Hong Kong Raises Bar On Virtual Asset Custody For Licensed Platforms

Hong Kong’s Securities and Futures Commission (SFC) issued new custody standards for licensed virtual asset trading platforms. The rules require platforms to strengthen how they store and protect client digital assets.

The SFC found problems during a review of some platforms earlier this year. The regulator identified weak cybersecurity controls and poor custody practices at several operators. Global incidents at overseas platforms also showed similar weaknesses, including compromised third-party wallet providers and poor access controls.

The new guidance covers areas including senior management responsibility, client cold-wallet infrastructure and operation, use of third-party wallet solutions, and real-time threat monitoring among others. Any third-party wallet solutions require strict oversight and monitoring. Platforms must implement real-time threat monitoring.

Officials set minimum expected standards via a circular for licensed virtual asset trading platforms (VATPs) to meet, supplemented by examples of good practices. The circular also includes examples of good practices that platforms can follow to improve their operations beyond the basic requirements.

The regulator’s review found inadequate transaction verification and access controls. Separately, overseas incidents showed compromised third-party wallet solutions that led to client asset losses. Others lacked proper access controls for approval devices used in transactions. 

Dr. Eric Yip, the SFC’s Executive Director of Intermediaries, said client asset protection must remain the top priority for all licensed platforms. He noted that platforms can use the SFC’s practical guide to improve their custody practices amid increased global risks.

The custody standards form part of Hong Kong’s ASPIRe roadmap for virtual asset regulation. This broader program aims to create a secure framework for digital asset activities in Hong Kong. The “Safeguards” pillar of ASPIRe focuses on investor protection and secure custody practices.

On June 27, the Financial Services and the Treasury Bureau (FSTB) and the SFC jointly launched consultations on legislative proposals to introduce dedicated SFC licensing regimes for virtual asset dealers and custodian service providers.