HKMA PQC Toolkit: 23 Workstreams, Four Tools and a 2028 Checkpoint

On 2 November 2026 the Hong Kong Monetary Authority and the Hong Kong University of Science and Technology (HKUST) launched the Post-Quantum Cryptography (PQC) Toolkit, and the HKMA’s Banking Supervision Department sent a covering circular to the chief executives of all authorized institutions (AIs) on the same day. The HKMA PQC Toolkit includes a reference manual covering 23 workstreams and four planning tools, offered as a practical reference for AIs as they formulate and implement their PQC transition plans.

The supervisory weight sits in the circular. Use of the Toolkit is “strongly encouraged”. In the same paragraph, AIs “are expected to establish clear milestones for their preparations and keep these under regular senior management review”, with priorities that include four named areas. The HKMA also attached a number to the next checkpoint: it expects the sector’s Quantum Preparedness Index (QPI) score could reach 5 to 6 by the next QPI survey in Q2 2028, up from the 2.3 out of 10 it published in July 2026.

Related reading: HKMA ART Framework: Nine AI Principles Replace the 2019 Guidance

Quantum readiness dates set by the July and November circulars

• 27 July 2026: circular “Results of Quantum Preparedness Index Survey”, reporting a survey of AIs the HKMA had recently concluded, and the whitepaper “Quantum Preparedness of Hong Kong’s Banking Sector”; initial QPI score of 2.3 out of 10.
• 2 November 2026: PQC Toolkit launched, with the circular “Post-Quantum Cryptography (PQC) Toolkit”.
• Q2 2028: next QPI survey; the HKMA expects the sector score could reach 5 to 6.
• 2030: target of full sector readiness, which the HKMA defines as a QPI score of 10 out of 10.

None of these dates is a filing deadline. Neither circular creates a return, a template or a submission date. Both circulars carry the same file reference, B1/15C, so the date and title are what distinguish them in an internal policy register.

What the HKMA PQC Toolkit contains

Alongside a structured framework, the circular names two components. The first is a reference manual that sets out key considerations across the PQC transition “in line with the QPI framework”, running from awareness and planning to piloting and practical preparedness. It covers 23 workstreams and is also available in a machine-readable format. The second is a set of four tools the circular calls “practical and adaptable”, intended to support early planning.

The circular gives the workstream count without naming the workstreams; those sit in the manual on the HKMA’s Fintech Knowledge Hub. The reference architectures illustrate “possible” target states, which reads as examples to adapt, and the circular does not present them as HKMA-approved designs. The HKMA also says it will update the Toolkit as needed to take account of technological developments, international standards and practical implementation experience, so a plan mapped to the November 2026 manual needs a record of the version it was built against.

Strongly encouraged and expected: two different verbs in one paragraph

Toolkit use is optional in form. AIs are “strongly encouraged” to use it when developing and reviewing their PQC transition plans, in a manner commensurate with their risk profile, technology environment, operational complexity and existing institutional or group-level arrangements. Our note on the CPMI-IOSCO cyber resilience toolkit for FMIs covers a comparable voluntary package from another standard setter.

The next sentence carries a stronger verb. AIs are expected to set clear milestones for their preparations and keep them under regular senior management review. The circular says its priorities include:

• a prioritised transition roadmap that identifies milestones, resource needs and key dependencies, including the readiness of critical suppliers and group service providers;
• clear accountability for quantum-related risks and transition decisions, with appropriate senior management oversight;
• assessment of material exposures, supported by a cryptographic inventory with “progressively wider coverage of systems and critical operations”;
• cryptographic agility, meaning the capability to upgrade cryptographic algorithms “in a timely manner and without material operational disruption”.

The November text is more specific than the July circular:

On my reading, adopting the Toolkit does not by itself meet the milestone expectation, and an institution that plans with its own method can still meet it. The July circular added that the HKMA will adopt a proportionate approach, “taking into account individual institutions’ circumstances”.

Cryptographic inventory scope runs through OR-2 critical operations

A footnote in the July circular ties the inventory to existing operational resilience work: AIs are expected to “make reference to critical operations identified when implementing the operational resilience framework” in Supervisory Policy Manual module OR-2. The November circular asks for an inventory with progressively wider coverage of systems and critical operations, without repeating the OR-2 cross-reference. Coverage is allowed to grow over time, and the whitepaper’s own first-step advice is to commission an inventory “accepting that it will be imperfect at first”.

The starting point is low. In the whitepaper survey, 45% of responding AIs reported no formal cryptographic bill of materials (CBOM) and a further 29% relied on informal inventory tools such as spreadsheets. Automated discovery has a stated limit: the whitepaper lists “relying solely on automated discovery tools” as a pitfall, and one AI’s proof of concept found that a complete inventory is likely to need automated tooling, manual review and vendor input together.

The whitepaper also places the transition within technology risk management under SPM TM-G-1, the Cyber Resilience Assessment Framework (C-RAF) and operational resilience planning under OR-2, avoiding a disconnected workstream. Teams with an existing CBOM can compare its attributes with the Toolkit’s data model, which the circular describes only as a means of collecting and managing transition information.

Supplier and group service provider readiness sits inside the roadmap

The roadmap priority names two kinds of dependency: critical suppliers and group service providers. The dependency assessment questionnaire covers service providers and other counterparties. Where key management, certificate services or core platforms run from a head office or regional hub, my reading is that the intra-group provider belongs in the dependency map even without an external contract, because the circular lists group service providers alongside critical suppliers.

