Singapore proposes quantum-safe deadlines for financial institutions
A MAS consultation sets out a phased transition ending in 2034, with earlier deadlines for critical infrastructure. The guidance would not be legally binding.
The Monetary Authority of Singapore (MAS) has proposed that financial institutions protect critical systems against quantum-computing threats by the end of 2030, with other systems following by 31 December 2034. Its consultation would give firms until 31 December 2027 to prepare migration plans.
MAS said sufficiently powerful quantum computers could defeat public-key encryption algorithms in widespread use, threatening financial communications and data. There is no consensus on when those computers might emerge, but the regulator said it could be within the next few years.
The proposed guidance asks institutions to locate vulnerable systems and give priority to critical operations, systems exposed to the internet and information needing long-term protection. Plans should cover third-party vendors, management supervision and adequate resources.
Firms would be expected to test solutions before putting them into use. Where immediate upgrades are not possible, they should adopt temporary protections and record the reasons for delays.
Earlier plan-submission deadlines would apply to Critical Information Infrastructure Owners (CIIOs), Domestic Systemically Important Banks (DSIBs) and NETS: 30 June 2027. CIIOs would also be expected to finish migrating their critical information infrastructure systems by 31 December 2029.
The consultation ends on 23 November 2026. MAS said the guidance, which follows its February 2024 advisory on quantum cybersecurity risks, would carry no legally binding obligations. The deadlines could change as threats and cryptographic standards develop.
