🌐 Quantum Weekly - The Global Signals That Actually Mattered (2 to 8 November 2026)

Brian Couzens

2 days ago

13 min read

A Navy Image of the world with the dates

9 November 2026

The week of 2 to 8 November moved post-quantum cryptography (PQC) into financial supervision and third-party assurance. Two Asian financial regulators acted four days apart: the Hong Kong Monetary Authority (HKMA) gave banks a PQC toolkit after measuring the sector at 2.3 out of 10 on its own readiness index, and the Monetary Authority of Singapore (MAS) published a consultation on quantum-safe migration with proposed dates for financial institutions in Singapore. Between the two, the US National Security Agency (NSA), the US Cybersecurity and Infrastructure Security Agency (CISA) and the Australian Signals Directorate's Australian Cyber Security Centre (ASD's ACSC) issued joint questions for organisations to put to their vendors on PQC readiness. Capital and infrastructure moved alongside: IonQ completed its all-stock acquisition of the Zero Trust company Elisity, issuing USD 1.15 billion in shares, and in the United Kingdom the Financial Conduct Authority (FCA) set up a quantum computing experimentation group while UK Research and Innovation (UKRI) committed new quantum skills and networking funds. Six confirmed signals came from five jurisdictions: Hong Kong, the United States, Australia, the United Kingdom and Singapore. None is evidence that a cryptographically relevant quantum computer exists today.

📌 SITG-Consulting - Own Announcements (outside the signal count)

During the window I published "How NIST IR 8547 Final Affects TLS 1.3 and PQC Migration" and "How Would Q-Day Actually Unfold? Not a Breach You Patch" (2 November). On 3 November 2026 I announced that SITG-Consulting is Intelligence Sponsor of Curaçao Quantum Week 2026, organised by the Curacao Quantum Safe Foundation and running from 3 to 10 November. The announcement date is 3 November; no signing date for the sponsorship is stated in the post. I then published a review of Sectigo's Crypto Agility Report 2026 (4 November), "Independent PQC Assurance: Why Evidence Must Replace Assumption in Post-Quantum Migration" (5 November), my PQC Governance Digest: Cut-off 6 November 2026 (6 November), an analysis, "MAS P019-2026 Under the Microscope: Singapore's PQC Migration Paper" (7 November), and "A Message to Global Regulators on Quantum Risk and Readiness" (8 November).

🇭🇰 Hong Kong - HKMA Gives Banks a PQC Toolkit After Measuring the Sector at 2.3 Out of 10

Financial Supervision / Readiness Measurement / Bank Governance

The Detail: On 2 November 2026 the HKMA, in a press release, announced the launch of a PQC Toolkit co-developed by the HKMA and the Hong Kong University of Science and Technology (HKUST). A circular to all authorised institutions carries the same issue date.

The HKMA reports that the banking sector's initial score on its Quantum Preparedness Index (QPI) was "2.3 out of 10", which it describes as an early stage of readiness.
The Toolkit "sets out a structured and comprehensive framework" for banks' PQC transitions, covering governance, assessment of cryptographic exposure, transition needs and progress monitoring.
The HKMA states that the Toolkit aims to drive the sector toward "a QPI score of 10 by 2030", which it equates with full quantum readiness. That is an aim, not a mandatory deadline.
Arthur Yuen, HKMA Deputy Chief Executive: "The Quantum Preparedness Index has established a clear starting point for the sector."

Why it matters: A supervisor has measured its banking sector, published the score and issued a framework to raise it, with a named year attached. For boards of Hong Kong authorised institutions, the score becomes a benchmark that the supervisor can return to; a bank that cannot place itself on the index will find that harder to explain in 2027 than today. Banks operating in Hong Kong and elsewhere should map the Toolkit's governance and exposure-assessment steps to their group programme now, so that one inventory serves both. A PQC Readiness Assessment tests that programme against what supervisors are now asking for.

