Less than 10% of S’pore financial firms are ready for quantum computing threat: ST Engineering exec

The window to prepare for quantum attacks may be tightening.

In a March 2026 note, US tech giant Google set 2029 to complete migration to post-quantum cryptography (PQC), which uses new algorithms to resist future attacks from quantum computers.

The financial sector, which handles large sums and volumes of sensitive data over long periods, could become a prime target for quantum attacks, warned Tan Bin Ru, president of Enterprise Digital at Singapore-based ST Engineering.

Yet, under 10 per cent of financial services firms in Singapore have a PQC plan, she said. Early movers include big banks, payment providers and crypto exchanges.

Timelines are taking shape in the Republic. This year, the Cyber Security Agency of Singapore (CSA) issued guidance for Critical Information Infrastructure (CII) owners to complete PQC migration by 2031. Singapore has 11 CII sectors, including banking and finance.

Other organisations exposed to quantum threat – like those holding sensitive data that must stay confidential for years – are urged to do so by 2035.

THE BUSINESS TIMES INSIGHTS

Powering Asean's Future 2026

Find out how enterprises are navigating power constraints and sustainability targets

ACCESS THE INSIGHTS

Quantum computers use quantum bits that can stand for 0 or 1 at once, unlike classical computers which process information as either 0 or 1.

They could eventually be powerful enough to solve complex problems much faster than classical computers – including cracking the codes protecting today’s data.

A narrowing window

A three-year timeline for financial services firms may be too short, Tan said. Research into PQC transition started around five years ago in defence.

“When it comes to security, transition is a multi-year journey,” she said.

Quantizant, ST Engineering’s platform aimed at helping organisations become quantum-resilient, will launch for customers at this year’s Singapore FinTech Festival (SFF) on Nov 18 to 20, she said. A beta version debuted at last year’s SFF.

Some clients have completed the discovery phase of PQC transition, she said (see below). Singapore, Hong Kong and Australia lead regional efforts, though many institutions remain at the awareness stage.

The banking ecosystem’s complexity adds to the challenge, as current encryption is embedded across applications, infrastructure and third-party services.

The Monetary Authority of Singapore (MAS) is expected to issue more guidelines on quantum resilience for financial institutions this year, following its February 2024 advisory.

Why now?

Two things are slowing PQC adoption, Tan said: resources going to other tech priorities such as artificial intelligence, and the absence of a real-world quantum attack.

Bad actors are already collecting and storing data to crack once the technology matures – a tactic known as “harvest now, decrypt later”. This lets them map a target’s ecosystem, learn its encryption methods, and locate high-value assets and vulnerabilities, Tan said.

Once quantum capabilities scale, attackers could go after targets with the weakest encryption or largest payoff, she said.

This was produced in partnership with the Monetary Authority of Singapore and the Global Finance & Technology Network.

For more stories, go to bt.sg/sff26