HONG KONG MONETARY AUTHORITY
香港金融管理局

Banking Supervision Department
銀行監理部

Our Ref: B1/15C

2 November 2026

The Chief Executive
All Authorized Institutions

Dear Sir/Madam,

Post-Quantum Cryptography (PQC) Toolkit

I am writing to share the release of the PQC Toolkit (the Toolkit), jointly developed by the Hong Kong Monetary Authority (HKMA) and The Hong Kong University of Science and Technology to support Authorized Institutions (AIs) in preparing for their transition to quantum-resistant cryptography.

The initial Quantum Preparedness Index (QPI)¹ score of 2.3 out of 10 indicated that the banking sector was at an early stage of quantum readiness. Since the QPI Survey, AIs have started to take steps to enhance their preparedness, with the shared objective of achieving sector-wide readiness by 2030.

Drawing on insights gained through ongoing engagement with the industry, the HKMA has jointly developed the Toolkit to provide a practical reference for AIs as they formulate and implement respective PQC transition plans. The Toolkit sets out a structured framework to support AIs with different levels of maturity and operational complexity.

The Toolkit also includes a comprehensive reference manual (manual). It sets out key considerations across the PQC transition journey in line with the QPI framework, from awareness and planning to piloting and practical preparedness. The manual covers 23 workstreams, and is also available in a machine-readable format. These are designed to help AIs to take a risk-based approach in identifying and planning actions required for transition.

/...Page 2

[1] Press release on “HKMA launches quantum preparedness whitepaper and index to support banking sector’s readiness for quantum era”, July 2026. (https://www.hkma.gov.hk/eng/news-and-media/press-releases/2026/07/20260727-3/)

55th Floor, Two International Finance Centre,
8 Finance Street, Central, Hong Kong
Tel: (852) 2878 1946 Fax: (852) 2878 1670
E-mail: clkchu@hkma.gov.hk
Website: www.hkma.gov.hk

香港中環金融街8號國際金融中心2期55樓
電話：(852) 2878 1946 傳真：(852) 2878 1670
電郵：clkchu@hkma.gov.hk
網址：www.hkma.gov.hk

The Toolkit also includes four practical and adaptable tools to support early planning:

• a data model to facilitate the collection and management of information relevant to the PQC transition;

• a dependency assessment questionnaire to support engagement with service providers and other counterparties on PQC readiness and transition plans;

• reference architectures that illustrate possible target-state technical arrangements; and

• a project planning tool to support the development of a structured transition roadmap, with estimates of indicative lead-time for key tasks.

AIs are strongly encouraged to make use of the Toolkit when developing and reviewing their PQC transition plans, in a manner that is commensurate with their risk profile, technology environment, operational complexity and existing institutional or group-level arrangements. Specifically, AIs are expected to establish clear milestones for their preparations and keep these under regular senior management review. Priorities include:

• developing and updating a prioritised transition roadmap that identifies milestones, resource needs and key dependencies, including the readiness of critical suppliers and group service providers;

• assigning clear accountability for quantum-related risks and transition decisions, with appropriate senior management oversight;

• assessing material exposures, supported by a cryptographic inventory with progressively wider coverage of systems and critical operations; and

• strengthening cryptographic agility by developing the capability to upgrade cryptographic algorithms in a timely manner and without material operational disruption.

The HKMA will continue to engage with the industry and update the Toolkit as needed to take account of technological developments, international standards and practical implementation experience. With concerted efforts, the HKMA expects the sectoral QPI score could reach a score of 5 to 6 by the time of the next QPI Survey, scheduled to be conducted in Q2 2028. This would represent meaningful progress towards full readiness, or a QPI score of 10 out of 10, by 2030 target.

The Toolkit is available in the Fintech Knowledge Hub section of the HKMA website². We welcome feedback on its application and areas where further support would be useful. Should you have any questions about this circular or the Toolkit, please contact us at all-banks-go-fintech@hkma.gov.hk.

Yours faithfully,
Carmen Chu
Executive Director (Banking Supervision)

[2] PQC Toolkit. https://www.hkma.gov.hk/eng/key-functions/banking/fintech-knowledge-hub/quantum-preparedness/