🇺🇸 🇦🇺 United States and Australia - NSA, CISA and ASD's ACSC Publish Joint Questions to Put to Vendors on PQC Readiness

Third-Party Risk / Procurement / Joint Guidance

The Detail: On 4 November 2026 the NSA, in a release datelined Fort Meade, announced that it had joined ASD's ACSC and CISA in releasing "Post-quantum questions to ask your vendors: Evaluating third-party readiness for post-quantum cryptography".

The guidance offers vendor-neutral questions for procurement, contract renewals and ongoing vendor assurance.
The release states that an organisation's transition to PQC "will depend on its vendors' readiness, transparency, and roadmaps."
The guidance aligns vendor engagement to five phases of an organisation's PQC transition: locating and inventorying cryptographic dependencies, assessing risk to individual systems, triaging and prioritising systems for transition, implementing PQC algorithms, and communicating with vendors and educating relevant stakeholders.
The release sets no deadlines; it refers only to engagement within "required timeframes".

Why it matters: Three national agencies across two countries have put PQC readiness into the procurement and contract cycle. The questions transfer part of the inventory burden to suppliers. A buyer that asks and records the answers creates an evidence trail on cryptographic implementations, roadmaps and transparency. A buyer that does not engage leaves a gap in its supplier assurance. Procurement and third-party risk teams should add the questions to renewal templates for any supplier that implements cryptography on their behalf, and record the answers as assurance evidence. Answers are claims until tested; Quantum Trust and PQC Assurance checks supplier statements against what the product does.

🇺🇸 United States - IonQ Completes Its Acquisition of Elisity, Issuing USD 1.15 Billion in Shares

Capital Markets / Consolidation / Security Platforms

The Detail: On 4 November 2026 IonQ, in a release datelined College Park furnished to the US Securities and Exchange Commission with a Form 8-K, announced that it had completed its acquisition of Elisity, a Zero Trust security company, in an all-stock transaction. Its Form 8-K records completion on 3 November.

"At closing, IonQ issued $1.15 billion of consideration in common stock under the terms of the merger agreement."
The sellers may earn up to a further USD 150 million based on Elisity's performance against revenue milestones through January 2028.
IonQ's chairman and chief executive, Niccolo de Masi, states that IonQ "now brings together post-quantum cryptography, quantum key distribution, and Zero Trust security in a single platform".
The deal was announced before the window; completion falls in it.

Why it matters: A quantum hardware company has paid for network security capability in its own stock, and says it now offers PQC, quantum key distribution (QKD) and Zero Trust as one platform. In my assessment, that brings quantum hardware vendors into the same buying conversation as conventional security suppliers. Buyers should evaluate each component on its own evidence: PQC against the NIST standards and validated modules, QKD against the authentication limits national agencies have published, and Zero Trust against existing architecture. A single platform, if delivered as described, is a procurement convenience; it is also a concentration of dependency on one supplier for both today's controls and tomorrow's cryptography.

🇬🇧 United Kingdom - FCA Sets Up a Quantum Computing Experimentation Group, Starting With Financial Crime

Financial Supervision / Quantum Computing Applications / Industry Collaboration

The Detail: On 5 November 2026 the FCA, in a press release (first published 5 November according to the page; page metadata records 4 November), announced a Quantum Experimentation Group bringing together financial services firms, quantum technology providers and national research laboratories.

The group will first explore how quantum machine learning could help detect money laundering and fraud, using an FCA synthetic dataset.
It will launch in the first quarter of 2027; interested organisations can register until 31 December 2026.
The FCA describes the group as "the first of its kind for a regulator". That is the FCA's claim.
Jessica Rusu, the FCA's chief data, information and intelligence officer: "We want to help firms explore where quantum could make a meaningful difference".

Why it matters: A conduct regulator is building working knowledge of quantum computing through hands-on experiments rather than reading about it. In my assessment, supervisors that understand the technology from the inside ask sharper questions about its risks, including the cryptographic risk that sits on the other side of the same capability. The group concerns applications, not PQC, and has no direct cryptographic bearing. Firms that join should keep the two tracks separate in their governance: experimentation with quantum computing does not substitute for a PQC migration plan.

