Hong Kong SFC authority has unveiled new guidelines for how licensed crypto platforms handle customer funds, warning that recent failures overseas show the risks of weak custody controls.
Summary
A new circular issued on August 15 by the Hong Kong SFC set out mandatory standards for licensed virtual asset trading platform (VATP) operators in the region.
The measures cover cold wallet infrastructure, transaction controls, third-party wallet oversight, and real-time threat monitoring, in direct response to the trend of industry hacks and scams, which have led to multi-million dollar losses in recent months.
“The SFC sees the need for VATPs to critically review and strengthen their custody practices at a time when multiple cases of custody vulnerabilities have arisen overseas and the regulator’s own targeted review aimed to evaluate VATPs’ resilience against cybersecurity threats,” the announcement read.
Recent reviews of local operators by the commission found that the majority only had “fundamental” measures in place, with gaps that could leave client assets exposed. In light of the discovery, the SFC’s new framework now lays down minimum standards all VATPs must meet.
All requirements are effective immediately, with VATPs expected to assess and upgrade their custody frameworks. The new mandate comes as Hong Kong continues to advance its mission to become a global digital hub.
The first stablecoin bill in its history recently officially came into effect on August 1, creating a licensing regime for issuers. Earlier this year, the government also issued its upgraded policy statement on digital assets, outlining priorities such as regulatory clarity and domestic adoption.
Hong Kong now stands as one of the most pro-crypto regions in Asia and continues to work on cementing its place on the global radar.