Introduction

In December 2025, the Financial Services and the Treasury Bureau (“FSTB”) and the Securities and Futures Commission (“SFC”) published consultation conclusions setting out the key features of their legislative proposal to regulate virtual asset (“VA”) custodian service providers under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615) (“AMLO”).

Current regulation of VA custodian activities

At present, SFC‑licensed virtual asset trading platforms (“VATPs”) must perform custodian services for client VAs through their respective wholly owned subsidiaries (“associated entities”).

For SFC-licensed or registered intermediaries that provide VA‑related services, they are required to custody client VAs with a SFC‑licensed VATP, a bank or a subsidiary of a Hong Kong‑incorporated bank which meets the requirements of the Hong Kong Monetary Authority (the “HKMA”). The same principle applies to SFC‑authorised funds investing in VAs, the trustees or custodians of which may only delegate VA custody functions to any of the aforesaid entities.

The FSTB and SFC noticed that certain operators that carry out VA custody function in Hong Kong, and companies which provide standalone VA custodian services in Hong Kong, remain unregulated. To enhance investor protection and market confidence, the FSTB and SFC now propose a dedicated VA custodian licensing regime under the AMLO.

Definition of “VA custodian service”

“VA custodian service” is proposed to mean “by way of business, the safekeeping of instruments enabling transfer of VAs of clients (including but not limited to private keys) on behalf of clients”, so that the licensing regime focuses on the core risk presented by entities which safeguard private keys or similar instruments that enable transfers of VAs. ​

The definition is intended to be technology‑neutral and will be interpreted on a substance‑over‑form basis. Whether or not a licence or registration is required will depend on whether the custodian service provider may unilaterally transfer client VAs to the exclusion of clients, and whether clients can independently access and manage their VAs at all times. Below are some illustrative examples:

·           multi‑party computation (“MPC”) or other technology providers will be assessed on a case‑by‑case basis. No licence or registration is required where the MPC provider’s arrangements allow clients to transfer their own VA (be it together with the MPC service provider or unilaterally) and reconstruct the complete private key or retrieve access to their VAs without support from the MPC service provider. On the other hand, a licence or registration may be required where clients cannot unilaterally transfer their VAs (e.g. where the MPC service provider does not provide a recovery kit).

 

·           a staking service provider providing “custodial” staking services through which it has the ability to transfer client VAs must obtain a licence or registration.

 

·           non‑custodial wallet providers without the ability to transfer client VAs would likely be out of scope.

 

·           trustees and fund managers which delegate VA custody to independent third‑party custodians will not themselves be required to obtain a licence or registration solely by reason of such delegation.

 

·           custodians which provide custody services solely for tokenised securities will not be subject to the proposed VA custodian licensing regime, as securities and futures contracts are excluded from the definition of “virtual asset” under the AMLO.

Licensing of entities / individuals and proposed exemptions

Licensing of entities

Under the new regime, SFC intends to require entities licensed or registered for providing VA services to use SFC-licensed or registered VA custodian service providers for safekeeping client VAs. Non‑exhaustive examples of entities that will need to obtain a VA custodian licence or registration include:

·           associated entities of SFC‑licensed VATPs that are currently required to provide VA custodian services under the VATP regime. If such associated entities wish to continue to provide “VA custodian services”, they would need to obtain a separate licence or registration;

 

·           SFC‑licensed corporations licensed for Type 13 regulated activity under the SFO, banks, subsidiaries of Hong Kong-incorporated banks, and stored value facility licensees that provide “VA custodian services”, even where such services are ancillary to VA dealing or fund depositary services; and

 

·           licensed or registered fund managers that self‑custody VAs by safekeeping the private keys (or similar instruments) enabling transfer of fund VAs, subject to a possible limited exemption for self‑custody of newly issued tokens (which remains under consideration).

Licensing of individuals

Individuals performing core VA custodian functions will either be required to be licensed or engaged as relevant individuals. These will include:

·         senior management responsible for monitoring and supervising VA custodial services;

·         individuals with direct access to private keys or authority to initiate or approve VA transfers (including initiators and intermediate approvers);

·         personnel involved in multi‑signature or threshold signing schemes; and

·         individuals with access to private key generation, storage or recovery systems.

 

VA custodian service providers should ensure that only their responsible officers, executive officers, managers‑in‑charge, relevant managers or their delegates should be authorised to perform these core functions. Individuals within group entities of the SFC-regulated VA custodian service provider carrying out such functions should be accredited to such VA custodian service provider. Staff engaged only in clerical or internal corporate functions (e.g. human resources, finance, legal and compliance) are not expected to be licensed or engaged as relevant individuals.

Proposed exemptions from licensing/registration

The FSTB and SFC propose to provide exemptions for the following:

·           licensed or registered fund managers that self‑custody newly issued tokens up to a limited threshold (which remains under consideration);

·           companies that only custody VAs for their group companies, regardless of whether fees will be charged;

·           legal and accounting professionals that hold back‑ups of private keys or similar instruments for clients, or are appointed by a court to administer VAs; and

·           HKMA‑licensed stablecoin issuers that only provide custody services for the stablecoins they issue.

