What Changed
- HKMA and HKUST published the Post-Quantum Cryptography (PQC) Toolkit to help banks assess cryptographic exposure and structure transition timelines.
- The initiative builds on the July 2026 Quantum Preparedness Index (QPI) score of 2.3 out of 10, aiming for complete readiness (score of 10) by 2030.
- The Toolkit incorporates multidisciplinary academic, regulatory, and industry expertise and will be updated continuously to match international standards.
The Hong Kong Monetary Authority (HKMA), in collaboration with the Hong Kong University of Science and Technology (HKUST) and industry participants, has launched the Post-Quantum Cryptography (PQC) Toolkit. The release affects banks and financial institutions operating in Hong Kong SAR, providing them with a structured framework to plan and advance their transition toward quantum-safe cybersecurity.
The Toolkit assists banks in establishing clear governance structures, auditing cryptographic exposure and asset dependencies, identifying transition priorities, engaging with technology suppliers, and monitoring implementation progress over time. It builds directly upon the HKMA’s Quantum Preparedness Index (QPI), introduced in July 2026. The initial sector-wide QPI assessment yielded a score of 2.3 out of 10, indicating that while banks had started addressing quantum developments, overall sector readiness remained at an early stage. The joint Toolkit seeks to translate this baseline awareness into practical action, driving the Hong Kong banking sector toward a target QPI score of 10 by 2030.
Deputy Chief Executive of the HKMA, Arthur Yuen, stated that the Toolkit provides a common foundation that institutions can adapt to their specific operational circumstances. Professor Frederik Anseel, Dean of the School of Business and Management at HKUST, emphasized that preparing for quantum threats represents an organizational leadership challenge that requires building capability even while threat timelines remain uncertain. The initiative draws on HKUST's multidisciplinary expertise across cybersecurity, cryptography, finance, economics, corporate governance, and technology applications.
According to the announcement, the Toolkit will be updated periodically to reflect evolving technological developments, international standards, and practical implementation experience. The document is accessible through the Fintech Knowledge Hub section of the HKMA website.
Who May Be Affected
Banks and financial institutions in Hong Kong SAR, their cybersecurity and risk teams, and technology suppliers.
Cross-Border Context
Relevant to international banks and cross-border financial entities operating within Hong Kong SAR's regulatory framework.
What to check next
- Review the Toolkit Circular at brdr.hkma.gov.hk/eng/doc-ldg/docId/20261102-3-EN
- Access the HKMA Fintech Knowledge Hub section for the Toolkit materials
- Check the July 2026 HKMA Quantum Preparedness Whitepaper and Index at www.hkma.gov.hk/eng/news-and-media/press-releases/2026/07/20260727-3/
This article provides general information and does not constitute legal advice. Consult the official text and obtain advice appropriate to your circumstances where needed.