Three Regulators, Three Timelines: A One-Page PQC Calendar for Banks in India, Singapore and the UAE
· Compliance · 6 min read
Why a single calendar matters
A bank with operations in Mumbai, Singapore and Dubai does not get three cryptographic estates. It gets one estate, three sets of supervisors, and three slightly different vocabularies for the same work. Building three programmes is how budgets get wasted. Building one programme that produces evidence for all three is the efficient path.
Where each regulator actually stands (September 2026)
| Jurisdiction | What exists today | Legal weight |
|---|---|---|
| Singapore | CSA Quantum-Safe Migration Handbook v1.0 (16 Jul 2026): CII plan by 31 Mar 2027, quantum-safe procurement from 2028, migration complete by end-2031. MAS supervisory expectations promised later in 2026. | Firm supervisory signal; MAS expectations carry near-mandatory weight |
| UAE | National Encryption Policy (approved Nov 2025): government entities must produce approved PQC transition plans, run automated cryptographic inventory, and design for crypto-agility. National Crypto Discovery Tool rolled out in 2026. | Binding for government entities; strong signal for regulated sectors |
| India | RBI formed a Q-SAFE expert committee (May 2026) to assess sector preparedness and recommend a roadmap. SEBI CSCRF and CERT-In guidance already push inventory and crypto governance. | Committee stage; roadmap pending |
The honest summary: Singapore has dates, the UAE has law, India has momentum. None of them disagree on what comes first.
The work they all ask for, in the same order
Across CSA, MAS, the UAE policy, the RBI committee's mandate, and the G7 Cyber Expert Group's financial-sector roadmap, the sequence is identical:
- Inventory. Know every algorithm, key, certificate and protocol, and who owns it. The UAE goes further and requires the inventory to be automated and continuously maintained.
- Prioritise. Rank by data lifetime, exposure to harvest-now-decrypt-later, and business criticality.
- Plan. A board-approved migration plan with owners and dates. Singapore wants it filed by March 2027.
- Migrate with agility. Move to NIST FIPS 203/204/205, starting with hybrid key exchange on long-lived data flows, and build so the next change is cheaper.
A practical calendar for a three-market bank
- Q4 2026: Automated discovery across the crown-jewel estate in all three markets. One CBOM, tagged by jurisdiction and legal entity.
- Q1 2027: Board-approved plan. File in Singapore by 31 March. Reuse the same plan as the UAE transition plan and as your answer to RBI when its roadmap lands.
- 2027: Hybrid ML-KEM on the highest-value, longest-lived flows. Post-quantum requirements written into every RFP ahead of Singapore's 2028 procurement milestone.
- 2028 onward: Signatures and PKI, then the long tail. Re-run the inventory every quarter as evidence.
The mistake to avoid
Treating each regulator as a separate compliance project. The evidence each one wants, an inventory, a risk ranking, a dated plan and proof of progress, is the same evidence. Produce it once, map it three ways.
Qypher builds one CBOM across your estate and maps each finding to RBI, SEBI, CERT-In, MAS, CSA and CBUAE expectations at once, then generates the post-quantum migration artifacts your team deploys. Get a free assessment →
Sources: CSA Quantum-Safe Migration Handbook v1.0 (Jul 2026); MAS remarks at the FY2025/2026 annual report conference (28 Jul 2026); UAE Cybersecurity Council National Encryption Policy (Nov 2025); RBI Q-SAFE committee announcement (May 2026); G7 Cyber Expert Group financial-sector PQC roadmap (Jan 2026).