The Hong Kong Securities and Futures Commission has listed new requirements and recommendations to protect digital assets belonging to traders. The commission released a circular for all licensed virtual asset trading platforms (VATPs) to guide the sector toward enhanced custody systems under the “ASPIRe” plan.
According to the commission, from now on, VATPs will need to review and strengthen their custody practices, particularly in light of the series of incidents in recent months that have highlighted deficiencies in custody protection. Dr Eric Yip, the SFC’s Executive Director of Intermediaries, even added, “In order for Hong Kong to foster a competitive, sustainable and trusted digital asset ecosystem, client asset protection must always remain a top priority for all licensed VATPs, which can leverage the SFC’s practical guide to step up their custody practices especially amid heightened risks globally.”
Hong Kong agency warns of vulnerable wallet
In the detailed statement, the SFC noted that its examination of VATPs exposed gaps in several operational controls. In June 2024, it identified three unregistered VATPs active in Hong Kong: Tokencan, VBIT Exchange, and HKD.com. At the time, it accused the firms of making deceptive claims, committing fraud, and providing misleading information to investors, many of whom struggled to access their funds later.
Earlier this year, it also discovered several vulnerabilities in VTP cybersecurity, highlighting issues like inadequate network segmentation, outdated encryption methods, and lax access restrictions. Subsequently, in late January, it issued requirements for the platforms to implement network segmentation protocols, robust access control frameworks, and round-the-clock monitoring.
The recent circular introduced additional requirements for VATPs, highlighting several custody failures abroad that exposed vulnerabilities in wallets, transaction verification procedures, and access controls. According to the commission’s findings, the main failures in wallet infrastructure and controls overseas involved breaches in third-party wallet solutions, inadequate transaction verification processes, and weak access management for approval devices.
The agency also claimed that both hot and cold wallets are vulnerable, even when custody uses HSMs, MPC, or Multi-Sig methods, thus drumming up the new requirements. In addition, it claimed the circular offers extra direction for Platform Operators, seeing that although most reported having core safeguards in their latest inquiry, several submissions were still inadequate.
HKMA and SFC warn traders on stablecoin investments
It further noted that over time, the new measures will form the central guidelines for virtual asset custodians and help in creating a unified and effective framework for custody practices across the industry. Meanwhile, on Thursday, the commission, alongside the Hong Kong Monetary Authority, also put out a joint statement responding to recent changes in the stablecoin market.
The HKMA particularly emphasized that it follows a disciplined and prudent process, with relatively tough standards for granting stablecoin issuer licenses. On the other hand, the SFC claimed it will continue to observe trading activities in Hong Kong and implement safeguards where necessary. Nonetheless, both parties did encourage the public to be prudent, undertake in-depth research, and resist the temptation to invest solely based on market excitement or momentum.
Julia Leung, the Chief Executive Officer of the SFC, noted that the sudden price movements of stablecoins show that investors need to be aware of all the risks in the market and what they could lose before investing. She also urged investors to be careful of all opportunities to make gains from investments advertised on social media and other modes.
The post Hong Kong updates its virtual asset custody rules first appeared on Coinfea.