The Monetary Authority of Singapore has proposed that every financial institution in the city-state move its critical systems to encryption that can withstand quantum computers by Dec. 31, 2030, and finish the job across all remaining systems by the end of 2034. The timetable is set out in a consultation paper MAS published on Nov. 6, which is open for comment until Nov. 23.

For banks, insurers, brokers and payment firms in Singapore, the paper turns a long-discussed technical risk into dated supervisory milestones. The largest players get less time. Domestic systemically important banks, operators of critical information infrastructure and the payments network NETS would have to hand MAS a migration plan by June 30, 2027.

What MAS is asking Singapore banks to do

The regulator's concern is a "cryptographically relevant quantum computer," a machine powerful enough to break public-key algorithms such as RSA and ECC that protect online banking, payments and interbank messages. MAS said in the paper that no date for such a machine has been agreed internationally, but that there is "strong consensus" it could arrive within the next few years.

The proposed circular lists five sets of expectations. Boards or senior management must own the program, fund it and receive regular progress reports, and quantum risk must be written into risk frameworks and procurement policies. Firms must build an inventory of their cryptographic assets, covering algorithms, key lengths, protocols and the systems that depend on them, and use it to rank what to fix first. Systems critical to operations, systems facing the internet and data that must be kept for long periods go to the front of the queue.

Each firm would also need a migration plan approved by its board or senior management. That plan must cover interim controls for systems that cannot yet be moved, skills gaps and vendor roadmaps, so that third-party suppliers upgrade on the firm's schedule. New systems bought from now on should either support quantum-safe algorithms or be upgradable to them within the deadlines. MAS also wants new cryptography tested for performance and compatibility before it goes live, noting that the larger keys and heavier computing load of quantum-safe algorithms may strain existing hardware.

The 2027, 2030 and 2034 timelines

For all financial institutions, the paper sets three indicative dates:

• Dec. 31, 2027: have a quantum-safe migration plan in place.
• Dec. 31, 2030: complete the migration of critical systems, defined as those whose failure would seriously disrupt operations or customer service, such as time-critical transaction processing.
• Dec. 31, 2034: complete the migration of all remaining systems.

Critical information infrastructure owners, the domestic systemically important banks and NETS face two extra milestones. They must submit their plans to MAS by June 30, 2027, and infrastructure owners must finish moving their critical infrastructure systems by Dec. 31, 2029, a year ahead of the general deadline for critical systems.

The circular would not impose legally binding obligations, MAS said. It sets out supervisory expectations, and firms that hit technical or operational obstacles may deviate if they document the reasons and put compensating controls in place. MAS said the dates may be revised as the threat, cryptographic standards and regulation change.

Building on 2024 advisory and CSA tools

The proposal builds on an advisory on quantum-related cybersecurity risks that MAS issued in February 2024, which set out the problem but carried no deadlines. It also points financial firms to tools from the Cyber Security Agency of Singapore. In July, CSA, GovTech and the Infocomm Media Development Authority released a Quantum-Safe Migration Handbook and a Quantum Readiness Index, a self-assessment questionnaire across five domains, after a public consultation. CSA said at the time that critical infrastructure owners and government agencies in particular must begin preparing now.

The move adds a security track to a busy MAS fintech agenda that already includes its work on cross-border settlement in tokenized deposits and stablecoins. Hong Kong regulators have also been setting out technology priorities for banks, as seen at the HKMA's Fintech Week.

MAS is seeking comment on three questions: whether the expectations are complete, whether the timelines are workable and whether any part of the draft needs clarifying. It said it will publish submissions with respondents' names unless they ask for confidentiality. The consultation closes at 11:30 p.m. on Nov. 23, five days after the Singapore FinTech Festival opens on Nov. 18.