Hong Kong Banks Score 2.3/10 on Quantum Readiness. US Banks Are No Different, and the Clock Is Running.

The HKMA invited all Authorized Institutions operating in Hong Kong to participate in the survey underlying the QPI. The aggregate PQC readiness score across all respondents: 2.3 out of 10.The HKMA’s target is 10 by 2030.

The sub-dimensions tell a consistent story. Institutions have written some things down. They have not done much with what they wrote.

The survey data translates the aggregate score into institution-level behaviour. The pattern is consistent, and it is not subtle.

The whitepaper asked respondents to rank their top three obstacles across four domains: risk assessment, cryptographic inventory, roadmap development, and vendor engagement. Vendor and third-party dependencies dominated every category.

Banks cannot migrate in isolation. Core banking platforms, payment processors, hardware security modules, certificate authorities, and financial market infrastructures all sit outside any single institution’s control. Without coordinated vendor roadmaps and a systematic way to assess vendor cryptographic posture, an otherwise sound migration plan stalls at the third-party boundary.

The HKMA’s own recommendation, to embed quantum-readiness clauses in procurement contracts and treat cryptographic transparency as a vendor selection criterion, is concrete, practical, and executable this quarter. It is also the precise workflow PQCClear automates.

It would be tempting to read 2.3/10 and conclude that Hong Kong’s banks have a particular problem. The evidence says otherwise. Their regulator has simply been unusually transparent, because it asked the questions and published the answers.

One month before the QPI, FINMA, Switzerland’s financial regulator, published Guidance 05/2026 on quantum computing, summarizing its own survey of 60 Swiss financial institutions conducted between November 2025 and January 2026.

Two of the world’s most sophisticated, well-regulated financial centres, surveyed within months of each other, producing almost identical results. The pattern is not jurisdictional. It is universal.

Run the same survey on US community banks and credit unions, institutions that typically have smaller security teams, greater reliance on third-party vendors, and less dedicated quantum risk awareness than their Hong Kong and Swiss counterparts, and the numbers would almost certainly be worse. The FFIEC has not yet published equivalent sector-wide PQC readiness data. When it does, the US community banking sector should not expect to be the exception to an emerging global pattern.

The HKMA report includes a compilation of government PQC migration programmes across nine jurisdictions. Read together, they describe a regulatory environment converging rapidly on the same requirements.

As Marin Ivezic observed in his analysis of the report, the debate over when Q-Day arrives is being overtaken by ecosystem-driven deadlines. Regulators, standards bodies, insurers, and procurement frameworks are setting their own clocks. For any institution operating across multiple jurisdictions, the practical planning answer is to work against the most demanding applicable deadline, which for most banks with federal contracts or connections to federal payment systems is December 31, 2030.

The HKMA’s most actionable recommendation is also its most important: embed quantum-readiness clauses in procurement contracts, and treat cryptographic transparency as a vendor selection criterion.

This is not a novel idea. DORA Article 28 creates exactly this obligation for EU financial entities. The FFIEC third-party risk framework creates the same obligation through the lens of information security. The executive order signed June 22, 2026 makes it explicit for federal contractors. What the HKMA has done is translate an abstract requirement into a concrete procurement practice that any institution, in any jurisdiction, can implement before the end of this quarter.

1. 01

   Add a quantum readiness assessment to your vendor onboarding process, so new relationships are scored before they are signed rather than remediated afterwards.

2. 02

   Request each critical vendor's PQC migration roadmap in writing, and document the response you get.

3. 03

   Include the right to conduct cryptographic assessments in new and renewed contracts, while the renewal is still open and you have leverage.

4. 04

   Track vendor progress over successive assessment cycles, so a stalled roadmap is visible as a trend rather than a surprise.

None of these actions require a quantum computer to exist. None require your institution to have completed its own internal migration. They require a decision to begin, and the documentation that you began. That documentation is what your examiner will ask for in 2027.

The HKMA has published a score and set a clock. The FFIEC has not yet published equivalent survey data for US institutions, but the global pattern makes the conclusion hard to avoid. The regulatory timeline is the same. The vendor dependency problem is the same. The harvest-now-decrypt-later risk is the same.

The four immediate actions the whitepaper recommends apply to every US bank and credit union regardless of asset size:

1. 01

   Engage the board. If quantum cryptographic risk has not been discussed at board level since the June 22, 2026 executive order, schedule a briefing this quarter. Reference EO 14412 and OMB M-26-15 by name.

2. 02

   Appoint an accountable owner. PQC migration without a named internal owner does not happen. Someone must own the inventory, the roadmap, and the vendor engagement programme.

3. 03

   Commission a cryptographic inventory. CISA's CBOM minimum elements guidance arrives March 19, 2027. Institutions that begin their inventory now will be compliant before the standard is formally required.

4. 04

   Engage critical vendors. Contact your three most critical fintech vendors this quarter. Ask specifically for their PQC migration roadmap. Document the response, or the non-response. Both are examination-relevant evidence.