Singapore wants banks' critical systems quantum-resistant by 2030

On November 6, the Monetary Authority of Singapore (MAS), which is both the city-state's central bank and its financial regulator, opened a consultation on a draft circular with an explicit title: guidance and a timeline for the financial sector's migration to quantum-resistant cryptography. Financial institutions and any other interested party have until November 23 to respond.

The text, referenced P019-2026, creates no legal obligation. It sets out the MAS's "supervisory expectations," in other words what the supervisor expects from each institution, with precise deadlines.

Why set dates now?

The MAS acknowledges that there is no international consensus on a date for the arrival of a quantum computer capable of breaking RSA and elliptic-curve cryptography (ECC), which today protect a large share of digital communications. Yet it writes that there is a "strong consensus" that this could happen "in the coming years." That is a more pressing assessment than the one from the country's cybersecurity agency, the CSA, which in mid-October pointed to a horizon of five to ten years. The draft builds on a first advisory sent to financial institutions in February 2024.

The proposed timeline

For all financial institutions:

• December 31, 2027: have a migration plan approved by the board of directors or senior management;
• December 31, 2030: have migrated critical systems, those whose failure would seriously disrupt operations or customer service, such as urgent transaction processing;
• December 31, 2034: have migrated all other systems.

Systemically important banks, critical infrastructure operators and NETS, the country's electronic payment network, will also have to submit their plan to the MAS by June 30, 2027. Critical infrastructure operators in the sector will have to migrate those infrastructures before the end of 2029. That is two years ahead of the 2031 deadline set by the CSA for all critical infrastructure, which we detailed in October.

An institution that cannot meet a deadline for technical or operational reasons will have to document the reasons and apply interim safeguards. The MAS reserves the right to revise these dates as the threat and standards evolve.

A checklist useful well beyond Singapore

The text names no post-quantum algorithm. It refers to the CSA's practical guide and instead describes a method that any security officer can adopt:

• a commitment from the board or senior management, with a designated owner, resources and regular follow-up;
• an inventory of cryptographic assets (algorithms, key lengths, protocols, affected systems and dependencies), starting with what is critical, internet-facing or tied to long-retained data;
• a procurement rule: any new system must support post-quantum algorithms or be upgradable within the required timeframe;
• a dialogue with vendors to align their roadmaps with the institution's;
• performance and interoperability testing before deployment, as the new algorithms require larger keys and more computation;
• quantified milestones to measure progress.

For a European bank, these dates broadly match the European roadmap, which targets the end of 2030 for high-risk uses and then 2035 for as many systems as possible, and which Germany has adopted as its own. European institutions operating in Singapore will be directly affected by the circular if it is adopted.

Next step: the final version, after the November 23 closing date. Submissions will be published unless their authors request otherwise. We will then see whether banks consider these dates achievable.