Hong Kong’s Securities and Futures Commission (SFC) has issued a new circular to all licensed virtual asset trading platforms (VATPs), outlining stricter requirements for safeguarding client assets. The move comes amid a rise in global cybersecurity breaches affecting cryptocurrency exchanges and follows the regulator’s own review, which identified gaps in custody controls earlier this year.
The SFC said the updated standards aim to provide a framework for more secure custody practices as the industry transitions to advanced technologies under its “ASPIRe” roadmap. The guidance applies immediately to all licensed VATPs and will form the core expectations for virtual asset custodians going forward.
Cybersecurity Incidents Prompt Action
In its review, the SFC found shortcomings in operators’ ability to protect digital assets, citing weaknesses such as compromised third-party wallet solutions, insufficient transaction verification, and inadequate access controls over devices used for transaction approvals.
Similar vulnerabilities have been linked to major overseas incidents that resulted in substantial losses of client assets, the regulator said. These cases underscore the persistent risks in virtual asset custody and the need for platforms to reinforce their safeguards.
The circular calls on VATPs to critically assess their custody arrangements and address any deficiencies in risk management, with an emphasis on preventing unauthorized access and ensuring robust wallet infrastructure.
Key Requirements for Licensed Platforms
The regulator’s guidance specifies minimum standards across several areas, including:
- Senior management is accountable for custody arrangements and operational security.
- Cold wallet infrastructure and operational protocols to protect client assets from online threats.
- Assessment and oversight of third-party wallet service providers.
- Real-time monitoring for cybersecurity threats and suspicious activity.
The SFC also highlighted examples of effective practices in the circular, intended to assist platforms in meeting compliance obligations while strengthening industry-wide resilience.
Dr. Eric Yip, the SFC’s executive director of intermediaries, said client asset protection must remain a top priority for licensed VATPs. He noted that the regulator’s guidance offers a practical tool for operators to improve custody systems, particularly in light of heightened global risks.
The SFC’s announcement reflects a broader regulatory push in Hong Kong to balance digital asset innovation with investor protection. Platforms failing to meet the updated custody standards risk regulatory action, including potential suspension or revocation of licenses.