 

SFC-regulated VA custodian service providers will be permitted to leverage overseas group resources and infrastructures without triggering licensing requirements for the overseas group entities, provided that the SFC‑regulated VA custodian retains independent and unilateral control to move or transfer client VAs. Having said that, such overseas entities should not market themselves to the Hong Kong public as VA custodian service providers.

Scope of business: permitted activities and types of VAs

Permitted activities

The SFC proposes to allow licensed/registered VA custodian service providers to carry out functions that are part and parcel of VA custodian services, such as the deposit and withdrawal of client VAs and carrying out settlement instructions of licensed intermediaries for VA trading activities. In addition, the SFC proposes to permit the offering of staking services,  provided that licensed/registered VA custodian service providers implement robust safeguards broadly consistent with the SFC’s circular on stacking services provided by VATP dated 7 April 2025. ​

Types of VAs under custody

There will be no restrictions on the types of VAs that may be held in custody, provided that the VA custodian service providers conduct robust due diligence and risk assessment, particularly in relation to money laundering/terrorist financing risks. The SFC will issue guidance on due diligence requirements in this regard, which is expected to include:​

·         setting up a token admission committee;

·         continuously assessing and monitoring relevant technological developments, distributed ledger technology network robustness and emerging security threats; and

·         ensuring that internal controls, technology infrastructure and AML/CFT monitoring and market surveillance tools can adequately address risks specific to VAs under custody.​

 

The SFC also clarifies that VA custodian service providers may also provide custody services for tokenised securities.

Regulatory requirements

Financial resources requirements

The SFC proposes baseline financial resources requirements of a minimum paid‑up share capital of HK$10 million and a minimum liquid capital of HK$3 million for VA custodian service providers (except for banks which will remain subject to the existing capital requirements of the HKMA). The SFC will retain flexibility to impose additional financial resources requirements where circumstances warrant.​

Other regulatory requirements

In addition to those regulatory requirements proposed by the SFC in the consultation paper issued on 27 June 2025 (which include segregation of client VAs and competent personnel, regulatory requirements in the areas of private key management, cybersecurity and business continuity planning, AML/CFT requirements stipulated in Schedule 2 to the AMLO relating to CDD and corresponding record-keeping), SFC will formulate additional requirements and build upon the regulations established for VATPs, using the requirements set out in the VATP Guidelines, particularly Chapter X on Custody of Client Assets which are elaborated in the Circular to licensed virtual asset trading platform operators on custody of virtual assets as the baseline.

Prohibition on active marketing by unlicensed persons

Unlicensed or unregistered persons will be prohibited from actively marketing VA custodian services to the public of Hong Kong, whether in Hong Kong or elsewhere. This aims to prevent unregulated overseas VA custodian service providers from soliciting clients in Hong Kong without being subject to the regulatory requirements of Hong Kong.​ The SFC will provide further guidance on the meaning of “actively market”.

No transitional arrangements

No deeming arrangement will be provided for existing VA custodian service providers. The licensing regime will apply in full from the commencement date of the relevant statutory provisions, and existing service providers are encouraged to engage in pre‑application processes with the SFC or the HKMA as soon as possible. ​Applicants will be required to engage an external assessor to conduct an assessment of their policies, procedures, systems and controls.​

An expedited licensing/registration process will be available for associated entities of SFC‑licensed VATPs, banks and subsidiaries of Hong Kong-incorporated banks that have already been assessed by the SFC or the HKMA in relation to their VA custody services and are already providing such services.​

Takeaways

The proposed regime will introduce a dedicated licensing framework for VA custodian services providers and require SFC‑regulated VA service providers to rely on duly licensed or registered VA custodian services providers. Breaches of the proposed regime may attract criminal liability (including fines and imprisonment for unlicensed activities and AML/CFT breaches) as well as regulatory sanctions such as licence suspension or revocation and pecuniary penalties. Existing and prospective VA custodian services providers should start reviewing their structures, controls and group arrangements in anticipation of the new requirements.

As the legislation process is still ongoing, the SFC will further refine requirements on matters such as hot and cold wallet arrangements, insurance and compensation mechanisms, private key management, independent audits and assessments, and business continuity and disaster recovery, and will engage with industry stakeholders in developing detailed standards.​

 

For enquiries, please feel free to contact us at:

E: regcom@onc.hk                                                             T: (852) 2810 1212 W: www.onc.hk                                                                    F: (852) 2804 6311 19th Floor, Three Exchange Square, 8 Connaught Place, Central, Hong Kong

Important: The law and procedure on this subject are very specialised and complicated. This article is just a very general outline for reference and cannot be relied upon as legal advice in any individual case. If any advice or assistance is needed, please contact our solicitors.

Published by ONC Lawyers © 2026