Hong Kong's Banks Scored 2.3 Out of 10 on Quantum Readiness. The Fix Is Boring, and That Is the Point

On 2 November 2026, at Hong Kong FinTech Week, the Hong Kong Monetary Authority and the Hong Kong University of Science and Technology launched a Post-Quantum Cryptography Toolkit for banks. The timing tells you most of the story. In July, the HKMA introduced its Quantum Preparedness Index to measure how ready the banking sector actually is for quantum-safe cryptography. The first score was 2.3 out of 10.

That is not a score you fix with a new algorithm announcement. It is a score you fix with an inventory.

I build a small experimental messenger with post-quantum key exchange, so I read these announcements differently from a bank compliance officer. My codebase is small enough that I can list every place cryptography touches it in an afternoon. A bank cannot. That gap is the whole story of the post-quantum transition, and Hong Kong just put a number on it.

What the 2.3 actually means

The HKMA is careful about what the index measures: awareness, planning, pilot projects, and practical readiness. A score of 2.3 means the sector has started paying attention but has barely started doing the work. Reporting on the survey behind the index put two numbers alongside it that matter more than the headline: around half of surveyed banks had no formal post-quantum plan, and 32 percent had not begun transition work at all.

Read that again slowly. Not "had not finished." Had not begun. In a sector that holds other people's money and keeps records that must stay secret for years, a third of institutions had not started, months after NIST published its post-quantum standards in 2024 and days after NIST finalised its transition report on 27 October 2026, deprecating quantum-vulnerable public-key cryptography after 2030 and disallowing it after 2035.

HKMA chief executive Eddie Yue warned at the launch that quantum computing could arrive within three to 15 years and could break existing cryptography quickly once it does. That range is honest and useless at the same time. Three years means you are already late. Fifteen years means a board can postpone the budget meeting. A toolkit exists to close that gap between "someday" and "this quarter."

What the toolkit actually contains

Strip away the launch language and the toolkit is four jobs, in order.

First, governance and accountability. Someone named owns the transition. Not a committee, not a working group that meets twice a year, a person or team whose job it is to answer for progress. HKMA deputy chief executive Arthur Yuen put it plainly: the index gave the sector a starting point, and the next step is to turn that understanding into clear responsibilities, informed priorities, and practical plans.

Second, assess cryptographic exposure. Take stock of cryptographic assets and dependencies. Where does RSA sit? Where does elliptic-curve cryptography sit? Which systems depend on which libraries, which vendors, which hardware? You cannot migrate what you have not listed, and in a bank the list is the hard part. It runs through core banking systems, payment rails, ATMs, mobile apps, third-party services, and hardware security modules that were bought a decade ago and never touched since.

Third, identify transition needs and set priorities. Not everything moves first. Data that must stay secret for ten years moves before data that expires next week. Key establishment, the ML-KEM side of the standards, moves before signatures in most plans, because the "harvest now, decrypt later" threat hits stored ciphertext first. A risk-based order beats a heroic rewrite.

Fourth, monitor implementation progress. The toolkit includes practical tools for building transition timelines and for strengthening engagement with suppliers, because a bank that migrates its own code but waits on a vendor's black-box appliance has not migrated at all.

The HKMA says the toolkit will keep evolving as standards and implementation experience mature, and it is available through the authority's Fintech Knowledge Hub. What it does not do is also worth noting: the launch announcement did not name specific algorithms for banks to adopt, and it did not set bank-by-bank deadlines. The target is the sector-level one: a QPI score of 10, defined as full quantum readiness, by 2030.

Why this matters outside banking

HKUST Business School dean Frederik Anseel called preparing for the quantum era "a leadership challenge," and said banks can build the knowledge and organisational capability they need even while the timing of the threat remains uncertain. I think that is the most useful sentence in the whole announcement, because it applies far beyond banks.

Most post-quantum writing, including some of mine, focuses on algorithms: ML-KEM versus the classical key exchange it replaces, ML-DSA versus ECDSA, key sizes, performance costs. Those details matter, and I have spent real time on them in my own messenger, where switching a key exchange means touching session setup, stored keys, and the fallback path when the other side runs an older build. But the algorithm is the easy part to describe. The hard part is everything around it: knowing where the old cryptography lives, who is responsible for changing it, what breaks when a key gets four times larger, and which supplier has not answered your email.

A bank with a 2.3 score and a solo builder with a small project have opposite versions of the same problem. The bank has scale and no map. The builder has a map and no scale. The builder can swap an algorithm in a weekend and test it on their own device that evening. The bank needs a toolkit just to find out what it owns. Both of them fail the same way if they skip the inventory and go straight to the shiny new standard.

So here is the practical version of the HKMA toolkit, sized for a project like mine or yours:

1. List every place your code uses public-key cryptography, including the ones inside libraries you did not write. If you cannot list it, you cannot migrate it.
2. Write down who owns each item. If the answer is "someone, eventually," the owner is you, now.
3. Rank by how long the protected data must stay secret, not by how easy the code change looks.
4. Pick one system, migrate it, and keep the old path working until the new one is proven. Crypto-agility, the ability to swap algorithms without redesigning the system, is worth more than picking the perfect algorithm on the first try.
5. Check your suppliers and dependencies the same way. An upstream library that never ships a post-quantum update is your problem, whether or not you wrote it.

None of that is exciting. None of it will get applause at a conference. It is also the entire difference between a sector that scores 2.3 and one that reaches 10 by 2030.

The uncomfortable part

Four years to full readiness, from 2.3, with a third of banks not yet started, is a steep climb. The HKMA target lines up with the NIST timeline, which gives federal high-value systems until the end of 2030 for post-quantum key establishment and the end of 2031 for signatures, and with the HSBC-style corporate pledges to be quantum-ready by 2030 that surfaced around the same FinTech Week sessions. Everyone has picked roughly the same year. That is either reassuring coordination or a shared deadline that a lot of organisations will miss together.

I do not know which one it is, and neither does anyone else, because a toolkit is not a migration. It is a plan for a migration. The next number that matters will not be a launch announcement. It will be the next QPI score, whenever the HKMA publishes it, and whether the share of banks with no formal plan has actually shrunk.

Until then, the lesson from Hong Kong is simple and a little humbling for those of us who like the algorithm part best: the post-quantum transition will be won or lost in inventories, ownership lists, and supplier emails. The cryptography was standardised in 2024. The boring work is still at 2.3 out of 10.

Sources: HKMA press release on Hong Kong FinTech Week 2026 (2 November 2026); HKMA/HKUST PQC Toolkit announcement coverage by Blockchain.News, The Quantum Insider, The Standard, and EconoTimes; NIST IR 8547 final, 27 October 2026.