HKMA Issues Guideline on Supervision of Stablecoin Issuers

Schedule 2 Stablecoins Ordinance Requirement

HKMA Stablecoin Guideline Requirements (paragraph references are to paragraphs of the HKMA Stablecoin Guideline)

A. RESERVE ASSET MANAGEMENT

Full asset backing

Section 5(2): the market value of the reserve assets pool backing each type of issued stablecoins must at all times equal or exceed the par value of the outstanding stablecoins of the type in circulation.

HKMA-licensed Stablecoins Issuers should:

• implement robust measures that:
  • take account of the reserve assets’ risk profile and ensure appropriate over-collateralisation to mitigate market risk;
  • adopt custodial arrangements that do not compromise full backing (e.g., account-level fees should not be deducted from accounts holding reserve assets); and
  • conduct ongoing monitoring and regular reconciliations between the reserve assets’ market value and the par value of outstanding stablecoins in circulation to ensure compliance with the full backing requirement (paragraph 2.2.1);
• adopt a consistent and prudent method for calculating the market value of reserve assets that uses reasonable, reliable data sources reflecting prevailing market prices and apply the more prudent side of bid/offer prices. Use a consistent and transparent approach to calculate the par value of outstanding stablecoins. HKMA-licensed stablecoin issuers should ensure that there is no mismatch between the valuation methods used for the reserve assets and outstanding stablecoins’ par value (paragraph 2.2.2); and
• have effective asset-backing arrangements for stablecoins that are temporarily restricted from circulation (e.g., due to a court order or enforcement action), but could re-enter circulation to ensure that they can meet the redemption requirements once the restrictions are removed. (Paragraph 2.2.3)

Acceptable reserve assets

Section 5(5): Reserve assets must be of high quality and liquidity and have minimal investment risks.

The following are acceptable forms of reserve assets:

1. cash;
2. bank deposits for terms not exceeding three months;
3. marketable debt securities that:
   • are issued or guaranteed by a government, central bank, public sector entity, qualified international organisation² or multilateral development bank;
   • have a maximum residual maturity of one year;
   • qualify for a 0% risk weight (under sections 55 to 58 of the Banking Capital Rules (Cap. 155L); or are denominated in the domestic currency of a government or central bank stablecoin issuer;
   • are highly liquid; and
   • are not obligations of a financial institution or an associated entity of a financial institution, that is not a public sector entity bank;
4. cash receivable from overnight reverse repurchase agreements with minimal counterparty risk, collateralised by assets referred to under 3) above;
5. investment funds that invest in any of the above assets whose sole purpose is managing the HKMA-licensed stablecoin issuer’s reserve assets; and/or
6. other asset types acceptable to the HKMA. (Paragraph 2.3.1)

Referenced currency

Section 5(3): Reserve assets for each stablecoin type must be denominated in the same referenced currency as the issuer’s stablecoin, unless the HKMA approves the holding of reserve assets in a different referenced asset.

Reserve assets must be denominated in the same referenced currency as the issuer’s stablecoins. If there is more than one referenced currency, reserve assets must be denominated in the referenced currencies in the same ratio as the stablecoins.

The HKMA must give its prior written approval of a currency mismatch. The HKMA-licensed Stablecoin Issuer will need to demonstrate the need and rationale for the currency mismatch and implement measures (e.g., over-collateralisation) to manage relevant risks and prevent risks being transferred to stablecoin holders or disrupting its operations. (Paragraph 2.4.1)

Segregation & safekeeping

Section 5(1): The reserve assets for each stablecoin must be segregated from any other reserve assets of the issuer.

HKMA-licensed Stablecoin Issuers should put in place effective trust arrangements that segregate reserve assets backing their stablecoins from their own assets to ensure that they are available to meet redemption requests at par value. Acceptable trust arrangements include appointing an independent trustee or executing a declaration of trust over the reserve assets. Before implementing a trust arrangement, HKMA-licensed Stablecoin Issuers must obtain an independent legal opinion confirming that the trust arrangement is effective, and they should submit that opinion to the HKMA. (Paragraph 2.5.2)

Section 5(4): Each pool of reserve assets must be adequately protected against claims by the issuer’s other creditors and kept separate from the HKMA-licensed Stablecoin Issuer’s other funds.

All income or loss generated from managing the reserve assets belong to the HKMA-licensed Stablecoin Issuer. The trust arrangement must therefore include a mechanism to allow the regular transfer of excess assets (i.e., those exceeding the internal target set by the HKMA-licensed Stablecoin Issuer) from the reserve assets account to the stablecoin issuer’s own account. The mechanism should include a triggering mechanism and detailed procedures to ensure that only the excess assets are transferred out of the reserve assets account. (Paragraph 2.5.3)

Section 5(8): HKMA-licensed Stablecoin Issuers must implement adequate and appropriate control systems for:

• assessing the risks associated with having reserve assets managed by third parties;
• monitoring third parties’ performance; and
• managing their relationship with third parties.

HKMA-licensed Stablecoin Issuers must appoint qualified custodians to safekeep the reserve assets. Acceptable custodians include Hong Kong licensed banks and other asset custodians appointed under an arrangement that is acceptable to the HKMA. If an investment manager is appointed to manage the reserve assets, the HKMA-licensed Stablecoin Issuer must ensure the investment manager is qualified for the role. When conducting risk assessments and due diligence on a prospective custodian and/or investment manager in accordance with the requirements of paragraph 6.6 of the HKMA Stablecoin Guideline on third party risk management, the HKMA-licensed Stablecoin Issuer must take into account the following non-exhaustive factors: its size, capabilities, expertise, track record, reputation, and Hong Kong presence.

