Current cryptography won't survive quantum threat as HKMA urges 2030 deadline for banks

Today's cryptographic practices will not survive a quantum environment and endanger confidential financial data, Hong Kong Monetary Authority’s deputy chief executive Arthur Yuen Kwok-hang warned — urging the sector to be post-quantum cryptography (PQC)-ready by 2030.

The HKMA launched a white paper on quantum preparedness of the banking sector in July, highlighting that the Quantum Preparedness Index score is only 2.3 on a 10-point scale, a benchmark that Yuen described as "not very high".

While awareness of the quantum threat exists, "planning and actions has not really started in a real sense," Yue said at the Hong Kong Fintech Week x StartmeupHK 2026 on Monday, noting that the sector has roughly three to four years to achieve PQC readiness.

The concern centers on the ability of current cryptographic practices to protect highly confidential financial data against future quantum-enabled attacks, and the complexity of migrating to quantum-resistant systems involving numerous external service providers.

Organizational Complacency and Diffused Responsibility

Frederik Anseel, the dean of Hong Kong University of Science and Technology’s Business School, noted a gap between awareness and action in the financial sector.

"You might have a general awareness, but there is not a clear timeline, there is not a clear trend," Anseel said. "That does not create a sense of urgency."

He warned of "diffusion of responsibility," in which organizations assume technical experts are already handling the problem. Instead, firms should assign a clear mandate and set a deadline, he said. He also recommended that companies begin by mapping their processes to discover "what you don't know," starting with critical operations.

Third-party and Supply Chain Dependencies

Stuart Riley, HSBC’s group chief information officer, acknowledged that involving external service providers complicates the picture, but is unavoidable for end-to-end security. 

He emphasized "no-regret moves" that organizations can take today, such as upgrading to TLS 1.3 encryption protocols – the latest major version of the Transport Layer Security protocol, which is the standard technology used to encrypt data sent between a browser and a website, or between any two systems, to prevent eavesdropping and tampering.

Riley said HSBC has established a company-wide global ambition to be quantum-ready by 2030 across all critical business services, with leadership sessions focused on the topic.

He noted HSBC's hybrid model: a centralized quantum team working alongside cyber teams to set standards and build central services, while business units manage implementation of their own systems.

Riley also mentioned the need to determine which emerging standards to adopt across a large and complex IT environment. But he stressed that business leaders need to feel responsible for these services.

Uncertainty About the "Q-Day" Timeline

Riley joked that in his 35-year career, "there's not been a year where quantum hasn't been five years away." Nevertheless, he said the threat is becoming ever closer, as the industry has continually seen breakthroughs in error-rate reduction and qubit availability.

He recommended prioritizing systems by customer importance and data sensitivity, and emphasized that focusing on open standards helps "de-risk" the situation.
 

𝗗𝗼𝘄𝗻𝗹𝗼𝗮𝗱 𝗧𝗵𝗲 𝗦𝘁𝗮𝗻𝗱𝗮𝗿𝗱 𝗔𝗽𝗽 ↓