The Hong Kong Securities and Futures Commission (SFC) has introduced strict new regulations for virtual asset custodians, including a surprising ban on the use of smart contracts in cold wallets. The new rules, which are effective immediately, aim to bolster security as Hong Kong positions itself as a major hub for digital assets.
In a circular released on Friday, the regulator outlined several prescriptive security measures that licensed virtual asset custodians must follow. These include:
Certified Hardware: Using a certified hardware security module (HSM) for key management.
Whitelisted Addresses: Permitting withdrawals only to pre-approved addresses.
Around-the-Clock Monitoring: Maintaining a 24/7 security operations center to monitor systems and wallets.
Air-Gapped Environments: Requiring private keys to be generated and stored in air-gapped, physically secured environments.
However, the most significant change is the prohibition of smart contracts for cold wallet implementations. The SFC circular states that using smart contracts on public blockchains for cold wallets increases “potential online attack vectors,” and therefore should be avoided.
This new directive is expected to face pushback from the industry, as many institutional custodians rely on smart contracts for their cold wallet solutions. For example, prominent custody providers like BitGo and Safe (formerly Gnosis Safe) use smart contract-based multisignature models. According to a Messari report, Safe held over $72 billion in assets across its smart accounts as of the third quarter of 2024.
Last March, US-based crypto exchange Coinbase referred to Safe as “the leading provider” of multisig services, highlighting how widespread this technology is in the crypto space.
The new custody standards are part of a broader effort by Hong Kong to create a comprehensive regulatory framework for digital assets. The city has recently launched spot Bitcoin and Ether ETFs and is expanding its roster of licensed virtual asset trading platforms, solidifying its role as a key crypto hub in Asia.