Management Summary
- Purpose / Background: The HKMA has assessed the banking sector's readiness for the "Quantum Era." While quantum computing offers significant potential for financial modeling and optimization, its ability to break current cryptographic standards—specifically through Cryptographically Relevant Quantum Computers (CRQC)—poses an urgent risk to secure communications, customer data, and payment systems.
- One-line conclusion: AIs must transition from awareness to actionable Post-Quantum Cryptography (PQC) readiness by establishing formal governance, cryptographic inventories, and vendor management strategies immediately.
- Key Changes:
- Shift from viewing quantum computing purely as a research topic to a critical enterprise risk.
- Requirement to perform comprehensive cryptographic inventories to identify vulnerabilities.
- Mandatory integration of "quantum readiness" into third-party/vendor risk management and new contracts.
- Adoption of a phased "Awareness, Planning, Pilot, Practical Preparedness" framework.
- Proactive engagement with FMIs and regulators to ensure ecosystem-wide interoperability.
- Key Dates / Deadlines: No specific calendar deadline provided; however, the HKMA emphasizes "immediate attention" and a "multi-year" transition requirement, urging AIs to start foundational work now.
- Applicability / Impact scope: All Authorized Institutions (AIs) operating in Hong Kong, including their third-party dependencies, payment networks, and financial market infrastructure (FMI).
- Recommended management actions:
- Appoint an executive owner with cross-functional authority for quantum readiness.
- Include quantum risk as a permanent agenda item in board/senior risk governance meetings.
- Commission an initial (iterative) cryptographic inventory to map current encryption usage.
- Embed PQC roadmap requirements into all new and renewed third-party vendor contracts.
- Participate in upcoming HKMA-led workshops, PQC toolkits, and industry forums to align on standards.
Detailed Summary
- Document overview: This paper outlines the findings of the HKMA’s Quantum Preparedness Survey 2026. It assesses the sector’s current maturity in quantum computing and PQC and provides a strategic roadmap for AIs to mitigate risks while preparing for future technological advantages.
- Main requirements:
- Governance: Establish senior management oversight. Quantum risk must be treated as an enterprise-level risk.
- Inventory: Develop a "cryptographic inventory." AIs must identify where and how encryption is used across systems and data.
- Third-Party Risk: Engage vendors to obtain their PQC roadmaps and ensure new contracts include quantum-readiness clauses.
- Operational Alignment: Embed PQC transition into existing Business-as-Usual (BAU) processes (e.g., cyber risk management, operational resilience).
- Key changes:
- Recognition of the "Harvest Now, Decrypt Later" (HNDL) risk, where sensitive data stolen today could be decrypted by future quantum computers.
- Shift from passive observation to active "cryptographic agility"—the ability to easily update or swap cryptographic algorithms as standards evolve.
- Important dates & transition:
- The transition is a multi-year effort. Immediate actions (governance, inventory, vendor engagement) are required now, well in advance of widespread CRQC availability, to manage the transition timeline and technical debt.
- Impact and risks:
- Cybersecurity: Potential compromise of existing public-key infrastructure (PKI) and digital signatures.
- Operational: Complexity of replacing legacy systems that rely on hard-coded or outdated cryptographic standards.
- Strategic: Need for talent development and internal expertise in PQC.
- Compliance action checklist:
- [ ] Assign a senior executive owner.
- [ ] Add quantum risk to the Risk Governance framework.
- [ ] Initiate the cryptographic discovery/inventory phase.
- [ ] Review procurement templates to mandate vendor PQC roadmaps.
- [ ] Participate in HKMA industry sharing sessions.
- Appendices/attachments summary:
- Appendix 05 (Technical/Financial Use Cases): Provides deep-dive technical explanations of quantum mechanics (superposition and entanglement) and a categorization of financial use cases (Optimization, Simulation, Machine Learning). It also lists major quantum algorithms (e.g., Shor’s, QAOA) and provides technical detail on why current asymmetric encryption is vulnerable. (Covers ~15% of the document content).