Hong Kong's central bank just scored its own banking sector 2.3 out of 10 on quantum readiness, and gave it four years to fix that

[Caitlin_69]

The Hong Kong Monetary Authority published its first Quantum Preparedness Index on July 27, a new benchmark measuring how ready the city's banking sector actually is for the eventual arrival of quantum computers capable of breaking today's encryption. The sector wide score came in at 2.3 out of 10, based on a survey of authorized institutions conducted earlier this year and produced with KPMG and Quinlan & Associates, assessing banks across four categories, awareness, planning, pilots and practical preparedness. Every single dimension scored low, awareness came in at 2.4, planning at 2.5, practical preparedness at 2.3, and pilots lowest of all at just 1.8

Roughly 68% of surveyed banks showed at least some awareness of quantum related risk or had begun planning, while the remaining 32% had not started any meaningful preparation at all, and about half of institutions surveyed still lack any formal post-quantum cryptography migration plan. The HKMA's own white paper explains the underlying threat plainly, quantum computers capable of running Shor's algorithm at scale could eventually break the RSA and elliptic curve cryptography currently protecting digital payments, tokenized deposits and blockchain based settlement, letting attackers decrypt protected data or forge the digital signatures used to authorize transactions and verify identities

The more immediate concern, as with most quantum security discussions, is harvest now, decrypt later, where encrypted financial data gets intercepted and stockpiled today with no ability to read it yet, simply waiting for capable enough quantum hardware to arrive later. The Bank for International Settlements already treats this as a live data protection issue through its Project Leap initiative, having completed two phases testing hybrid post-quantum encryption between central banks and applying quantum-resistant digital signatures to real liquidity transfers in an operational payment environment. The HKMA is targeting a full readiness score of 10 by 2030, backed by a new Post-Quantum Cryptography toolkit co-developed with the Hong Kong University of Science and Technology, workshops and coordinated industry guidance, with 87% of surveyed banks specifically asking regulators for clearer supervisory expectations and timelines to actually guide their transition

Hong Kong Banks Early Stages Preparing Quantum Computing Threats Hkma Sayswww.scmp.com

[QuantumLeap53]

A regulator publicly scoring its own sector this low is a bold, transparent move, plenty of financial regulators would rather quietly nudge institutions along than put an embarrassing number in a public white paper

[Elliot_67]

Pilots scoring the lowest of all four categories at 1.8 makes sense to me, awareness is cheap to claim in a survey response, actually running a pilot migration project takes real budget and expertise most banks clearly haven't committed yet

[StoneCold]

Four years to go from 2.3 to a full 10 out of 10 is an extremely steep climb given how slowly financial institutions typically move on any infrastructure level cryptography change, curious how realistic that 2030 target actually is

[Reuben]

This connects directly to the broader Q-Day conversation happening across crypto and tech more generally, it's useful to see a concrete, numbered readiness benchmark rather than just vague warnings about an eventual quantum threat

[Socket91]

This is a good example of quantum risk finally translating from abstract physics conversation into an actual regulatory compliance framework with real numbers, timelines and consequences attached

[Tiger]

87% of banks asking regulators for clearer supervisory expectations and timelines is the real story buried in here, the industry isn't resisting this, it's waiting for the HKMA to actually tell it what compliance looks like

[Di87]

Half of banks having no formal migration plan at all despite growing awareness is exactly the kind of gap between recognizing a risk and actually budgeting to fix it that regulators everywhere are having to force through mandates like this

[AlphaGareth16]

The Bank for International Settlements already running real operational pilots through Project Leap shows this isn't purely theoretical planning anymore, actual quantum-resistant signatures have been applied to genuine liquidity transfers already

[alwaysMason58]

The harvest now, decrypt later framing applying specifically to banking data is what makes this feel urgent rather than distant, financial records that need to stay confidential for decades are exactly the kind of data worth stockpiling today for a future decryption capability

[TealBear]

Worth remembering Hong Kong publishing this so publicly might actually put pressure on other financial hubs to produce similarly honest self-assessments rather than staying vague about their own quantum exposure

[CyberWarden61]

The toolkit developed with a local university is a smart practical step, giving banks a concrete resource to actually start cryptographic asset inventory work rather than just handing down a target score with no support to reach it