Hong Kong gives banks a plan for replacing vulnerable cryptography
A new toolkit asks banks to map where they use cryptography, check which suppliers can support a change and set a timetable. A customer login shows why the work crosses company lines.
Reading tools for text size, copying, printing and your reading list
Start with one login
Imagine a bank that relies on an outside company to verify who is signing in. Its mobile app might be ready for a new cryptographic method while its identity provider still needs to test the change. Updating the app alone would leave a dependency unresolved. Until the bank knows who controls both ends, it cannot safely schedule the switch.
That is the kind of planning problem behind the post-quantum cryptography toolkit launched November 2 by the Hong Kong Monetary Authority and the Hong Kong University of Science and Technology. Post-quantum cryptography uses methods designed to withstand attacks by future quantum computers and can run on ordinary hardware. The toolkit brings governance, asset inventories, supplier coordination and implementation planning into one framework.[1]
What the readiness score measures
The July index drew on a survey of banks’ awareness, planning, pilot projects and practical preparedness. About half of surveyed banks had no formal post-quantum plan. The sector scored 2.3 out of 10. The authority wants that score to reach 10 by 2030. A bank can make progress on the index by identifying its dependencies before it changes a single customer-facing system.[1][3]
Follow a bank login through the transition
- Map the dependency
Which outside provider authenticates the customer?
- Set the priority
Which services would fail if that component changed?
- Assign the work
Who owns the migration and the supplier relationship?
- Test and review
Can customers still sign in, and is the fallback proven?
The manual covers 23 areas of work. Banks also get a model for recording information, a supplier questionnaire, example technical designs and a project planner. The regulator expects the sector could score 5 to 6 in its next survey, scheduled for the second quarter of 2028. The toolkit and reference materials are available from the regulator’s Fintech Knowledge Hub.[2][4]
A useful inventory links a cryptographic dependency to the customer service that relies on it, a person who can change it, and suppliers that need to cooperate. That is what lets a bank tell a low-risk pilot from a change that could interrupt thousands of logins.
What progress would look like
In the hypothetical login service, a bank could identify a test environment, agree on compatible software with its provider and ensure existing customers can still get through if the trial fails. Those are examples of evidence to look for, rather than outcomes announced by the regulator.
For the example above, a bank could report which login service it tested, whether its supplier participated, and whether a customer with an older version of the app could still sign in. Those details would tell readers what changed in practice between one survey score and the next.