The survey’s highest-ranked PQC adoption challenge sits here. Among challenges in vendor and industry engagement, 87% of responding AIs ranked dependencies on critical third parties among their top three concerns and 85% ranked vendor readiness and roadmaps. The wider supervisory frame is in our note on the BCBS third-party risk principles, and the dependency-mapping gaps the Basel Committee recorded are covered in our article on Basel Committee ICT risk management practices.

What the QPI measures, and what the 2028 survey will test

The QPI scores readiness from 0 to 10 across four dimensions, each built from sub-indices, and the circular aligns the manual with the same framework.

The overall 2.3 split into averages of 2.6 for retail banks and 2.2 for non-retail banks. The 5 to 6 figure for Q2 2028 is a sector-level expectation, qualified with “could” and “with concerted efforts”; neither circular sets a score for an individual institution.

Monitoring is where the milestone expectation meets the data. In the survey, 58% of responding AIs reported that progress on quantum readiness or cryptographic transition activities is not tracked, with no reporting mechanisms, metrics or dashboards in place. The whitepaper suggests indicators in four areas (discovery coverage, risk exposure, migration progress and cryptographic agility), reported against an agreed target state through existing technology risk and audit committee channels, which gives senior management review something to measure.

Timing is the open question. The July circular reported an average implementation timeframe of 5.6 years among banks that already had transition plans; on my arithmetic, a programme of that length started in 2027 would finish after 2030. The sources define the 2030 target as a QPI score of 10, without a migration completion date for individual systems.

Frequently Asked Questions

Our group runs a global PQC programme from head office. Does the Hong Kong AI still need to use the Toolkit?

The circular strongly encourages AIs to use the Toolkit in a manner commensurate with existing institutional or group-level arrangements, so a group programme is an acknowledged starting point. The milestone expectation is addressed to the AI. My reading is that a group plan can carry it where the Hong Kong AI’s milestones are identifiable and reviewed by its senior management, and the group service providers it relies on appear in the dependency analysis.

Does the circular apply to stored value facility licensees or licensed stablecoin issuers?

The 2 November 2026 circular is addressed to the chief executives of all authorized institutions, and the July circular had the same addressees. Neither document, nor the press release, extends the expectations to other HKMA-regulated entities. The Toolkit sits in the Fintech Knowledge Hub section of the HKMA website, and use by a firm outside the AI population is that firm’s decision.

Will the HKMA publish institution-level QPI results?

The published materials report the QPI at sector level, with separate averages for retail and non-retail banks. The July circular calls the index a measurable benchmark to be refreshed from time to time. Neither circular says whether individual results will be published or shared with each institution.

Related Articles

• HKMA ART Framework: Nine AI Principles Replace the 2019 Guidance: the HKMA’s October 2026 supervisory guidance on responsible AI.
• CPMI-IOSCO Cyber Resilience Toolkit: What FMIs Should Review: four voluntary cyber resilience tools for financial market infrastructures.
• BCBS Third-Party Risk Principles: DORA and Outsourcing Rules: the Basel Committee’s 12 principles for banks and supervisors on third-party arrangements.
• Basel Committee ICT Risk Management: The Four Root Causes of Incidents: incident root causes, change management and dependency mapping.

Key Takeaways

• The deliverable the 2 November circular expects is a milestone set under regular senior management review; Toolkit use is strongly encouraged as one route to it.
• Inventory scope: reference the critical operations identified under OR-2, as the July circular’s footnote expects, and widen coverage of systems and critical operations progressively, as the November circular sets out.
• Dependency map: group service providers listed next to external critical suppliers.
• Internal progress reporting: the whitepaper suggests indicators for discovery coverage, risk exposure, migration progress and cryptographic agility, reported against an agreed target state through existing technology risk and audit committee channels.
• Milestone dates: test them against the 2030 target, given the 5.6-year average timeframe banks with plans reported in July.

Sources and References

• HKMA press release, “HKMA and HKUST launch PQC Toolkit to support banks’ quantum preparedness” (2 November 2026): hkma.gov.hk
• HKMA circular to all authorized institutions, “Post-Quantum Cryptography (PQC) Toolkit” (2 November 2026, Our Ref: B1/15C): HKMA Banking Regulatory Document Repository
• HKMA Fintech Knowledge Hub, Quantum Preparedness (PQC Toolkit download page): hkma.gov.hk
• HKMA circular to all authorized institutions, “Results of Quantum Preparedness Index Survey” (27 July 2026, Our Ref: B1/15C): HKMA Banking Regulatory Document Repository
• HKMA press release, “HKMA launches quantum preparedness whitepaper and index to support banking sector’s readiness for quantum era” (27 July 2026): hkma.gov.hk
• HKMA whitepaper, “Quantum Preparedness of Hong Kong’s Banking Sector” (July 2026): PDF

Setting PQC milestones before the Q2 2028 survey

The circular’s expectation reduces to two things an institution can show: clear milestones for its PQC transition, set against the priorities the circular lists (roadmap, accountability, exposure and inventory, and cryptographic agility), and a regular senior management review of those milestones. Existing plans can be mapped to the 23 workstreams; new ones can start from the project planning tool’s indicative lead-times. The next external measurement is the QPI survey scheduled for Q2 2028.

Disclaimer: The information on RegReportingDesk.com is for educational and informational purposes only. It does not constitute legal, regulatory, tax, or compliance advice. Always consult your compliance officer, legal counsel, or the relevant supervisory authority for guidance specific to your institution.