Notwithstanding the appointment of a custodian and/or any investment manager, HKMA-licensed Stablecoin Issuers remain primarily responsible and accountable for managing and safekeeping the reserve assets. (Paragraph 2.5.4)

Prohibition on interest bearing stablecoins

Section 15: HKMA-licensed Stablecoin Issuers are prohibited from paying interest on their stablecoins and from allowing others to pay interest on them.

“Interest” is defined to include any profit, income or other return payable to stablecoin holders based on:

• how long the stablecoin has been held; or
• its par value or market value.

HKMA-licensed Stablecoin Issuers must not pay interest or interest-like incentives in any form to holders of their stablecoins. They can, however, offer marketing incentives that do not amount to interest payments.

For these purposes, interest means any profit, income or other return represented to arise or to be likely to arise from holding the stablecoins on the basis of the length of time the stablecoins are held, the stablecoins’ par value or their market value.

In addition, HKMA-licensed Stablecoin Issuers must ensure that any income or loss arising from the management of reserve assets, including but not limited to interest payments or capital gains or losses, is attributed to the stablecoin issuer. (Paragraph 2.6)

Disclosure and reporting

Section 5(7): HKMA-licensed Stablecoin Issuers must make timely public disclosures of:

• their reserve assets management policy;
• an assessment of the risks arising from their reserve assets and their management of the risks;
• the composition and market value of their reserve assets; and
• the results of regular independent attestation and audit of their reserve assets.

HKMA-licensed Stablecoin Issuers must prepare daily statements of:

• the par value of their outstanding stablecoins in circulation; and
• the market value and composition of their reserve assets.

They should report this information to the HKMA weekly and publish it on their website in a prominent position. This disclosure requirement is mandatory unless the HKMA approves different disclosure arrangements.

HKMA-licensed Stablecoin Issuers should appoint a qualified independent auditor acceptable to the HKMA to regularly conduct an attestation on their reserve assets. The frequency of attestation must be agreed with the HKMA. The attestation should cover:

• the market value and composition of the reserve assets;
• the par value of the outstanding stablecoins in circulation; and
• whether the reserve assets are adequate to fully back the par value of the outstanding stablecoins in circulation: (a) as at the last business day of the period covered by the auditor’s attestation report; and (b) as at at least one randomly selected business day during the period.

HKMA-licensed Stablecoin Issuers should submit the auditor’s attestation report to the HKMA within one month of the last day covered by the attestation report, and disclose each attestation report on their website in a reasonably prominent location.

(Paragraphs 2.7.2 and 2.7.3)

Section 13: HKMA-licensed Stablecoin Issuers must publish a white paper for each stablecoin it issues providing comprehensive information about the stablecoin.

HKMA-licensed Stablecoin Issuers are required to publish a white paper for each of their issued stablecoins which must be disclosed on their website in a reasonably prominent location. They must notify the HKMA before publishing or making material changes to a white paper. White papers should be in non-technical language that is comprehensible to the public where possible. (Paragraph 8.2.3)

White papers should set out:

• general information about the HKMA-licensed Stablecoin Issuer;
• detailed information about the stablecoins;
• the arrangements for the management of the reserve assets, including any relevant arrangements with third parties;
• the mechanisms for issue, redemption and distribution covering the procedures, redemption rights, timeframe, any conditions and fees involved and any arrangements with third parties for distribution of the stablecoins;
• the technology underlying the stablecoins; and
• the risks associated with using the stablecoins.

(Paragraph 8.2.4).

Section 6.5: HKMA-licensed Stablecoin Issuers must publicly disclose the redemption rights attaching to their stablecoins, including any redemption fee payable, any conditions for exercising the redemption right, the procedures for redemption and the processing time for redemption requests.

The information required to be provided to holders by section 6.5 of Schedule 2 to the Stablecoins Ordinance must be set out in the white paper for the stablecoins and in the terms and conditions applicable to the stablecoins. The terms and conditions should also address:

• the arrangement for issuance and redemption during exceptional circumstances, such as hard forks; and
• the stablecoins’ transfer mechanism (e.g. the point at which the stablecoins are considered to be transferred when a stablecoin holder executes a transfer), having regard to the operations of the underlying distributed ledgers.

The terms and conditions should be published in a reasonably prominent location on the HKMA-licensed Stablecoin Issuer’s website. (Paragraph 3.6.1)

Reporting to the HKMA

HKMA-licensed Stablecoin Issuers must submit to the HKMA their annual audited financial statements which include an audit of the reserve assets backing their issued stablecoins. These must be submitted within four months of the financial year-end. (Paragraph 8.2.5)

They should also review their issuance, redemption and distribution policies and procedures regularly and at least once per year. Shortcomings identified during reviews must be promptly addressed and dealt with by updates to the relevant policies and procedures. Stablecoin issuers’ policies and procedures and any material changes to them must be approved by the board.

HKMA-licensed Stablecoin Issuers are also required to conduct regular audits to ensure their operations comply with their policies and procedures and relevant regulatory requirements. The outcome of audits and any material findings must be reported to the HKMA on a timely basis and the audit report should be submitted to the HKMA if requested. (Paragraph 3.6.2)

Any breach of statutory or regulatory requirements relating to stablecoin issuance, redemption and distribution, and material non-compliance with policies relating to these activities, must be immediately reported to the HKMA. (Paragraph 3.6.3)

B. ISSUE, REDEMPTION & DISTRIBUTION OF STABLECOINS

Purpose & soundness of issue

Section 11: An HKMA-licensed Stablecoin Issuer’s issue of a stablecoin must be prudent, having regard to its purpose, business model and operational arrangement.

