In December 2025, the Financial Services and the Treasury Bureau (FSTB) and the Securities and Futures Commission (SFC) published consultation conclusions¹ setting out the key parameters of their proposed licensing regime for providers of virtual asset (VA) custodian services (VA Custodian Consultation Conclusions), which are summarised in this newsletter. For details of the consultation paper’s original proposals,² please refer to our newsletter SFC & FSTB Consult on Regulation of Virtual Asset Custodians.

The FSTB and SFC have also published consultation conclusions on the proposed licensing regime for providers of VA dealing services, and a further consultation on proposed licensing regimes for providers of VA advisory and VA management services. These developments are discussed in detail in our recent newsletter. The proposed regimes will extend the current licensing framework under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615) (AMLO) to regulate the provision of VA custodian, VA dealing, VA advisory, and VA management services as separate regulated activities. The FSTB and SFC propose to introduce a bill to the Legislative Council in 2026 to regulate the four activities.

Hong Kong’s Current Regulation of VA Custodian Activities

Hong Kong’s current regulations seek to ensure that investors’ VAs are held in custody with SFC or HKMA-regulated entities subject to the relevant regulator’s requirements. SFC-licensed VATPs, for example, must hold client VAs through their associated entities, which are subject to AML/CFT requirements and asset safeguarding obligations including segregation of client VAs and robust controls on private key management under Part X of the Guidelines for Virtual Asset Trading Platform Operators (VATP Guidelines). SFC-licensed or registered intermediaries offering VA-related services, e.g. VA dealing, to clients are required to provide custody for client VAs with an SFC-licensed VATP, a bank that is an authorized institution under Hong Kong’s Banking Ordinance (Cap. 165) (bank) or a subsidiary of a Hong Kong-incorporated bank.³ In the case of SFC-authorised funds investing in VAs, the trustee or custodian can only delegate VA safekeeping to an SFC-licensed VATP, a bank, or a subsidiary of a Hong Kong-incorporated bank meeting the requirements of the HKMA.⁴ Banks can also provide custodian services and, if they do, are required to comply with the HKMA’s guidance for banks and subsidiaries of Hong Kong-incorporated banks providing custodian services for digital assets, including VAs.⁵

When the FSTB consulted on proposals to license VA over-the-counter (OTC) trading in 2024, it learned that VA custody is commonly provided as part and parcel of many VA OTC activities, for example, VA broker-dealer activities. These and various standalone VA custodian services in Hong Kong are currently unregulated. Given the proposed implementation of a new licensing regime for VA dealing service providers and an increase in the number of VA-related services and products, in particular SFC-authorised spot VA exchange-traded funds, the regulators anticipate significant demand for VA custodian services, which they propose to regulate similarly to comparable VA-related services.

Providing a VA Custodian Service in Hong Kong

Providing a VA custodian service in Hong Kong will be defined as “by way of business, safekeeping instruments enabling transfer of VAs of clients (including but not limited to private keys) on behalf of clients”. The originally proposed first limb of the definition requiring licensing of a business safekeeping VAs on clients’ behalf has been removed. A VA custodian service provider licence or registration will therefore be required only for custodians that safekeep private keys or similar instruments (such as smartcards or authentication credentials for accessing private keys) that enable the transfer of VAs for any person—an area the regulators regard as the primary risk in VA custody. Trustees and fund managers that delegate VA custody to a third-party custodian will not need to be licensed or registered as VA custodians.

A VA custodian service provider licence or registration will be required by any entity that can unilaterally transfer its clients’ VAs. Accordingly, whether an entity providing multi-party computation (MPC)⁶ or other technology services requires a VA custodian service provider licence or registration will be determined on a case-by-case basis. The key considerations will include whether the service provider can transfer client VAs unilaterally and whether its clients can independently access and manage their VAs at all times. For example, a licence or registration will not be necessary for an MPC service provider whose clients can transfer their own assets (either independently or in conjunction with the MPC service provider) and are able to reconstruct the complete private key independently or retrieve access to their VAs without support from the MPC service provider. However, depending upon the specific arrangements in place, other MPC service providers may require a licence or registration, where clients cannot transfer their VAs unilaterally (for example, where the MPC service provider has not provided a recovery kit).