🇸🇬 Singapore - MAS Consults on Quantum-Safe Migration Dates for Financial Institutions in Singapore

Financial Supervision / Migration Deadlines / Systemic Institutions

The Detail: On 6 November 2026 MAS published Consultation Paper P019-2026, which seeks feedback on a proposed Circular that "sets out MAS' supervisory expectations for financial institutions in Singapore to prepare for quantum-safe migration, including indicative milestones and completion timelines." The consultation closes on 23 November 2026.

The paper states that "The proposed Circular is not intended to impose legally binding obligations on FIs".
For all financial institutions: "FIs should aim for the following indicative timelines for their quantum-safe migration." A migration plan by 31 December 2027; migration of critical systems completed by 31 December 2030; "all remaining systems" by 31 December 2034.
For Critical Information Infrastructure Owners (CIIOs), Domestic Systemically Important Banks (DSIBs) and NETS, the paper states that additional expectations "will apply": a quantum-safe migration plan submitted to MAS by 30 June 2027, and, for CIIOs, migration of critical information infrastructure systems completed by 31 December 2029.
Where technical or operational impediments exist, institutions "should document the reasons for deviation and implement appropriate interim controls." For systems that cannot be readily migrated, the paper also expects institutions to "implement appropriate interim compensating controls, and document the controls applied and justification for deferral."
The paper states that the timelines may be revised as the threat landscape and standards evolve.

Why it matters: This is a proposal, not a rule, but the dates are specific and the proposed plan from CIIOs, DSIBs and NETS goes to the supervisor by 30 June 2027. Singapore's Cyber Security Agency, in its 14 October 2026 release, restated a 2031 target for migration of critical information infrastructure systems; the MAS proposal for financial-sector CIIOs is end-2029, earlier than that national target. Institutions inside scope have until 23 November to respond, and should test now whether their inventory can support a plan that MAS will read. In my assessment, the deviation provision is where supervisory judgement will concentrate: an institution that intends to rely on it needs documented impediments and appropriate interim controls, not a general statement of difficulty. I set out where the paper is strong and where it leaves gaps in my analysis of 7 November.

🇬🇧 United Kingdom - UKRI Commits £12 Million to a Quantum Commercialisation Skills Centre and £35 Million to Networking Testbed Calls

Sovereign Infrastructure / Skills / Quantum Networking

The Detail: On 6 November 2026 UKRI, in a news release published for the National Quantum Technologies Showcase, set out new quantum investments.

The Engineering and Physical Sciences Research Council (EPSRC) has selected the UK Quantum Super Connector, a partnership led by Imperial College London with the universities of Bristol, Cambridge, Glasgow and Oxford, to establish a national Quantum Commercialisation Skills Centre. "The centre will receive £12 million of funding."
"£35 million from Innovate UK will support two new funding calls for quantum networking testbeds", launching in February 2027.
UKRI will also invest over £4 million in capital equipment for the Quantum Technology Research Hubs and £600,000 in research infrastructure underpinning work toward a UK quantum internet.
The release cites an independent evaluation of the original £300 million EPSRC programme, estimating £547 million in monetised benefits, including projected benefits, against £442 million in programme costs.
The £138 million quantum sensing procurement mentioned in the release was announced in the Budget a week earlier and falls outside this window.

Why it matters: In my assessment, public money is going to two constraints that limit adoption: people who can commercialise the technology, and testbeds where quantum networking can be tried before it is bought. For operators of critical networks, testbeds are where QKD and related claims can be examined under controlled conditions; in my assessment, organisations considering quantum networking should seek evidence from such testbeds before procurement, not after. The release has no PQC content and no direct cryptographic bearing.

