Singapore's MAS consults on quantum-safe migration timelines for the financial sector: plans by 2027, critical systems by 2030, everything by 2034

The Monetary Authority of Singapore has published a consultation paper on a proposed Circular on Financial Sector Quantum-Safe Migration Guidance and Timelines. The paper sets out MAS's supervisory expectations for financial institutions preparing for quantum-safe migration, including indicative milestones and completion timelines. Consultation P019-2026 opened on November 6, 2026 and closes at 11:30 pm Singapore time on November 23, 2026.

Reporting on the paper describes a staged schedule: all financial institutions develop quantum-safe migration plans by the end of 2027, critical information infrastructure owners, domestic systemically important banks and the national payments operator submit their plans to MAS by mid 2027, critical systems are quantum-safe by the end of 2030 and the remaining systems by the end of 2034. MAS notes the guidance would not be legally binding and that the dates may move as standards and the threat evolve. It builds on the authority's February 2024 advisory on quantum related cyber risk and follows the Hong Kong Monetary Authority's post-quantum toolkit released earlier the same week.

Our take

Supervisors are now writing dates into finance calendars: Singapore, Hong Kong, Switzerland and the United Kingdom all moved within a few months. Canada's OSFI has not published a quantum-safe timeline, but Canadian banks and credit unions with correspondent relationships in these markets will be asked for their plans regardless. Canada has set deadlines, most people have not read them, and the supervisory questions arriving from abroad will read a lot like ITSM.40.001. An inventory an auditor will accept is the first deliverable in every one of these frameworks. Start your Discovery Program before the questionnaire arrives.