SFC & FSTB Consult on Regulation of Virtual Asset Custodians

The Financial Services and the Treasury Bureau (FSTB) and the Securities and Futures Commission (SFC) have issued a Public Consultation on a Legislative Proposal to Regulate Virtual Asset Custodian Services setting out the key parameters of a proposed licensing regime for virtual asset (VA) custodian service providers in Hong Kong. The SFC would license VA custodians (or register them in the case of banks) and would supervise their ongoing compliance with anti-money laundering and counter-terrorist financing (AML/CFT) obligations and other regulatory requirements similar to those applicable to virtual asset trading platforms (VATPs) under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615) (the AMLO).

The SFC and FSTB are simultaneously consulting on a licensing regime for providers of VA dealing services in Hong Kong,¹ which is covered here. The deadline for responding to both consultations is 29 August 2025. The regulators’ stated intention is to introduce bills on the proposed licensing regimes for VA custodians and dealers as soon as practicable.

Hong Kong’s Current Regulation of VA Custodian Activities

Hong Kong’s current regulations seek to ensure that investors’ VAs are held in custody with SFC or HKMA-regulated entities subject to the relevant regulator’s requirements. SFC-licensed VATPs, for example, must hold client VAs through their associated entities, which are subject to AML/CFT requirements and asset safeguarding obligations including segregation of client VAs and robust controls on private key management. SFC-licensed or registered intermediaries offering VA-related services to clients are similarly required to provide custodian services for client VAs either themselves or with Hong Kong banks or their subsidiaries.² In the case of SFC-authorised VA funds, the trustee or custodian can only delegate VA safekeeping to an SFC-licensed VATP, a bank, or a subsidiary of a Hong Kong-incorporated bank meeting the requirements of the HKMA.³ The HKMA published guidance on providing custody for digital assets (including VAs) for banks and the subsidiaries of Hong Kong-incorporated banks in February 2024,⁴ which sets requirements for the segregation of client VAs and risk management.

When the FSTB consulted on proposals to license VA over-the-counter (OTC) trading in 2024, it learned that VA custody is commonly provided as part and parcel of many VA OTC activities, for example, VA broker-dealer activities. These and various standalone VA custodian services in Hong Kong are currently unregulated. Given the proposed implementation of a new licensing regime for VA dealing service providers and an increase in the number of VA-related services and products, in particular SFC-authorised spot VA exchange-traded funds, the regulators anticipate significant demand for VA custodian services, which they propose to regulate similarly to comparable VA-related services.

Proposed Hong Kong Licensing Regime for Virtual Asset Custodian Service Providers

The Regulators of VA Custodian Service Providers

Under the proposals, the SFC would be responsible for licensing and registering VA custodian service providers and setting the regulatory standards, while the HKMA would be the frontline regulator of banks and stored value facilities (SVFs) providing VA custodian services and would supervise their VA custodian activities. VA custodians that are subsidiaries of Hong Kong-incorporated banks would be regulated by the SFC, while stablecoin issuers licensed by the HKMA under the Stablecoins Ordinance that provide custody for the stablecoins they issue will be subject to the HKMA’s ongoing supervision.

Providing a VA Custodian Service

SFC licensing or registration would be required for carrying on a business in Hong Kong of providing a VA custodian service, which is to be defined as:

• “by way of business, the safekeeping of (i) VAs on behalf of clients; or (ii) instruments enabling transfer of VAs of clients (including but not limited to private keys) on behalf of clients.”

“By way of business”

The requirement for the custodian services to be provided “by way of business” means that the licensing requirement only covers VA safekeeping on behalf of clients or the safekeeping of private keys (or similar instruments) that would enable transfer of client VAs as a business activity. Licensing would not be required for a person’s self-custody of their own VAs.

“VAs” and “Instruments enabling transfer of VAs”

The definition of VAs will be the definition set out in section 53ZRA of the AMLO which applies to the VATP licensing regime. “Instruments enabling transfer of VAs” intends to capture the safeguarding of private keys (or similar instruments such as smartcards or authentication credentials for accessing private keys) which would enable transfer of client VAs.

Use of third parties in safekeeping client VAs

Recognising that VA custodian service providers may use third parties to safeguard clients’ VAs, the Consultation Paper invites comments on the various business models, third parties and technology infrastructure set-ups that may be involved in custody arrangements to shape entity or individual entitlement to licence requirements under the new regime.

Proposed incidental exemptions

Depending on the final definition of “VA custodian service”, incidental exemptions are proposed for SFC and HKMA-regulated entities whose safekeeping of client VAs is wholly incidental to their principal business of providing a VA service or carrying on the regulated activity for which they are licensed or registered, provided that they do not safekeep the private keys or similar instruments on behalf of clients.

An exemption is also proposed for HKMA-licensed stablecoin issuers that provide custody of the stablecoins they issue for their clients irrespective of whether the issuer safekeeps the private keys.

Licensing/registration requirement for existing licensed/registered intermediaries

Entities that are already licensed or registered with the SFC, such as fund managers, will be required to use Hong Kong VA custodian service providers that are licensed by or registered with the SFC for safekeeping client VAs.