🌐 Global Sweep - Supervisors Set the Pace, Suppliers Answer for It

Ecosystem / Capital Markets / PQC Infrastructure / Hardware Architecture / Sovereign Security

The Detail:

Financial supervision: the HKMA measured its banking sector at 2.3 out of 10 and issued a toolkit with an aim of full readiness by 2030; MAS proposed indicative migration dates for all financial institutions, with additional expectations that "will apply" to CIIOs, DSIBs and NETS, including a migration plan submitted to MAS by 30 June 2027; the FCA set up a quantum computing experimentation group on financial crime.
PQC infrastructure and third-party risk: NSA, CISA and ASD's ACSC issued joint vendor questions for procurement, renewals and ongoing assurance.
Capital markets: IonQ completed its Elisity acquisition with USD 1.15 billion issued in stock. Listed quantum companies reported quarterly results in the window (IonQ, Quantinuum and IQM on 5 November, Pasqal on 6 November); these are noted, not counted.
Sovereign infrastructure: UKRI committed £12 million to a quantum commercialisation skills centre and £35 million to quantum networking testbed calls.
Hardware architecture: no counted signal. Hardware items this week were vendor product, component or results announcements (see What Was NOT Missed).
Regions with no counted in-window signal meeting the primary-source standard: Canada; European Union institutions and member states (Germany, France, Netherlands, Finland, Sweden, Denmark, Spain, Italy); Switzerland and Israel; GCC (Qatar, UAE, Saudi Arabia, Bahrain, Kuwait, Oman); Japan, China, South Korea, India, Taiwan and Malaysia; Africa (South Africa, Nigeria, Kenya, Ghana); Latin America (Brazil, Chile, Mexico, Colombia). Brazil and South Korea produced in-window items that did not meet the inclusion rule. This records that no signal was verified to the standard; it does not show that nothing occurred.
Geographic position: six signals from five jurisdictions. The United Kingdom and the United States appear in two each, and Hong Kong, Australia and Singapore in one each.
Standards bodies and regulators with no confirmed in-window PQC output identified: NIST (one pre-draft on key derivation, not PQC), the European Commission, ENISA, Europol, ETSI, BSI, ANSSI, the European Central Bank, the Bank of England, the Bank for International Settlements and the Financial Stability Board.

Why it matters: Supervisors in two Asian financial centres put numbers and dates in front of banks in the same week that three national agencies gave buyers a script for questioning suppliers. The two halves fit: a supervisor asks the institution for a plan, and the institution cannot write one without answers from its vendors. For boards, PQC readiness is now something a supervisor can score and a procurement file can evidence, or fail to.

🔮 SITG-Consulting COMMENT - THE WEEK'S REAL SIGNAL

In my assessment, the week's highest-consequence signal is the MAS consultation. MAS has put proposed dates against named classes of institution, with a proposed plan from CIIOs, DSIBs and NETS due on its desk by 30 June 2027. The paper says the Circular would not be legally binding. A supervisory expectation with a submission date attached will still be read by boards as a deadline, and in my assessment it should be.

MAS: the deviation provision is the test. Documented reasons plus interim controls will separate institutions with evidence from those with intentions. The proposed end-2029 date for financial-sector CIIOs is earlier than Singapore's national 2031 target for critical information infrastructure.
HKMA: a published sector score of 2.3 is a baseline the supervisor can measure against. Banks should know their own position on the index before they are asked.
NSA, CISA and ASD's ACSC: the vendor questions turn third-party PQC readiness into written evidence. A supplier's answer is a claim; the buyer still needs to test it.
IonQ and Elisity: the acquisition brings the capabilities under one corporate owner; IonQ says it combines PQC, QKD and Zero Trust in a single platform. Concentration of dependency belongs in the risk register next to the convenience.
FCA: a regulator learning the technology hands-on will ask better questions of firms on both sides of it, applications and cryptographic risk.

The defining shift: PQC readiness is now being measured by supervisors and evidenced through suppliers. Institutions with an inventory, a governed migration plan and tested supplier evidence will be better placed to demonstrate readiness. Those artefacts do not replace implementation, operational testing or progress monitoring. Cryptographic Agility Services build the capability to change algorithms on the timetable a supervisor sets.