HKMA-licensed Stablecoin Issuers should implement a strategy that aligns with the principle of ensuring the soundness and reliability of their stablecoins and adopt a business plan that is practical and feasible with a reasonable chance of generating sufficient demand for their stablecoins to sustain their licensed stablecoin activities.

They should conduct stablecoin activities prudently, comply with the statutory and regulatory requirements in relevant jurisdictions, and ensure they have sufficient capacity and resources to effectively implement their business plan and to withstand internal and external shocks, and handle unforeseen emergencies.

(Paragraph 4.3.1)

Issuance requirements

HKMA-licensed Stablecoin Issuers must maintain an effective stablecoin issuance mechanism. In practice, they should only issue stablecoins to their customers and issues should be made promptly after receiving funds and a valid request for issue. Funds received from customers should be in the same currency as the stablecoin’s referenced currency (or currencies, and in the same ratio if more than one). Crucially, every stablecoin minted must be matched by an equivalent increase in the relevant reserve assets pool. (Paragraph 3.2.1)

Redemption requirements

Section 6(1) and (2):

HKMA-licensed Stablecoin Issuers must redeem stablecoins at par on receipt of a valid redemption request from holders. They must not impose any unduly onerous condition on redemption or charge fees beyond what is reasonable.

Valid redemption requests must be honoured as soon as practicable and holders should be paid the par value less any reasonable redemption fee in the stablecoin’s referenced currency or currencies.

Section 6(4): HKMA-licensed Stablecoin Issuers must provide stablecoin holders with rights in the event of their insolvency to:

• direct the disposal of the reserve assets pool to redeem all outstanding stablecoins of the same type pro rata; and
• claim against the HKMA-licensed Stablecoin Issuer for any shortfall if the proceeds from the disposal of the reserve assets is not enough to redeem all the outstanding stablecoins in full.

Stablecoin holders must have the right to redeem their stablecoins at par. HKMA-licensed Stablecoin Issuers must obtain an independent legal opinion to confirm that they provide stablecoin holders with the rights required by section 6 of the Stablecoins Ordinance which must be submitted to the HKMA. An updated legal opinion will be required if there is any material change to those rights. (Paragraph 3.3.2)

HKMA-licensed Stablecoin Issuers must maintain effective redemption procedures for the stablecoins they issue and cannot attach any unduly burdensome condition or charge an unreasonable fee for stablecoin redemption. Holders’ redemption requests must be honoured within one business day of their receipt, unless the HKMA’s prior written approval has been obtained. (Paragraph 3.3.3)

Relevant factors in determining whether redemption fees are reasonable include (without limitation) whether the fees are proportional to the HKMA-licensed Stablecoin Issuer’s operational costs of redeeming the stablecoins and how they compare with prevailing industry practices. (Paragraph 3.3.4)

The assessment of whether a condition is unduly burdensome will consider, among others, whether:

• fulfilment of the condition is reasonably practicable;
• the condition is required due to legal or regulatory obligations of the HKMA-licensed Stablecoin Issuer; and
• the condition will cause undue hardship to stablecoin holders. (Paragraph 3.3.4)

In honouring redemption requests, HKMA-licensed Stablecoin Issuers should transfer the par value of the stablecoins received from the holder to the holder after deducting any reasonable redemption fee. Funds must be denominated in the stablecoin’s referenced currency, and if there is more than one referenced currency, in those currencies in the same ratio referenced by the stablecoins. Each draw-down of reserve assets for honouring a redemption request must coincide with a corresponding decrease in the par value of the outstanding stablecoins in circulation. (Paragraph 3.3.5)

For each type of stablecoin issued, HKMA-licensed Stablecoin Issuers must additionally give holders the right to direct the disposal of the reserve assets pool to redeem all outstanding stablecoins of that type on a proportional basis. Holders must also have the right to claim from the HKMA-licensed Stablecoin Issuer any shortfall if the proceeds from selling the reserve assets are insufficient to fully redeem all outstanding stablecoins of that type. These rights must be available in the event of the Stablecoin Issuer’s insolvency. (Paragraph 3.3.1)

Distribution requirements

Section 11: See above.

Stablecoin issuers that arrange for third party distribution of their stablecoins need to ensure that this does not negatively impact the prudence and soundness of issues.

HKMA-licensed Stablecoin Issuers must consider the legal and regulatory requirements in jurisdictions in which their stablecoins will be distributed and the licensing status of any third party distributors. If stablecoins will be offered in Hong Kong, any distributor must be a permitted offeror under the Stablecoins Ordinance.

In conducting the risk assessments and due diligence on third parties required by paragraph 6.6, HKMA-licensed Stablecoin Issuers must take into account (among others):

• their size, capabilities, expertise, track record and reputation; and
• the adequacy of the third party’s governance, conduct standards, risk management, and internal controls.

Additionally, HKMA-licensed Stablecoin Issuers must ensure that their arrangements with third-parties comply with applicable laws and regulations in the relevant jurisdictions and must not distribute the licensed stablecoins in jurisdictions where this is unlawful.

As regards third parties providing secondary market liquidity, HKMA-licensed Stablecoin Issuers should consider whether their engagement is necessary, and if so, the extent and scope of their engagement given their business model and operations. HKMA-licensed Stablecoin Issuers need to ensure that the arrangements prioritise maintaining a stable value for the stablecoins in the secondary markets, and that all potential and/or actual conflicts of interest have been identified and mitigated.

