The Monetary Authority of Singapore is signaling that the threat of quantum computing is no longer distant, inviting financial institutions to comment on proposed guidance for a transition to quantum-safe security measures by November 23, 2026. While not legally binding, the proposed Circular outlines MAS’ “supervisory expectations” for financial institutions’ migration, including milestones and timelines, acknowledging that the guidance builds on previous cybersecurity advisories and emphasizing that quantum-safe migration is a complex, multi-year undertaking requiring sustained commitment.
MAS Expectations for Financial Sector Quantum-Safe Migration
This compressed timeline signals the urgency MAS places on preparing for the potential disruption of cryptographically relevant quantum computers (CRQC) to existing security infrastructure. MAS anticipates a CRQC capable of breaking current encryption standards could emerge within the next few years, framing the threat as imminent rather than theoretical. The agency is requesting input on proposed milestones and completion timelines for transitioning to quantum-safe solutions.
MAS expects firms to establish interim checkpoints and quantitative targets to monitor progress, allowing for adjustments as the evolving threat landscape and cryptographic standards demand, and institutions are expected to actively monitor deployed quantum-safe solutions for vulnerabilities and implement prompt remediation measures when necessary. MAS specifically asks for comments on whether these expectations are comprehensive enough, seeking to broaden the scope of preparedness across the financial sector.
The guidance builds upon a previous advisory issued in February 2024, indicating a sustained focus on quantum security risks. MAS is also soliciting feedback on the proposed timelines for both developing migration plans and completing the full transition to quantum-safe systems.
The consultation paper states that “MAS seeks comments on the proposed supervisory expectations on quantum-safe migration, and whether there are any other expectations that should be included,” highlighting the agency’s commitment to collaborative development of robust security standards. The agency will communicate any updates to the timelines as the field progresses, acknowledging the dynamic nature of quantum computing and its implications for financial security.
Proposed Timelines for Quantum-Safe System Migration (CIIOs, DSIBs, NETS)
Financial institutions in Singapore face defined milestones for transitioning to quantum-safe cryptography, with the Monetary Authority of Singapore (MAS) requesting feedback on proposed timelines for both planning and implementation. Critical Information Infrastructure Owners (CIIOs), Domestic Systemically Important Banks (DSIBs), and NETS are subject to the most accelerated schedule, needing to submit quantum-safe migration plans to MAS by June 30, 2027. This requirement precedes a broader expectation for all financial institutions to develop such plans by December 31, 2027, establishing a tiered approach to preparedness.
MAS anticipates CIIOs will complete migration of systems designated as critical infrastructure by December 31, 2029, five years before the general deadline for all remaining systems, December 31, 2034. The agency acknowledges that technical or operational impediments may arise, stipulating that any deviations from these timelines must be documented alongside the implementation of appropriate interim controls.
See today’s quantum computing news on Quantum Zeitgeist for the latest breakthroughs in qubits, hardware, algorithms, and industry deals.
