The Hong Kong Monetary Authority (HKMA), in partnership with The Hong Kong University of Science and Technology (HKUST), has launched the Post-Quantum Cryptography (PQC) Toolkit, establishing an operational and supervisory framework to guide licensed banks in transitioning their infrastructure away from vulnerable classical public-key encryption. Announced at the HKMA’s flagship FiNETech8 forum, the toolkit directly addresses findings from the central bank’s baseline audit conducted in July 2026, which revealed that Hong Kong’s banking sector averaged an initial Quantum Preparedness Index (QPI) score of just 2.3 out of 10. The joint framework serves as the core operational roadmap to elevate all regulated institutions to full quantum preparedness (a QPI score of 10.0) by 2030.
| HKMA & HKUST Banking PQC Transition Framework | ||
|---|---|---|
| Framework Component | Key Technical & Operational Rubrics | Regulatory & Compliance Target |
| Readiness Trajectory | Progression from the July 2026 baseline QPI score of 2.3/10 to full quantum readiness. | Sector-wide compliance milestone targeting a QPI score of 10.0 by 2030. |
| Cryptographic Inventory | Identification of cryptographic assets, legacy public keys, and third-party dependencies. | Generation of comprehensive Cryptographic Bills of Materials (CBOMs) across core banking platforms. |
| Risk Prioritization | Classification of sensitive financial data based on confidentiality shelf-life and exposure windows. | Mitigates long-tail “harvest now, decrypt later” (HNDL) interception across transaction archives. |
| Supply Chain Engagement | Standardized evaluation criteria and procurement questionnaires for upstream enterprise software. | Enforces PQC compliance across core ledger providers, HSM vendors, and cloud infrastructure. |
| Governance Architecture | Clear assignment of executive and board accountability paired with auditable progress tracking. | Integrates quantum-safe transition audits into HKMA ongoing supervisory reviews. |
Co-developed by HKMA supervisory teams and HKUST faculty across cybersecurity, cryptography, finance, and corporate governance, the toolkit is structured to translate broad technical awareness into institutional action. The initial QPI evaluation indicated that while financial institutions operating in Hong Kong acknowledged the theoretical risk of cryptanalytically relevant quantum computers, actual system-level migration remained in an early stage. By outlining methodical discovery processes, the toolkit helps banks inventory public-key dependencies across core transaction engines, SWIFT gateway interfaces, and Hardware Security Modules (HSMs).
The framework also places heavy emphasis on the vendor ecosystem. Because modern financial institutions rely on complex webs of third-party software for core banking, clearing, and communication, the toolkit provides structured engagement templates to audit supplier roadmaps and establish realistic migration schedules. Co-development partners will continuously update the toolkit to reflect ongoing revisions to international cryptographic standards—such as NIST’s finalized post-quantum parameters—and evolving supervisory best practices.
Official release statements, regulatory circulars, and the foundational sector survey can be accessed via the Hong Kong Government Press Release here, the HKUST Announcement Portal here, the HKMA Quantum Preparedness Announcement here, and the complete HKMA Quantum Preparedness of Hong Kong’s Banking Sector Whitepaper here.
November 7, 2026