Hong Kong Banks Score Low on Quantum Preparedness: 2.3 out of 10
The Hong Kong Monetary Authority (HKMA) recently published a whitepaper revealing that Hong Kong banks have a “dismal” Quantum Preparedness Index score of 2.3 out of 10. This score reflects a minimal readiness posture toward the existential threats posed by quantum computing to conventional cryptographic defenses. Such a low score signals that, despite growing quantum risks, the banking sector in Hong Kong remains at an early stage of adapting its security infrastructure, risk frameworks, and cryptographic toolkits towards quantum resilience.
This index was unveiled at the eighth FiNETech conference and is informed by a survey conducted earlier this year, assessing banks’ awareness, strategy formation, and implementation concerning quantum risk. The whitepaper’s findings highlight a significant gap between awareness and action, with only about one-third of banks actively exploring or testing quantum-related technologies, and roughly half still lacking formalized plans to transition to post-quantum cryptography (PQC).
With the HKMA setting an ambitious target for full readiness by 2030, this report underscores the urgency for enhanced strategic initiatives, collaborative development, and regulatory alignment to elevate the quantum security posture of every financial institution operating within Hong Kong.
Quantum Awareness vs. Action: Over Two-Thirds Aware But Limited Follow-Through
According to the HKMA survey, about 68% of banks demonstrated at least some awareness of quantum computing’s risks or had progressed to planning or pilot stages of quantum security adaptation. Further, about half of these banks had managed to elevate quantum risk discussions to their boards, signaling recognition at senior governance levels.
However, translating awareness into concrete action remains a bottleneck:
| Bank Quantum Risk Engagement Stage | Approximate Proportion of Banks |
|---|---|
| Awareness or planning/piloting quantum initiatives | 68% |
| Formal board-level discussions on quantum topics | 50% |
| Banks piloting or testing quantum-related solutions | 33% |
| Banks with formalized transition plans for PQC | ~50% (roughly half still pending) |
This disconnect between awareness and action is emblematic of the wider industry challenge where many institutions acknowledge the quantum threat but hesitate to commit resources toward comprehensive mitigation efforts. The hesitancy may stem from multiple factors, including complexity and uncertainty over PQC standards, budget constraints, or prioritizing more immediate operational risks.
Notably, banks with no formal PQC roadmap remain exposed to adversaries capable of quantum computations, risking future decryption of currently secure communications and stored data. The partial progress in board engagement is positive, but the need to embed quantum risk within strategic risk management frameworks more thoroughly is apparent.
HKMA’s Strategic Initiatives: Toolkit Development and Capacity Building
The HKMA’s whitepaper does more than diagnose the present lag — it charts a path forward involving practical support and systemic capacity building:
-
Development of a Post-Quantum Cryptography Toolkit: In collaboration with the Hong Kong University of Science and Technology’s business school, the HKMA is crafting a PQC toolkit designed to facilitate banks’ adoption of quantum-resistant algorithms. This initiative aims to bridge knowledge gaps and provide pragmatic tools aligned with evolving global standards.
-
Educational Workshops and Skill Development: A series of workshops are planned to help financial institutions build skills, enhance crypto agility, and responsibly explore opportunities emerging from quantum technologies. These sessions target decision-makers, technologists, and compliance officers alike, ensuring a holistic uplift in quantum literacy.
These steps fit within the HKMA’s broader vision of reaching a perfect 10 on the Quantum Preparedness Index by 2030, a timeline that corresponds with the U.S. federal government’s target for migrating to post-quantum cryptography by 2030-31. The HKMA’s proactive approach reflects an understanding that quantum readiness is not solely a technical issue but also a governance and organizational challenge.
Comparison: Quantum Preparedness Index Scores and Initiatives
| Aspect | Hong Kong Banks (HKMA Survey) | U.S. Federal Government |
|---|---|---|
| Quantum Preparedness Score | 2.3 out of 10 | Not quantified; government-led |
| Awareness or Planning Stage | ~68% of banks | Comprehensive agency mandates |
| Board-Level Quantum Discussions | ~50% of banks | High-level government directives |
| Pilot/Testing Quantum Tech | ~33% of banks | Active research and pilot programs |
| Formalized PQC Transition Plans | About 50% pending | Directed migration by 2030-31 |
| Support Initiatives | PQC toolkit, skill-building workshops | NIST PQC standardization, pilot programs |
| Target Year for Full PQC Migration | 2030 | 2030-31 |
This comparison highlights that while regulatory impetus exists internationally, the Hong Kong banking sector’s relatively low quantum preparedness contrasts with the more coordinated federal approach in the U.S. The HKMA’s initiatives reflect a crucial step toward international alignment, though banks in Hong Kong will need accelerated effort to catch up.