(Paragraph 3.4)

Customer on-boarding and management

HKMA-licensed Stablecoin Issuers must implement robust policies and procedures for customer on-boarding and the issue and redemption of stablecoins. Where applicable, they should conduct customer due diligence on stablecoin holders and potential stablecoin holders before issue and redemption as required by the HKMA AML/CFT Guideline.

They must comply with relevant laws and regulations in the jurisdictions in which they will offer stablecoins and should implement policies and procedures that:

• block stablecoin issues and offers in jurisdictions where these activities are illegal (e.g., by verifying customer IDs, geolocation lookup via Internet Protocol addresses, access blocking etc.);
• ensure their operations and marketing activities comply with laws and regulations applicable in the relevant jurisdictions;
• actively monitor regulatory changes affecting stablecoins in order to make appropriate changes to their operations.

Additionally, HKMA-licensed Stablecoin Issuers must have controls to mitigate the risk of location spoofing (e.g., use of VPNs) during remote customer on-boarding and in the course of their business. For example, VPN use can be detected by implementing controls that examine network protocols and device configurations, and by verifying IP addresses against those of commercial VPN providers.

(Paragraph 3.5)

C. BUSINESS ACTIVITIES IN RELATION TO ISSUANCE OF STABLECOINS IN HONG KONG

Restrictions on business activities

Section 12: HKMA-licensed Stablecoin Issuers must:

• have sufficient resources for conducting stablecoin activities;
• obtain HKMA consent for the conduct of any business activity other than a licensed stablecoin activity (Other Business Activities);
• implement controls to ensure that: (a) any other business activity approved by the HKMA does not cause significant risk to their stablecoin activities; and (b) conflicts of interest (actual or potential) can be properly managed and mitigated.

HKMA-licensed Stablecoin Issuers need to:

• implement governance arrangements for the conduct of other HKMA-approved business activities;
• carry out risk assessments to identify risks and implement controls to manage and mitigate the risks identified; and
• establish appropriate controls to ensure that other HKMA-approved business activities do not pose substantial risks to their licensed stablecoin activities and to manage and mitigate any potential or actual conflicts of interest arising from these activities. Sufficient resources must be allocated to issuers’ licensed stablecoin activities.

The restrictions on Other Business Activities do not apply to HKMA-licensed Stablecoin Issuers that are authorised institutions under the Banking Ordinance.

(Paragraph 4.1)

Issuance of more than one type of specified stablecoins

HKMA-licensed Stablecoin Issuers can issue more than one type of stablecoin under their licence, but should consult the HKMA before issuing a new type of stablecoin (e.g., a stablecoin referencing other official currencies). The issuer will need to demonstrate to the HKMA that:

• it has adequate capabilities and resources to manage the issue of different types of stablecoins; and
• the issue of an additional type of stablecoin will not adversely impact its existing stablecoin operations.

D. FINANCIAL RESOURCES OF HONG KONG STABLECOIN ISSUERS

Minimum paid-up share capital

Section 4(2): HKMA-licensed Stablecoin Issuers must have paid-up share capital of HKD 25 million (or its equivalent in a currency freely convertible into Hong Kong dollars) or other financial resources in an equivalent amount approved by the HKMA.

Section 17: The HKMA may impose higher financial resources requirements under licence conditions.

HKMA-licensed Stablecoin Issuers must have adequate financial resources to sustain their licensed stablecoin activities, fulfill all its obligations, and facilitate a smooth exit, whether voluntary or due to licence revocation.

Financial resources meeting the requirements of Schedule 2 to the Stablecoins Ordinance must be used solely for the stablecoin issuer’s business activities and cannot be diverted to dealing with related parties (shareholders, directors, affiliated companies or senior management). Authorised institutions are exempt from these requirements but must comply with the requirements under the Banking Ordinance.

Liquid assets

Section 4(1): HKMA-licensed Stablecoin Issuers must have adequate financial resources and liquid assets to meet their obligations as they fall due.

HKMA-licensed Stablecoin Issuers must have adequate financial resources and liquid assets to meet their obligations as they become due. To achieve this, they should maintain sufficient liquid net assets funded by equity—meaning not from loans, guarantees, or similar borrowings—to cover their obligations. When assessing the adequacy of liquid net assets, factors such as historical and projected operating expenses should be taken into account. To ensure this requirement is met, HKMA-licensed Stablecoin Issuers should ensure a reliable and secure ongoing source of financial resources. Stablecoin issuers that are authorised institutions must instead comply with the requirements of the Banking Ordinance and related guidance.

E. RISK MANAGEMENT

Risk governance

Section 9: HKMA-licensed Stablecoin Issuers must implement risk management policies and procedures to manage risks arising from their stablecoin activities, including:

• Adequate security and internal controls to ensure the safety and integrity of data and records;
• Effective means for detecting fraud and attempted fraud;
• Robust, effective contingency plans to handle operational disruptions; and
• other operational safeguards appropriate for their activities.

The HKMA’s prior consent is required for any deviation from the above policies and procedures.

HKMA-licensed Stablecoin Issuers must establish risk governance frameworks defining clear responsibilities for the board, any specialised committees, senior management and their different functions. They need to monitor their adherence to risk appetite and risk limits, and identify, measure, manage and control risks. This should involve the following three lines of defence:

1. business units should conduct ongoing risk identification, assessment, management and reporting;
2. independent risk management and compliance functions – the risk management function should take responsibility for overall risk identification, assessment, monitoring, reporting, control and mitigation, while the compliance function should be responsible for managing the compliance risk; and
3. an independent internal audit function.

