HKMA · Quantum Preparedness
The HKMA wrote the playbook. ACD runs it.
In July 2026 the HKMA scored Hong Kong banking 2.3 / 10 on post-quantum readiness and published PACT — a complete framework for the transition to post-quantum cryptography. ACD is the discovery layer that makes PACT's hardest step executable.
The benchmark
2.3 out of 10, with a 2030 clock.
The Quantum Preparedness Index (QPI) scores the sector across four dimensions — Awareness, Planning, Pilots and Practical Preparedness. The gap between awareness and preparedness is the whole problem.
0
sector QPI score — the baseline ACD moves you off
0
of banks aware, planning or piloting — but not yet prepared
0
the HKMA’s full-readiness target
The whitepaper's own "four immediate steps" start with governance and end with vendors — but the middle step, commissioning a cryptographic inventory, is the one it calls the longest lead-time item. That's the step ACD collapses from months to days.
The framework
PACT — a framework for the whole journey.
PQC Accountability and Controlled Transition (a joint HKMA + HKUST framework, November 2026) organises a bank's PQC transition into four mutually supporting pillars.
Govern the transition
Institutional direction, accountable ownership and decision authority — with common requirements and demonstrated capability.
Assess and plan\u2190 ACD's pillar
Establish the current cryptographic position, assess exposure and timing, and bring plans into an integrated roadmap.
Implement and retire
Deliver authorised changes under controlled conditions and verify the approved target is achieved.
Maintain and adapt
Keep knowledge and controls current, and demonstrate the continuing ability to make further cryptographic change.
PACT groups related cryptographic uses into cryptographic estates with accountable owners, and runs on two information rails — direction and decisions down, evidence and feedback up. That evidence rail is where most tools fail.
The fit
ACD is the 'Assess and plan' pillar, automated.
PACT's second pillar begins at workstream 4.1 — establish the current cryptographic position. Every workstream in that pillar is a deterministic ACD output.
PACT runs on evidence. ACD produces it.
The framework's evidence-and-feedback rail can't be satisfied by a spreadsheet someone edits by hand, or a model that "probably" flags a finding. It needs deterministic, signed, re-runnable evidence — exactly what ACD emits.
Deterministic
Registry lookup, zero false positives.
Signed & reproducible
An auditor can re-run and confirm.
Continuous
Drift detection feeds the "maintain and adapt" pillar.