The Hong Kong Monetary Authority (HKMA) has delivered a blunt verdict on how prepared its banks are for the quantum era, and the number is low. In a whitepaper published on July 27, the regulator launched its first Quantum Preparedness Index (QPI), scoring the banking sector 2.3 out of 10 on readiness for post-quantum cryptography (PQC) and setting a target of full readiness by 2030.
For a jurisdiction positioning itself as Asia’s digital-asset hub, the timing is pointed. The same cryptography the report flags as vulnerable is what secures the blockchain settlement, stablecoins and tokenized assets Hong Kong has spent the past year aggressively promoting.
What The Index Measured
Produced with KPMG and Quinlan & Associates, the QPI is based on a survey of Authorized Institutions across four dimensions: Awareness, Planning, Pilots, and Practical Preparedness. Every dimension scored low. Awareness came in at 2.4, Planning at 2.5, Practical Preparedness at 2.3, and Pilots lowest of all at 1.8.
The underlying detail is starker than the headline. Around 68% of surveyed institutions reported having no quantum-related initiatives in place, 66% had not assessed their quantum exposure, and roughly half had no formal roadmap for adopting PQC. Nearly three-quarters had neither conducted nor planned any proof-of-concept testing of quantum-safe algorithms. A small cohort of banks has moved further, but the report describes a clear gap between those leaders and the rest of the sector.
Why Crypto Infrastructure Is Squarely In Scope
The whitepaper is explicit that this is not an abstract IT concern. It warns that financial systems such as secure payment networks and distributed ledger technology (DLT) applications rely on cryptography for core functions and could face severe operational disruption if those protections were compromised.
The mechanism is Shor’s algorithm, which a sufficiently powerful “cryptographically relevant quantum computer” (CRQC) could use to break the RSA and elliptic-curve cryptography that underpins digital signatures and wallet security. In a blockchain context, an attacker able to forge those signatures could authorise transactions or impersonate trusted parties. The report cites expert surveys putting the likelihood of such a machine within 10 years at up to 49%, and within 15 years at over 50%.
The most immediate danger it identifies is “Harvest Now, Decrypt Later” (HNDL); adversaries capturing encrypted data today to decrypt once quantum capability matures. For long-lived financial records and onchain data, that means the clock has already started.
The Tokenization Collision
That threat is amplified by exactly where Hong Kong is heading. Under its Fintech 2030 strategy, the HKMA has made tokenization a strategic pillar, pushing real-world asset tokenization, tokenized deposits, a regulated stablecoin regime and digital-asset settlement through Project Ensemble. The city granted its first stablecoin issuer licences in April to HSBC and a Standard Chartered-led venture, and banks held digital assets in custody worth over HK$14 billion at the end of 2025, up roughly 180% year over year.
In other words, the regulator is moving financial activity onto cryptographic rails at the same moment its own index shows banks are barely defending those rails against a future quantum break. The report notably points to HSBC’s earlier use of quantum-safe technology to move tokenized gold across distributed ledgers as one of the few concrete steps taken so far.
What HKMA Wants Banks To Do
The whitepaper stops short of hard mandates, instead laying out a four-stage transition, Awareness, Planning, Pilot and Practical Preparedness, built around “cryptographic agility,” the ability to swap algorithms without major disruption. Its four immediate asks: engage the board on quantum risk, appoint an accountable owner, commission a cryptographic inventory, and press critical vendors for post-quantum roadmaps.
Supervisory demand for direction is high. Some 87% of surveyed banks ranked clear supervisory expectations and timelines among their top support priorities. The HKMA said it will provide guidance, run workshops, and co-develop a PQC toolkit with academic partners, working toward the 2030 readiness goal.
The gap between a 2.3 score and that target is wide, and the report is candid that closing it will take years of coordinated effort. For a market racing to tokenize, the message is that the security layer beneath the innovation still has a long way to catch up.
Also Read: Coinbase Can Make Its Vault Quantum-Safe, Bitcoin Is the Harder Problem
