Hong Kong Securities and Futures Commission sets minimum custody standards for licensed virtual asset trading platforms

The Hong Kong Securities and Futures Commission (SFC) has issued a circular to all licensed virtual asset trading platforms (VATPs) setting out its expectations for robust custody of client virtual assets, aimed at strengthening client asset protection and supporting the industry’s transition to more advanced custody technologies under the SFC’s “ASPIRe” roadmap. The circular responds to custody vulnerabilities and cybersecurity incidents at overseas virtual asset platforms and to deficiencies identified in the SFC’s targeted review earlier this year of VATPs’ resilience against cybersecurity threats. It sets out expected minimum standards and examples of good practices covering areas including senior management responsibilities, client cold wallet infrastructure and operation, use of third-party wallet solutions, and real-time threat monitoring. The SFC also indicated these standards will form core expectations for virtual asset custodians and underpin an industry-wide framework for virtual asset custody. The release references a public consultation on legislative proposals to regulate virtual asset custodian services jointly issued by the Financial Services and the Treasury Bureau and the SFC.