Hong Kong regulator tightens custody standards for crypto exchanges amid rising global risks

Hong Kong's financial regulator has issued new guidance requiring licensed crypto trading platforms to strengthen custody practices for client assets as part of the region's roadmap for advancing crypto asset infrastructure.

In a Friday statement , the Securities and Futures Commission (SFC) said licensed "virtual asset trading platforms" (VATPs) should critically review their custody practices following multiple overseas incidents that exposed vulnerabilities and led to significant client losses. A targeted review by the SFC earlier this year also found shortcomings in some VATPs' controls against cybersecurity threats.

The SFC detailed its new expectations in a separate circular , covering senior management responsibilities, cold wallet infrastructure, third-party wallet oversight and real-time threat monitoring.

"Going forward, these standards will also form the core expectations for virtual asset custodians, and help foster an effective industry-wide framework for virtual asset custody," the SFC said, adding that the requirements outlined in the circular take immediate effect.

"This will likely concentrate the market around operators with the scale and expertise to meet them, making advanced custody setups more viable," Alessio Quaglini, co-founder of Hong Kong-based crypto custodian Hex Trust, told The Block.

The SFC's move follows a surge in crypto security breaches in July, with PeckShield estimating hack-related losses at $142 million — up 27% from June.

While Beijing maintains its ban on crypto trading and mining in mainland China, Hong Kong has moved in the opposite direction, aiming to attract crypto businesses through a licensing framework for exchanges. A separate licensing regime for stablecoin issuers also took effect on Aug. 1.