Custodians providing custody only for tokenised securities will not require a licence or registration as securities and futures contracts are excluded from the definition of virtual assets under the AMLO.

The definition of VA custodian service is technology neutral. Whether a particular decentralised model or technological service requires a VA custodian service provider licence or registration will depend on the substance of the service provided. For example, a staking service provider offering “custodial” staking services which allow it to transfer client VAs would require a licence or registration. In contrast, a non-custodial wallet provider that lacks the ability to transfer VAs would likely fall outside the scope of the licensing regime. The question of whether a service qualifies as “decentralised” will also need to be assessed on a case-by-case basis to determine whether it falls within the definition of virtual asset custodian service having regard to the specific facts and circumstances.

Entities Requiring a VA Custodian Service Provider Licence or Registration in Hong Kong

The SFC intends to require entities licensed or registered for providing VA services (including licensed or registered fund managers) to use SFC-licensed or registered custodian service providers to safekeep client VAs. The VA Custodian Consultation Conclusions provide the following non-exhaustive list of entities that will need to be licensed or registered as VA custodian service providers under the AMLO:

• Associated entities of SFC-licensed VATPs, which are currently required to provide VA custodian services under the VATP regime. This means that associated entities of SFC-licensed VATPs that currently provide custodian services by safekeeping the private keys (or similar instruments) which enable the transfer of client VAs, and which wish to continue providing these services, will need to obtain a separate VA custodian service provider licence under the new licensing regime.

• SFC-licensed corporations licensed for Type 13 regulated activity (providing depositary services for relevant CISs) under the SFO, banks, subsidiaries of locally incorporated banks, and stored value facilities that provide VA custodian services themselves by safekeeping the private keys (or similar instruments) which enable transfers of client VAs, notwithstanding that safekeeping is provided as part of the provision of VA dealing services or in acting as depositaries of SFC-authorised funds holding VAs in their portfolios.

• Licensed or registered fund managers that provide self-custody for VAs by safekeeping the private keys (or similar instruments) which enable the transfer of fund VAs. This may, however, be subject to an exemption for the self-custody of newly issued tokens up to a limited threshold which is under consideration.

The question of whether VA management service providers will need to safekeep the VAs of private funds with SFC-regulated VA custodians is being consulted on in the Further Public Consultation on Legislative Proposal to Regulate Virtual Asset Advisory Service Providers and Virtual Asset Management Service Providers.

Proposed Exemptions from Hong Kong Licensing/Registration Requirement for VA Custodian Service Providers

The SFC and FSTB are proposing to provide exemptions for:

• SFC or HKMA regulated entities where the safekeeping of client VAs is wholly incidental to the principal business of providing the VA service or carrying on of the regulated activity for which the entity is licensed or registered, provided that the regulated entities do not safekeep the private keys or similar instruments on behalf of clients;

• companies that only custody VAs for their group companies, irrespective of whether fees are charged;

• legal and accounting professionals that hold back-ups of private keys or similar instruments for their clients or are appointed by a court to administer VAs; and

• HKMA-licensed stablecoin issuers that only provide custody for the stablecoins they issue.

The VA Custodian Consultation Conclusions also confirm that licensed or registered VA custodian service providers will be allowed to rely on their overseas group resources and infrastructure without the overseas group member(s) needing to be licensed or registered. However, this is subject to the condition that the SFC-regulated VA custodian must retain the ability to independently and unilaterally move or transfer client VAs. The overseas group members are also prohibited from marketing themselves to the Hong Kong public as VA custodian service providers unless they are licensed by or registered with the SFC.

Individual Licences and Relevant Individuals

Individuals responsible for the VA custodian service will need to be licensed representatives or relevant individuals accredited to the SFC-regulated VA custodian service provider. Members of staff who perform more than a clerical role (i.e., performing routine tasks following established procedures, such as document filing and data input) in a business function directly relating to the VA custodian service provider’s fulfilment of its regulatory obligations will need to be licensed or engaged as relevant individuals. According to the VA Custodian Consultation Conclusions, SFC-licensing or engagement as a relevant individual will be required for:

• members of senior management responsible for monitoring and supervising VA custodian services;

• individuals with direct access to private keys or the authority to initiate or approve VA transfers (including but not limited to the initiator and intermediate approvers);

• staff participating in multi-signature or threshold signing schemes; and

• individuals with access to private key generation, storage or recovery systems.

