Key Elements of Compliance and Asset Custody for Virtual Asset Trading on the Hong Kong Stock Exchange

Recently, Hong Kong regulators issued licenses to two virtual asset exchanges, marking the first time that retail investors in Hong Kong can legally purchase virtual assets like Bitcoin and Ethereum. This move injects a strong boost for Compliance exchanges' development in the virtual asset sector.

Recently, the regulatory authorities in Hong Kong have introduced a series of policies related to virtual asset trading. Starting from June 1, more exchanges can apply for a Compliance license from the Securities and Futures Commission. Against this backdrop, many exchanges are keen to apply for a Hong Kong license to conduct compliant centralized trading operations.

So, what specific requirements does the Hong Kong Securities and Futures Commission have for centralized exchanges? Besides legal documents, what special configurations are there on the technical level?

In fact, Hong Kong's current compliance regulatory framework imposes high technical requirements on exchanges in terms of software and hardware compliance. The most critical issue, and the one that the Securities and Futures Commission is most concerned about, is the custody of client assets.

How is the asset custody of virtual asset exchanges different from traditional finance?

In the traditional financial system, when users buy stocks through brokers, the funds are actually held in the bank's custodial account, with the bank responsible for the safety of the funds. Brokers cannot directly mobilize user funds and need to obtain client instructions and bank authorization.

Under the virtual asset trading framework compliant with regulations in Hong Kong, exchanges themselves need to play the role of a "bank." Customers' virtual assets are directly held in the exchange's cold wallets. This is equivalent to consolidating the functions of banks, custodians, and other various aspects in traditional finance within the entity of the exchange. Therefore, compliance exchanges have technical requirements in both hardware and software that far exceed those of brokers, approaching bank levels, and also need to incorporate dimensions of encryption technology.

Major Security Issues in Virtual Asset Trading

From a security perspective, blockchain can be divided into on-chain and off-chain components. On-chain smart contracts may have vulnerabilities that can be exploited by hackers. Off-chain, for trading platforms, is a system engineering task that involves multiple aspects such as user authentication, network security, terminal security, emergency response mechanisms, and asset accomplice technology routes.

From a Compliance perspective, regulatory policies have gradually become clearer in recent years. Japan started managing exchange licensing earlier and has set requirements for cybersecurity, data security, and more. After the FTX incident last year, places like Hong Kong have placed greater emphasis on implementing regulations to protect investor interests. This year, Hong Kong has released clear regulatory policies for virtual asset licenses, starting with the regulation of trading platforms.

Specific Requirements of Hong Kong Regulation on Asset Custody

Hong Kong's regulatory policies stand out in terms of logic and comprehensiveness:

1. The private keys of virtual assets must be stored locally in Hong Kong.

2. Due to the current lack of a mature third-party compliance supervision system, applicants for licenses are required to build their own virtual asset security custody system and detailed requirements have been listed.

3. In terms of technical route selection, it is both conservative and open. The conservatism is reflected in the tendency to choose technologies that have been validated and matured in the traditional financial sector; the openness is reflected in the willingness to also consider new technological solutions.

4. The requirements must be assessed by an authoritative third-party evaluation agency, and a license can only be applied for after proving that the requirements are met.

Specific Measures to Protect User Asset Security

1. IT Level: Requires 98% of assets to be stored in cold wallets, which are completely offline and disconnected from the internet. At the same time, there are strict requirements for the storage environment, such as temperature and humidity control, anti-tracking, signal interference, etc.

2. It is mandatory to establish a risk compensation fund or dedicated insurance, with the ability to handle claims.

3. Compliance aspect: It is required to have a professional "Chief Compliance Officer" responsible for KYC, transaction fund source review, and other tasks.

4. Risk Control: It is necessary to manage risks related to market manipulation, user fraud, counterparties, and credit.

5. Governance: It is required to establish a sound governance system, including the separation of roles, clear distinction of funds, separation of responsibilities, etc.

Possible Solutions to be Introduced in the Future

1. New technologies such as MPC may be adopted after the certification matures.

2. Personal wallet solutions may emerge, complementing centralized exchanges.

3. In the future, it may only take 1-2 institutions to be responsible for all asset custody.

4. With the improvement of regulation, the role of custody may become independent from the exchange.

5. After the new technology route matures, the technology choices of custodians will become more diversified.

In summary, as technology advances and industry understanding deepens, this field will attract more participants, and the market prospects are broad.