Non-exhaustive examples of entities that would be required to be licensed or registered as VA custodian service providers include:

• associated entities of SFC-licensed VATPs, which are currently required to provide VA custodian services under the VATP regime. This means that the associated entities of SFC-licensed VATPs currently providing custodian services by way of safekeeping the private keys (or similar instruments) which enable transfer of client VAs (and who wish to continue to do so) would need to obtain a separate VA custodian service licence under the new regime;

• banks, subsidiaries of Hong Kong-incorporated banks and SVFs that provide VA custodian services themselves by way of safekeeping the private keys (or similar instruments) which enable transfer of client VAs to their clients, even if such safekeeping is carried on as part of providing VA dealing services or acting as depositaries of SFC-authorised funds with VAs in the funds’ portfolios; and

• SFC-licensed or registered fund managers that provide self-custody to the funds under their management which invest in VAs by way of safekeeping the private keys (or similar instruments) which enable transfer of fund VAs.

Entities that would not require a VA custodian service provider licence include:

• bank security vaults storing encrypted / de-activated back-up of private keys (or a part thereof);

• security companies storing encrypted / de-activated back-up of private keys (or a part thereof); and

• technical service providers that support the provision of the VA custodian service but do not safekeep the private keys (or similar instruments) themselves such as the service of providing communication or information technology networks.

3. Eligibility for Licensing as a VA Custodian Services Provider

Incorporation

Applicants for VA custodian services provider licences (other than banks and stored value facilities) would have to be:

• a Hong Kong-incorporated company with a permanent place of business in Hong Kong: or

• a company incorporated elsewhere but registered in Hong Kong under the Companies Ordinance (Cap. 622)

Financial resources

Licence applicants other than banks (which are subject to the HKMA’s existing capital requirements) would be subject to financial resources requirements referenced to those of SFO Type 13⁵ regulated activity licensees. They would be required to have:

• a minimum paid-up share capital of HK$10 million; and

• a minimum liquid capital up to HK$3 million (depending on the business model).

The regulators are also considering imposing additional financial resources requirements in line with operating expenses and/or the scale of business activities. This will be the subject of a separate consultation that will also cover compensation and insurance arrangements, the custodial infrastructure and internal control requirements.

Fit and proper requirements

In the same way as VATPs regulated under the AMLO, applicants for a VA custodian service provider licence, their substantial shareholders and individuals carrying out VA custodian functions for the corporate entity, will need to be fit and proper before a licence or registration is granted. The SFC will consider past convictions of ML/TF or other fraudulent offences, failure to observe the AML/CFT or other regulatory requirements applicable to licensed VA custodian service providers, experience, relevant qualifications, good standing and financial integrity.

Knowledge and experience

Licensees would be required to have a proper corporate governance structure and personnel with the knowledge and experience to effectively discharge their responsibilities.

Conduct of business

VA custodians would be required to act honestly, fairly, with due skill, care and diligence, in the best interests of clients and market integrity, and comply with all statutory and regulatory requirements.

Risk management

Licensed/registered VA custodians would need to implement appropriate risk management policies and procedures to manage ML/TF, cybersecurity and other risks proportionate to the scale and complexity of the business.

Information and notifications

A wide range of information including wallet addresses used in the course of business, the scope of business conducted and the types of services provided must be submitted and kept updated.

Record keeping

Licensed/registered VA custodians would need to keep proper records of transactions and fund flows which must be accessible to the SFC and HKMA for monitoring purposes.

Financial reporting and disclosure

Licensees and registrants other than banks would be required to publish audited accounts and comply with prescribed auditing and disclosure requirements.

4. Permitted Activities

Licensed or registered VA custodian service providers would be allowed to provide VA custodian services in their course of business. Depending on the final definition adopted, VA custodian services would include: safekeeping VAs on behalf of clients including by safekeeping instruments (such as private keys or similar instruments) which allow the transfer of client VAs. They would also cover functions that are integral to the VA service, such as the deposit and withdrawal of client VAs and carrying out settlement instructions of licensed intermediaries for VA trading activities.

Types of VAs under custody

There is no proposed restriction on the types of VAs for which licensed or registered VA custodians can act as custodian, provided that the VA custodian has performed robust due diligence to ensure adequate management of ML/TF risks and, if the VA custodian safekeeps the private key, its custody infrastructure can support taking the VA into custody.

Other activities

For other activities, such as the conversion of a VA to another VA or fiat or vice versa, or spot trade of any VA, licensed or registered VA custodians will also need to apply for a licence or registration as a VA dealing service provider under the proposed Hong Kong VA dealing regime, unless exempted or using a separate entity for that service. Other services ancillary to Hong Kong VA custodian services (e.g. staking) may be allowed with approval from the SFC or HKMA, subject to regulatory requirements imposed by the SFC.

Various economies are actively developing digital and other financial assets, and Hong Kong is no different, actively nurturing an environment to sustainably develop Web3 and digital assets. Hong Kong is currently focusing on enhancing liquidity in digital asset trading and diversifying digital asset product offerings. In developing the VA market, the SFC’s new roadmap ASPIRe outlines SFC’s plans to allow further VA product offerings and services such as staking, borrowing/lending, and derivatives trading.

