Singapore Just Put Dates on Quantum-Safe Migration. Banks Have Until March 2027 to File a Plan.
· Compliance · 7 min read
Two announcements, twelve days apart
In July 2026, Singapore moved from "prepare for quantum" to dates on the calendar.
- 16 July 2026: the Cyber Security Agency of Singapore (CSA), with GovTech and IMDA, published version 1.0 of the Quantum-Safe Migration Handbook and its companion Quantum Readiness Index, closing a consultation that ran from October to December 2025.
- 28 July 2026: at the MAS annual report media conference, Managing Director Chia Der Jiun announced that MAS will issue formal supervisory expectations on quantum resilience later in 2026, with the aim that financial institutions achieve quantum resilience before the end of this decade.
Banking and finance is one of the 11 sectors designated as Critical Information Infrastructure (CII) under Singapore's Cybersecurity Act. For large Singapore FIs, both documents apply.
The three CSA milestones
The Handbook sets out three dated milestones for CII owners:
| Date | Milestone |
|---|---|
| 31 March 2027 | Submit a quantum-safe migration plan to CSA |
| 1 January 2028 | Newly procured CII systems should support quantum-safe algorithms or be quantum-safe ready |
| 31 December 2031 | Migration complete, vulnerable cryptography no longer in use |
A note on legal status, because it matters for how you brief your board. The Handbook describes itself as not mandatory or prescriptive, and the 2028 and 2031 milestones use "should." Binding obligations for CII owners normally flow through Codes of Practice or written directions. Treat the dates as a firm supervisory signal, not yet as statute. In practice, a regulator-published date aimed at named operators shapes budgets and procurement either way.
What the Handbook actually recommends
The algorithm guidance is unusually concrete:
- Deprecated: RSA, Diffie-Hellman and elliptic-curve cryptography at all key sizes.
- Recommended: the NIST standards ML-KEM, ML-DSA and SLH-DSA.
- Restricted: stateful hash-based signatures (LMS, XMSS) to firmware signing only.
- Symmetric and hashing: AES-256 recommended, AES below 128-bit deprecated, hashes below 256-bit output deprecated.
The Handbook and the Readiness Index share five domains: Risk Assessment, Governance, Technology, Training and Capability, and External Engagements. The Index is a self-assessment that scores ten objectives on a four-level scale, from L0 (not started) to L3 (operationalised and continuously improved).
What MAS will expect
MAS has not yet published the expectations document, but it has named the three phases:
- Inventory. Catalogue where and how cryptography is used, from payment systems and customer databases to internal communications and cloud services.
- Prioritise. Rank vulnerable assets for migration, weighing data sensitivity, system lifespan, and harvest-now-decrypt-later exposure.
- Execute. Build the technical capability and governance to carry the migration through.
This builds on MAS's February 2024 advisory to FI CEOs (Circular MAS/TCRS/2024/01), which already recommended cryptographic inventories, priority assets, and crypto-agility. The difference now is milestones. In Singapore, supervisory expectations carry near-mandatory weight.
The date that matters most is the first one
The 2031 finish line gets the headlines. The 31 March 2027 plan deadline is the one that reprices the work, because a credible plan requires a credible inventory. That is roughly six months away.
A plan filed without a real Cryptographic Bill of Materials is a guess. Most institutions discover, once they run discovery, that cryptography lives in far more places than the architecture diagrams show: vendor appliances, hardcoded libraries, internal service meshes, HSM-bound signing keys, partner connections.
A practical sequence for the next six months
- Run discovery on crown-jewel systems first. The Handbook's own "no-regrets" advice. Payments, core banking, customer data, and signing keys before everything else.
- Name an owner. One accountable executive for the programme, reporting to the board.
- Score and map. Tie every vulnerable asset to the specific expectation it fails: CSA milestones, MAS phases, and your TRM obligations.
- Ask vendors now. The 2028 procurement milestone means today's RFPs should already require a post-quantum roadmap.
- Take the Readiness Index honestly. Use the L0 to L3 score as your baseline, and re-run it each quarter.
Qypher builds a regulator-mapped CBOM across your estate, scores quantum exposure against MAS, CSA, RBI and CBUAE expectations, and generates the post-quantum migration artifacts your team deploys. Get a free assessment →
Sources: CSA Quantum-Safe Migration Handbook v1.0 and Quantum Readiness Index (16 Jul 2026); MAS Annual Report FY2025/2026 media conference remarks (28 Jul 2026); MAS Circular MAS/TCRS/2024/01 (Feb 2024); PostQuantum.com analysis.