MAS Proposes Quantum-Safe Deadlines: A Plan by 2027, Critical Systems by 2030, Everything by 2034

On 6 November 2026, the Monetary Authority of Singapore published Consultation Paper P019-2026, a proposed Circular on Financial Sector Quantum-Safe Migration Guidance and Timelines. It is the supervisory expectations document MAS announced in July, and it applies to all financial institutions in Singapore, not only those designated as critical information infrastructure.

It is a proposal. Comments close on 23 November 2026, and MAS says the timelines may be revised as the threat, the standards and regulatory expectations evolve. But the shape is clear, and for most institutions the first date is about a year away.

The proposed dates

A "critical system" is one whose failure would significantly disrupt the institution's operations or materially affect its service to customers, such as a system that processes time-critical transactions or provides essential customer services. Where an institution cannot meet a date for technical or operational reasons, it should document why and put interim controls in place.

How binding is it?

MAS says the circular is not intended to impose legally binding obligations. It sets out supervisory expectations and is to be read alongside the Notice on Technology Risk Management, the Notice on Cyber Hygiene, the TRM Guidelines and the Outsourcing Guidelines. In practice, Singapore institutions treat MAS expectations as the standard their supervisor will examine against, and the CII owners, D-SIBs and NETS would have to put their plan in front of MAS directly.

What MAS expects the plan to contain

The draft lists five expectations:

1. Governance and accountability. Board or senior-management commitment, a clear owner, enough resources and regular progress reporting. Quantum risk goes into risk-management frameworks, policies and procurement.
2. A cryptographic asset inventory. At minimum the algorithms, key lengths and protocols in use, the systems and functions they support, and their dependencies, covering PKI, HSMs, cryptographic libraries and VPNs. Priority goes to assets that are business-critical, internet-facing, or tied to data with long retention periods.
3. A migration plan. Risk-based and approved by the board or senior management. It must cover the prioritised inventory; procurement rules requiring new systems to support quantum-safe algorithms or be upgradable to them in time; interim controls for assets that cannot move yet; capability gaps and training; and vendor engagement to align third-party roadmaps with the institution's dates.
4. Implementation. Test before deploying, including performance and interoperability (larger keys and more computation), migrate in phases, and document the justification and compensating controls for anything deferred.
5. Progress tracking. Interim checkpoints and quantitative targets, adjusted as standards evolve, plus monitoring of vulnerabilities in the post-quantum components themselves.

How it fits with CSA's dates

Banks designated as critical information infrastructure owners were already working to the Cyber Security Agency's milestones: a plan by 31 March 2027, quantum-safe procurement from 2028, and migration complete by end-2031. The MAS proposal adds to that rather than replacing it:

• Two plan dates in 2027: CSA's on 31 March, and the submission to MAS on 30 June. One plan, built once, can serve both.
• An earlier finish for CII: MAS proposes that FI CII owners complete migration of CII systems by end-2029, two years ahead of CSA's 2031 milestone.
• A date for everyone else: institutions outside CII now have dates too: a plan by end-2027 and critical systems by end-2030.

The 2030 date for critical systems also lines up with NIST's final IR 8547, which deprecates all quantum-vulnerable public-key algorithms after 2030, and with the US federal deadline for post-quantum key establishment.

What to do now

1. Read the draft and respond by 23 November. MAS asks three questions: on the expectations, on the timelines, and on anything that should be clarified. If a date is unworkable for your estate, say so with specifics now; afterwards you will be documenting deviations instead.
2. Start the inventory with the fields MAS names. Algorithm, key length, protocol, the system and function it supports, and dependencies. An inventory that only lists algorithm names will not support the prioritisation the draft asks for.
3. Decide which systems are "critical" under MAS's definition. That list sets your 2030 scope.
4. Write post-quantum requirements into procurement now. Systems bought in 2027 will still be running in 2030.
5. Ask each vendor for a dated roadmap for HSMs, payment switches, core banking and cloud services, and keep the answers as evidence.
6. Plan for quantitative progress reporting. Pick measures you can recompute every quarter, such as the share of critical systems still on RSA or ECC key exchange.

Qypher builds the cryptographic inventory MAS describes, with algorithm, key length, protocol, system and owner for each asset, maps each finding to MAS, CSA and TRM expectations, and generates the post-quantum migration artifacts your team deploys. Run a free scan →

Sources: MAS Consultation Paper P019-2026, Quantum-Safe Migration Guidance and Timelines for the Financial Sector (6 November 2026); MAS advisory MAS/TCRS/2024/01 (February 2024); CSA Quantum-Safe Handbook and Quantum Readiness Index (July 2026); NIST IR 8547 (final) (27 October 2026).