MAS P019-2026 Under the Microscope: Singapore's PQC Migration Paper

Brian Couzens

2 minutes ago

6 min read

The Monetary Authority of Singapore has put dated quantum-safe migration expectations in front of its entire financial sector, and the dates are tighter than those of the UK, the EU and NIST. The paper behind them carries no binding force, leaves its technical standard in a non-mandatory handbook, asks for no independent assurance and allows deviation on grounds it never defines. This is an analysis of MAS Consultation Paper P019-2026: what it says, what it leaves out and what the final Circular needs.

What MAS Published

In November 2026, MAS issued Consultation Paper P019-2026, Quantum-Safe Migration Guidance and Timelines for the Financial Sector. It proposes a Circular setting out supervisory expectations for how financial institutions (FIs) in Singapore migrate to post-quantum cryptography (PQC).

The paper is seven pages long. Take out the cover, the contents page and the submission instructions, and the regulatory position runs to just over three pages.

It sets five expectations: governance and accountability, a cryptographic asset inventory, a board-approved migration plan, tested implementation, and progress tracking. It sets indicative dates: a migration plan by 31 December 2027, critical systems migrated by 31 December 2030 and all remaining systems by 31 December 2034. Critical Information Infrastructure Owners (CIIOs), Domestic Systemically Important Banks (DSIBs) and NETS are expected to submit their plans to MAS by 30 June 2027, and CIIOs to migrate their CII systems by 31 December 2029.

Comments close on 23 November 2026.

Not Binding by Design

Paragraph 1.1 is explicit. The proposed Circular is "not intended to impose legally binding obligations" on FIs. It sets supervisory expectations with indicative milestones, and the operative verb throughout is "should".

The Circular creates no penalty of its own. Paragraph 2.6 says it is to be read as supplementary to MAS's existing Notices and Guidelines, including the Notice on Technology Risk Management and the Notice on Cyber Hygiene. Those Notices are binding, so supervisory pressure is not absent. But any enforcement would have to be argued through instruments that say nothing specific about quantum-safe migration. The paper does not draw that link itself.

Reporting follows the same pattern. Only CIIOs, DSIBs and NETS are expected to submit a plan to MAS. Every other institution writes its plan and keeps it.

The Standard Lives in a Non-Mandatory Handbook

The paper names no algorithm, no key size and no protocol profile. It does not mention hybrid cryptography, cryptographic agility or harvest-now-decrypt-later by name. It does not refer to the National Institute of Standards and Technology's (NIST) post-quantum standards, FIPS 203, 204 and 205.

Instead, paragraph 2.2 "encourages" institutions to refer to the Cyber Security Agency of Singapore's (CSA) Quantum-Safe Migration Handbook and Quantum Readiness Index. That handbook, published as version 1 on 16 July 2026, does the technical work. It recommends ML-KEM, ML-DSA and SLH-DSA, restricts LMS and XMSS to firmware signing, discusses hybrid deployment as an interim strategy and sets out requirements for cryptographic agility.

It also states that it is for informational purposes only and "not mandatory, prescriptive or exhaustive".

So the financial regulator has set expectations for a cryptographic migration and left the definition of the destination in a document that declines to be a standard. An institution can meet every expectation in the MAS paper without adopting a single algorithm the handbook recommends.

Harvest-Now-Decrypt-Later Is Implied, Not Named

The CSA handbook calls harvest-now-decrypt-later "the immediate threat": adversaries collecting encrypted data today to decrypt once a cryptographically relevant quantum computer (CRQC) exists.

The MAS paper never uses the term. It comes close once, asking institutions to prioritise assets "associated with data that has long retention periods". That is the right instinct, but it is a prioritisation criterion, not an exposure analysis. Nothing asks institutions to establish how long their data must stay confidential, which encrypted holdings are already exposed in principle, or how that exposure shapes the order of migration.

For a sector holding customer records, transaction histories and contractual data with confidentiality obligations measured in decades, the timeline should start at exposure, not at migration.

