The Hong Kong Securities and Futures Commission (SFC) has issued new guidelines, effective immediately, introducing comprehensive security requirements for cryptocurrency custody standards and banning the use of smart contracts in cold wallets.
In a circular released on Friday, regulators issued detailed control requirements for licensed custodians of virtual assets. Measures include the use of certified hardware security modules, allowing withdrawals only to trusted address lists, and establishing a 24/7 security operations center to monitor systems, networks, wallets, and infrastructure.
The environment for private keys used to sign transactions must be kept isolated from the network and have physical security, and it is recommended to implement "strict multi-factor physical access controls."
"In the future, these standards will also become core expectations for virtual asset custody service providers, helping to establish a consistent framework for virtual asset custody," the circular stated.
Cold wallets are prohibited from using smart contracts
One of the most notable changes is the prohibition of using smart contracts in cold wallets. The circular noted, "The implementation of cold wallets should not include smart contracts deployed on public blockchains to reduce the risk of online attacks associated with on-chain smart contracts."
Smart contracts are widely used in institutional custody for hot wallets and cold wallets. For example, BitGo uses optimized Ethereum smart contracts suitable for hot and cold wallets and details its smart contract multi-signature model.
US company Coinbase describes Safe as the "leading provider" of multi-signature services, highlighting the industry's possible reaction to Hong Kong's move.
Hong Kong builds a crypto hotspot
By quickly introducing regulations and ensuring market access, Hong Kong is becoming a crypto hotspot in Asia. In April this year, Hong Kong launched spot ETFs for Bitcoin and Ethereum, providing institutions with compliant investment avenues, and established the ASPIRe roadmap to expand access and enhance protections for custody, products, and market structure.
Meanwhile, the Hong Kong Special Administrative Region continues to expand its list of licensed exchanges and fully implement a stablecoin system. By the end of 2024, more virtual asset trading platform registration certificates will be added, while Hong Kong's stablecoin law has been in effect since August 1 and will publish a public registry of licensed issuers.