The risk management, compliance and internal audit functions must have adequate authority and resources and unfettered access to the information they require, and be independent of the front-line operations. The risk management and compliance functions should generally report directly to senior management, while the internal audit function should report to the board or a board committee. The risk management function should also have direct access to the board, and the compliance function must be able to report matters directly to the board where necessary.

(Paragraph 6.2)

Risk management framework and internal control system

HKMA-licensed Stablecoin Issuers must establish a comprehensive, board-approved risk management framework with documented policies and procedures to identify, assess, monitor, report, control and mitigate all material risks — including credit, liquidity, market, technology, operational, reputation, and AML/CFT risks. This framework must clearly define accountability and authority while enabling:

• Risk identification and assessment, including the evaluation of exposure to material risks associated with their businesses taking into account internal factors (business model, operations) and external factors (market trends, target sectors);
• Risk monitoring and reporting: ongoing surveillance of their risk profile and material exposures using qualitative and quantitative metrics for early warnings, with timely, actionable reports incorporating audit findings and feedback provided to senior management and the board;
• Risk control and mitigation employing robust internal controls ensuring operational integrity, fraud and error prevention, data security, and compliance with laws and policies, supported by verification processes and consequences for non-compliance.

(Paragraph 6.3)

Credit, liquidity and market risk management

Section 5(6)(a): HKMA-licensed Stablecoin Issuers are required to implement comprehensive risk management policies and procedures to ensure reserve assets are properly managed and valid redemption requests are promptly honoured.

For Credit Risk: Measures should be implemented to manage credit risk exposures to counterparties in relation to their management of reserve assets. HKMA-licensed Stablecoin Issuers should set and enforce internal limits based on their creditworthiness. Issuers should also establish breach response procedures which include promptly notifying the HKMA of prolonged breaches (e.g., of more than one business day).

For Liquidity Risk: Measures should be put in place to project and monitor liquidity demand from redemption requests under normal and stressed conditions. Policies to manage the reserve assets’ liquidity profile (e.g., managing allocation according to instrument types, maturities, counterparties) should also be put in place to ensure timely payouts to meet valid redemption requests, considering factors such as the liquidity of instruments, settlement times, term and early withdrawal options and concentration risks. HKMA-licensed Stablecoin Issuers should set and enforce internal limits for liquidity indicators (e.g., cash ratios and conversion of reserve assets within certain time limits), with breach procedures and HKMA notification for prolonged breaches of internal limits.

For Market Risk: HKMA-licensed Stablecoin Issuers should set and enforce internal limits for market risk indicators, with breach procedures and HKMA notification protocols for prolonged breaches (e.g., exceeding one business day). Issuers should also apply appropriate over-collateralisation for reserve assets to cover market risk.

Stress testing: Quarterly stress testing should be carried out using strict but plausible scenarios to assess the robustness of reserve assets and the adequacy of risk management measures against credit, liquidity and market stress. Methodologies, data sources and results must be submitted promptly to the board and the HKMA. Scenarios and assumptions require regular review and board approval for material changes.

(Paragraph 6.4)

Technology risk management

HKMA-licensed Stablecoin Issuers must maintain and implement a technology risk management framework to ensure the adequacy of controls over their information technology operations, the quality and security of their technologies and the safety and efficiency of their operations.

The HKMA requires the technology risk management framework to cover at least the following:

• Token management

  The HKMA expects the technology risk management framework to document the token standards and distributed ledgers used and the smart contract architecture for each stablecoin type. HKMA-licensed Stablecoin Issuers should adopt a suitable level of authorisation requirement for the level of risk of each operation throughout the stablecoins’ lifecycle. Additionally, HKMA-licensed Stablecoin Issuers should implement specific authorisation controls such as multi-signature requirements for high-risk lifecycle operations and impose additional security measures such as velocity limits on transactions, restrictions on minting, time locks and pre-signed transactions for certain operations, off-chain simulation, and check signed transactions where applicable to ensure that operational execution is robust and secure.

  Staffing plans, staff screening and training are also required together with policies to ensure adequate segregation of duties to ensure checks and balances. Auditing of smart contracts is required annually and whenever there are smart contract upgrades. Reporting protocols must also be put in place for material changes or incidents.

• Wallet and private key management

  HKMA-licensed Stablecoin Issuers must apply stringent controls to the full lifecycle of cryptographic keys (from generation to usage to destruction), with elevated standards for “Significant Seeds and/or Private Keys” involved in the deployment or upgrade of smart contracts in relation to stablecoins, role management and operations that materially affect the stablecoins’ supply.

  The HKMA Stablecoins Guideline sets out the HKMA’s detailed expectations on the controls to be implemented for each aspect involved in wallet and private key management including: (i) hardware and software management; (ii) key generation; (iii) key distribution; (iv) key storage; (v) physical security of key storage; (vi) key inventory; (vii) key usage; (viii) key rotation and destruction; (ix) key compromise; (x) key back-up; (xi) key recovery; and (xii) logs.

• Account management

  During customer on-boarding, effective procedures must be adopted to establish and verify customer identity according to the nature of the customer (i.e., natural or non-natural person). HKMA-licensed Stablecoin Issuers should establish at least one secure ongoing communication channel with customers.

  When meeting requests for stablecoin issue or redemption, funds should only be accepted from or transferred to customers’ pre-registered accounts and stablecoins must only be transferred to or from customers’ pre-registered wallets. Only bank accounts in customers’ names and wallet addresses belonging to customers or in their names should be pre-registered with HKMA-licensed Stablecoin Issuers.

