The Hong Kong Monetary Authority (HKMA) scored the city’s banking sector at 2.3 out of 10 in the first results of its Quantum Preparedness Index (QPI), published on July 27, 2026, with a whitepaper on banks’ preparations for quantum computing. The HKMA said it aims for a score of 10, which it called “full sectoral readiness,” by 2030.
The HKMA invited all authorized institutions (AIs) operating in Hong Kong, the banks and deposit-taking companies it authorizes, to take part in the survey behind the index in early 2026. It did not publish how many responded and wrote that its percentages are shares of the survey’s respondents, not of the whole banking sector. The HKMA credited the analysis in the whitepaper’s charts to KPMG.
Seventy-one percent of respondents had neither conducted nor planned any proof of concept or live testing of post-quantum cryptography (PQC), the algorithms built to withstand attack by a future quantum computer.
How the banks scored
The HKMA scored readiness on four dimensions, with sector averages of 2.4 for awareness, 2.5 for planning, 1.8 for pilots, and 2.3 for practical preparedness. Retail banks averaged 2.6 on overall readiness and non-retail banks 2.2, the HKMA wrote.
In the whitepaper’s survey results, 45% of respondents reported having no formal cryptographic bill of materials (CBOM), a machine-readable record of the cryptography used in a system, which organizations combine into a wider inventory. Sixty-six percent had not yet assessed their exposure to quantum risk. Around 64% said their institutions had yet to train their broader workforce on quantum threats and PQC.
Around half of the respondents had discussed quantum computing at board level, the HKMA said. Of the 29% of respondents that had conducted or planned tests, around 39% described completed proofs of concept. The HKMA set out five examples of completed proofs of concept, covering post-quantum protection for websites and signatures, cloud key management, a content delivery network, distributed-ledger connections, and cryptographic inventory tooling.
Vendors and other barriers
Respondents ranked their top three barriers in each area of the work. In vendor and industry engagement, they cited dependencies on critical third parties most often, at 87%, followed by vendor readiness and roadmaps at 85%.
For cryptographic inventories, 79% of respondents cited technical complexity, ahead of the scale and volume of applications and systems at 71%, according to the whitepaper. In risk assessment, the barrier respondents cited most often, at 73%, was “the lack of established models, tools, or industry-standard frameworks.”
Recommended first steps
The HKMA listed four steps that banks “can take” now. Banks can engage the board, treating quantum risk as an enterprise risk, and identify an accountable owner for quantum readiness with senior sponsorship.
They can also commission a cryptographic inventory, “accepting that it will be imperfect at first,” and engage critical vendors, asking for their post-quantum roadmaps and writing quantum-readiness requirements into new contracts. The HKMA wrote that these actions “do not require AIs to wait for full maturity in quantum technology or finalised PQC implementation guidance.”
The HKMA also wrote that banks “should, where possible, carry the transition through existing governance, risk and control frameworks.” It named its Cyber Resilience Assessment Framework and two modules of its Supervisory Policy Manual, TM-G-1 on technology risk management and OR-2 on operational resilience.
Support and the 2030 aim
The HKMA said it will co-develop a PQC toolkit with the School of Business and Management at the Hong Kong University of Science and Technology and run a series of workshops for banks. The HKMA intends the toolkit to help banks set transition priorities and improve their crypto-agility, the ability to replace cryptographic algorithms without rebuilding the systems that use them.
Carmen Chu, the HKMA’s executive director for banking supervision, told the FiNETech8 conference on July 27 that a score of 10 is the level the sector should reach “by 2030, to adequately address the evolving quantum-related risks.” The HKMA framed that date as a goal for the sector as a whole.
For banks that already have transition plans, “the implementation timeframe is expected to be 5.6 years on average,” Chu said.
Update, November 12, 2026: On November 2, the HKMA and HKUST launched the PQC toolkit, and the HKMA sent a circular on it to all authorized institutions. The HKMA said it would use the toolkit to drive the sector “towards full quantum readiness, that is, a QPI score of 10 by 2030.”
