OTR EMERGING DATA
Emerging Data
Effect on you
Banks and cybersecurity suppliers may need to prepare for a multi-year migration before a quantum computer can break today’s public-key encryption. Imagine a thief copying a locked digital safe today. He cannot open it. But he believes that, one day, a much more powerful computer will let him break the lock. That is one reason banks must think about quantum computing before the technology becomes powerful enough to threaten today's widely used public-key encryption.
What changed
On 6 November, the Monetary Authority of Singapore opened consultation P019-2026 on how financial institutions should prepare to change their encryption systems. Feedback closes on 23 November 2026. These are proposed supervisory expectations, not final rules. IBM announced a new Quantum Safe product suite on 27 October to help organisations identify and manage this work. Singapore's ST Engineering already markets quantum-safe network encryption equipment.
The connection we found
The obvious business story is about quantum computers. We think the earlier opportunity is about something less exciting but potentially more immediate: finding every piece of old encryption that needs replacing. A large bank may have thousands of systems. Some protect payments. Others connect to outside suppliers, mobile applications, databases and backup services. Before upgrading them, the bank must discover where its encryption is being used, which systems depend on it and what will break if the technology changes.
How it could work
Profit opportunity one: IBM (NYSE: IBM) could earn from encryption discovery, planning and migration software before banks begin replacing every vulnerable system. Profit opportunity two: ST Engineering (SGX: S63) could capture network-security equipment and integration work when financial institutions upgrade sensitive connections. Profit opportunity three: Cloudflare (NYSE: NET) is a more indirect candidate. Its supported post-quantum connections require compatible endpoints, and would produce incremental revenue only if they drive new paid contracts or higher spending. No MAS-linked contract is established here. A separate commercial opportunity exists for Singapore cybersecurity firms that can inventory encryption, test compatibility and help banks change systems safely. The valuable product may not be quantum computing. It may be the service that helps a bank survive the transition. Cloudflare support is connection-specific: both endpoints must support the relevant algorithms. Its documentation, updated 15 October 2026, targets full-suite readiness in 2029 rather than claiming every product is ready today.
What could happen next
What would justify acting first? A final MAS circular, published bank procurement requests, disclosed contracts and measurable migration spending. If banks already possess the necessary technology or complete most work internally, external supplier profits could be smaller.
Research context
Publication and review times
Published
Research review No fixed date
Key points
On 6 November, the Monetary Authority of Singapore opened consultation P019-2026 on how financial institutions should prepare to change their encryption systems. Feedback closes on 23 November 2026.
These are proposed supervisory expectations, not final rules.
IBM announced a new Quantum Safe product suite on 27 October to help organisations identify and manage this work. Singapore's ST Engineering already markets quantum-safe network encryption equipment.
Bottom line
Singapore’s quantum-safe consultation could bring encryption discovery and migration planning forward, before banks replace vulnerable systems.
This is research and interpretation, not an investment price forecast. Source verification limits are listed below.
Evidence and sources
Review the information supporting this view and the limits on what it can show.
Material claims and sources
Claim sources 1
- Claim id
SG-1
- Material claim
MAS opened P019-2026 on 6 November; feedback closes 23 November 2026.
- Kind
fact
- Original publication time status
unavailable
- Source limit
Date-only clocks. Proposed nonbinding supervisory expectations, not final rules.
Claim sources 2
- Claim id
SG-2
- Material claim
Draft expectations include cryptographic inventory, planning, vendor engagement and testing.
- Kind
fact
- Supporting source links
- Original publication time status
unavailable
- Source limit
Proposed scope; no named vendor award.
Claim sources 3
- Claim id
SG-3
- Material claim
IBM announced a Quantum Safe suite on 27 October supporting discovery, assessment and migration.
- Kind
fact
- Supporting source links
- Original publication time status
unavailable
- Source limit
Date-only publication; vendor capability statement.
Claim sources 4
- Claim id
SG-4
- Material claim
ST Engineering markets quantum-safe encryption and readiness capabilities for financial institutions.
- Kind
fact
- Supporting source links
- Original publication time status
unavailable
- Source limit
Existing 2025 offering, not a newly awarded bank contract.
Claim sources 5
- Claim id
SG-5
- Material claim
Cloudflare PQC support is channel-specific and requires compatible peers; full-suite readiness is targeted for 2029.
- Kind
fact
- Supporting source links
- Original publication time status
unavailable
- Source limit
Updated 15 October 2026; original publication time unavailable. Not universal current readiness.
Claim sources 6
- Claim id
SG-6
- Material claim
Inventory, testing and integration could generate earlier external supplier demand than wholesale replacement.
- Kind
inference
- Original publication time status
unavailable
- Source limit
No bank budget, award, incremental revenue or return established.
Claim sources 7
- Claim id
SG-7
- Material claim
Migration requirements could spread through financial-sector suppliers and wider sensitive-data industries.
- Kind
scenario
- Supporting source links
- Original publication time status
unavailable
- Source limit
Fourth- and fifth-order possibilities, not a rule applying to all sectors.
Claim sources 8
- Claim id
SG-8
- Material claim
Track final guidance, procurement and disclosed contracts before concluding vendor profits.
- Kind
recommendation
- Original publication time status
unavailable
- Source limit
Preparation is useful; commercial conversion remains uncertain.
Evidence behind this view
Recorded connection
The obvious business story is about quantum computers.