  HKMA-licensed Stablecoin Issuers must also authenticate customers’ identities when they perform account operations such as logging into accounts, requesting issue or redemption, changing their particulars, or pre-registering bank accounts or wallet addresses. They should consider implementing two-factor authentication measures and one-time passwords should be delivered through secure channels. Transactions should be logged and provide a clear audit trail and customers must be given an avenue for reviewing their past transactions.

  Additionally, measures should be put in place to prevent, detect and block unauthorised access to customers’ accounts and fraudulent transactions and to advise customers on security precautions if needed. Further measures should also be imposed where customers are given programmable access to their accounts.

• Security management

  HKMA-licensed Stablecoin Issuers must implement measures to ensure a high level of security of IT assets covering: (i) system security settings; (ii) authentication and access control with a security administration function; (iii) security monitoring; (iv) security patch management; (v) physical and personnel security, especially when third party service providers are given access to critical information processing facilities; and (vi) endpoint security and end-user computing.

• Information management

  Measures managing the security of information collected by HKMA-licensed Stablecoin Issuers must at least cover: (i) information ownership assignment and classification; (ii) encryption of information when in storage and in transmission; and (iii) information retention and disposal.

• IT services and operations

  HKMA-licensed Stablecoin Issuers must ensure that IT services and operations are effective and robust. The HKMA expects that the policies and procedures on IT services and operations should cover: (i) IT operations management and support; (ii) IT incident and problem management; (iii) capacity and performance of IT assets; and (iv) IT facilities and equipment maintenance.

• Project and change management

  The framework for managing technology-related projects and the risk management and internal control framework should: (i) adopt a full project life cycle methodology approach; (ii) use a formal testing and acceptance process before adopting systems; (iii) segregate development, testing and production environments; and (iv) implement change management to plan, schedule, apply, distribute and track changes to IT assets, including emergency changes and approval procedures for these changes.

• Network management

  HKMA-licensed Stablecoin Issuers must designate competent expertise to manage and continuously monitor the network for failures, overload and intrusions. Controls and procedures for using networks and network services must also be put in place with secure network infrastructure, applicable encryption and other network security measures.

• Cybersecurity

  HKMA-licensed Stablecoin Issuers must implement robust cybersecurity measures to identify and mitigate cyber risks. This includes conducting regular risk assessments to identify threats from internal and external operations, monitoring threat intelligence to detect emerging risks, and deploying tools like antivirus software and anti-malware to detect vulnerabilities. Regular vulnerability scans, penetration testing, and simulated cyberattack drills should be performed to evaluate security defences in place. Additionally, an incident response plan must be established to detect, contain and recover from cyber incidents, with clear escalation procedures and forensic analysis to prevent recurrence.

• Disaster recovery

  An IT disaster recovery plan is required to be included in the incident management framework and business continuity plan.

• Management of technology service providers

  HKMA-licensed Stablecoin Issuers must ensure that third-party technology service providers are able to meet their cybersecurity standards and have restrictions on outsourcing critical technology services. Service contracts should also define performance, ownership and accountability. Diversifying providers and having contingency plans may also reduce dependency risks.

(Paragraph 6.5)

Operational risk management

Regular review procedures should be put in place to identify operational risks that emerge from time to time and suitable risk assessment matrices should be adopted for each identified risk.

In terms of third party risk management, the HKMA recommends the adoption of the following measures:

• Pre-engagement assessment

  Identify and assess risks of third party arrangements, including the potential impact on the stablecoin issuer’s business operations, and in particular, evaluate the criticality of the third party services, the reasons for outsourcing, and the effect on the issuer’s risk profile. The risks of disruption to the third party’s operations should also be assessed as part of the HKMA-licensed Stablecoin Issuer’s incident management framework and business continuity plan and Stablecoin Issuers should ensure that they and third parties implement appropriate contingency plans to minimise the impact on their operations.

  Due diligence on third parties should be conducted covering areas such as cost, service quality, financial stability, reputation and technical capabilities, third party audits, compliance with regulations, long-term capacity, industry expertise and ability to adapt to market innovation.

• Contractual agreements

  Written contracts must be entered into with third parties specifying the service scope, performance standards, operational/subcontracting arrangements, contingency plans, termination rights, fees, data access rights and data handling (storage, backup, confidentiality and deletion upon contract expiry).

• Ongoing monitoring and review

  HKMA-licensed Stablecoin Issuer’s should conduct continuous monitoring of third parties’ operational status and the availability of their services. They should also conduct regular risk assessments and quality reviews to ensure compliance. Depending on market standards and business needs, the arrangements may need to be re-negotiated and updated.

• Regulatory and data access compliance

  Ensure that authorities (e.g., the HKMA) and auditors can access data without obstruction and measures should be put in place to allow on-site/off-site examinations (announced/unannounced) of third-party operations.

• Comply with Personal Data (Privacy) Ordinance (Chapter 486 of the law of Hong Kong) and privacy guidelines

  HKMA-licensed Stablecoin Issuers should implement measures to ensure that third party arrangements comply with the Personal Data (Privacy) Ordinance (Cap. 486) (PDPO) and relevant codes of practice, guidelines etc. Data access by third party service providers should be restricted to authorised personnel only. HKMA-licensed Stablecoin Issuers must also ensure data return or destruction upon termination of a third party’s services.

• Cross-border arrangements

  If overseas third-party service providers are engaged, the additional risks arising from this arrangement must be considered (e.g., in relation to the governing law of the agreement). HKMA-licensed Stablecoin Issuers will need to ensure that the Hong Kong authorities, e.g., the HKMA, and their external auditors can access licensee data. They must also assess overseas regulatory authorities’ degree of access to data and ensure the HKMA is notified if such authorities seek access to their data.

