A quantum computer that can break today's bank encryption does not exist yet. So why are regulators asking banks to prepare now? Our series Quantum-Safe Banking starts with that question. (General information, not legal, compliance or security advice.)
Already late
The Hong Kong Monetary Authority's circular of 27 July 2026 put the sector's Quantum Preparedness Index at 2.3 out of 10. About half of institutions have no structured plan, around 32% have not started, and those with plans expect them to take 5.6 years on average. The HKMA expects sector-wide readiness by 2030, which means a cryptographic inventory and a roadmap now, not a finished migration.
The reason is “harvest now, decrypt later”: data captured today can be stored and opened once a capable machine exists. A survey of 26 experts rated such a machine within 10 years as “quite possible” and within 15 years as “likely”. NIST released its first post-quantum standards (FIPS 203, 204 and 205) on 13 August 2024. The simple test, often called Mosca's inequality, asks whether the years your secrets must stay secret plus the years your migration takes add up to more than the years until such a machine exists. With a 5.6-year migration, three of five example secrets in our calculator were already late at a 10-year horizon.
Which locks break, and which don't
Encryption does three jobs: hiding secrets, agreeing keys and checking signatures. Public-key methods such as RSA and elliptic-curve cryptography are the ones exposed to a large quantum computer. Symmetric encryption such as AES is far less exposed (NIST describes AES-128 as secure “for decades”), but you still have to check how its key was agreed. A 2025 estimate puts breaking RSA-2048 at under a week with fewer than a million noisy qubits, on a machine that would still have to be built. Signatures are a separate risk: devices that cannot update how they check signatures need quantum-resistant signatures before they are deployed.
Where to start
Start by finding the locks: a cryptographic inventory of where each kind of encryption is used. Our earlier article Quantum Encryption and Banks: Find the Locks Before They Can Be Opened shows a working prototype of that first step. To be clear about where we stand: quantum safety is a new line of work for us, we have a prototype tool, and it has not yet run inside a bank.