Hong Kong's regulator scores its banks 2.3 out of 10 on quantum readiness

The Hong Kong Monetary Authority (HKMA) has put a number on how prepared the territory's banks are for quantum computing's threat to encryption, and the number is low: 2.3 out of 10.

According to CoinDesk, the HKMA published a whitepaper on the banking sector's quantum readiness on Monday, unveiled at the eighth FiNETech conference and built on a survey conducted earlier this year. It carries the regulator's first Quantum Preparedness Index reading. The index tracks four stages — awareness, planning, pilot programs and practical preparedness — and most banks, per the whitepaper as reported by CoinDesk, are stuck at the first.

The survey detail: about 68% of banks showed at least some awareness or had moved into planning or pilot stages, leaving the rest not yet started. Roughly half have not formalized a plan to migrate to post-quantum cryptography. Board-level discussions had happened at about half the banks, but only one-third had begun exploring or testing anything quantum-related.

The concern the HKMA is flagging is "harvest now, decrypt later" — the risk that attackers stockpile encrypted data today to decrypt once quantum hardware matures. The Bank for International Settlements' Project Leap has flagged this as an immediate threat to the financial system. The same exposure applies to blockchains such as Bitcoin and Ethereum, whose cryptography would be vulnerable to a sufficiently powerful machine.

No such machine exists today. CoinDesk reports estimates for when the risk becomes real starting "as early as 2029" — a forecast, not a fixed date, and the whitepaper does not appear to attribute it to a specific body.

The HKMA is targeting a perfect 10 by 2030, via a post-quantum cryptography toolkit being developed with HKUST's business school, plus workshops on skills and "crypto agility." It is not acting in isolation: CoinDesk notes President Trump recently signed two executive orders — one to accelerate U.S. quantum development toward a research-grade machine by 2028, another directing federal migration to post-quantum cryptography by 2030–31.

Key facts

• Quantum Preparedness Index score: 2.3 / 10 (HKMA whitepaper, via CoinDesk).
• ~68% of surveyed banks showed awareness or had reached planning/pilot stages; the rest hadn't started (HKMA survey, via CoinDesk).
• ~50% have not formalized a post-quantum migration plan; ~33% have begun testing anything quantum-related (same).
• HKMA target: 10/10 by 2030 (CoinDesk).
• U.S. executive orders: quantum machine for research by 2028; federal post-quantum migration by 2030–31 (CoinDesk).

The real-world read

Two things to separate. The 2.3 score is a real, primary datapoint from the regulator itself — useful precisely because it is unflattering to the industry the HKMA oversees. The "as early as 2029" timeline is the softer part: it is an estimate, the sourcing here traces to CoinDesk's secondary reporting rather than a named cryptographer or agency, and it should be read as one end of a wide, contested range, not a countdown. A single-source item, too — the underlying whitepaper is the primary document worth checking against. Nothing here is marketing, and the HKMA's toolkit-and-workshops remedy is modest relative to a problem it scores at 2.3.

Opinion, and whose

The HKMA's framing — that awareness is building but "actual preparation is lagging" — is its own characterization of its survey. The BIS, via Project Leap, calls harvest-now-decrypt-later an immediate threat; that is the BIS's position, not a settled consensus on timing.

This is news, not financial or security advice.

Sources

• CoinDesk (Tier 2, secondary), 28 July 2026 — reported the HKMA whitepaper, the 2.3 index score, the survey breakdown, the 2030 target, the BIS Project Leap reference and the U.S. executive orders. It in turn cites the HKMA whitepaper (the primary source, not directly reviewed here) and does not name a body behind the "2029" estimate. No marketing or sponsored content.