Hong Kong SFC Strengthens Custody Standards for Virtual Asset Trading Platforms

The Securities and Futures Commission (SFC) of Hong Kong has issued a circular outlining robust custody standards for licensed virtual asset trading platforms (VATPs). This move aims to enhance protection for client virtual assets and establish a solid foundation for the industry's transition to advanced custody technologies under the “ASPIRe” roadmap.

The announcement comes amidst growing concerns over custody vulnerabilities, highlighted by multiple cybersecurity incidents at overseas virtual asset platforms that resulted in significant asset losses. Recent findings from the SFC’s targeted review of VATPs earlier this year revealed inadequacies in controls among certain operators. Issues such as compromised third-party wallet solutions, insufficient transaction verification processes, and inadequate access controls have been flagged as persistent risks within the global industry.

The circular provides examples of good practices and sets minimum standards for VATP operators. These include senior management responsibilities, secure cold wallet infrastructure, the use of third-party wallet solutions, real-time threat monitoring, and other measures. These standards are expected to shape an industry-wide framework for virtual asset custody and will eventually apply to virtual asset custodians.

Dr. Eric Yip, Executive Director of Intermediaries at the SFC, emphasized the importance of client asset protection in fostering Hong Kong’s competitiveness in the digital asset ecosystem. He noted that licensed VATPs could leverage the SFC’s guidelines to strengthen custody practices, especially in light of heightened global risks.

Hong Kong has been positioning itself as a major player in the digital asset space. The SFC’s “ASPIRe” roadmap aims to build a sustainable and trusted environment for virtual assets. This announcement aligns with the roadmap’s “Safeguard” pillar, which focuses on client asset protection as a top priority. Earlier this year, the SFC and the Financial Services and Treasury Bureau jointly issued a public consultation on regulating virtual asset custodian services, further underlining the city’s commitment to strengthening oversight in the sector.

The move reflects broader trends in the global cryptocurrency industry, where regulators are increasingly focusing on security and consumer protection. Similar initiatives have been observed in jurisdictions like the United States and European Union, where regulators are implementing stricter measures to address cybersecurity risks and custody vulnerabilities.