Hong Kong regulator and HKUST give banks a toolkit for the post-quantum switch

The HKMA and HKUST released a PQC Toolkit with a 23-workstream manual and four planning tools, aiming to lift banks' quantum readiness score from 2.3 to 10 by 2030.

Hong Kong's banking supervisor has moved from measuring quantum readiness to telling banks how to build it. On November 2 the Hong Kong Monetary Authority (HKMA) and The Hong Kong University of Science and Technology (HKUST) released a Post-Quantum Cryptography (PQC) Toolkit, developed with input from industry participants, to guide banks as they replace encryption that a future quantum computer could break.

What was announced

According to the HKMA, the Toolkit is a structured framework that helps banks set up governance and accountability for the transition, assess how exposed they are through their cryptography, identify what needs to change and track progress once work begins. Its practical tools cover taking an inventory of cryptographic assets and dependencies, setting priorities, working with suppliers and drawing up realistic timelines.

A circular sent to all Authorized Institutions on the same day adds detail. The Toolkit includes a reference manual organised around 23 workstreams, running from awareness and planning through piloting to practical preparedness, and it is also published in a machine-readable format. Four tools come with it:

a data model for collecting and managing information about the transition;
a dependency assessment questionnaire for engaging service providers and other counterparties on their PQC readiness;
reference architectures that sketch possible target-state technical setups;
a project planning tool for building a transition roadmap, with indicative lead times for key tasks.

What banks are expected to do

The circular strongly encourages banks to use the Toolkit in proportion to their risk profile, technology environment and complexity. It also says they are expected to set clear milestones and keep them under regular senior management review. The listed priorities are a prioritised roadmap that accounts for the readiness of critical suppliers and group service providers, clear accountability for quantum-related risk with senior oversight, a cryptographic inventory whose coverage widens over time, and stronger cryptographic agility, meaning the ability to swap algorithms quickly without major disruption.

The readiness numbers

The Toolkit builds on the Quantum Preparedness Index (QPI) that the HKMA launched in July 2026. The sector's first score was 2.3 out of 10, which the regulator read as an early stage of readiness. The stated goal is full readiness, a QPI of 10, by 2030. In the circular, the HKMA says it expects the sector could reach 5 to 6 by the next QPI survey, scheduled for the second quarter of 2028.

HKMA Deputy Chief Executive Arthur Yuen said the index had set a starting point and that the next step is to help banks turn that understanding into "clear responsibilities, informed priorities and practical plans." Frederik Anseel, dean of the HKUST Business School, described quantum preparation as a leadership challenge that banks can work on even while the timing of the threat is uncertain.

Why it matters

Post-quantum migration in finance is mostly an inventory and governance problem: banks first have to find where public-key cryptography sits in their own systems and in those of their vendors before they can replace it. By publishing shared templates, an expected trajectory and a dated re-survey, the HKMA has given Hong Kong banks a concrete benchmark, and it gives other regulators a reference model.

What to watch

The HKMA says the Toolkit will be updated as technology, international standards and implementation experience evolve, and it has invited feedback from banks. The next public checkpoint is the 2028 QPI survey and whether the sector reaches the 5 to 6 range the regulator expects.