• Reporting and notification

  HKMA-licensed Stablecoin Issuers should adopt policies for determining the materiality of third party arrangements and notifying the HKMA of any material third party arrangement before they commence. Non-material third party arrangements must also be monitored and the HKMA should be notified if they become material. Material third party arrangements include (without limitations) arrangements for custody of reserve assets, stablecoin distribution, and critical IT services.

(Paragraph 6.6)

Reputation Risk Management

HKMA-licensed Stablecoin Issuers must manage reputation risks by identifying, monitoring and minimising reputation risks that may arise considering the size and complexity of their business activities, and mitigate the potential impacts in a timely manner. These measures also require reporting protocols to notify the HKMA of incidents that may have a material adverse effect on their reputation. The HKMA also emphasises the importance of implementing measures to detect potential fraud in relation to its business and stablecoins.

(Paragraph 6.7)

Incident Management, Business Continuity and Exit

Section 16(1): HKMA-licensed stablecoin issuers must have in place and implement adequate and appropriate systems of control for appropriate planning to support timely recovery and continuity of critical functions in relation to their licensed stablecoin activities when there is a significant operational disruption.

Section 16(2): HKMA-licensed stablecoin issuers must have in place and implement adequate systems of control to ensure: (a) an orderly wind-down of their licensed stablecoin activities could be implemented; and (b) redemption of stablecoins could be honoured in an orderly manner.

The incident management framework should enable timely responses to material incidents affecting business operations, assets, reputation or regulatory compliance. This framework requires:

• clear criteria for classifying incident severity that would trigger response procedures across multiple risk domains (i.e. credit/liquidity, technology, operational, de-pegging, reputational, legal etc.);
• containment strategies for incidents threatening reserve asset backing or redemption capabilities, such as liquidity stress protocols;
• operational continuity plans for stablecoin issuance and redemption during disruptions, with specific measures regarding third-party services;
• technology failure protocols such as data back-ups for facilitating recovery and redemption pathways for irrecoverable ledger failures;
• post-incident actions including forensic evidence preservation, root cause analysis, and corrective measures.

HKMA-licensed Stablecoin Issuers must put in place a business continuity plan which must:

• be overseen by senior management;
• be documented and outline critical operations, dependencies, escalation procedures and key personnel contacts, with copies stored off-site;
• include regular business impact analyses, monitoring mechanisms, classification of essential critical services and recovery strategies (e.g., maximum tolerable downtime, recovery time and recovery point objectives);
• require regular back-ups of essential data at secure off-site locations, using real-time mirroring for high-availability records where applicable;
• designate geographically separate alternate sites for business and IT recovery, equipped to meet operational needs within required timeframes; and
• avoid over-reliance on third parties for recovery services; if used, risks must be managed per third party risk guidelines.

A business exit plan is required to ensure the orderly wind-down of stablecoin activities where necessary. This plan must cover scenarios triggering wind-down, with monitoring mechanisms and include detailed procedures for:

• liquidating reserve assets (maximising proceeds, minimising market impact);
• facilitating redemption claims by stablecoin holders;
• distributing proceeds to holders; and
• managing third-party arrangements.

Sufficient time and resources should be reserved for an orderly wind-down when needed, and the legal certainty and operational feasibility of the business exit procedures must also be considered.

HKMA-licensed Stablecoin Issuers must review and update their incident management framework, business continuity plan, and exit plan annually or after any activation. Identified shortcomings must be promptly addressed in updated documents.

Annual testing and simulations of all plans should be carried out and reported to the board and senior management to ensure that relevant staff are familiar with their roles and responsibilities, and the plans should be updated accordingly to fix identified gaps. HKMA-licensed Stablecoin Issuers must also comply with the following reporting obligations to the HKMA:

• submission of contact details of key personnel for plan implementation and notify changes promptly;
• immediate reporting if scenarios triggering incident response, continuity recovery, or exit plans materialise or are anticipated;
• obtain HKMA’s written consent before delaying stablecoin redemptions beyond one business day under any plan.

(Paragraph 6.8)

F. CORPORATE GOVERNANCE

Corporate governance

Section 9: HKMA-licensed Stablecoin Issuers must implement risk management policies and procedures to manage risks arising from their stablecoin activities commensurate with the scale and complexity of those activities.

Section 13: HKMA-licensed Stablecoin Issuers must have in place and implement adequate and appropriate risk management policies and procedures to identify, prevent, manage and disclose potential and actual conflicts of interest between themselves and stablecoin holders.

In connection with the requirement to implement adequate and appropriate risk management policies and procedures, the HKMA emphasises the need for good corporate governance with clear organisational roles, documented decision-making procedures and internal reporting lines to ensure effective decision-making.

• Board Responsibilities

  The board is responsible for the operations of the HKMA-licensed Stablecoin Issuer. At least one-third of the board should be independent non-executive directors (INEDs) to ensure appropriate checks and balances and objective judgement. The HKMA’s prior approval is required for director (including INED) appointments (except for authorised institutions which should comply with the requirements under the Banking Ordinance). In addition to documenting clearly defined responsibilities, authorities, composition requirements and arrangements, the board’s responsibilities also include:

  • setting business objectives/strategies;
  • establishing a corporate structure with defined responsibilities;
  • delegating members to specialised committees (e.g., audit, remuneration);
  • appointing/supervising senior management;
  • establishing and overseeing risk governance, approving risk management policies and key procedures and ensuring effective internal control functions; and
  • setting the issuer’s corporate values, standards and overseeing its remuneration policy.

