HKMA PQC Toolkit: A Detailed Prescription Without Demonstrated Results

Hong Kong's new PQC Toolkit is detailed. What remains unestablished is whether its approach works effectively, at proportionate cost, across different banks.

That is not an allegation. It is a limitation the authors explicitly acknowledge.

On 2 November 2026, the Hong Kong Monetary Authority (HKMA) and the Hong Kong University of Science and Technology (HKUST) released a Post-Quantum Cryptography (PQC) Toolkit for Hong Kong's banking sector. The package is substantial: a 117-page Reference Manual, a 29-page Practitioner Guide, 23 workstreams across four pillars, and a set of supporting tools including a data model, a dependency assessment questionnaire, reference architectures and a project planning tool.

I have read the Reference Manual and the Practitioner Guide. The governance framing is sound. The criticism that follows is grounded in what the documents themselves establish and what they leave unresolved.

Credit first

The toolkit treats PQC as institutional risk and operational change, not an algorithm replacement exercise. That framing is right.

Five governance concerns are addressed: ownership, protection needs, dependencies, controlled change and retirement. The inclusion of group service providers and critical suppliers is particularly sharp for banks whose transition depends on infrastructure and decisions outside the local entity.

The Reference Manual describes these principles across pages 11 and 12, and the workstream structure is mapped in the Practitioner Guide on pages 27 and 28.

Sound principles, however, do not validate the framework built around them.

The authors' own stated limitations

The Reference Manual contains a statement that deserves more attention than a footnote.

On page 97, and again on page 2, the authors write that the framework's effectiveness, implementation cost and scalability across banks have yet to be established empirically.

That is not my characterisation. It is theirs.

These are not peripheral questions. They determine whether the approach is useful at banking scale. A framework whose practical value remains empirically unestablished is, by its own admission, a proposition rather than a demonstrated delivery model.

The worked case study is hypothetical

The Reference Manual also states, on page 2, that the hypothetical case study and its results are illustrative and do not represent actual deployments or performance benchmarks.

A hypothetical case can explain the logic. It can walk a reader through the intended sequence. It cannot establish real delivery effort, operating cost or repeatability. The distinction matters: a detailed illustration is not implementation evidence, and banks should not treat it as such.

The structure creates its own workload

The toolkit introduces a considerable architecture: four pillars, three operating levels, two information rails, six ownership responsibilities and 23 workstreams. The Reference Manual covers this structural detail across pages 14 to 18 and 24 to 26.

The manual allows existing roles and records to carry these arrangements. That is a sensible provision. But somebody still has to keep the inventories, ownership maps, dependencies, decisions, tests and exceptions connected and current.

It looks as though you need a PMO just to manage the documentation. Where is the evidence that this burden pays for itself?

The Practitioner Guide, on page 4 and pages 27 to 28, includes a role-based route through the documents and a map back to the full workstreams. The navigation effort is recognised. But navigation support is not evidence of usability. The question is whether a delivery team can find its next action without first interpreting the architecture of the framework.

Ownership cannot manufacture capability

The Reference Manual acknowledges, on page 97, that assigning an owner cannot create a compatible product, additional supplier capacity or an acceptable alternative.

That is correct, and it deserves emphasis. Recording and escalating a dependency matters. It does not make the missing capability available. The framework must be judged on whether it helps resolve the constraint, not merely describe it.

Preparedness is not protection

The Practitioner Guide states, on page 5, that PACT does not make a QPI (Quantum Preparedness Index) score evidence of protection for a particular service.

That distinction matters. HKMA's own initial QPI assessment scored the sector at 2.3 out of 10, with an objective of full readiness by 2030. But a preparedness objective is not a security result. The question that remains is what protection has actually changed, across which services, with what remaining exposure.

The delivery language

Banks are "strongly encouraged" to use the toolkit. They are also expected to establish milestones and maintain senior-management oversight. There is an expectation to prepare.

The question is what makes persistent non-delivery consequential. Financial services runs on a funding hierarchy. Mandatory requirements get priority. Guidance competes for what is left. A framework that sits in the "should" category, without consequences for delay, leaves the programme exposed to postponement.

The authors identify the test themselves

The Reference Manual, on page 97, proposes evaluating whether PACT helps banks resolve responsibility gaps, make timely decisions and substantiate operating results at proportionate cost.

Those are the right tests. They are also, by the authors' own admission, unanswered. Publish the results.

What would convince me

Evidence from application across different banking environments. The time and effort required to adopt it. Delivery results and the constraints it helped resolve. Failures, revisions and lessons from real implementation. Evidence that the benefit justifies the cost of collecting and maintaining its records.

Show the operational results, not just the illustrative case.

The verdict

Another framework is not the missing piece. PACT contains useful disciplines. But its practical advantage over existing governance and change arrangements remains unproven.

Banks should not mistake a detailed management prescription for demonstrated transition capability.

The framework asks banks for evidence. The same standard should apply to the framework.

Show what it improves. Show what it costs. Show that it helps delivery.

---

Brian Couzens CEO, SITG-Consulting

Sources: HKMA, "Post-Quantum Cryptography (PQC) Toolkit", circular to all Authorized Institutions, 2 November 2026; PQC Toolkit Reference Manual; PQC Toolkit Practitioner Guide.