⚠️ Important - What Was NOT Missed

None of the six counted announcements demonstrates a cryptographically relevant quantum computer or a successful cryptanalytic attack. Quantinuum's quarterly results state that its Helios system "Reached 99.9995% logical fidelity in October"; that is the company's claim, the results passage itself cites no paper, and it makes no cryptanalytic claim.
None of the counted announcements establishes a basis for abandoning PQC migration or omitting the separate migration of digital signatures.
UK National Cyber Security Centre Annual Review 2026 (3 November) includes a section on preparing for the quantum transition and states that "2031 is a key date for the migration of critical services and components"; it restates existing NCSC timelines with no new policy. Not counted.
Quarterly results: IonQ (5 November; revenue USD 173.8 million, with headline net income driven by a non-cash warrant gain), Quantinuum (5 November), IQM (5 November), Pasqal (6 November) and WISeQey, formerly WISeKey (3 November, preliminary). Company financial reporting without a governance or deployment signal. Not counted.
IETF: the IESG approved draft-ietf-hpke-hpke, the revision of Hybrid Public Key Encryption, on 2 November; the document does not define the post-quantum algorithms, which sit in a separate draft. NIST published a pre-draft call for comments on SP 800-108 Revision 2 (key derivation) on 4 November, with no PQC content. Neither counted.
Vendor announcements: IBM, Oak Ridge National Laboratory and AMD error-correction co-design platform (5 November); IBM Quantum System Two operational in Chicago (6 November); IDEMIA Secure Transactions, Acceleronix and Orange quantum-safe eSIM provisioning trial kits (4 November); Horizon Quantum's non-binding letter of intent to acquire Entropica Labs for about USD 27 million (5 November); Toshiba Europe's Innovate UK quantum networking contract (6 November); SEALSQ and TechAgency services partnership (6 November); Universal Quantum chip launch (3 November); Quantum Motion superinductor paper (4 November); Quint Computing EUR 9.1 million seed (5 November). Not counted.
Netherlands Cybersecuritybeeld 2026 (6 November) mentions quantum computers once, in passing. Not counted.
India: the Reserve Bank of India's Master Directions on cyber resilience for non-bank payment system operators (5 November) contain no quantum or PQC provisions. Not counted.
Pending, primary source not reached or not found: Brazilian press reported that two quantum computers destined for CIQUANTA-PB arrived at the Port of Suape on 5 November. No dated primary announcement was verified. Yonsei University's IBM Nighthawk installation (4 November) and Korea's Hangang supercomputer (2 November) were found only in press, and no primary page links Hangang to quantum computing. A QNu Labs training programme release carries no dateline. Excluded.
Out of window: IDEMIA Secure Transactions' EMVCo certification for a PQC-capable card platform (29 October, covered in press from 2 November); AWS KMS support for ML-KEM (26 October); Singapore CSA Quantum-Safe Kickstarter Grant (announced 14 October); Europol's quantum report (October); the UK Budget's £138 million quantum sensing procurement (the week before 6 November). Malaysia's Communications Minister Fahmi Fadzil spoke on quantum migration at MWC Doha; the reports reviewed are dated 9 November, after the window.
Forward context: MAS consultation closes 23 November 2026; the ITU Plenipotentiary Conference opens in Doha on 9 November; Executive Order 14412 gives the Federal Acquisition Regulatory Council until 19 December 2026 to publish a proposed rule; that is the order's deadline, not a confirmed publication.

⚠️ Disclaimer

This newsletter is produced by SITG-Consulting for informational purposes only. It does not constitute professional advice, whether legal, technical, regulatory, or otherwise. The content reflects publicly available information and the author's independent analysis as of the date of publication. Readers should verify all claims independently and seek qualified professional counsel before making decisions based on this material. SITG-Consulting accepts no liability for actions taken or not taken based on the contents of this newsletter.

Previous edition: https://www.sitg-consulting.com/post/quantum-weekly-the-global-signals-that-actually-mattered-26-october-1-november-2026 Full archive: https://www.sitg-consulting.com/blog

SITG-CONSULTING