The Monetary Authority of Singapore (MAS) will issue supervisory expectations later this year that set milestones and timelines for financial institutions (FIs) in their migration toward quantum resilience, Managing Director Chia Der Jiun said on July 28, 2026. MAS aims for FIs “to achieve quantum resilience before the end of this decade,” Chia said at the media conference for MAS’s 2025/2026 annual report.
MAS has not published the expectations, either as a draft for consultation or in final form. Quantum-resilient cryptography uses algorithms designed to withstand attack by a future quantum computer.
For now, MAS has given financial institutions an end-of-decade aim and three areas of work, with the dates for each milestone still to come.
The three areas
MAS will set “progressive timelines” for institutions to establish “an inventory of their cryptographic assets,” to develop “a prioritisation of the migration of vulnerable assets to quantum-resilient solutions,” and to “build technical capabilities and governance frameworks to support a quantum-safe migration,” Chia said. Cryptographic assets are the keys, algorithms, and certificates that systems use to protect data and prove identity.
Quantum computing “poses significant risks to the security of data and communications used by financial institutions in the medium term and requires early preparation,” Chia said. He said “some experts have given a 5-10 year estimated timeframe for when quantum-computing could break existing encryption techniques” and cited other views that it could be less than five years.
The 2024 advisory
The expectations will follow an advisory that MAS sent to the chief executives of all financial institutions on February 20, 2024. In the circular, numbered MAS/TCRS/2024/01, MAS set out measures that institutions “should consider” as they prepare for the quantum transition.
Those measures included keeping an inventory of cryptographic solutions, identifying critical assets to prioritize for migration, and assessing whether systems can support crypto-agility, the ability to switch algorithms without rebuilding the systems that use them. MAS also advised institutions to ask IT vendors for quantum-resistant solutions once they become commercially available.
The advisory “should be read as supplementary information to the MAS notices and guidelines,” MAS wrote in the circular. For the coming document, Chia said MAS would set out “clear expectations, milestones and timelines” for the migration. He did not say what legal force those expectations would have.
In the same remarks, Chia said MAS had introduced a requirement on July 1 for key financial institutions to conduct AI-assisted red teaming of critical internet-facing systems. Red teaming is a simulated attack, in this case using advanced AI models to find ways into a system.
Trials and next steps
Chia said MAS had also done “technical work with the industry and international counterparts” on quantum-resilient cryptography. In August 2024, MAS signed a memorandum of understanding with DBS, HSBC, OCBC, UOB, SPTel, and SpeQtral for a sandbox to test quantum key distribution (QKD) on financial-sector use cases. QKD is a method of sharing encryption keys through the quantum states of light.
MAS and the Banque de France reported in November 2024 that they had exchanged signed and encrypted emails using CRYSTALS-Dilithium and CRYSTALS-Kyber, the schemes behind NIST’s ML-DSA and ML-KEM standards, combined with current algorithms. The two central banks ran the experiment across continents over ordinary internet connections.
A day before Chia spoke, the Hong Kong Monetary Authority said it aims for full readiness across Hong Kong’s banking sector by 2030. In Singapore, the next step is the expectations document, due “later this year,” Chia said.
Update, November 12, 2026: On November 6, MAS published a consultation paper proposing that all financial institutions set a migration plan by December 31, 2027, migrate critical systems by December 31, 2030, and migrate remaining systems by December 31, 2034, with earlier dates for operators of critical information infrastructure and systemically important banks. MAS called the timelines indicative and wrote that the guidance “is not intended to impose legally binding obligations on FIs.” Comments are due November 23.
