cryptographic inventories, board-level governance and accountability for the PQC transition, structured supplier engagement and concrete roadmaps. Timeline - measurable progress against the QPI benchmark toward full readiness by 2030. The neutral case for starting now - data encrypted today could be decrypted later once quantum computers mature, the harvest-now-decrypt-later scenario that cryptographic inventories and early planning are meant to defuse.

Sources - hkma.gov.hk, thequantuminsider.com, blockchain.news, miragenews.com, nist.gov