Singapore did not wait for a fault-tolerant quantum computer to test quantum-safe plumbing. Between 2024 and 2025, MAS ran a proof-of-concept sandbox with DBS, HSBC, OCBC, UOB, SPTel and SpeQtral to evaluate Quantum Key Distribution (QKD) for securing financial communications. The technical report, published in September 2025, remains the clearest public evidence of how Singapore banks are moving from theory to operational trials.
What the Sandbox Actually Tested
QKD uses quantum mechanics to generate and exchange encryption keys in a way that detects eavesdropping. In the sandbox, participating banks deployed a QKD solution jointly provided by SPTel and SpeQtral to validate whether the technology could securely transfer sensitive data between data centres and financial institution premises. The exercise was not a marketing demonstration. It examined technical viability, operational constraints and integration with existing IT environments.
The findings were candid. QKD has the potential to strengthen communication network security, particularly for high-value links between data centres and bank premises. But the report also flagged that QKD providers and the telecommunications sector must strengthen security assurance, including standards for tamper-resistant, auditable trusted nodes with multi-layer protection. Interoperability between different QKD vendors remains incomplete—a critical gap if the technology is to be widely adopted across a diverse banking ecosystem.
HSBC’s Crypto-Agility Playbook
HSBC’s participation illustrates how a global bank is converting sandbox lessons into enterprise governance. HSBC Singapore chief operating officer Tancy Tan has said the bank is building crypto-agility and visibility across core functions as the basis for post-quantum cryptography and hybrid-model pilots. HSBC launched its global quantum programme in the UK in 2022 and expanded a second Quantum Centre of Excellence to Singapore in early 2025, citing the city-state’s research clusters, National Quantum Network and active industry pilots.
Tan has been explicit that MAS’ advisory on quantum risk to financial institutions has shaped the bank’s direction. “We are closely aligned to regulators’ guidance,” she said, noting that NIST has recommended phasing out vulnerable cryptography by 2035. HSBC’s approach prioritises cryptographic foundations over speculative hardware timelines: protect customer data, maintain digital trust, and build the governance to swap algorithms when standards evolve.
The Unglamorous Bottleneck: Management Support
The sandbox report delivered a message that technology teams rarely put in press releases: quantum-safe initiatives need strong senior management support, in-house competency and dedicated budget. QKD is not a plug-in. It requires network redesign, vendor management, security assurance and skills that many banks are still building.
Singapore’s QKD experiment does not mean every bank will deploy QKD tomorrow. It means the industry now has empirical data on benefits, limitations and integration friction. That evidence base is exactly what MAS wants before it finalises supervisory expectations. The technical report is available through MAS: https://www.mas.gov.sg/publications/annual-report/2026/annual-report-2025-2026/robust-and-resilient-financial-centre/technology-and-cyber-resilience.