We think the earlier opportunity is about something less exciting but potentially more immediate: finding every piece of old encryption that needs replacing.
A large bank may have thousands of systems. Some protect payments.
Others connect to outside suppliers, mobile applications, databases and backup services.
Before upgrading them, the bank must discover where its encryption is being used, which systems depend on it and what will break if the technology changes.
We have not established a separate count of independent evidence clusters for this card. Several reports may rely on the same event or data provider.
Source ledger
Source references in the research point to these original reports.
| Reference | Source | Publication and retrieval |
|---|---|---|
| S1 | MAS quantum-safe migration consultation P019-2026 Monetary Authority of Singapore Published 6 November 2026; date only. Consultation, not final rules or procurement. | Retrieved: |
| S2 | P019-2026 proposed circular and consultation questions Monetary Authority of Singapore November 2026 document. Feedback closes 23 November 2026; no closing time established. Proposed supervisory expectations are not legally binding. | Retrieved: |
| S3 | IBM Quantum Safe unified suite announcement IBM Published 27 October 2026, date only. Product capability statement, no Singapore contract disclosed. | Retrieved: |
| S4 | Quantum-safe solutions for financial institutions ST Engineering Published 12 November 2025, date only. Existing encryptor and readiness capabilities, not a new 2026 award. | Retrieved: |
| S5 | PQC in Cloudflare products Cloudflare Page updated 15 October 2026; time of day and original publication unavailable. Endpoint compatibility required; full-suite readiness target 2029. No incremental paid revenue established. | Retrieved: |
Consequences and economics
Follow how this part of the research connects to the wider idea, including its limits.
Who this affects
- Intended audience
Singapore financial institutions, cybersecurity suppliers and investors assessing migration software and network-security exposure.
- Geography
Singapore financial sector; wider supplier exposure is conditional on local adoption and product compatibility.
- Who gains summary
Potentially IBM, ST Engineering, supported network-security providers and Singapore migration specialists if banks commission external work.
- Who may lose summary
Institutions and legacy vendors may face assessment, remediation and compatibility costs; supplier losses are not measured.
- When this could matter
During consultation and planning, then as bank budgets, tenders and contracts reveal actual demand.
Calculation and commercial economics
- Assessment status
qualitative
- How it could happen
Inventory and planning can precede replacement. External vendors could earn for software, assessments, compatible network equipment and integration if institutions procure rather than complete all work internally.
- Path to revenue or cash flow
IBM: discovery and migration software. ST Engineering: relevant network encryption and integration. Cloudflare: supported enterprise connections if demand creates incremental paid business. Local specialists: inventory and compatibility work.
- Timing
Consultation feedback closes 23 November 2026; commercial conversion depends on subsequent decisions, procurement and implementation. No award timing established.
- How large the effect could be
Bank budgets, contract values and incremental vendor revenue are unverified.
- Limits
Consultation is not a procurement award. Existing tools and internal work may meet needs. Channel compatibility, deployment costs and competition limit turning use into revenue.
Indirect effects
How this effect would happen
Financial institutions begin checking which systems and suppliers depend on older encryption. Discovery software and specialist audits gain potential demand.
Third-order effects
How this effect would happen
Banks develop migration plans and start pilot upgrades. IBM, ST Engineering and supported network-security providers could compete for contracts.
Fourth-order effects
How this effect would happen
Financial institutions ask payment processors, cloud providers and outsourced technology partners to prove that their systems are compatible.
Fifth-order effects
How this effect would happen
The same security expectations could spread through commercial supply chains. Healthcare providers, logistics companies and other businesses handling sensitive information might eventually buy similar services.
Action and timing
What to do today
- Specific action
Map cryptographic assets and supplier dependencies; compare the draft expectations with current capability. Track final guidance, bank procurement requests and disclosed migration contracts before treating vendor exposure as revenue.
- Timing
Review feedback needs before 23 November 2026; reassess commercial conclusions when final guidance and procurement evidence appear.
- Costs and practical limits
Inventory, testing and integration require staff and potentially software spending. Quantities are unverified; avoid disruption through phased testing.
- When this would not be suitable
Unsuitable for assuming immediate awards, replacing systems without compatibility testing, or buying shares solely on consultation headlines.
Challenge and uncertainty
Check the opposing evidence and other explanations that could weaken this view.
What could change this view?
- Final expectations, external spending and supplier profits remain unverified. Supported connections require compatible endpoints; banks may use existing tools.
Evidence against this view
Recorded opposing evidence and risks
Counter-evidence and limits
- Existing reporting check
MAS establishes proposed expectations; vendor sources establish available capabilities. The synthesis connects early inventory work with possible supplier demand, without asserting awards.
- Counter-evidence summary
Banks may already own appropriate tools or perform work internally. Cloudflare capabilities vary by connection and compatible peer.
- Alternative explanations
Migration may be absorbed into existing budgets and contracts, delayed by ability of different systems to work together constraints, or awarded to unlisted or incumbent providers.
- What would prove this wrong
Little external procurement, unchanged spending, unsuccessful compatibility testing or no conversion of plans into contracts weakens the early-revenue thesis.
- What the sources actually establish
MAS proposal is not final or legally binding. Dates are retained without invented time-of-day clocks. Company descriptions do not verify MAS-approved vendors, bank awards or incremental paid demand.