Hong Kong’s SFC Sets Strict Custody Standards for Crypto Exchanges Amid Global Risks

Highlights:

• SFC sets strict custody standards for crypto exchanges after global breaches.
• Licensed platforms must improve wallet systems and transaction controls.
• The rules aim to secure Hong Kong’s role in the global crypto market.

Hong Kong’s Securities and Futures Commission (SFC) has introduced new strict custody standards for crypto exchanges after global security breaches. The regulator issued a circular to licensed virtual asset trading platforms (VATPs) outlining the measures. These standards aim to protect client assets and boost the region’s competitive position in the digital asset sector.

The shift is in the wake of a focused review of custody practice earlier this year. The findings of that review indicated deficiencies in controls by some of the operators against cyber threats. The need for tighter protection has also come into the limelight with rising levels of incidents overseas, causing billions of losses.

The Hong Kong SFC issued new guidance for virtual asset trading platforms to strengthen custody standards, citing global security incidents and gaps found in a recent review. The circular outlines minimum requirements for wallet infrastructure, access controls, and management…

— Wu Blockchain (@WuBlockchain) August 15, 2025

Executive Director of Intermediaries at the SFC, Dr. Eric Yip, stated:

“To promote a competitive, sustainable and trusted digital asset ecosystem in Hong Kong, the protection of client assets will always be a priority of utmost importance to all licensed VATPs. The guide provided by SFC can help address the issues related to custody, particularly in light of the increasing risks on a global scale.”

Key Measures Under the New Custody Standards for Crypto Exchanges

The circular lists requirements in wallet infrastructure, transaction verification, and access controls. Cold wallets that utilize air-gapped hardware are to be used by licensed VATPs. The wallet address now requires allowlisting to avoid unauthorized transfers.

Third-party wallet solutions are also to be overseen at the SFC. Providers need to go through independent security audits. Furthermore, custody systems will lie within the direct responsibility of the senior management. This involves making sure that trained personnel help to identify and respond to any suspicious activity. Moreover, operators need to initiate 24-hour security surveillance. The real-time threat detection will assist in responding to cyberattacks before major losses are incurred. The control of private keys and other related credentials is also part of the measures.

In the first half of 2025, global breaches resulted in a loss of over $3 billion. Additionally, PeckShield estimated that $142 million in hacking losses occurred in a series of July breaches. The number jumped 27% from June, showing that attacks are on the rise. The latest case hit the Turkish exchange BtcTurk, which reportedly lost $48 million in a multi-chain exploit.

Building a Secure Digital Asset Ecosystem

The custody standards of the crypto exchanges are under the SFC roadmap, the ASPIRe. The plan maps the direction of digital asset regulation and infrastructure development in Hong Kong. The new measures will also act as the foundation of a potential licensing regime that will cover standalone virtual asset custodians.

The regulator setting strict custody standards for crypto exchanges comes only weeks after Hong Kong initiated a stablecoin licensing regime. This shows the approach that the city has taken to attract crypto businesses by providing transparent regulatory frameworks. The standards will become applicable immediately, with no grace period for VATPs to meet them.

🚨 Hong Kong’s Stablecoin Law Takes Effect TODAY

Hong Kong’s stablecoin bill is now LAW.

It sets the stage for a licensed, tightly regulated stablecoin market.

Here’s what you need to know 🧵👇 pic.twitter.com/uqZyaxxTJR

— Stabolut (@stabolut) August 1, 2025

The SFC is also conducting a public consultation on the licensing of custodians of client assets and related transfer tools. The plan includes transition steps and speeds up approvals for companies the regulator has already reviewed. There are also plans for higher application fees as well as annual fees under a user-pays model.