The Hong Kong Monetary Authority and the Hong Kong University of Science and Technology (HKUST) launched the Post-Quantum Cryptography (PQC) Toolkit during the Hong Kong Fintech Week 2026, with support from the industry.

The HKMA PQC Toolkit lays out a structured, comprehensive framework to guide banks in planning and advancing their respective transition journeys.

It sets out a framework to help banks establish governance and accountability, assess their cryptographic exposure, identify transition needs, and monitor implementation progress. It also includes key planning considerations for banks to enable an orderly and risk-based transition, the HKMA shared.

The HKMA PQC Toolkit arrives three months after the regulator’s first Quantum Preparedness Index (QPI) scored the banking sector 2.3 out of 10, against a goal of full readiness by 2030.

The score indicated that although the sector had started addressing quantum-related developments, overall readiness to transition towards post-quantum computing remained at a nascent stage.

Prof. Frederik Anseel, Dean of the School of Business and Management at HKUST (HKUST Business School), shared that progress can be made,

“Preparing for the quantum era is a leadership challenge. Banks can build the knowledge and organisational capability they need, even while the timing of the threat remains uncertain. Our collaboration with the HKMA and industry translates academic research and practical experience into guidance that banks can use.”

Arthur Yuen, Deputy Chief Executive of the HKMA, added,

“Through our collaboration with HKUST and the industry, the Toolkit provides a common foundation that banks can adapt to their own circumstances. Our aim is to make it easier for banks to begin the work and sustain progress throughout the transition.”

A practitioner guide to the PQC Accountability and Controlled Transition (PACT) framework, co-authored by HKUST academics and an HKMA senior manager, Terrance Fung, explains that the HKMA is aiming for full sectoral readiness (which is a score of 10 on the Quantum Preparedness Index) by 2030.

The guide indicates that this is a preparedness objective, and adds that “individual protection needs and delivery constraints can require earlier action”.

Early Preparation is Essential for PQC Migration

The whitepaper Quantum Preparedness of Hong Kong’s Banking Sector by the HKMA and supported by KPMG and Quinlan & Associates warned that the emergence of Relevant Quantum Computers (CRQC) poses a potentially significant cyber risk to traditional cryptography safeguards.

Meanwhile, the practitioner guide shared that early preparation is necessary.

This is because the migration to PQC is expected to be a multi-year effort, one that involves addressing the operational complexity of migrating interconnected systems and mitigating “Harvest Now, Decrypt Later” (HNDL) risk to confidential data that is long-lived.

The guide illustrates the point with a hypothetical bank whose corporate payment instructions must stay confidential for seven years.

If the bank assumes, for planning purposes, that vulnerable encryption could be broken from 1 January 2035, it must stop new vulnerable transmissions by 1 January 2028.

With nine months of migration work and two months of contingency, that work must start by 1 February 2027, per the illustrative timing shown above.

Four Mutually Supporting Pillars for Quantum Preparedness

The PACT Practitioner Guide organises the transition into four pillars, each linked to a QPI dimension.

The pillars span 23 workstreams across four pillars: Govern the Transition, Assess and Plan, Implement and Retire, and Maintain and Adapt.

Govern and Transition

Gives the foundation for Awareness, which includes establishing accountable ownership, mandate and scope and ensuring that there are common requirements and relevant skills to “help people understand the implications of quantum change.”

Assess and Plan

This pillar expands from the previous pillar to enable steps like establishing a cryptographic baseline and a migration approach, thereby laying the groundwork for initial pilots.

Implement and Retire

The third pillar supports pilots via controlled trials and aims to ensure controlled deployment and change preparation too, among other initiatives.

Maintain and Adapt

This final pillar aims to sustain practical preparedness by keeping knowledge and controls current, and showcasing cryptographic agility.

The HKMA shared that the PQC Toolkit will be updated over time via the co-development approach to reflect evolving technological developments, international standards, as well as industry implementation experience.

Featured image edited by Fintech News Hong Kong based on an image by muhagraph on Magnific