HKMA's PACT framework, explained: 23 workstreams banks must answer

In November 2026 the Hong Kong Monetary Authority and HKUST published PACT — the PQC Accountability and Controlled Transition framework. It is the roadmap by which Hong Kong banks are expected to move from today's public-key cryptography to quantum-safe algorithms, and it is structured as four pillars spanning 23 workstreams.

The four pillars

Govern — accountability, policy and oversight for the transition. Assess and plan — inventory, exposure and migration approach. Implement and retire — replace and decommission legacy algorithms. Maintain and adapt — monitor drift and remain crypto-agile. Across these sit the 23 workstreams that define what "ready" looks like.

The first — and longest — step is inventory

The HKMA is explicit that the cryptographic inventory is the longest-lead-time item. You cannot assess exposure, plan a migration or retire algorithms until you know where every RSA, ECDSA and Diffie-Hellman instance lives. Most banks do not have this today — and it is the step that determines how fast every downstream workstream can move.

Where the Quantum Preparedness Index fits

Alongside PACT, the HKMA tracks a Quantum Preparedness Index (QPI) across four dimensions — awareness, planning, pilots and practical preparedness. Hong Kong's banking sector currently scores 2.3 out of 10, with a stated target of 10 by 2030. That gap is the opportunity: the firms that commission their inventory early will move first, and the regulators are watching.

What to do now

Start with a deterministic inventory and a PACT gap analysis — map your estate across the 23 workstreams, score your QPI, and produce the board-ready report the framework expects. Everything else in PACT is downstream of that first deliverable.