Hong Kong Regulator Pushes Banks to Prepare for Quantum Computing Risks

A New Benchmark for an Old Fear

Hong Kong's monetary authority unveiled a benchmark this week designed to measure how well the city's banks are preparing for quantum computing threats. The move puts Hong Kong among a small number of financial centers actively tracking institutional readiness for what cryptographers call Q-Day: the point at which quantum computers gain enough processing power to break current encryption standards.

The Hong Kong Monetary Authority announced the framework on Monday, signaling that quantum-related cybersecurity can no longer be treated as a distant concern. While quantum computers capable of cracking widely used encryption algorithms do not yet exist, experts estimate the technology could mature within the next decade. That timeline has prompted regulators in several jurisdictions to begin pushing financial institutions toward quantum-resistant cryptography.

What Makes Quantum Computing a Threat

Traditional computers process information in binary bits, zeros and ones. Quantum computers leverage quantum bits, or qubits, which can exist in multiple states simultaneously. This allows them to perform certain calculations exponentially faster than classical machines.

The problem for banks: many of the encryption protocols that protect customer data, transaction records, and interbank communications rely on mathematical problems that are difficult for classical computers to solve but could be trivial for sufficiently advanced quantum systems. Algorithms like RSA and elliptic curve cryptography, which underpin much of global finance, are vulnerable.

Financial institutions store sensitive data with long shelf lives. Account histories, loan agreements, and investment portfolios archived today could be harvested now and decrypted later once quantum computers mature, a tactic known as "harvest now, decrypt later." That risk is particularly acute in Hong Kong, a hub for cross-border capital flows and a gateway to mainland China's financial system.

Regional Context and Policy Pressure

Hong Kong's regulatory push comes as quantum computing development accelerates across Asia. China has invested heavily in quantum research, launching a quantum satellite in 2016 and establishing the National Laboratory for Quantum Information Sciences in Hefei. Japan and South Korea have similarly prioritized quantum technology in national research strategies.

The United States National Institute of Standards and Technology released its first set of post-quantum cryptographic standards in 2024, providing a reference framework for organizations worldwide. Singapore's Monetary Authority has also issued guidance on quantum risk, and the Bank for International Settlements has flagged the issue in reports on emerging technology threats to financial stability.

Hong Kong's new benchmark aims to quantify where local banks stand in adopting quantum-resistant measures. It assesses factors including the deployment of post-quantum encryption protocols, staff training on quantum risks, and timelines for replacing vulnerable systems. The authority has not yet disclosed whether the benchmark will be mandatory or advisory, nor whether it will publish aggregate scores.

Industry Readiness Remains Patchy

Despite growing awareness, most financial institutions have made limited progress in transitioning to quantum-safe infrastructure. A 2025 survey by a global consultancy found that fewer than one in five banks had begun piloting post-quantum cryptography, and many chief information security officers cited budget constraints and competing priorities as obstacles.

Upgrading encryption across legacy systems is not a simple software patch. It requires replacing cryptographic libraries, re-engineering authentication processes, and testing compatibility across thousands of interconnected applications. For large banks operating in multiple jurisdictions, the process can take years and cost tens of millions of dollars.

Smaller institutions face even steeper challenges. They often lack the in-house expertise to evaluate quantum risk or implement new cryptographic standards, leaving them reliant on third-party vendors who may themselves be unprepared.

What Comes Next

The Hong Kong Monetary Authority's benchmark represents a shift from general warnings to measurable accountability. If regulators begin requiring banks to meet specific quantum-readiness thresholds, institutions will face pressure to allocate resources and accelerate migration timelines.

The broader question is whether Hong Kong's move will spur coordination across Asia's financial centers. Quantum risk is not confined by borders; a vulnerability in one node of the regional banking network can cascade across correspondent banking relationships and payment systems. Harmonized standards and shared timelines for adopting post-quantum cryptography would reduce fragmentation and lower costs for institutions operating regionally.

For now, the countdown to Q-Day continues. The uncertainty lies not in whether quantum computers will eventually break today's encryption, but in how much time remains and whether the financial sector will be ready when that moment arrives.