The Hong Kong Monetary Authority published its first Quantum Preparedness Index in July 2026, giving the city’s banking sector a score of 2.3 out of 10. The low reading shows most banks remain at an early planning stage for post-quantum security.
The assessment matters because Hong Kong is pushing more financial activity onto tokenized rails. With tokenized bonds, deposits and settlement systems expanding, cryptographic resilience is becoming a core requirement for digital-market infrastructure.
HKMA Links Quantum Readiness to Tokenized Finance
Hong Kong has already issued three tokenized green bond offerings since 2023 totaling HK$16.8 billion, or about $2.1 billion. Tokenized deposits have also reached HK$29 billion, increasing the value of financial instruments dependent on secure digital signatures and key management.
The HKMA folded quantum resilience into its Fintech 2030 agenda and launched a whitepaper, workshops and the QPI to push banks toward practical preparation. The regulator now wants a sector-wide move from awareness to formal migration planning before 2030.
Banks are expected to produce comprehensive post-quantum cryptography transition plans and begin pilot migrations in 2026. The HKMA is also co-developing a PQC toolkit with The Hong Kong University of Science and Technology’s School of Business and Management, giving financial institutions reference tools for cryptographic agility and migration testing.
The program is organized around the DART framework: Data, Artificial Intelligence, Regtech and Technology. Those pillars connect cryptographic inventories, anomaly detection, automated audits and PQC-capable hardware procurement into a single supervisory agenda.
The Data workstream focuses on mapping cryptographic assets and defining quantum-resistant storage and sharing standards. That step is essential because banks cannot replace vulnerable cryptography until they know where keys, certificates and dependencies sit.
AI workstreams are being used to detect anomalous cryptographic behavior and model performance impacts from PQC migration. Regtech efforts focus on automated audits and sandboxes, while the Technology pillar prioritizes PQC-capable HSMs, vendor coordination and resilient implementation libraries.
Quantum Risk Creates a New Infrastructure Deadline
The core risk is that future quantum computers could break widely used public-key cryptography. Shor’s algorithm threatens RSA and elliptic-curve systems, which support digital signatures, wallet security and many token ownership models, making private-key compromise a long-term systemic threat.
Grover’s algorithm also reduces the effective strength of symmetric ciphers and hash functions. That does not destroy those systems outright, but it lowers security margins and increases the need to reassess integrity mechanisms across payments and settlement infrastructure.
Post-quantum candidates include lattice-based, code-based, hash-based, multivariate and isogeny-based schemes. Each option carries trade-offs in key size, computational load, signature handling and operational complexity, making migration a performance and governance problem, not only a cryptographic upgrade.
Those trade-offs create concrete challenges for banks. Larger keys can increase latency and bandwidth usage, stateful hash-based signatures complicate multisignature workflows, and legacy systems often lack cryptographic agility, making backward compatibility a major constraint during phased migration.
If ownership proofs, wallet keys or settlement signatures become vulnerable, token issuers and custodians could face traceability loss, unauthorized transfers and weakened confidence in the integrity of blockchain-based financial claims.
Industry estimates cited in the quantum-readiness debate suggest a meaningful share of circulating token supply could be exposed if cryptographic standards are not upgraded. That risk makes PQC planning a custody, audit and market-confidence issue for tokenized finance.
For banks, custodians and infrastructure providers, the immediate task is practical preparation. Firms need cryptographic inventories, vendor road maps, migration pilots, key-rotation policies and external audits, turning quantum readiness into a funded operational program rather than a future research topic.
The next four years will test whether Hong Kong can align tokenization growth with cryptographic resilience. The QPI gives banks a baseline, but the real measure will be whether pilots, toolkit adoption and vendor procurement move the sector toward quantum-safe infrastructure before tokenized finance reaches larger scale.
