HKMA and HKUST Launch PQC Toolkit to Accelerate Banking Sector Transition by 2030

Introduction

The Hong Kong Monetary Authority (HKMA), together with the Hong Kong University of Science and Technology (HKUST), unveiled a Post‑Quantum Cryptography (PQC) Toolkit at the recent FiNETech 8 forum. The toolkit provides a concrete operational and supervisory framework for licensed banks to replace vulnerable classical public‑key encryption with quantum‑safe alternatives. It is a direct response to the HKMA’s July 2026 baseline audit, which found the sector’s average Quantum Preparedness Index (QPI) at only 2.3 out of 10. The goal is to lift every regulated institution to a QPI of 10.0 by 2030.

Core Components of the PQC Toolkit

1. Cryptographic Inventory and Bill of Materials

Banks must first catalogue all cryptographic assets, legacy public keys, and third‑party dependencies across core banking platforms, SWIFT gateways, and hardware security modules (HSMs). The toolkit mandates the creation of a comprehensive Cryptographic Bill of Materials (CBOM) that serves as a baseline for migration planning.

2. Risk Prioritization and Data Classification

The framework introduces a risk‑based ranking system that classifies financial data by confidentiality shelf‑life and exposure windows. This helps institutions focus on high‑value assets that are most vulnerable to the “harvest‑now‑decrypt‑later” threat posed by future quantum computers.

3. Supply‑Chain Engagement

Given the reliance on third‑party software, the toolkit provides standardized evaluation criteria and procurement questionnaires for core ledger providers, HSM vendors, and cloud services. Banks are required to audit supplier roadmaps and embed realistic migration schedules into contractual agreements.

4. Governance and Oversight

Executive and board accountability are codified through clear governance structures. Progress must be tracked audibly, and quantum‑safe transition audits will be incorporated into the HKMA’s ongoing supervisory reviews.

Implementation Pathway to 2030

The toolkit outlines a phased trajectory:

1. 2026‑2027: Complete CBOMs, initiate risk‑based prioritization, and engage key vendors.
2. 2028‑2029: Pilot PQC algorithms in non‑critical environments, validate performance, and begin phased rollout in transaction engines and HSMs.
3. 2030: Achieve full sector‑wide compliance, reflected in a QPI of 10.0, with continuous monitoring and updates aligned with evolving international standards such as NIST’s post‑quantum parameters.

Ongoing Collaboration and Updates

The HKMA and HKUST will jointly maintain the toolkit, ensuring it reflects the latest cryptographic standards and supervisory best practices. Regular updates will be issued as NIST finalizes new PQC parameters and as the global banking community shares migration experiences.

Practical Takeaways for Banks

• Start inventory now: Even a partial CBOM can reveal hidden public‑key dependencies.
• Prioritize high‑value data: Focus on assets with long‑term confidentiality requirements.
• Engage vendors early: Secure commitments on PQC roadmaps to avoid downstream bottlenecks.
• Embed governance: Assign clear ownership at the board level to drive accountability.

By adopting the PQC Toolkit, Hong Kong’s banking sector can transition methodically toward quantum resilience, safeguarding financial data and maintaining trust in a post‑quantum world.