• Senior Management

  Senior management (i.e. chief executives, the stablecoin manager (if the stablecoin issuer is an authorised institution), and other senior executives) should report to the board and should be guided by clearly defined responsibilities, performance assessments and accountability mechanisms. Their key duties include:

  • proposing and implementing board-approved business strategies;
  • establishing corporate structure with documented roles and reporting lines;
  • ensuring staff competency via recruitment, appraisal and development programmes;
  • implementing risk management frameworks and internal controls; and
  • establishing a management information system for providing the board and senior management with regular, accurate information.

• Compliance and internal audit

  These functions must be performed by competent professionals, be independent, adequately resourced and separate from the business units. They must also have sufficient authority and unfettered data access.

  The compliance function should ensure the licensed issuer’s compliance with applicable laws, regulations and codes of conduct. It should develop board-approved compliance policies and ensure the effective management of compliance risk. The compliance function should report to senior management with the right to report to the board directly. The compliance policy should be regularly reviewed.

  The internal audit function should be responsible for conducting impartial assessments of the licensed issuer’s internal systems and controls, identifying weaknesses and proposing improvements. Its operations should be guided by an audit charter approved by the board and it should report to the board or a board committee directly.

  The compliance and internal audit functions should be independent of one another. HKMA-licensed Stablecoin Issuers that rely on an external or group service must demonstrate the effectiveness of the arrangement to the HKMA.

• Corporate governance measures

  The HKMA recommends adopting a code of conduct for the board, senior management and staff members with integrity standards covering the fitness/propriety of chief executives, directors, managers and stablecoin managers and prohibiting certain behaviour such as conflicts of interest and bribery (aligned with the Prevention of Bribery Ordinance). To comply with the conflict management requirements under section 13(3) of Schedule 2 to the Hong Kong Stablecoins Ordinance, policies to identify and prevent conflicts (e.g., segregation of duties, information barriers) should be adopted. Additionally, a remuneration policy commensurable with HKMA-licensed Stablecoin Issuers’ business strategies and long-term interests should be put in place. The remuneration policy for chief executives, stablecoin managers and control function heads should be overseen by the board. The remuneration policies for internal control functions should also be separated from those for staff of the front-line business units.

Fitness and propriety

(Sections 37, 39, 53, 58, 66 Hong Kong Stablecoins Ordinance, sections 7 and 8 of Schedule 2 Hong Kong Stablecoins Ordinance)

HKMA-licensed Stablecoin Issuers must ensure that their controllers, directors, chief executives, stablecoin managers and managers meet stringent fitness and propriety standards and have suitable knowledge and expertise to carry out their respective duties. Key roles that require the HKMA’s prior approval include chief executives, directors and controllers (of non-authorised institutions) and stablecoin managers (of authorised institutions). The appointment or appointment cessation of managers of HKMA-licensed Stablecoin Issuers must be notified to the HKMA within 14 days.

To evaluate whether a proposed chief executive, stablecoin manager, director, controller or manager meets the fitness and propriety requirements, the HKMA will generally consider their:

1. integrity:

   • clean criminal record and regulatory history in Hong Kong and other jurisdictions;
   • absence of past disqualifications;
   • financial soundness (absence of risks to operations and stablecoin holders’ confidence);

2. competence:

   • relevant experience, qualifications, and leadership ability;
   • demonstrated time commitment and ability to work with other functions and staff;
   • absence of conflicts of interest;
   • for INEDs, independence from the HKMA-licensed Stablecoin Issuer and its significant shareholders.

For managers, HKMA-licensed Stablecoin Issuers must also clearly define the required skills and knowledge for each managerial position and implement structured procedures for managers including:

• rigorous selection and appointment protocols;
• performance appraisals and disciplinary mechanisms;
• temporary coverage plans for vacancies;
• ongoing training and development programmes; and
• internal audit reviews of control systems to ensure that managers are fit and proper to hold their respective positions.

(Paragraph 7.2)

G. BUSINESS PRACTICES AND CONDUCT

Information & accounting systems

HKMA-licensed Stablecoin Issuers should establish effective information and accounting systems with back-up facilities and disaster recovery arrangements to accurately and timely record all business activities, including both on-chain and off-chain data, and generate quality management information for operational efficiency and maintain audit trails.

Additionally, compliant books, accounts and financial statements must be maintained in accordance with Hong Kong’s regulatory standards and accounting requirements. HKMA-licensed Stablecoin Issuers should also adopt comprehensive record-keeping policies to retain accurate documentation of business activities and decisions for a sufficiently long period having regard to relevant statutory and regulatory requirements. If these systems are located outside Hong Kong, the HKMA and other authorised parties must be provided with unimpeded access to conduct both announced and unannounced on-site examinations or off-site reviews.

Personal data protection

HKMA-licensed Stablecoin Issuers should observe and comply with the PDPO and all relevant publications on personal data protection by the Office of the Privacy Commissioner for Personal Data.

Complaints handling

Section 14: HKMA-licensed Stablecoin Issuers must ensure that holders have access to complaints handling and redress mechanisms that are fair, timely and efficient.

As HKMA-licensed Stablecoin Issuers are required to segregate duties, complaints should be handled by competent staff not involved in the subject matter. Formal policies must be established to cover complaint acknowledgment, investigation, escalation, remediation, resolution, response, closure and follow-up on systemic issues. Records of complaints should be kept confidential. The complaint system should also be publicly accessible with processes and timeframes disclosed prominently on the Hong Kong stablecoin issuer’s website. If third-party entities are engaged to distribute stablecoins, procedures for third-party entities’ handling of complaints should also be implemented.