Hong Kong SFC Issues New Custody Rules for Crypto Platforms

The Securities and Futures Commission (SFC) has moved to tighten custody standards for licensed virtual asset trading platforms in Hong Kong. The regulator’s decision follows several major overseas security breaches that left client assets exposed and, in some cases, lost. These new requirements form part of the SFC’s ASPIRe roadmap, a plan designed to improve the way digital assets are safeguarded. 

Earlier this year, the SFC carried out a targeted review of local operators. The findings were sobering: weaknesses in wallet infrastructure, loose access controls, and gaps in management oversight. Overseas incidents also revealed recurring flaws. Several platforms had relied on compromised third-party wallet solutions. Others lacked robust verification for transactions or failed to secure approval devices against misuse. The message from the SFC is clear: such vulnerabilities cannot be ignored.

Clear Standards and Practical Guidance

The circular, issued on Friday, sets a baseline for all licensed platforms. It demands stronger cold wallet infrastructure, better transaction authentication, and round-the-clock threat monitoring. Operators using third-party wallet services will need to show that those providers meet the same high standards as in-house systems. Responsibility will sit firmly with senior management. Those who must ensure that safeguards are not only in place but also kept effective over time.

The SFC also shared examples of custody best practices drawn from both local and international firms. These, the regulator says, should guide platforms in building systems that can stand up to the growing risks in the digital asset space.

A Focus on Investor Confidence

For Dr Eric Yip, the SFC’s Executive Director of Intermediaries, the changes are about protecting investors first. “In order for Hong Kong to foster a competitive, sustainable, and trusted digital asset ecosystem, client asset protection must always remain a top priority,” he said.

Dr Yip urged platforms to use the SFC’s guidance to strengthen their custody operations, especially at a time when global cyber risks remain high. “Licensed platforms can leverage the SFC’s practical guide to step up their custody practices,” he added.

Building for the Long Term

The regulator believes that these rules will help prepare the industry for more advanced storage solutions in the future. By aligning local platforms with global best practices, the SFC hopes to give investors greater confidence. Also, position Hong Kong as a secure hub for virtual asset trading. As the market grows and threats become more sophisticated, the SFC’s strategy blends immediate protective measures with a vision for long-term industry resilience.