5. Individual Licences and Relevant Individuals

Individuals responsible for the VA custodian service would need to be licensed representatives or relevant individuals accredited to the VA custodian service provider. Members of staff who perform more than a clerical role (i.e., performing routine tasks following established procedures, such as document filing and data input) directly relating to the VA custodian service provider’s fulfilment of its regulatory obligations would need to be licensed or engaged as relevant individuals. This would include members responsible for directly supervising the conduct of these functions, approving instructions or transactions, or approving asset transfers, who would be expected to obtain the SFC’s approval as responsible officers or the HKMA’s consent as executive officers for VA custodian services. Individuals applying to be a licensed representative or relevant individual will need to be fit and proper.

While clerical staff would not generally be expected to be licensed or engaged as relevant individuals, any staff authorised to sign or approve transactions to transfer clients’ VAs would need to be licensed or engaged as relevant individuals.

6. Safekeeping Private Keys

A crucial part of providing Hong Kong VA custodian services is ensuring the security and robustness of the custodian services provided to safeguard client VAs.

Hong Kong VA custodian service providers that do not safekeep private keys (or similar instruments) but appoint other SFC-licensed or registered VA custodian service providers or VA custodians regulated in other jurisdictions to safekeep the private keys (or similar instruments), will have to be licensed or registered as VA custodian service providers under the new regime. They will also be expected to adhere to regulatory requirements similar to those applicable to depositaries of SFC-authorised funds licensed for Type 13 regulated activity. These will include requirements for robust internal controls to oversee delegates and third parties.

For Hong Kong VA custodian service providers that safekeep private keys (or similar instruments), segregation of client VAs, competent personnel, compliance with robust regulatory requirements in private key management, cybersecurity and business continuity planning will be required. The SFC will align these regulatory requirements with the current custody requirements for SFC-licensed VATPs, and will be subject to a separate public consultation.

7. Open-ended Licensing

The regulators expect that licensed or registered VA custodian service providers will need to make substantive investment to acquire the necessary scale and sophistication for their business operations. The consultation paper is proposing to grant open-ended licences or registrations that will remain valid until revoked by the SFC (e.g., because of misconduct or cessation of operations).

8. Licensing Process for VA Custodian Service Providers

It is proposed that the new licensing regime will take effect on the commencement date of the relevant statutory provisions. There will be no arrangements under which existing VA custodian service providers will be deemed to be licensed for a transitional period. Instead, all industry stakeholders already engaged in Hong Kong VA custodian services should reach out to the SFA or HKMA as soon as possible (e.g. to initiate pre-application processes) and this will help determine the new regime’s commencement date and avoid unnecessary interruptions to relevant businesses.

VA custodian service providers that safekeep private keys (or similar instruments) seeking SFC licensing or registration will need to engage an external assessor to perform an external assessment after all relevant systems and controls are deployed to ensure that they are suitably designed and implemented. The SFC will be required to be a party to the external assessor’s engagement, as is the case for VATP licence applicants.

As noted above, associated entities of SFC-licensed VATPs, banks and subsidiaries of Hong Kong-incorporated banks currently providing VA custodian services may need to be licensed or registered under the new licensing regime for VA custodians. An expedited licensing process will apply to entities whose VA custodian services have already been assessed by the SFC or HKMA.

Licensing fees

Since a licence for Hong Kong VA custody is considered more complicated than typical SFO licences due to the additional technical elements involved, the SFC is proposing a higher licensing fee for VA custodian service provider licences. It is proposed that the licensing application and annual fees would be at least as high as the HK$129,730 application and annual fees that apply to Type 3 licences.

9. Prohibition on Active Marketing

Unlicensed/unregistered persons will be prohibited from actively marketing, whether in Hong Kong or elsewhere, the provision of VA custodian services to the Hong Kong public. The prohibition will prevent overseas VA custodians from actively marketing their services in Hong Kong.

10. Regulatory Authorities and Sanctions

It is proposed that the SFC would set the regulatory requirements for licensed and registered VA custodian service providers.

The SFC would also be empowered to impose licensing and registration conditions, vary existing conditions and enter licensees’ business premises to conduct routine inspections and investigate suspected non-compliance with statutory and regulatory requirements. It would also be entitled to impose disciplinary sanctions (including a civil penalty and suspension or revocation of licence or registration) in the event of non-compliance with statutory and regulatory requirements.

The HKMA would be the frontline regulator of banks and SVFs with respect to their VA custodian business and would be empowered to supervise the VA custodian business of banks and SVFs registered for VA custodian services. It would have powers to enter registered entities’ business premises to conduct routine inspections and investigate into suspected non-compliance.

Proposed sanctions for breach of regulatory requirements for VA custodians

The proposed sanctions are summarised in the table below.

Statutory Appeal

A Hong Kong review tribunal mechanism is proposed to handle appeals against decisions made by the SFC or HKMA in implementing the regime.

[newsletter_scf_custom_fields field=”references” ]