Hong Kong’s Securities and Futures Commission (SFC) has issued broad new custody standards for licensed virtual assets custodians. The new standards ban the use of smart contracts in cold storage and demand higher physical and crypto security protocols.
In a decision handed down on Friday, the SFC directed custodians to use accredited hardware security modules. And put withdrawal ceilings on whitelisted addresses only. The rules should minimize internet risk exposure and protect assets from illegal use or unauthorized access.
The circular specifically bans adding smart contracts to cold wallets because they may create online attack risks through on-chain features. Cold wallets must stay offline, with private keys stored in secure, air-gapped environments under multi-factor physical access controls.
The regulations require custodians to maintain a 24/7 security center monitoring systems, networks, wallets, and related infrastructure continuously. The plan reflects the regulator’s aim for real-time monitoring of unusual activities and immediate action to address potential breaches.
Universal Standards for Hong Kong Crypto Custodians
Such new requirements would be core standards of Virtual Asset Custodian Service providers in the regulated Hong Kong market. Regulators emphasize the industry-wide universal standards necessary to keep client monies safe and segregated.
Banning smart contracts can affect custodians quite a bit, as they currently employ them in cold and hot storage of assets. BitGo and Safe held $72 billion in crypto custody in various accounts via smart contract-dependent systems at the end of 2024.
Regulation of Hong Kong can be a catalyst to revise global custodians’ business models in serving customers in the territory. Some see the regulations as limiting. However, others believe they help build stronger institutional confidence in Hong Kong’s digital asset ecosystem.
A step beyond custody regulation, Hong Kong continues to be one of the emerging crypto leaders in Asia with liberal access policies in the markets. In 2024, the region approved spot Bitcoin and Ether ETF products, expanded licensed exchange offerings, and put in force the first stablecoin regulatory framework.
The stablecoin law, which took effect on August 1, introduced a licensing system and proposed a public register of approved issuers, showing the aim to maintain orderly yet innovation-friendly regulation of digital finance.
