What the UK-Singapore Financial Dialogue Joint Statement of 20 October 2026 Says About Post-Quantum Cryptography, QKD and Bank Supervisors
In 2024 the Monetary Authority of Singapore ran a post-quantum cryptography experiment with the Banque de France. In August of the same year it signed a memorandum with DBS, HSBC, OCBC, UOB and two network operators to try a different technique, quantum key distribution, which uses single photons over fiber to give two sites a shared key. A central bank that tests both routes is hedging, and that hedge sits behind one sentence in a document published on 20 October 2026.
That day the United Kingdom and Singapore held the 11th UK-Singapore Financial Dialogue in Singapore. HM Treasury published the joint statement the same day. It covers tokenisation, artificial intelligence, capital markets, transition finance and the two countries' roles in 2027, when the UK holds the G20 Presidency and Singapore chairs ASEAN. Quantum technology appears once.
The one sentence on quantum security in the 20 October 2026 joint statement
The full text reads: "The exchange on quantum technologies covered the UK's and Singapore's approach to quantum security and supervisory expectations for financial institutions transitioning to quantum-safe technologies, including the UK National Cyber Security Centre's post-quantum cryptography migration guidance, as well as lessons learnt from MAS' Quantum Key Distribution sandbox with industry partners."
Three features matter. The sentence speaks of supervisory expectations, the phrase a regulator uses for what it will look for when it examines a firm. It names the parties to the conversation by function: HM Treasury and MAS led, with the Bank of England and the FCA present. And it chooses two reference points, one British and one Singaporean, that come from different schools of thought about how to make keys safe against a future quantum computer.
Two things are absent. The statement contains no agreement, joint standard, timetable or follow-up workstream on quantum security. Every verb in that paragraph describes discussion. Coverage by Quantum Computing Report on 23 October went further, describing an agreement to "deepen bilateral cooperation," a "joint oversight" pillar and an emphasis by regulators on "immediate cryptographic discovery audits." None of those phrases appears in the HM Treasury text, and the MAS media release page was unavailable when Quentir checked it on 25 October. Until a primary text says more, the sentence describes an exchange of views between supervisors.
What the NCSC guidance of 20 March 2025 asks of UK organizations
The UK reference is concrete. The National Cyber Security Centre published Timelines for migration to post-quantum cryptography on 20 March 2025. It sets three milestones: by 2028, define migration goals, carry out a full discovery of the services and infrastructure that depend on cryptography, and build an initial plan; by 2031, finish the highest-priority migrations; by 2035, complete migration of all systems, services and products. The guidance says the core dates apply to all organizations and that it offers indicative timelines that industry, government and regulators can follow.
The NCSC is equally clear about the other technique. Its white paper Quantum networking technologies, published on 5 August 2025, states that the NCSC "will not support the use of QKD for government or military applications," calls post-quantum cryptography "the best mitigation," and advises that in other sectors QKD "should not be solely relied upon" for generating and distributing keys. The paper adds that the use of QKD systems "should not constitute evidence towards assessments of security of data-in-transit" under the NCSC's Cyber Assessment Framework. Its reasoning starts from authentication: QKD does not establish who is at the other end, so it must be combined with quantum-resistant authentication, either post-quantum signatures or pre-shared symmetric keys, which the NCSC says work only in some controlled environments. The paper also describes assuring QKD hardware against well-resourced attackers as an ongoing challenge.
What MAS learned from its quantum key distribution sandbox with DBS, HSBC, OCBC and UOB
The Singapore reference is the technical report MAS released on 29 September 2025. MAS and the four banks used a QKD service from SPTel and SpeQtral, operators of Singapore's National Quantum-Safe Network Plus, to confirm that QKD can carry sensitive data securely, including between data centers and bank premises. The findings are balanced. MAS says QKD can strengthen network security. It also says QKD providers and the telecommunications sector must strengthen security assurance, including standards for tamper-resistant, auditable trusted nodes, and that interoperability between providers needs more work before wide adoption. The report adds that the work needed senior management support, budget and in-house skill.
Read side by side, the two references overlap more than their reputations suggest. Outside government, the NCSC warns against relying on QKD alone. MAS, for its part, had tested post-quantum algorithms with the Banque de France before it opened the QKD sandbox. Both texts treat the assurance of QKD equipment as unfinished work. The difference still has practical weight. Under the NCSC's guidance, a QKD link should not count toward a data-in-transit assessment under its Cyber Assessment Framework, while MAS has tested the same technique with four banks in Singapore. A bank that operates in both cities will meet that difference as a question of what each supervisor counts as adequate progress.
Practical takeaway. The 20 October 2026 joint statement creates no shared rule or deadline. It tells a bank supervised in both the UK and Singapore that each authority now discusses quantum-safe transition as a supervisory expectation, with the NCSC's 2028, 2031 and 2035 milestones on one side and MAS's tested but conditional view of QKD on the other.
How Quentir Reads It
Financial supervisors are approaching post-quantum migration from several directions at once. Quentir's Defense Monitor described how Hong Kong put a readiness score on quantum preparedness for its banks, which turns the same question into a measurement. The UK-Singapore sentence is a softer instrument, yet it carries one signal the Hong Kong approach does not: two supervisors with different technical bets are comparing them openly.
The engineering difference has a human side. Payments, securities settlement and remittances between London and Singapore move ordinary people's savings and wages, and much of that traffic is protected by public-key cryptography that a capable quantum computer could break. Data copied today could be read later. QKD supplies keys over a dedicated optical link, and those keys still feed conventional authenticated encryption, so it suits a fixed fiber between two data centers. Post-quantum algorithms run in software and certificates, and they protect an app or a counterparty connection only once each system has been upgraded. Europe has seen the same split in a different setting, where a tactical trial in Malta in September 2026 combined QKD hardware with conventional encryptors and key management. Some banks may consider QKD as a supplement to post-quantum migration on their most critical links, and the supervisory question then becomes which mix each authority will accept. Quentir follows each of these threads across its blog, Medicine Monitor and Defense Monitor, and the All-access membership keeps that archive in one place, including every Signature Brief and Signature Report as it publishes.
The statement also connects to 2027. The UK takes the G20 Presidency and the Governor of the Bank of England chairs the Financial Stability Board, whose future work programme the dialogue discussed. Whether quantum-safe migration reaches the FSB agenda next year is open. The next checkpoint is the 12th dialogue, to be hosted by the UK in 2027, and whether its statement moves quantum security from "covered" to an agreed piece of work.
Sources: HM Treasury, 11th UK-Singapore Financial Dialogue October 2026: Joint Statement, published 20 October 2026; National Cyber Security Centre, Timelines for migration to post-quantum cryptography, published 20 March 2025; National Cyber Security Centre, Quantum networking technologies white paper, published 5 August 2025; Monetary Authority of Singapore, MAS and Industry Partners Publish Technical Report on Proof-of-Concept Sandbox for Quantum-Safe Communications within the Financial Sector, 29 September 2025; Quantum Computing Report, UK and Singapore Align on Post-Quantum Cryptography Migration and Quantum Security Standards in Financial Sector, 23 October 2026 (secondary coverage, compared with the primary statement). The MAS media release on the 11th dialogue was unavailable when checked on 25 October 2026.
Published intelligence, built to inform your own decisions. Published: October 25, 2026.