The Monetary Authority of Singapore (MAS) has issued a consultation paper proposing a new supervisory framework to guide quantum-safe migration across Singapore’s financial sector, outlining governance expectations, migration planning requirements, and indicative timelines extending into the next decade. The consultation paper, titled Consultation Paper on Quantum-Safe Migration Guidance and Timelines for the Financial Sector, was published today.
The proposed circular would apply to all financial institutions (FIs) in Singapore. MAS stated that the circular is not intended to create legally binding obligations but instead establishes supervisory expectations regarding quantum-safe migration, including suggested milestones and completion timelines.
MAS is seeking feedback from financial institutions and other interested parties. Written comments must be submitted by 23 November 2026 through a FormSG consultation process. The regulator noted that submissions will generally be published and attributed to respondents unless confidentiality is specifically requested.
According to the consultation paper, advances in quantum computing pose growing risks to cryptographic systems used throughout the financial sector. MAS said there is currently no internationally agreed date for the emergence of a cryptographically relevant quantum computer (CRQC), but noted a strong consensus that such systems could appear within the next few years. A CRQC could potentially break widely used public-key cryptographic algorithms, including RSA and elliptic curve cryptography (ECC), affecting security mechanisms that underpin current digital infrastructure.
The proposal builds upon MAS’ advisory on cybersecurity risks associated with quantum technologies that was issued in February 2024. MAS described quantum-safe migration as a complex, multi-year undertaking requiring sustained commitment from senior management and sufficient organizational resources. The authority also encouraged financial institutions to reference guidance published by Singapore’s Cyber Security Agency (CSA), including its Quantum-Safe Handbook and Quantum Readiness Index.
Under the proposed framework, MAS expects financial institutions to establish governance and accountability structures that include board-level or senior management oversight, clear ownership responsibilities, adequate resourcing, and regular progress reporting. Quantum-related risks would be incorporated into risk management frameworks, policies, and procurement processes.
Financial institutions would also be expected to create and maintain comprehensive inventories of cryptographic assets. These inventories should cover algorithms, key lengths, protocols, supported systems and functions, and related dependencies. MAS indicated that organizations should use these inventories to identify vulnerable assets and prioritize migrations, particularly for systems considered business-critical, internet-facing, or associated with long-term data retention requirements.
The proposed circular calls for organizations to develop board- or senior management-approved migration plans. These plans would need to include risk-prioritized inventories and migration approaches; integration of quantum risks into enterprise risk management and procurement processes; interim controls for assets that cannot yet be migrated; assessment of capability gaps, training requirements, and implementation challenges; and vendor engagement strategies to align third-party migration roadmaps with institutional timelines.
MAS also proposes that institutions assess technical and operational implications before deploying quantum-safe technologies. Testing would be expected to evaluate performance and interoperability impacts, including the ability of existing hardware and software infrastructure to accommodate increased computational requirements, larger key sizes, and expanded storage demands associated with quantum-safe algorithms. Financial institutions would be encouraged to adopt phased implementation strategies and document any deferred migrations alongside compensating controls and justifications.
Additionally, MAS expects organizations to establish interim checkpoints and quantitative targets to monitor migration progress. Institutions would be expected to track vulnerabilities in deployed quantum-safe solutions and respond when remediation becomes necessary.
Proposed Migration Timelines
MAS has proposed a set of indicative migration milestones for all financial institutions. Where technical or operational barriers prevent adherence to the timelines, institutions should document the reasons and implement interim controls.
The proposed deadlines are:
- 31 December 2027: Financial institutions should develop a quantum-safe migration plan that meets MAS requirements.
- 31 December 2030: Completion of migration of critical systems to quantum-safe solutions.
- 31 December 2034: Completion of migration of all remaining systems to quantum-safe solutions.
MAS defines a critical system as one whose failure would significantly disrupt the operations of a financial institution or materially affect services provided to customers, including systems that process time-critical transactions or deliver essential customer services.
Additional Requirements for Critical Institutions
The consultation paper proposes additional expectations for organizations designated as Critical Information Infrastructure Owners (CIIOs), Domestic Systemically Important Banks (DSIBs), and NETS.
Under the proposal:
- 30 June 2027: CIIOs, DSIBs, and NETS would be expected to submit a quantum-safe migration plan to MAS.
- 31 December 2029: CIIOs would be expected to complete migration of Critical Information Infrastructure (CII) systems to quantum-safe solutions.
MAS stated that these timelines may be revised as quantum threats, cryptographic standards, and regulatory expectations evolve, and said it would communicate any updates as appropriate.
Consultation Questions
As part of the consultation process, MAS is seeking feedback in three areas:
- Whether the proposed supervisory expectations for quantum-safe migration are appropriate and whether additional expectations should be included.
- Whether the proposed timelines for developing migration plans and completing migration activities are appropriate.
- Whether any other aspects of the draft circular require clarification, amendment, or supplementation.
The proposed circular is intended to complement existing MAS regulatory instruments, including the Notice on Technology Risk Management (TRM), Notice on Cyber Hygiene, TRM Guidelines, and Outsourcing Guidelines.
