Hong Kong readies banks for quantum cybersecurity threats

The Hong Kong Monetary Authority (HKMA) has introduced a new assessment framework aimed at helping banks prepare for the potential impact of quantum computing on the cryptography underpinning distributed ledger and digital finance systems. The move signals that Hong Kong’s rapid push toward tokenization and blockchain settlement is now paired with a formal push to address “post-quantum” security risks.

In a white paper released Monday, the HKMA unveiled the sector’s first Quantum Preparedness Index (QPI). The HKMA assigned an overall readiness score of 2.3 out of 10 across surveyed institutions and said roughly half of them had no formal post-quantum planning in place. The regulator’s goal is to raise the sector to a QPI score of 10 by 2030.

Key takeaways

• The HKMA’s first Quantum Preparedness Index scores the banking sector at 2.3/10, indicating limited readiness for post-quantum upgrades.
• According to the HKMA, around half of surveyed institutions lack formal post-quantum planning.
• Hong Kong’s tokenization and distributed ledger initiatives heighten the urgency of cryptographic migration planning.
• The regulator warns that sufficiently powerful quantum computers could eventually break RSA and elliptic-curve cryptography used in financial systems.
• The HKMA is targeting full sector preparedness by 2030 and is urging earlier inventories and risk assessments.

Why HKMA is turning to quantum preparedness now

The HKMA’s quantum framework arrives as the city expands how it uses tokenization in mainstream finance. Hong Kong has already issued three batches of tokenized green bonds totaling about HK$16.8 billion (around $2.1 billion) since 2023, according to government disclosures published on the government information site and related bond issuance updates since that period.

At the policy level, the HKMA is also advancing tokenized deposits and digital-asset settlement. It has been working on these capabilities under Project Ensemble, an initiative that Cointelegraph previously covered in the context of tokenization efforts and wholesale CBDC-related infrastructure.

Within this broader push, the HKMA’s central argument is that distributed ledger applications and payment networks rely on cryptography for core functions—and that a successful cryptographic compromise would create systemic vulnerabilities. The white paper states that if those protections were undermined, it could lead to severe disruption across the systems that depend on them.

The QPI score and what the assessment found

The white paper and the accompanying index formalize how the HKMA expects banks to think about readiness. With an overall QPI score of 2.3/10, the HKMA essentially portrays the sector as being in an early stage—before deep technical migrations and long-running system updates.

Two findings stand out from the HKMA’s release. First, it reports that around half of the surveyed institutions had no formal post-quantum planning in place. Second, it describes examples of early technical work: the HKMA says one institution completed a proof of concept applying post-quantum cryptography to distributed-ledger connectivity.

The HKMA also points to real-world experience in the industry, noting HSBC’s 2024 use of quantum-safe technology to move tokenized gold across distributed ledgers. This detail is included in the HKMA’s white paper as an example of post-quantum considerations being explored in connection with tokenized asset settlement.

Quantum risk: what could be broken, and why timelines matter

In the HKMA’s framing, the major threat comes from the possibility that quantum computers could run Shor’s algorithm at scale. In its view, that capability could eventually undermine widely used public-key systems such as RSA and elliptic-curve cryptography.

If that were to happen, the HKMA warns it could enable attackers to decrypt protected data or forge digital signatures—mechanisms used to authorize transactions, verify identities, and establish trust within financial systems.

The regulator emphasizes practical urgency rather than alarm. According to the white paper, replacing cryptographic systems embedded across infrastructure can take years. For that reason, it urged banks to begin with foundational work now—such as inventories of cryptographic assets, risk assessments, and migration planning—before machines with the required capability become available.

Hong Kong’s tokenization strategy raises the bar for security upgrades

The HKMA’s quantum effort aligns with its broader Fintech 2030 direction, announced as a strategy in 2025 that made tokenization a key pillar. Cointelegraph previously reported that tokenization was one of four strategic pillars within an overall plan of more than 40 initiatives in coverage of HKMA’s Fintech 2030 strategy.

The HKMA has signaled that its tokenization agenda includes acceleration of real-world asset (RWA) tokenization, regularization around tokenized government bond issuance, and exploration of tokenized Exchange Fund papers. It has also described blockchain settlement work supported by e-HKD, tokenized deposits, and regulated stablecoins.

Meanwhile, the business momentum behind digital assets and tokenized deposits appears to be building. In a speech, Hong Kong Financial Secretary Paul Chan said banks in the city held more than HK$14 billion (about $1.785 billion) in digital assets under custody at the end of 2025, up about 180% year over year. He also cited tokenized deposits reaching HK$29 billion (about $3.7 billion).

That combination—growing tokenization activity alongside a regulator-led push for cryptographic resilience—helps explain why the HKMA is moving beyond generic cybersecurity guidance and instead introducing a measurable readiness score. For market participants, the QPI structure may translate into clearer expectations for governance and technical planning as they integrate DLT into more of their regulated operations.

Going forward, banks in Hong Kong will likely need to watch how the HKMA tracks QPI progress toward the 10/10 by 2030 target and whether additional guidance is released on timelines, assessment methods, and post-quantum migration priorities. With the assessment showing low current readiness, the next phase to monitor is how quickly institutions turn plans into concrete inventories, testing, and system upgrades across ledger connectivity and transaction authorization layers.