Soken Security Insight: Quantum Preparedness Requires Multi-Dimensional Governance
In our experience auditing highly regulated financial and Web3 protocols at Soken, quantum readiness extends beyond algorithmic upgrades. It requires integrated governance that aligns board-level risk appetite with technology roadmaps and regulatory mandates. Without formalized transition plans and active pilot programs, institutions risk technical debt and systemic vulnerabilities that become strikingly acute once quantum adversaries materialize.
The current Hong Kong snapshot underscores a common industry phenomenon: awareness is often a preliminary stage, but actionable preparedness demands focused leadership, resource allocation, and ongoing skills development. A cryptographic toolkit paired with robust upskilling and scenario-based exercises can substantially accelerate real-world mitigation versus awareness alone.
mica-and-eu-crypto-regulation-context">Quantum Risk and Regulatory Alignment: MiCA and EU Crypto Regulation Context
Quantum computing’s threat to traditional cryptography has global implications, especially as jurisdictions like the European Union implement frameworks such as the Markets in Crypto-Assets Regulation (MiCA). Effective compliance with MiCA and analogous regimes increasingly demands proactive quantum risk management:
-
MiCA’s Regulatory Focus: MiCA emphasizes rigorous standards for cryptographic security and operational resilience for crypto asset service providers, aiming to ensure consumer protection and systemic integrity. While it does not yet mandate PQC migration explicitly, evolving best practices and supervisory expectations will likely incorporate quantum risk hedging as post-quantum algorithms gain standardization.
-
PQC Migration as Strategic Compliance: The HKMA’s target to mature quantum preparedness aligns with the spirit of future-proof regulatory design emphasized by MiCA and EU crypto frameworks. As MiCA and other laws develop, entities lacking clear quantum risk plans may face compliance friction, heightened supervisory scrutiny, and legal uncertainty.
-
Interjurisdictional Coordination Importance: Banks and crypto service providers operating across Hong Kong, the EU, and the U.S. will need coherent quantum resilience strategies that satisfy multiple regulatory regimes simultaneously, which elevates the importance of toolkits and cross-border knowledge sharing like that spearheaded by the HKMA.
Roadmap for Hong Kong Banks: Steps to Quantum Readiness
Given the HKMA survey outcomes, banks can advance quantum readiness by addressing critical gaps through prioritized steps:
-
Formalize Post-Quantum Cryptography Plans
Develop clear, board-approved strategies defining timelines, budgets, and technology partnerships for PQC migration. -
Initiate Pilot and Testing Programs
Expand pilot projects to experimentally validate quantum-resistant cryptographic protocols and hardware compatibility. -
Embed Quantum Risk in Enterprise Risk Management
Integrate quantum threat modeling and mitigation controls into operational risk frameworks and incident response plans. -
Leverage HKMA Toolkit and Training
Utilize the forthcoming PQC tools and engage in specialized workshops offered by the HKMA to build internal skills and crypto agility. -
Coordinate with Regulatory and Industry Peers
Align efforts with MiCA compliance teams and international peers to harmonize quantum risk mitigation roadmaps and share best practices.
| Step Number | Action Item | Key Deliverable | Impact |
|---|---|---|---|
| 1 | Strategy formalization | Board-approved PQC roadmap | Leadership alignment, funding |
| 2 | Pilot projects and testing | Documented pilot results and risk reports | Technical validation, learning |
| 3 | Enterprise-level risk integration | Quantum risk section in risk registers | Operational preparedness |
| 4 | Adoption of HKMA toolkit and training | Skills certification, agile crypto teams | Enhanced institutional capacity |
| 5 | Regulatory and industry coordination | Joint frameworks and shared standards | Compliance efficiency and synergy |
This phased approach enables practical progress that bridges strategic intent with actionable steps, sealing the present gap between awareness and readiness.
Navigating the emerging quantum threat demands a coordinated, well-resourced approach that spans technology, governance, and regulatory compliance. The HKMA’s low Quantum Preparedness Index score starkly illustrates the nascent stage of Hong Kong banks’ quantum journey but also sets a measurable benchmark catalyzing accelerated action.
A natural next step for financial institutions is to leverage the HKMA’s PQC toolkit and related capacity-building offerings to operationalize quantum readiness efforts. Aligning quantum risk management with evolving crypto regulations such as MiCA will also future-proof compliance and enable sustained resilience in the fast-evolving Web3 ecosystem. Institutions that embed quantum agility early can confidently secure their cryptographic infrastructure against the formidable computing paradigms on the horizon.
For organizations navigating this complex landscape, integrating quantum readiness into broader IT security and compliance strategies is paramount—a challenge that sophisticated audit and advisory engagements can help address with tailored technical and governance insights.