What to Know

  • The Hong Kong Monetary Authority gave the city’s banking sector a Quantum Preparedness Index score of 2.3 out of 10.
  • The index was published alongside a whitepaper on the banking industry’s readiness for the quantum era.
  • The findings were unveiled at the eighth FiNETech conference and were based on a survey conducted earlier this year.
  • Most banks remain in the awareness phase, with many still lacking formal plans for post-quantum cryptography.
  • About 68% of surveyed banks showed at least some awareness or had moved into planning or pilot stages, while the rest had not started.
  • Roughly half of surveyed banks have yet to formalize a plan for migrating to post-quantum cryptography.
  • Board-level discussions had occurred at about half of the banks, but only one-third had begun exploring or testing quantum-related initiatives.
  • The HKMA wants the banking sector to reach 10 out of 10 on the Quantum Preparedness Index by 2030.
  • The regulator is preparing toolkits, workshops and skills training to support banks as quantum-related security risks become more pressing.
  • Quantum computing could eventually threaten the cryptography used across modern finance, including banking systems and blockchains such as Bitcoin and Ethereum.

HKMA Puts a Hard Number on Quantum Preparedness

Hong Kong’s banking sector has received a stark warning from its central bank: quantum readiness remains at an early stage, and the gap between awareness and execution is still wide. The Hong Kong Monetary Authority has assigned the industry a Quantum Preparedness Index score of just 2.3 out of 10, underscoring how far lenders still need to go before they can be considered prepared for the security and operational challenges of the quantum era.

The index was released with a whitepaper on the quantum preparedness of Hong Kong’s banking industry. It marks the first time the HKMA has attached a formal score to the sector’s readiness, giving banks, regulators and technology teams a clearer benchmark for where the industry stands. The result is low, but it also gives the regulator a baseline from which to measure progress as financial institutions begin moving from discussion to implementation.

The HKMA’s assessment points to a sector that is largely still learning what quantum computing could mean for financial infrastructure. While awareness is beginning to build, preparation has not yet translated into broad-based planning, testing or deployment. For an industry that depends on encryption, secure messaging, digital identity, payments and data protection, that slow start is significant.

Most Banks Are Still in the Awareness Phase

The whitepaper shows that many banks are not yet beyond the earliest stage of quantum preparation. The Quantum Preparedness Index tracks four broad stages: awareness, planning, pilot programs and practical preparedness. Hong Kong banks, taken as a group, are still concentrated near the beginning of that path.

About 68% of surveyed banks showed at least some awareness of quantum-related risks or had progressed into planning or pilot stages. That figure indicates that the issue is no longer invisible across the industry. However, it also means that a notable portion of the sector had not started at all. Even among banks that are aware of the issue, awareness is not the same as resilience.

Roughly half of the banks surveyed have yet to formalize a plan for moving to post-quantum cryptography. That is a critical gap because post-quantum cryptography is expected to be one of the main tools used to defend systems against future quantum-enabled attacks. Without a formal migration plan, banks may struggle to inventory vulnerable systems, prioritize critical infrastructure, coordinate vendors and sequence upgrades across complex technology stacks.

Governance is also uneven. Board-level discussions had taken place at about half of the banks, suggesting that quantum risk is beginning to reach senior decision-makers. Yet only one-third had begun exploring or testing anything quantum-related. That divide matters because cyber resilience is not simply a technology question. It requires budget, governance, risk ownership, vendor management and a clear view of how long migration could take.

Why Quantum Risk Matters for Banks

Quantum computing is not just another emerging technology theme for banks. It has direct implications for the cryptographic systems that protect financial data, transactions and communications. Modern finance relies on encryption to secure everything from customer records to interbank transfers. If future quantum machines become capable of undermining widely used cryptographic methods, financial institutions could face a major security challenge.

The immediate concern is often described as “harvest now, decrypt later.” Under that scenario, malicious actors collect encrypted data today and store it until more powerful quantum hardware becomes available. Even if the information is unreadable now, it could become vulnerable later if the encryption protecting it can be broken. The Bank for International Settlements’ Project Leap has flagged this type of threat as an immediate issue for the financial system.

For banks, that means quantum preparedness cannot wait until large-scale quantum machines are already available. Sensitive financial records, identity data and transaction information can remain valuable for years. If attackers are already stockpiling encrypted information, the window for defensive action begins before the technology is fully mature. That is why regulators are pushing institutions to focus on crypto agility, which refers to the ability to replace or upgrade cryptographic systems efficiently when standards change.

