Hong Kong's SFC Orders Tighter Crypto Custody Standards Following Global Breaches

In brief

Providers must use cold wallets with air gapped hardware, apply whitelisting and among other requirements, the regulator said Friday.
A separate public consultation would license custodians of client assets and transfer tools, including private keys.
The new standards sit under its broader roadmap for regulating digital assets and aims to strengthen trust and regional competitiveness.

Hong Kong’s Securities and Futures Commission has set stricter custody expectations for licensed virtual asset trading platforms, positioning those requirements as the baseline for a forthcoming licensing regime that would cover standalone virtual asset custodians.

The move, said to be for the protection of client assets, was done in order for Hong Kong to “foster a competitive, sustainable and trusted digital asset ecosystem,” Dr. Eric Yip, the commission’s executive director of intermediaries, said in a statement on Friday.

The SFC has been approached for comment.

According to the SFC’s circular, sent to licensed virtual asset trading platforms, reports of “multiple cybersecurity incidents” at overseas centralized platforms have increased significantly over the past year, causing “substantial client losses.”

The failures stemmed from wallet-system vulnerabilities and weak associated controls, it said. The SFC said it set the new minimum custody standards and good practices for licensed VATPs, in response to those breaches and its own review.

The rules require robust cold-wallet infrastructure and operations, oversight of third-party wallet providers, controls for private keys and comparable credentials, air-gapped hardware, systematic transaction verification, strict address whitelisting, independent third-party assessments, and staff training to prevent blind signing.

The regulator has a separate pending proposal where anyone engaged in safekeeping clients’ virtual assets or the instruments that enable transfers would require licensure.

The standards will take immediate effect for VATPs and their associated entities. Operators are also mandated to run round-the-clock security monitoring, with the same bar expected to anchor the planned custodian licensing regime.

The commission also plans to table a bill soon after, with transitional arrangements, expedited approvals for firms already assessed, and higher application and annual fees under a user-pays model. Public comments close on 29 August 2025.

New guidance from the commission follows on from its regulatory roadmap unveiled earlier in February, aimed at strengthening its virtual asset ecosystem, and comes just weeks after the launch of a stablecoin licensing regime at the start of August.