Hong Kong releases a post-quantum transition toolkit for banks

A new framework follows the initial readiness assessment

The Hong Kong Monetary Authority issued a circular on November 2, 2026, introducing a toolkit for post-quantum cryptography. Developed with the Hong Kong University of Science and Technology, the PQC Toolkit will help authorized institutions prepare their transition to cryptography resistant to quantum computing capabilities. It provides banks with a preparation method; it does not announce that their systems have already migrated or that all risks have disappeared.

The HKMA recalls that the sector’s initial Quantum Preparedness Index score was 2.3 out of 10, indicating an early stage of readiness. That result belongs to an earlier assessment: the circular does not present it as a new measurement taken on November 2. Institutions have since started strengthening their preparations. The shared objective remains sector-wide readiness by 2030, a working target rather than an outcome already achieved.

A 23-workstream manual and four practical tools

The toolkit includes a reference manual covering 23 workstreams, from awareness and planning to pilots and practical preparedness. A machine-readable version is also announced. The approach is intended for institutions with different levels of maturity and operational complexity. The regulator encourages organizations to identify actions according to their own risks, rather than applying a uniform technical schedule without considering the systems and services involved.

Four tools supplement the manual: a data model for collecting and managing relevant information, a questionnaire for examining dependencies on suppliers and other counterparties, reference architectures, and a project planning tool. The latter provides indicative estimates of lead times for certain tasks. These resources can structure a roadmap; they are neither a security certification nor an algorithm mandated for everyone, nor evidence that a supplier has already completed its own transition.

Responsibilities and milestones require continuing oversight

The HKMA strongly encourages banks to use the toolkit when developing or reviewing their plans. It expects clearly defined milestones under regular senior management review. Priorities include resources and critical dependencies, assigning accountability, and a cryptographic inventory progressively covering more systems and critical operations. The document also addresses cryptographic agility: being able to update algorithms within appropriate time frames without material operational disruption.

The regulator intends to continue engaging with the industry and update the tools as technology, international standards, and practical experience evolve. It expects the sectoral index could reach 5 to 6 in the next survey, scheduled for the second quarter of 2028, ahead of the target of 10 in 2030. These figures are conditional expectations. The November 2 publication is a concrete preparation step, without demonstrating that a quantum attack is imminent or that banking infrastructure is already protected against all its consequences.