The same broad issue extends beyond traditional banking. Blockchains such as Bitcoin and Ethereum also depend on cryptographic assumptions. Practical, large-scale quantum machines capable of breaking bank security or blockchains such as Bitcoin do not exist today. Still, estimates for when the risk could become real start as early as 2029, making the coming years important for both financial institutions and digital asset infrastructure.

HKMA Targets Full Readiness by 2030

The HKMA is aiming to lift the banking industry’s Quantum Preparedness Index score to 10 out of 10 by 2030. That target signals that the regulator does not view quantum readiness as a distant research topic. Instead, it is being framed as a concrete supervisory and operational priority that banks need to incorporate into their technology and cyber resilience roadmaps.

To help close the gap, the HKMA is rolling out practical support. One element is a post-quantum cryptography toolkit being developed with the business school of the Hong Kong University of Science and Technology. The regulator is also planning workshops designed to help banks build skills, improve crypto agility and explore quantum opportunities responsibly.

The toolkit and training approach suggest that the HKMA is trying to standardize the industry’s starting point. Banks often differ widely in technology architecture, vendor reliance, internal expertise and risk appetite. A shared framework can help institutions identify what needs to be assessed first, how to classify exposure and how to develop migration plans without treating quantum preparedness as an abstract concept.

For banks, the path from a low readiness score to full preparedness will likely require more than cybersecurity teams alone. Institutions may need to map cryptographic dependencies across payments, customer platforms, internal networks, data archives, vendor systems and third-party connections. They may also need to build governance models that connect technology specialists with legal, compliance, operational risk and board-level oversight.

Global Regulators Are Moving on Similar Timelines

Hong Kong’s push is taking place as other major jurisdictions move along parallel tracks. In the United States, President Donald Trump recently signed two executive orders related to quantum technology and post-quantum security. One aims to accelerate U.S. quantum computing development, with the goal of producing a machine powerful enough for scientific research by 2028. The other calls for the federal government’s migration to post-quantum cryptography by 2030-31.

Those timelines are important because finance is globally interconnected. Banks operate across borders, depend on international payment rails and rely on global technology vendors. If regulators in major financial centers move toward post-quantum cryptography, banks may face growing pressure to align their systems, procurement standards and security controls with emerging international expectations.

For Hong Kong, a global financial hub with deep banking and capital markets activity, the HKMA’s early scoring exercise may help prevent complacency. A 2.3 out of 10 score is not a sign of readiness, but it does provide a measurable starting point. By identifying the gap now, the regulator is pushing banks to begin the long process of building operational resilience before the threat becomes practical at scale.

Market participants and technology risk specialists are likely to watch whether banks move beyond awareness into formal execution. The key question is not whether institutions understand the term quantum computing, but whether they can show concrete progress in planning, pilot programs and practical preparedness. For now, the HKMA’s message is clear: the industry has begun to recognize the risk, but recognition is only the first step.

Frequently Asked Questions (FAQs)

What score did Hong Kong banks receive for quantum preparedness?

The Hong Kong Monetary Authority gave the banking sector a Quantum Preparedness Index score of 2.3 out of 10, indicating that the industry remains at an early stage of readiness.

What is the Quantum Preparedness Index?

The Quantum Preparedness Index is the HKMA’s benchmark for assessing how prepared Hong Kong’s banking industry is for the risks and opportunities associated with quantum computing.

What stages does the index track?

The index tracks four stages: awareness, planning, pilot programs and practical preparedness. Hong Kong banks are currently concentrated near the awareness stage.

How many banks have started preparing for quantum risks?

About 68% of surveyed banks showed at least some awareness or had moved into planning or pilot stages, while the remaining banks had not started.

Why is post-quantum cryptography important?

Post-quantum cryptography is designed to protect systems against future quantum-enabled attacks that could threaten current encryption methods used in banking and digital finance.

What is a harvest now, decrypt later attack?

It refers to a scenario in which attackers collect encrypted data now and wait until future quantum hardware can potentially decrypt it later.

Are quantum computers already breaking bank security?

Practical, large-scale quantum machines capable of breaking bank security and blockchains such as Bitcoin do not exist today, but estimates for when the risk could become real start as early as 2029.

What is the HKMA’s target for 2030?

The HKMA aims for Hong Kong’s banking sector to reach a Quantum Preparedness Index score of 10 out of 10 by 2030.

How is the HKMA helping banks prepare?

The regulator is developing a post-quantum cryptography toolkit with the Hong Kong University of Science and Technology’s business school and is planning workshops to build skills and improve crypto agility.

Photo by wutthichai charoenburi on Pexels