Does China have a post-quantum cryptography mandate?

No. China's Cryptography Law (effective 2020) and Commercial Cryptography Regulations (State Council Order 760, effective 2023) -- its two governing statutes -- contain zero mentions of quantum cryptography of any kind. No law or regulation mandates PQC migration.

Is China developing its own post-quantum algorithms instead of using NIST's?

Yes. The Commercial Cryptography Standards Research Institute (ICCS), affiliated with the State Cryptography Administration (SCA), launched a formal national algorithm-selection competition in February 2025 with separate tracks for public-key, hash, and (from September 2026) block-cipher algorithms -- explicitly framed as cryptographic self-reliance distinct from NIST's ML-KEM and ML-DSA selections.

What happened to China's algorithm submission deadline?

It passed without results. The public-key track's formal call set a submission deadline of 24:00 Beijing time on 30 June 2026, after which ICCS said it would publish candidates advancing to a first evaluation round. As of this review, no candidate list, shortlist, or result of any kind has been published.

How is China's approach different from most other countries on this tracker?

Most countries track or adopt NIST's ML-KEM/ML-DSA/SLH-DSA selections directly. China is running a parallel, sovereign selection process through ICCS, the same institutional pattern it already uses for its SM2/SM3/SM4 commercial cryptography standards, which exist specifically as domestic alternatives to RSA/ECC/AES-family algorithms.

pqccbomchinaosccaiccssovereign-cryptography

China Is Running Its Own NIST-Style PQC Competition -- Separately From NIST's

ICCS's national algorithm-selection call, funded research into anti-quantum cryptographic vulnerability scanning, and a provincial banking-sector migration guide show real activity. China's own submission deadline passed with no results published.

PQC Security EditorialOctober 18, 20264 min read

Most of the countries on this tracker are waiting to see what NIST's finalized post-quantum algorithms mean for their own migration plans. China is running its own competition to decide that question for itself.

A funded, dated, sovereign selection process

The Commercial Cryptography Standards Research Institute (ICCS), affiliated with China's State Cryptography Administration (SCA, 国家密码管理局), launched a formal "next-generation commercial cryptography" algorithm call in February 2025. It has separate tracks: public-key algorithms, hash algorithms, and, starting September 2026, block ciphers. This isn't informal research-community activity -- it's a structured, government-institute-run process that mirrors NIST's own PQC competition in form, while being entirely separate from it in substance. The explicit framing, per ICCS's own announcements, is cryptographic self-reliance: a domestic algorithm track distinct from NIST's ML-KEM and ML-DSA.

This follows a pattern China already established with classical cryptography. Its SM2/SM3/SM4 algorithm series exists as a sovereign alternative to RSA, SHA, and AES -- used domestically, required in some regulated contexts, and maintained independently of international standards bodies. A domestic post-quantum track extends that same institutional logic into the PQC era.

Behind this sits real funding. SCA's National Cryptography Science Fund ran two dated application rounds: Announcement No. 46 (December 2023) funded research on "practical design of anti-quantum public-key cryptography" and security evaluation of domestic and international PQC submissions. Announcement No. 55 (January 2026) went further, funding quantum-provable security theory for code-based and symmetric PQC schemes, dynamically reconfigurable crypto modules for agile algorithm updates, and -- notably -- a tool for "automated identification of anti-quantum-computing cryptographic vulnerabilities" through source and binary code scanning. That last item is CBOM-adjacent in substance, even though nothing requires any organization to actually use the resulting tool.

The deadline that passed quietly

The public-key track's formal call, issued 9 October 2025, set a hard submission deadline: 24:00 Beijing time, 30 June 2026. ICCS said candidates advancing to a first evaluation round would be published after that. As of this review, nothing has been published -- no candidate list, no shortlist, no result of any kind. That's a real, concrete deadline for a real process, and it's worth tracking specifically because the next development (whenever it lands) will be the first hard signal of which algorithms China intends to standardize domestically.

