Singapore’s financial regulator has moved from warning to wiring deadlines. In November 2026, the Monetary Authority of Singapore (MAS) opened consultation on a proposed circular that sets out supervisory expectations for quantum-safe migration, complete with indicative milestones and completion timelines for financial institutions. The consultation, numbered P019-2026, closes on 23 November 2026, signalling that the “wait and see” phase for banks is over.
A Circular With a Calendar Attached
The draft circular does not simply ask banks to “consider” quantum risk. It establishes a structured migration pathway: inventory cryptographic assets, rank systems by exposure, phase out vulnerable public-key algorithms, and demonstrate progress against supervisory checkpoints. MAS has consistently framed this as a multi-year operational programme rather than a cybersecurity side project. Vincent Loy, MAS assistant managing director for technology and chief technology officer, has described quantum-safe readiness as part of a broader convergence of cloud, AI and quantum risks that demands board-level accountability.
The timeline pressure is reinforced by parallel guidance from the Cyber Security Agency of Singapore (CSA). CSA’s Quantum-Safe Migration Handbook, released in July 2026, recommends that organisations exposed to quantum threats draw up migration plans by 2027 and complete the transition by 2035. For critical information infrastructure owners, including banking and finance, the milestones are tighter: formal migration plans to CSA by March 2027, new systems quantum-safe from January 2028, and full migration of CII systems by 2031.
The Readiness Index Exposes the Gap
MAS and CSA have also introduced a Quantum Readiness Index (QRI), a self-assessment tool covering awareness, planning, trials and production deployment. Early scoring has been sobering. Industry surveys and regulatory commentary around the QRI have pointed to readiness levels still in the early stages, with most institutions lacking a complete view of where cryptography sits across vendors, APIs, mobile clients and decades-old core banking platforms. The message is deliberate: measurement precedes migration.
What Banks Must Do First
The immediate operational priority is a cryptographic bill of materials (C-BOM)—a factual baseline of algorithms, keys, certificates and dependencies. Without that inventory, institutions cannot sequence retirement of RSA and elliptic-curve cryptography, negotiate with vendors, or prove progress to the regulator. MAS has also stressed crypto-agility: the architectural ability to swap algorithms without re-engineering every system.
The consultation paper is short, but its implications are long. It converts quantum readiness from a technology experiment into a supervisory expectation with dates attached. For Singapore banks, the countdown has already started. The full consultation paper is available on the MAS website: https://www.mas.gov.sg/publications/consultations/2026/consultation-paper-on-quantum-safe-migration-guidance-and-timelines-for-the-financial-sector.