SFC-regulated VA custodian service providers will be required to implement controls and procedures to adequately safeguard client VAs. In particular, only responsible officers, executive officers, managers-in-charge (or managers of HKMA-registered VA custodian service providers) or their delegates should be authorised to perform the functions referred to above.

Individuals within group entities of an SFC-regulated VA custodian service provider who are authorised to carry out these functions will need to be accredited to that provider. A proper delegation from the SFC-regulated VA custodian service provider to the individual within the group entity will need to be obtained before that individual is permitted to access private keys or sign VA transactions.

Staff members performing internal corporate functions for a virtual asset custodian service provider, such as human resources, finance and accounting, or legal and compliance, will not be required to be licensed or engaged as relevant individuals.

Other Proposed Regulatory Requirements

Safekeeping of client VAs

The regulatory requirements for VA custodian service providers will build on the requirements for VATPs under the VATP Guidelines, particularly Part X on Custody of Client Assets which are elaborated on in the SFC’s Circular to licensed virtual asset trading platform operators on custody of virtual assets.⁷ The SFC will consider suggestions put forward by respondents to the consultation paper in relation to requirements for hot and cold wallet storage, insurance or other compensation arrangements, private key management, independent audits and assessments, and business continuity and disaster recovery. It also proposes to actively engage the industry in setting the requirements.

Fit and proper requirements

In the same way as VATPs regulated under the AMLO, applicants for a VA custodian service provider licence, their substantial shareholders and individuals carrying out VA custodian functions for the corporate entity, will need to be fit and proper before a licence or registration is granted. In determining whether a person is fit and proper, the SFC will consider past convictions for money laundering (ML), terrorist financing (TF) or other fraudulent offences, failure to observe the anti-money laundering (AML), counter-terrorist financing (CFT) or other regulatory requirements applicable to licensed VA custodian service providers, experience, relevant qualifications, good standing and financial integrity.

Knowledge and experience

Licensees will be required to have a proper corporate governance structure and personnel with the knowledge and experience to effectively discharge their responsibilities.

Conduct of business

VA custodians will be required to act honestly, fairly, with due skill, care and diligence, in the best interests of clients and market integrity, and comply with all statutory and regulatory requirements.

Risk management

Licensed/registered VA custodians will be required to implement appropriate risk management policies and procedures to manage ML/TF, cybersecurity and other risks proportionate to the scale and complexity of the business.

Information and notifications

A wide range of information including wallet addresses used in the course of business, the scope of business conducted and the types of services provided will be required to be submitted and kept updated.

Record keeping

Licensed/registered VA custodians will need to keep proper records of transactions and fund flows which must be accessible to the SFC and HKMA for monitoring purposes.

Financial reporting and disclosure

Licensees and registrants other than banks will be required to publish audited accounts and comply with prescribed auditing and disclosure requirements.

SFC-regulated VA Custodian Service Providers: Permitted Activities

In line with its policy of permitting SFC-licensed VATPs to offer staking services through their associated entities, the SFC proposes to allow licensed or registered VA custodian service providers to offer staking services, provided they implement robust safeguards to manage the inherent risks, consistent with the SFC’s guidance on staking⁸ issued to VATPs on 7 April 2025.

The regulators acknowledged the need for VA custodian service providers supporting payment service providers to be able to conduct third-party transfers. The SFC noted that transfers made to execute settlement instructions from licensed or registered VA dealing intermediaries are themselves third-party transfers from the custodian’s perspective. Accordingly, the SFC will review its policy on third-party transfers and evaluate appropriate regulatory and operational requirements to ensure compliance with AML and CFT obligations and investor protection standards.