The banking guide that isn't quite PBOC's

A banking-sector document complicates the picture further. The People's Bank of China's Institute of Finance -- a research arm, not a regulatory department -- led drafting of a Banking Industry Anti-Quantum-Computing Cryptography Migration Management Guide, released 17 April 2026. But it was issued as a 团体标准 (group standard) by the Jiangsu Finance Society, a provincial learned society, not by PBOC itself, and group standards in China's standards hierarchy are voluntary. Industry coverage of the guide describes its backers as hoping to eventually elevate it to a binding 行业标准 (industry standard) -- which is itself an acknowledgment that it isn't one yet.

What's still missing

No law mandates PQC migration. No deadline binds any organization. No cryptographic-inventory or CBOM requirement exists outside of funded research into a scanning tool nobody is required to use. China's two governing cryptography statutes -- the Cryptography Law and the Commercial Cryptography Regulations -- say nothing about quantum cryptography at all, which means everything described above sits below the level of binding law.

What to do with this

If you operate in the Chinese market, the signal to watch isn't a compliance deadline -- it's ICCS's eventual candidate announcement, whenever the public-key track's evaluation results surface. Organizations with a China-specific cryptographic footprint should expect the same dual-track pattern that already exists for classical cryptography: a domestic algorithm profile distinct from NIST-aligned markets, not a drop-in replacement. Multinational organizations already navigating SM2/SM3/SM4 requirements for Chinese operations are the ones with the most reason to track ICCS's process closely, since they're the most likely to eventually need both a NIST-aligned and a China-aligned PQC profile side by side.

The China country page tracks SCA's funding announcements, ICCS's algorithm call, and the banking-sector guide against their primary sources.

Frequently asked questions

Does China have a post-quantum cryptography mandate?: No. China's Cryptography Law (effective 2020) and Commercial Cryptography Regulations (State Council Order 760, effective 2023) -- its two governing statutes -- contain zero mentions of quantum cryptography of any kind. No law or regulation mandates PQC migration.
Is China developing its own post-quantum algorithms instead of using NIST's?: Yes. The Commercial Cryptography Standards Research Institute (ICCS), affiliated with the State Cryptography Administration (SCA), launched a formal national algorithm-selection competition in February 2025 with separate tracks for public-key, hash, and (from September 2026) block-cipher algorithms -- explicitly framed as cryptographic self-reliance distinct from NIST's ML-KEM and ML-DSA selections.
What happened to China's algorithm submission deadline?: It passed without results. The public-key track's formal call set a submission deadline of 24:00 Beijing time on 30 June 2026, after which ICCS said it would publish candidates advancing to a first evaluation round. As of this review, no candidate list, shortlist, or result of any kind has been published.
Has any Chinese bank or financial regulator published PQC migration guidance?: A banking industry guide exists, but not from the central bank directly. The People's Bank of China's Institute of Finance (a research arm, not a regulatory department) led drafting of a Banking Industry Anti-Quantum-Computing Cryptography Migration Management Guide, released 17 April 2026 -- but it was issued as a voluntary group standard by the Jiangsu Finance Society, a provincial learned society, not by PBOC itself, and not as a binding industry standard.
Does China require organizations to maintain a cryptographic inventory or CBOM?: No organizational mandate exists. SCA's National Cryptography Science Fund has funded research into a tool for automated identification of anti-quantum-computing cryptographic vulnerabilities via source and binary code scanning -- that's R&D funding for a scanning tool, not an obligation for any entity to use one or report findings from it.
How is China's approach different from most other countries on this tracker?: Most countries track or adopt NIST's ML-KEM/ML-DSA/SLH-DSA selections directly. China is running a parallel, sovereign selection process through ICCS, the same institutional pattern it already uses for its SM2/SM3/SM4 commercial cryptography standards, which exist specifically as domestic alternatives to RSA/ECC/AES-family algorithms.