Hong Kong prepares banks for quantum cybersecurity threats

The Hong Kong Monetary Authority launches a quantum readiness framework to assess the banking industry's ability to respond to cryptographic threats

The Hong Kong Monetary Authority (HKMA) has released a new assessment framework to help the banking industry prepare for the impact quantum computing may have on distributed ledgers and the underlying cryptography of digital financial systems. This move shows that while Hong Kong is accelerating tokenization and blockchain settlement, it has officially started to prevent "post-quantum" security risks.

In a white paper released on Monday, the HKMA launched the industry's first Quantum Readiness Index (QPI). The agency conducted an overall evaluation of the institutions interviewed, giving a readiness score of 2.3 out of 10, and pointed out that about half of the institutions had not formulated any formal post-quantum plans. The HKMA's goal is to increase the industry QPI score to 10 points by 2030.

Core Points

The HKMA's first quantum readiness index shows that the banking industry scores only 2.3/10, indicating that the industry's preparation for post-quantum upgrades is very limited. According to the HKMA, about half of the institutions surveyed lack formal post-quantum planning. Hong Kong's tokenization and distributed ledger plans further add to the urgency of cryptographic migration planning. Regulators have warned that a sufficiently powerful quantum computer could eventually crack RSA and elliptic curve cryptography used in the financial system. The HKMA aims to achieve adequate industry-wide preparedness by 2030 and urges early asset inventory and risk assessment.

Why does the HKMA focus on quantum preparation at this time?

The launch of the Quantum Framework by the HKMA comes as Hong Kong is expanding the use of tokenization in mainstream finance. According to government information disclosure and updates on relevant bond issuance during the same period, since 2023, Hong Kong has issued three batches of tokenized green bonds, totaling approximately HK$16.8 billion (approximately US$2.1 billion).

At the policy level, the HKMA is also promoting tokenized deposits and digital asset settlement. The HKMA continues to develop these capabilities through the Ensemble Project, which has previously reported on tokenization efforts and infrastructure related to wholesale central bank digital currencies.

In this overall advancement, the core argument of the HKMA is that distributed ledger applications and payment networks rely on cryptography to achieve core functions, and once cryptography is breached, systemic vulnerability will be created. The white paper points out that if these protections are weakened, it could lead to serious chaos in systems that rely on these systems.

QPI scores and evaluation findings

White papers and supporting indices clarify how the HKMA expects banks to think about readiness. An overall QPI score of 2.3/10 suggests that the industry is still in its early stages-far from entering the stage of in-depth technology migration and long-term system updates. Two findings were particularly prominent in the HKMA's release: first, about half of the institutions surveyed had not formulated formal post-quantum plans; second, the white paper listed examples of early technical work: one institution completed the application of post-quantum cryptography to distributed ledger connectivity. Proof of concept.

The HKMA also cited actual industry experience and pointed out that HSBC will use quantum security technology to transfer tokenized gold between distributed ledgers in 2024. This detail was included in the HKMA white paper as an example of exploring post-quantum considerations related to the settlement of tokenized assets.

Quantum Risk: What may be compromised and why the timeline is important

In the framework of the HKMA, the main threat comes from the possibility of quantum computers running Shoor's algorithm on a large scale. The agency believes that this capability could ultimately undermine widely used public key systems such as RSA and Elliptic Curve Cryptography. The HKMA warns that once this happens, attackers could decrypt protected data or forge digital signatures-mechanisms used to authorize transactions, verify identities and establish trust within the financial system.

Regulators emphasize pragmatic urgency rather than panic. The white paper points out that replacing cryptographic systems embedded in infrastructure can take years. As a result, the HKMA urges banks to start basic work now-such as cryptographic asset inventories, risk assessments and migration planning-to prepare before machines with the required capabilities emerge.

Hong Kong's tokenization strategy raises security upgrade thresholds

The HKMA's quantum work is in line with its broader "FinTech 2030" direction, which was announced in 2025 to turn tokens into a key pillar. It has been previously reported that in the HKMA's Fintech 2030 strategy, tokenization is one of the four strategic pillars in the overall plan that includes more than 40 initiatives.

The HKMA has stated that its tokenization agenda includes accelerating the tokenization of physical assets, regulating tokenized government bond issuance, and exploring tokenization of Exchange Fund Notes. The agency also described blockchain settlement efforts supported by digital Hong Kong dollars, tokenized deposits and regulated stablecoins.

At the same time, the business momentum behind digital assets and tokenized deposits seems to be growing. Hong Kong Financial Secretary Paul Chan said in a speech that as of the end of 2025, the scale of digital asset custody held by Hong Kong banks exceeded HK$14 billion (approximately US$1.785 billion), a year-on-year increase of approximately 180%. He also mentioned that tokenized deposits reached HK$29 billion (US$3.7 billion).

This combination-growing tokenization activity and regulators promoting cryptographic resilience-helps explain why the HKMA is no longer limited to general cybersecurity guidelines and introduces quantifiable readiness scores. For market participants, the QPI architecture may translate into clearer governance and technology planning expectations as they integrate distributed ledger technology into more regulated businesses.

Looking ahead, Hong Kong banks need to pay close attention to how the HKMA tracks QPI's progress towards the 2030 10/10 goal, and whether more guidance will be issued in terms of timetables, evaluation methods and post-quantum migration priorities. Given the current low level of preparedness, the next step needs to be focused on how institutions can quickly translate plans into specific asset inventory, testing, and system upgrades at the ledger connection and transaction authorization levels.