SFC-regulated VA Custodian Service Providers: Types of VAs under Custody

There will be no restriction on the types of VAs for which licensed or registered VA custodians can act as custodian, provided that the VA custodian has performed robust due diligence, including to ensure adequate management of money laundering and terrorist financing risks. The SFC has indicated that it will issue guidance on the due diligence requirements applicable to SFC-regulated VA custodian service providers when determining the types of VAs for which they will provide custody services. This guidance is expected to align with the due diligence framework set out in the VATP Guidelines. This will require VA custodian service providers to establish a token admission committee and to conduct ongoing assessment and monitoring of relevant developments, including technological changes, the robustness of distributed ledger technology networks, and emerging security threats applicable to all VAs for which custody services are provided. Providers will also be required to ensure that their internal controls, technology infrastructure, and AML/CFT monitoring and market surveillance tools can effectively manage any risks specific to those VAs.

It has also been clarified that VA custodian service providers will be able to additionally provide custody services for tokenised securities.

Financial Resources Requirements

The SFC will impose baseline financial resources requirements comprising a minimum paid-up share capital of HK$10 million and a minimum liquid capital of HK$3 million, except for banks. The SFC will, however, retain the discretion to impose additional financial resources requirements where circumstances warrant.

Prohibition on Active Marketing

Unlicensed/unregistered persons will be prohibited from actively marketing, whether in Hong Kong or elsewhere, the provision of VA custodian services to the Hong Kong public. The prohibition will prevent overseas VA custodians from actively marketing VA custodian services in Hong Kong.

No Transitional Arrangements

No deeming arrangement will be granted to existing VA custodian service providers operating in Hong Kong. The new licensing regime will take full effect on the commencement date of the relevant statutory provisions. Those already providing VA custody services are encouraged to contact the SFC (at fintech@sfc.hk) or the HKMA as soon as possible to initiate the pre-application processes.

VA custodian service providers seeking licensing or registration will need to engage an external assessor to perform an external assessment after all relevant systems and controls are deployed to ensure that they have been suitably designed and implemented.

Expedited Licensing and Registration Process

An expedited licensing approval process will apply to associated entities of SFC-licensed VATPs, banks or subsidiaries of locally incorporated banks which have already undergone the SFC’s or the HKMA’s assessment process in relation to their VA custodian services and are already engaged in providing VA custodian services.

Licensing Fees

Since a licence for Hong Kong VA custody is considered more complicated than typical SFO licences due to the additional technical elements involved, the SFC is proposing a higher licensing fee for VA custodian service provider licences. It is proposed that the licensing application and annual fees will be at least as high as the HK$129,730 application and annual fees that apply to Type 3 licences.

Regulatory Authorities

As under the proposals for the VA dealing licensing regime, the SFC will set the regulatory requirements for licensed and registered VA custodian service providers. The SFC will also be empowered to impose licensing and registration conditions, vary existing conditions and enter licensees’ business premises to conduct routine inspections and investigate suspected non-compliance with statutory and regulatory requirements. It would also be entitled to impose disciplinary sanctions (including a civil penalty and suspension or revocation of licence or registration) in the event of non-compliance with statutory and regulatory requirements.

The HKMA will be the frontline regulator of banks and SVFs with respect to their VA custodian business and will be empowered to supervise the VA custodian business of banks and SVFs registered for VA custodian services. It would have powers to enter registered entities’ business premises to conduct routine inspections and investigate suspected regulatory non-compliance.

Proposed sanctions for breach of regulatory requirements for VA custodians

The offences that will exist under the AMLO and the maximum penalties that will apply are summarised in the table below.

Conduct	Sanction
Carrying out, holding out as carrying out and actively marketing a Hong Kong VA custodian service without a licence or registration	A fine of HK$5 million and seven years’ imprisonment
Issuing an advertisement for an unlicensed or unregistered person’s provision of VA custodian services	A fine at level 5 (currently HK$50,000) and six months’ imprisonment
A licensee’s/registrant’s non-compliance with the statutory AML/CFT requirements	A fine of HK$1 million and two years’ imprisonment
Engaging in fraudulent or deceptive behaviour in transactions involving VAs	A fine of HK$10 million and ten years’ imprisonment
Making fraudulent or reckless misrepresentations to induce another person to engage in a transaction involving VAs	A fine of HK$1 million and seven years’ imprisonment
Misconduct (e.g. contravening other regulatory requirements) or fitness-and-properness issues	Suspension or revocation of licence or registration, reprimand, remedial order and/or a pecuniary penalty (not exceeding HK$10 million)