The Securities and Futures Commission (SFC) today sets out its expectations in a circular to all licensed virtual asset trading platforms (VATPs) on ensuring the robust custody of client virtual assets, in order to lay a solid foundation for the industry’s transition to more advanced custody technologies under the “ASPIRe” roadmap (Note 1).
The SFC sees the need for VATPs to critically review and strengthen their custody practices at a time when multiple cases of custody vulnerabilities have arisen overseas and the regulator’s own targeted review aimed to evaluate VATPs’ resilience against cybersecurity threats earlier this year revealed inadequacies in some operators’ controls.
Multiple cybersecurity incidents at overseas virtual asset platforms resulting in significant client asset losses have also highlighted persistent risks to custody globally. Key weaknesses in wallet infrastructures and controls include compromised third-party wallet solutions, insufficient transaction verification processes, and inadequate access controls over approval devices.
In its latest circular, the SFC provides examples of good practices along with its expected minimum standards that VATP operators must meet, covering senior management responsibilities, client cold wallet infrastructure and operation, use of third-party wallet solutions, real-time threat monitoring and others. Going forward, these standards will also form the core expectations for virtual asset custodians, and help foster an effective industry-wide framework for virtual asset custody (Note 2).
Dr Eric Yip, the SFC’s Executive Director of Intermediaries, said: "In order for Hong Kong to foster a competitive, sustainable and trusted digital asset ecosystem, client asset protection must always remain a top priority for all licensed VATPs, which can leverage the SFC’s practical guide to step up their custody practices especially amid heightened risks globally."
Notes:
- This is one of the objectives under Pillar “S” (Safeguard) of the SFC’s "ASPIRe" roadmap.
- See the Public Consultation on Legislative Proposal to Regulate Virtual Asset Custodian Services jointly issued by the Financial Services and the Treasury Bureau and the SFC.
