In May 1997 the Federal Financial Institutions Examination Council told American banks to prepare for the Year 2000 date change, and examiners spent the next two and a half years checking their progress. That project had an advantage the quantum transition lacks: the deadline was printed on the calendar. Nobody knows the year in which a quantum computer will break the public-key cryptography that protects bank payments, so a supervisor that wants a migration has to choose its own date and then find a way to measure the distance to it. The Hong Kong Monetary Authority has now done both, in two steps three months apart.
Practical takeaway. Hong Kong's banking supervisor has given post-quantum migration a baseline score (2.3 out of 10, July 2026), a target (10 by 2030) and, since 2 November 2026, a shared planning toolkit with HKUST. In our reading, banks with Hong Kong operations are likely to be asked in the next index survey what they have done with it.
What the HKMA measured on 27 July 2026: a Quantum Preparedness Index of 2.3 out of 10
At FiNETech8, its flagship fintech event, the HKMA launched the Whitepaper on Quantum Preparedness of Hong Kong's Banking Sector together with the first Quantum Preparedness Index on 27 July 2026. The index rests on a survey conducted in early 2026 and scores the sector on four dimensions: Awareness, Planning, Pilots and Practical Preparedness. The opening score was 2.3 on a ten-point scale.
About 68% of the surveyed banks were at the awareness stage or moving toward planning and piloting; the remaining 32% had not started. About half had no formal post-quantum planning. About half had discussed quantum computing at board level, and about one-third had begun exploring or piloting quantum-related initiatives. The HKMA stated its aim as full sectoral readiness, a score of 10, by 2030, to be reached "through practical guidance, training and industry engagement." The same release announced the toolkit that arrived on 2 November.
Two facts are missing from the public release: the weights given to the four dimensions, and the number of banks that answered. Without them, a reader outside the HKMA cannot tell whether 2.3 reflects a few large banks far ahead and a long tail at zero, or a sector moving slowly together. The 2030 aim is also an aim for the sector as a whole; the July release does not present it as a deadline imposed on any individual bank.
What HKUST and the HKMA said on 31 July 2026 about cryptographic agility
HKUST's own announcement of the collaboration, published on 31 July, explains what kind of help the toolkit was meant to give. The whitepaper had identified cryptographic agility as a key recommendation, and HKUST defines it as "the ability to effectively adapt and upgrade cryptographic systems as technological standards evolve." Carmen Chu, the HKMA's Executive Director for Banking Supervision, described the conversation as moving "from possibility to preparedness" and framed the task for banks as twofold: "risk management of quantum, and risk management by quantum."
The choice of partner is telling. The work is led from HKUST's business school, by Professor Allen Huang of the Department of Accounting, with engineering colleagues alongside. Dean Frederik Anseel called the transition "a leadership challenge." Post-quantum migration in a bank is largely a problem of ownership, budgets, vendor contracts and sequencing, now that NIST has published the first post-quantum standards to migrate to. A toolkit written for the people who sign off budgets and supplier terms reflects that reading of where the delay lies.
What happened between July and November 2026 elsewhere: a 2030 date from NIST and attackers already using ML-KEM
The three months between the index and the toolkit changed the context. On 27 October NIST published the final version of IR 8547, which, as we read it last week, deprecates P-256, RSA-3072 and Ed25519 after 2030. Hong Kong's target year for full sectoral readiness now coincides with the year after which the most widely used American reference treats today's public-key algorithms as deprecated. NIST deprecation does not by itself bind every foreign counterparty, but in our reading a Hong Kong bank that connects to US counterparties, card networks or cloud providers is likely to meet the 2030 date from both sides.
Other supervisors moved in the same weeks. The SEC's fiscal 2027 examination priorities, published on 23 October, mention quantum computing under Regulation SCI for exchanges and clearing agencies. On the threat side, Kaspersky reported on 21 October that the Lazarus group protects its own payload delivery with ML-KEM-1024, the NIST post-quantum key-encapsulation standard. A state-linked group that steals from financial institutions has adopted post-quantum encryption for its own traffic, while about half of Hong Kong's surveyed banks had no formal plan to do the same in early 2026.
What the toolkit released on 2 November 2026 contains, and what the HKMA has not published
The HKMA's press release of 2 November describes three layers. The first is a framework for planning and advancing a bank's transition, covering governance and accountability, cryptographic exposure, transition needs and the monitoring of implementation. The second is a set of planning considerations for an orderly, risk-based transition. The third is a set of practical tools for getting started: inventorying cryptographic assets and dependencies, setting transition priorities, strengthening supplier engagement and drafting realistic transition timelines. The HKMA says the toolkit will be updated as technology, international standards and industry experience develop. It is available from the HKMA's quantum preparedness page.
The launch was listed among the HKMA's Hong Kong FinTech Week 2026 initiatives on the same day, beside Project SAGE on agentic finance and the move of Project Ensemble to round-the-clock settlement in tokenised central bank money. The HKMA also issued a circular on the toolkit to all authorized institutions. Arthur Yuen, the HKMA's Deputy Chief Executive, said the index "has established a clear starting point for the sector" and, as The Standard reported, that the next step is to help banks "translate that understanding into clear responsibilities."
The public material leaves three questions open. It does not say whether use of the toolkit will be examined, how the next index survey will score a bank that has adopted it, or when the next survey will run. The circular's text was not available to us in machine-readable form, so we do not characterize its supervisory expectations here.
How Quentir Reads It
The HKMA has built a measurement loop: a baseline score, a sector target year, a shared method, and a promise to revise the method. That is the familiar machinery of prudential supervision applied to a risk without a known arrival date. Its strength is that 2.3 can now move, and a supervisor can report the movement. Its weakness is that the weights and the number of banks surveyed are not in the public release, so an outside reader cannot reproduce the total score or compare it directly with another market.
The encryption at issue protects account data, card transactions and interbank messages, some of which may need to stay confidential long after 2030. Earlier migration narrows the window in which such traffic can be captured now and decrypted later; it does not protect traffic already captured under today's algorithms. A sector at 2.3 out of 10 in early 2026 has four years to reach the readiness the HKMA has set as its aim, and the index measures sector readiness without making any claim about an individual customer's data.
The HKMA's sequence also sets an example for supervisors in Europe and the United States, where post-quantum expectations for banks still arrive mostly as standards dates and examination themes, without a sector-wide score. The question to watch is whether the next index reading, and the first revision of the toolkit, are published with their method.
Quentir's Signature Report No. 2, the PQC Migration Roadmap, is the paid edition that turns transition dates such as the HKMA's 2030 aim into a migration plan; this post stays with what the Hong Kong documents say.
Sources: Hong Kong Monetary Authority, HKMA launches quantum preparedness whitepaper and index to support banking sector's readiness for quantum era, 27 July 2026; HKUST, HKUST and HKMA Join Forces to Develop a Post-Quantum Cryptography Toolkit, 31 July 2026; Hong Kong Monetary Authority, HKMA and HKUST launch PQC Toolkit to support banks' quantum preparedness, 2 November 2026; Hong Kong Monetary Authority, Hong Kong FinTech Week 2026, 2 November 2026; Hong Kong Monetary Authority, circular, Post-Quantum Cryptography (PQC) Toolkit, 2 November 2026; Gloria Leung, HKMA, HKUST launches PQC toolkit to help banks achieve full quantum readiness by 2030, The Standard, 2 November 2026; HKUST and HKMA Launch PQC Toolkit for Banks, The Quantum Insider, 2 November 2026. Links checked 2 November 2026.
Published intelligence, built to inform your own decisions. Published: November 2, 2026.