Hong Kong Regulator Tightens Custody Standards for Crypto Exchanges Amid Global Risks

Hong Kong’s Securities and Futures Commission (SFC) has issued new guidance for licensed virtual asset trading platforms (VATPs), mandating stronger custody measures to safeguard client assets. The move comes as part of the city’s broader strategy to enhance crypto infrastructure and investor protection.

New Rules to Address Custody Vulnerabilities

In a statement released Friday, the SFC urged VATPs to critically review their asset custody practices following a series of overseas incidents that revealed weaknesses in security protocols and led to substantial client losses. A targeted review conducted earlier this year by the regulator uncovered gaps in some platforms’ defenses against cyber threats.

The updated standards outline clear expectations in areas including senior management accountability, the design and operation of cold wallet systems, oversight of third-party wallet providers, and the implementation of real-time threat monitoring systems. The SFC noted that these requirements take immediate effect and will form the basis of its expectations for all virtual asset custodians moving forward.

Responding to Rising Cybersecurity Threats

The regulatory push follows a surge in crypto-related security breaches. According to blockchain security firm PeckShield, July saw an estimated $142 million in losses from hacks — a 27% increase from the previous month.

While mainland China continues to enforce a strict ban on crypto trading and mining, Hong Kong has positioned itself as a hub for digital asset businesses. The city has rolled out a licensing regime for exchanges and, as of August 1, a separate licensing framework for stablecoin issuers.

By tightening custody standards, the SFC aims to create a more secure and trusted environment for virtual asset trading, aligning its policies with global efforts to reduce risks in the fast-evolving digital asset sector.