Hong Kong’s SFC Orders Tighter Crypto Custody Standards Following Global Breaches

Hong Kong’s Securities and Futures Commission has set stricter custody expectations for licensed virtual asset trading platforms, positioning those requirements as the baseline for a forthcoming licensing regime that would cover standalone virtual asset custodians.

The move, said to be for the protection of client assets, was done in order for Hong Kong to “foster a competitive, sustainable and trusted digital asset ecosystem,” Dr. Eric Yip, the commission’s executive director of intermediaries, said in a statement on Friday.

The SFC has been approached for comment.

According to the SFC’s circular, sent to licensed virtual asset trading platforms, reports of “multiple cybersecurity incidents” at overseas centralized platforms have increased significantly over the past year, causing “substantial client losses.”

The failures stemmed from wallet-system vulnerabilities and weak associated controls, it said. The SFC said it set the new minimum custody standards and good practices for licensed VATPs, in response to those breaches and its own review.

The rules require robust cold-wallet infrastructure and operations, oversight of third-party wallet providers, controls for private keys and comparable credentials, air-gapped hardware, systematic transaction verification, strict address whitelisting, independent third-party assessments, and staff training to prevent blind signing.

These new standards “set a clear benchmark” for how licensed platforms and custodians could help protect their clients, Alessio Quaglini, CEO of Hong Kong-licensed digital asset institution Hex Trust, told Decrypt, highlighting its importance given incidents where “weak wallet controls, poor transaction verification, or inadequate oversight have led to significant losses.”

By setting a new bar, the move could “lead to fewer players in the market with greater specialisation and scale,” making more advanced custody setups “commercially viable,” he explained.

Yet that change can also be a concern.

“New entrants or smaller players may face barriers to entry or higher costs, potentially creating a more concentrated market,” Chen Wu, CEO of Hong Kong-licensed virtual asset firm EX.IO, told Decrypt.

Across Asia, Hong Kong’s move may change how it positions among competitors. “While it drives partial convergence across Asia, regional regulatory disparities may persist,” Wu said. Despite “Hong Kong’s stricter, institution-focused approach” giving it some advantage, it would still need to “balance innovation and compliance costs,” she added.

The regulator has a separate pending proposal where anyone engaged in safekeeping clients’ virtual assets or the instruments that enable transfers would require licensure.

The standards will take immediate effect for VATPs and their associated entities. Operators are also mandated to run round-the-clock security monitoring, with the same bar expected to anchor the planned custodian licensing regime.

The commission also plans to table a bill soon after, with transitional arrangements, expedited approvals for firms already assessed, and higher application and annual fees under a user-pays model. Public comments close on 29 August 2025.

New guidance from the commission follows on from its regulatory roadmap unveiled earlier in February, aimed at strengthening its virtual asset ecosystem, and comes just weeks after the launch of a stablecoin licensing regime at the start of August.