Compliance

The regulator has already scored you.

The HKMA's Quantum Preparedness whitepaper (Jul 2026) scored the sector 2.3 out of 10 — and set a deadline. Here's the mandate, the regulation, and exactly where ACD fits.

Quantum Preparedness Index — sector average

The mandate

Four numbers that make the case.

The HKMA surveyed the sector across four readiness dimensions — Awareness, Planning, Pilots and Practical Preparedness. The gap is structural.

Hong Kong banking sector PQC readiness — Quantum Preparedness Index, Jul 2026

of institutions cite technical complexity as the top migration barrier

have not assessed their cryptographic exposure at all

still track cryptography in spreadsheets — no formal CBOM

What HKMA says to do now

Four immediate steps. One of them is the bottleneck.

The whitepaper's own words: these actions require no wait for quantum maturity or finalised guidance. The third is the longest lead-time item.

Engage the board

Frame quantum risk as an enterprise risk and make it a standing item in risk governance.

Identify an accountable owner

Give one senior sponsor a cross-functional mandate for quantum readiness.

Commission a cryptographic inventory

Accept that it will be imperfect at first and improve with iteration. The whitepaper calls this the longest lead-time item.

This is ACD's core job — eleven surfaces, one inventory, built to iterate.

Engage critical vendors

Request post-quantum roadmaps and embed readiness requirements in new contracts.

The checklist, answered

HKMA's asks — ACD answers every line.

Each line is the whitepaper's own language, mapped to the ACD output that satisfies it.

HKMA's ask

What ACD ships

Commission the cryptographic inventory (CBOM) — the longest lead-time item

11-surface automated discovery → CycloneDX CBOM

System-level visibility over where asymmetric crypto is used

Deterministic scan: code · binaries · keys · certs · deps · TLS · runtime

Identify & prioritise the cryptographic exposure

Quantum verdict + Mosca risk per asset → P0–P3 roadmap

Build for cryptographic agility

Drift + re-scan — a living inventory, not a one-off

Migrate to the right replacement — sign vs encrypt

Purpose-aware: RSA-sign → ML-DSA · RSA-encrypt → ML-KEM

The clock

This is a multi-year programme. It starts now.

Now

Assess & plan

Commission the inventory. Score readiness. Prioritise the exposure.

2030

HKMA target

Fintech 2030 + the whitepaper's readiness push — migrate high-risk systems.

2035

The wider clock

Long-lived data and "harvest now, decrypt later" make the window shorter than it looks.

Regulation

The Hong Kong landscape

Beyond the PQC whitepaper, the crypto inventory is the evidence base under these obligations.

HKMA — Cybersecurity Fortification Initiative (CFI)

The HKMA's CFI (including the C-RAF assessment and iCAST intelligence sharing) is the umbrella for banking cyber-resilience. The Quantum Preparedness whitepaper extends it with a sector-wide PQC readiness score and a 2030 target.

PCICSO (Cap. 653) — Protection of Critical Infrastructures

In force 1 Jan 2026. Eight sectors (including banking & financial services) face an annual risk assessment, an independent audit every 24 months, and a 12-hour serious-incident notification window. A cryptographic inventory is the evidence base that makes those obligations provable.

SFC — internet trading & AI-cyber circular (26EC32)

The SFC's cyber-resilience expectations for licensed intermediaries sit alongside the HKMA regime. ACD's inventory and readiness score feed directly into the risk-assessment evidence they expect.

Insurance Authority — GL20

IA GL20 sets a 72-hour incident-notification window. Continuous cryptographic monitoring (drift + re-scan) keeps you inside that window, not reacting after the fact.

Standards

The migration targets

ACD's purpose-aware roadmap maps each asset to the NIST post-quantum standard it belongs to.

FIPS 203 (ML-KEM)

Key encapsulation — the quantum-safe replacement for RSA/ECC encryption & key exchange

FIPS 204 (ML-DSA)

Digital signatures — the quantum-safe replacement for RSA/ECDSA signing

FIPS 205 (SLH-DSA)

Stateless hash-based signatures — a conservative alternative to ML-DSA

NIST IR 8547

Transition guidance — when and how to migrate from classical to post-quantum algorithms

References

Quantum Preparedness of Hong Kong's Banking Sector HKMA, July 2026
HKMA press release — quantum preparedness whitepaper 27 July 2026
Protection of Critical Infrastructures (Computer Systems) Ordinance (Cap. 653) In force 1 January 2026
HKMA Cybersecurity Fortification Initiative (CFI) HKMA
NIST FIPS 203 / 204 / 205 — Post-Quantum Cryptography Standards NIST, 2024
NIST IR 8547 — Transition to Post-Quantum Cryptography Standards NIST, 2024

ACD discovers and plans the transition; it does not perform the cryptographic migration itself.