Key Takeaways
- Quantum computing is a strategically significant development for financial services. In time, it may bring benefits in portfolio optimisation, risk modelling, derivatives pricing and fraud detection. It also poses a potentially significant risk to the cryptography that protects customer data, payments, authentication and financial market infrastructure (“FMI”). Recognising this, the Hong Kong Monetary Authority (“HKMA”) has made strengthening business, technology and quantum resilience a strategic objective under “Fintech 2030”, and has published this paper to assess the sector’s readiness and set out a practical way forward.
- The case for acting now rests on timing, not certainty. When a Cryptographically Relevant Quantum Computer (“CRQC”) will arrive remains uncertain. Even so, migrating to Post-Quantum Cryptography (“PQC”) is expected to be a multi-year effort, as cryptography is embedded across systems, processes and external interfaces. The “Harvest Now, Decrypt Later” risk is already present for long-lived confidential data. International timelines generally point to completing migration between 2030 and 2035, although these continue to be revised.
- To gauge readiness, the HKMA surveyed Authorized Institutions (“AIs”) and scored PQC readiness across four dimensions on a scale of 0 to 10. The sector scored 2.3 overall, with retail banks (2.6) slightly ahead of non-retail banks (2.2):
- Awareness: Governance, funding and training are not yet firmly established. 39% of AIs have no formal governance for quantum-related risk, and 64% have not trained their workforce
- Planning: 66% of AIs have not assessed their quantum-related exposure, and 45% have no formal cryptographic inventory
- Pilots: 71% of AIs have neither conducted nor planned any PQC testing
- Practical Preparedness: 58% of AIs do not track transition progress, and nearly three quarters do not validate migration, fallback or recovery arrangements
- Quantum computing itself is broadly recognised (68% of AIs report at least basic awareness) but remains a longer-term opportunity. 68% have no quantum-related initiatives, and 61% have no planned budget for them. A small but identifiable cohort of AIs is more advanced, so readiness is uneven.
- The most common barriers lie outside individual AIs’ control. Dependencies on critical third parties (87%) and vendor readiness (85%) rank highest, followed by technical complexity in building inventories (79%) and the lack of risk assessment methodologies (73%).
- This paper sets out a four-stage action plan: Awareness, Planning, Pilot and Practical Preparedness. These stages are not strictly linear and should be applied proportionately to each AI’s size, complexity and risk profile. AIs can begin now, without waiting for finalised standards or full technological maturity, by:
- Engaging the board and treating quantum risk as an enterprise risk
- Identifying an accountable owner with a cross-functional mandate
- Commissioning a cryptographic inventory, accepting it will be imperfect at first
- Engaging critical vendors and requesting post-quantum roadmaps and building quantum-readiness requirements into new contracts
