Early November 2026: Hong Kong's Bank Toolkit, Singapore's Dates, Post-Quantum Keys in AWS KMS

The short version

Two Asian financial regulators moved in the same week. Hong Kong gave its banks a toolkit, and Singapore proposed dates. Both start in the same place: governance, then a cryptographic inventory, then a prioritised plan with vendors in it. On the technology side, a major cloud key-management service now offers post-quantum key establishment, which removes one more "our provider doesn't support it yet" reason to wait.

Hong Kong: a toolkit for a sector scoring 2.3 out of 10

On 2 November, the Hong Kong Monetary Authority and HKUST launched a post-quantum cryptography toolkit for banks, called PQC Accountability and Controlled Transition (PACT). It covers governance and accountability, assessing cryptographic exposure, identifying transition needs and monitoring progress, with practical tools for inventorying cryptographic assets and their dependencies, setting priorities, engaging suppliers and building realistic timelines.

It follows the HKMA's Quantum Preparedness Index, launched in July, on which the banking sector's first score was 2.3 out of 10. The HKMA's target is 10 by 2030. "The Quantum Preparedness Index has established a clear starting point for the sector," said Arthur Yuen, the HKMA's Deputy Chief Executive. The toolkit is not a rule and sets no dates; it is meant to be adapted to each bank and updated over time.

Singapore: proposed dates for every financial institution

On 6 November, MAS published Consultation Paper P019-2026. It proposes a migration plan from every FI by end-2027, submitted to MAS by 30 June 2027 for CII owners, D-SIBs and NETS, with critical systems migrated by end-2030 and all systems by end-2034. Comments close on 23 November. Our full breakdown →

Malaysia wants to move faster

Speaking at MWC Doha, Malaysia's Communications Minister Fahmi Fadzil said "Malaysia is considering accelerating its quantum migration process" (Bernama via FMT, 9 November). He has asked the communications regulator MCMC to work with the National Security Council, the National Cyber Security Agency (NACSA) and telecom operators on an R&D space for faster, more secure migration. No timeline or rule has been announced yet; we will add one to our roadmap when it is published.

ML-KEM keys in AWS KMS

AWS Key Management Service now supports ML-KEM (FIPS 203) keys, in the ML_KEM_512, ML_KEM_768 and ML_KEM_1024 key specs, through new Encapsulate and Decapsulate operations, alongside the ML-DSA signing keys it already offered (AWS KMS developer guide). The keys are generated and held in FIPS 140-3 Level 3 HSMs; AWS notes they are not available in the China Regions. A direct "encrypt with ML-KEM" API is not there yet: AWS says it is tracking the IETF's post-quantum HPKE draft for that.

For banks, the practical point is that post-quantum key establishment is now available off the shelf in a major cloud key service. Where an application already uses KMS for RSA key wrapping or ECDH, there is now a post-quantum option to test against. That is exactly the kind of system an inventory should flag as "can migrate now", not "waiting on vendor".

The cat-qubit estimate, read carefully

Alice & Bob's preprint, IACR ePrint 2026/2665 (28 October), has been widely quoted since publication, and two figures are now circulating. Both are in the paper:

• About 23,000 cat qubits and 3.14 days to factor RSA-2048, the configuration the authors compile in full.
• About 611,000 cat qubits and 1.25 hours, by trading space for time and running in parallel.

It also estimates about 30,000 cat qubits and about an hour for an elliptic-curve key on secp256k1. All of it assumes hardware that has not been built: a 1 µs error-correction cycle and no bit-flip errors. Relaxing that assumption raises the RSA-2048 figure to about 45,000 cat qubits. These are design estimates, not a demonstration. The direction is still the one every estimate this year has taken: the cost of breaking RSA and ECC keeps falling. How the estimates fell in 2026 →

What to take from the week

• Supervisors in Asia now agree on the first step. HKMA's toolkit, MAS's draft, CSA's handbook and SAMA's circular all open with a cryptographic inventory that records algorithms, key lengths, protocols, dependencies and owners.
• "Our vendor doesn't support it" is getting weaker. Cloud KMS, browsers and major TLS libraries support ML-KEM. Find out which of your systems could move today.
• Date your plan against the earliest deadline you face. For an FI that is a CII owner in Singapore, that is now CSA's 31 March 2027 plan, then MAS's 30 June 2027 submission.

Qypher inventories cryptography across your public perimeter, code, cloud, binaries, keystores and HSMs, maps each finding to MAS, CSA, RBI, IRDAI, SAMA and the UAE policy, and generates the post-quantum migration artifacts your team deploys. Run a free scan →

Sources: HKUST and HKMA launch PQC toolkit (2 November 2026); MAS Consultation Paper P019-2026 (6 November 2026); Free Malaysia Today / Bernama (9 November 2026); AWS KMS: post-quantum keys; IACR ePrint 2026/2665 (28 October 2026).