Hong Kong banks score 2.3 out of 10 on quantum readiness, get a guide in response

In July 2026, the Hong Kong Monetary Authority (HKMA), which supervises the city's banks, gave the whole sector a score. Its Quantum Preparedness Index measures whether banks are ready to replace the encryption that future quantum computers could break. The result: 2.3 out of 10. The sector is still at an early stage.

On November 2, the HKMA and the Hong Kong University of Science and Technology (HKUST) responded with a practical tool: a toolkit for post-quantum cryptography (PQC), meaning algorithms designed to withstand these machines. It is published on the HKMA website along with a circular addressed to banks.

What does the toolkit contain?

According to the HKMA press release, the document gives banks a framework to organize their transition. It covers four areas:

• governance: who is responsible for the migration;
• exposure assessment: where the institution uses vulnerable cryptography;
• identifying transition needs;
• monitoring implementation.

Practical tools include inventorying cryptographic assets and their dependencies, setting priorities, engaging with vendors and drafting a concrete transition timeline. The HKMA plans to update the document as technologies, international standards and practical implementation experience evolve.

For Arthur Yuen, Deputy Chief Executive of the HKMA, the index set “a clear starting point” for the sector. Frederik Anseel, dean of the HKUST business school, sees quantum-era preparation as “a leadership challenge.”

A collective goal, milestones for each bank

The press release sets no binding deadline for banks. The final goal applies to the sector as a whole: reaching a score of 10, described as “full quantum readiness,” by 2030. In the circular published the same day, however, the HKMA expects each bank to set clear milestones for its preparation and have its senior management review them regularly.

The time frame matches Europe's. The European roadmap also targets 2030 for high-risk uses, a timeline that Germany has just adopted. For a French bank operating in Hong Kong, it is one more framework to follow. It is also a good reference for getting started.

What a European company can take from it

The steps described by the HKMA are nothing exotic. They are the ones European authorities recommend: knowing where your cryptography is, prioritizing data that must stay secret for a long time, and asking your vendors about their roadmaps. We detailed them in our six-step guide.

It remains to be seen whether the Hong Kong banking sector's score will improve at the next measurement. In its circular, the HKMA schedules it for the second quarter of 2028 and estimates that, with concerted efforts, the score could then reach 5 to 6.