Dates That Lead Their Peers, and an Exit Nobody Has Defined

On dates alone, MAS is ahead. Its 2030 deadline for critical systems and 2034 for everything else compare with CSA's own milestones of 2031 for CII owners and 2035 for other organisations; the UK National Cyber Security Centre's 2031 for priority migration and 2035 for completion; the EU coordinated roadmap's 2030 for high-risk use cases and 2035 for the rest; and NIST IR 8547, finalised in October 2026, which deprecates quantum-vulnerable public-key algorithms after 2030 and disallows them after 2035.

The weakness is not the dates. It is the exit. Paragraph 2.3 permits deviation wherever "technical or operational impediments exist", provided the institution documents its reasons and applies interim controls. The paper defines neither an impediment nor an adequate interim control. Every date in the paper is therefore as firm as the weakest justification an institution is prepared to write down.

There is also a tension inside the paper itself. Paragraph 2.1 states there is "strong consensus" that a CRQC could emerge "within the next few years". Full migration is set for 2034. If MAS believes its own threat statement, the exit clause needs a much harder edge than this.

Two Regulators, Two Timetables

A financial institution designated as a CII owner now faces two sets of dates for the same systems. CSA expects CII owners to submit a migration plan by 31 March 2027 and complete CII migration by 31 December 2031. MAS expects the same institution to submit a plan to MAS by 30 June 2027 and complete CII migration by 31 December 2029.

The tighter MAS date may be deliberate. The paper does not say so, does not mention CSA's milestones and does not explain whether one plan can serve both regulators. That is a reconciliation the final Circular should make, not one each bank should have to infer.

No Independent Assurance

Institutions are asked to build an inventory, write a plan, migrate and track progress against quantitative targets they set themselves. At no point does the paper ask anyone outside the institution to verify any of it.

No independent validation of the inventory. No external assurance over the migration. No defined evidence standard. An institution can define its own scope, build its own inventory, set its own targets and report its own success. For a change that touches payments, authentication and customer data across the sector, self-assessment is not a sufficient control.

Ownership Without an Owner

The paper asks for board-level or senior management commitment "with clear ownership". It does not say who the owner should be.

That matters because ownership decides scope, budget and reporting line. Left open, the programme drifts to whichever function accepts it, which in practice is the CISO's office. Quantum-safe migration is an enterprise risk programme. SITG-Consulting's position is that it belongs with the Chief Risk Officer, reporting to the board risk committee, with the CISO as delivery partner rather than owner.

Supply Chain Reduced to Engagement

Third-party risk appears in three places: quantum risk integrated into procurement processes, procurement requirements that new systems support or can be upgraded to quantum-safe algorithms, and "vendor engagements to align third-party migration roadmaps" with the institution's timelines.

The procurement clause is useful. The rest asks institutions to talk to vendors. It does not ask them to obtain evidence: a vendor's own inventory, a dated roadmap, validated implementations, or a position on what happens to dependencies that cannot move in time. Core banking platforms, payment networks, cloud providers, hardware security module (HSM) manufacturers and certificate authorities determine whether an institution can migrate at all. Engagement is not assurance.

What MAS Got Right

MAS has put dated expectations in front of its entire financial sector, not only its largest institutions. Its dates are tighter than those of its peers. The tiered approach, with earlier dates for CIIOs and plan submission for DSIBs and NETS, is structurally sound. The inventory expectation is specific: algorithms, key lengths, protocols, the systems they support and their dependencies. The procurement clause will shape purchasing decisions now rather than in 2030. The requirement to test for performance and interoperability before deployment reflects operational reality.

What the Final Circular Needs

Binding force, or an explicit statement of how the Technology Risk Management Notice applies to quantum-safe migration. A named accountable executive. MAS's own minimum baseline for algorithms and protocols, rather than a pointer to a handbook that disclaims being prescriptive. Harvest-now-decrypt-later written into prioritisation, with data confidentiality periods as an input. Independent assurance over the inventory and the migration. Vendor evidence, not vendor engagement. A defined test for what counts as an impediment and what counts as an adequate interim control. One reconciled timetable with CSA for institutions that are also CII owners.

Intent Is Not a Standard

MAS has signalled clearly, and its dates show ambition. But expectations without binding force, a technical standard held in a non-mandatory handbook, no independent assurance and an exit clause with no definition add up to a signal, not a framework.

The consultation closes on 23 November 2026. The question is whether the final Circular will contain what this paper does not.

SITG-CONSULTING