SFC Publishes Guidance on Staking For Licensed Virtual Asset Trading Platforms and Authorised Virtual Asset Funds

The Securities and Futures Commission (SFC) issued two circulars on 7 April 2025 setting out the criteria to be met by licensed virtual asset trading platforms (VATPs) wanting to offer virtual asset staking services to their clients and the requirements for SFC-authorised funds wanting to stake virtual assets. In both cases, the SFC’s prior approval is required. The requirements for SFC-licensed VATPs are set out in the SFC Circular on staking services provided by virtual asset trading platforms (SFC Staking Circular) and its Appendix contains the conditions that the SFC will impose on the licences of VATPs allowed to offer staking services. The SFC’s requirements for SFC-authorised funds staking virtual assets are set out in the SFC Circular on SFC-authorised funds with exposure to virtual assets. This allows SFC-authorised funds to stake virtual assets through licensed VATPs and authorised institutions only and imposes a cap on liquidity risk. The move to allow virtual asset staking subject to regulations to protect retail investors in particular is consistent with the SFC’s Regulatory Roadmap for Hong Kong’s virtual asset market published in February 2025, which outlined the regulator’s aims to broaden the range of virtual asset products and services available in Hong Kong as part of the Hong Kong Government’s push to position Hong Kong as an international virtual asset hub.

Staking in Hong Kong

“Staking” is an arrangement that allows clients to receive returns from locking or committing their virtual assets to allow a validator to participate in a blockchain protocol’s validation process that is based on a proof-of-stake consensus mechanism. Currently, VATPs are prohibited from using clients’ virtual assets to generate returns for clients by paragraph 7.26(b) of the SFC’s Guidelines for Virtual Asset Trading Platform Operators (VATP Guidelines). This effectively prohibits the provision of virtual asset staking, lending and borrowing services. In the SFC Staking Circular, the SFC acknowledges investors’ demand for staking services and the potential for these services to strengthen blockchain network security. It is therefore prepared to allow licensed VATPs to provide staking services to their clients subject to conditions imposed on their licences, which are aimed at protecting investors’ interests.

The latest guidance on staking follows up on the SFC’s “ASPIRe” regulatory roadmap, published in February 2025. The SFC Staking Circular will expand product services offerings by VATPs, thus echoing Pillar P (Products) which focuses on expanding product offerings and services based on investor categorisation. The regulatory roadmap also proposed allowing licensed VATPs to offer virtual asset borrowing and lending, trade initial token offerings, and offer virtual asset derivative trading for professional investors only. The SFC has not yet published the detailed frameworks under which these new services will be allowed to be offered, but will do so in due course.

SFC Circular on Staking Services Provided By VATPs

The SFC’s Circular on staking services provided by VATPs details the requirements and standards that VATPs providing staking services (and their associated entities) must adhere to. It emphasises the importance of maintaining effective measures to eliminate process errors, ensuring safe custody of staked virtual assets and adequate risk disclosures.

Licence Conditions for VATPs Permitted to Offer Virtual Asset Staking Services

The conditions that the SFC will impose on licensed VATPs that are allowed to offer staking services to their clients are set out in the Appendix to the SFC Staking Circular which includes the provisions outlined below.

Internal Controls

1. Asset Control & Custody:

   • A licensed VA Exchange must retain full control over all withdrawal mechanisms for staked client virtual assets;

   • Third-party custody is prohibited – client virtual assets cannot be held by external service providers.

2. Risk Management & Safeguards

   Licensed VATPs must:

   • implement measures to prevent fraud, errors and unauthorised activities to ensure proper risk management and safeguarding of staked client assets;

   • implement internal controls to mitigate operational risks and conflicts of interest; and

   • have clear operational rules governing the staking processes (e.g., staking/unstaking, outage handling).

3. Regulatory Reporting

   Licensed VATPs must provide the SFC with staking-related information upon request.

4. Client Acknowledgement: Licensed VATPs must obtain an acknowledgement from retail clients that they understand the risks involved in using the platform’s staking services before providing staking services to them.

5. Blockchain Protocol Selection and Third-Party Service Providers

   5.1 Token Admission and Review Committee Oversight: A dedicated committee must establish and review criteria for selecting blockchain protocols;

   5.2 Due Skill, Care & Diligence: Protocols must be chosen carefully, considering security, stability and compliance factors;

   5.3 Infrastructure & Risk Management:

   • Validators (in-house or third-party) must have adequate controls to support the protocol; and

   • Continuous monitoring of protocol updates and potential risks to staked assets.

Information Disclosure

Website & App Disclosures: Licensed VATPs must disclose on their website and any apps clear, general information about their staking services, including:

• Supported virtual assets, third-party involvement in provision of staking services, and operational rules;

• Risks for clients (slashing, lock-ups, hacking, inactivity relating to validators, legal uncertainties surrounding staking affecting enforceability of clients’ interests in staked virtual assets);

• Participation requirements, lock-up periods, unstaking process and its length;

• Fees, charges and how losses relating to slashing, hacking and technical errors will be dealt with; and

• Arrangements during outages, business resumption arrangements and custodial arrangement.

Risk Management & Internal Controls

1. Policies & Procedures: Licensed VATPs must implement measures to prevent and detect errors, fraud, and unauthorised activities to ensure proper risk management and safeguard staked client assets;

2. Operational Controls: Licensed VATPs must establish internal controls to mitigate risks and address conflicts of interest, including:

   • Whitelist Withdrawals: Only pre-approved cold wallet addresses can receive withdrawals;

   • Pre-Broadcast Verification: Staking instructions must be independently verified to confirm correct withdrawal addresses; and

   • Third-Party Validator Checks: Pre-signed withdrawal messages must be validated for contingency execution.

Operational & Contingency Planning

1. Clear Rules: Must define staking/unstaking processes, outage handling and custodial arrangements;

2. Slashing & Incident Response: Must have procedures for addressing slashing penalties, validator inactivity, and other risks, including emergency withdrawals when necessary; and

3. Resource Requirements: Must maintain additional safeguards as mandated by regulators to protect staked assets.

Security & Authorisation

1. Wallet Protection: Withdrawal wallet private keys/seeds must receive equivalent security measures and governance controls as non-staked client cold wallets; and

2. Regulatory Discretion: The SFC may impose additional resource requirements on a case-by-case basis.

Client Authorisation & Confirmation

1. Explicit Consent: Staking services may only be provided with either:

   • Standing client authorisation (per Guidelines for Virtual Asset Trading Platforms (VATP Guidelines) ss. 10.17-10.18), or

   • One-time written instruction.

2. Dual Confirmation: Licensed VATPs must:

   • Confirm staking terms (asset, amount, fees) with clients before initiating staking; and

   • Provide prompt confirmation after staking completion.

3. Account Statements: Must clearly detail staking activities as required by the VATP Guidelines sections 9.33(d)-(g).

Validator Selection & Oversight

1. Due Diligence in Selection of Validators

   • Licensed VATPs must carefully evaluate whether to use in-house or third-party validators.

   • Selection requires a comprehensive assessment of:

     • Its technical infrastructure (hardware/software)

     • Whether an independent smart contract audit has been conducted (if applicable)

     • Blockchain protocol compatibility

     • Validator’s track record in validation of that blockchain protocol (downtime, errors and risk management)

     • Management of conflicts of interest

     • Cybersecurity measures

     • Key management security

     • Software upgrade procedures

     • Financial stability

     • Insurance coverage for staking risks (e.g. for compensating slashing events).

2. Third-Party Validator Agreements

   • Where staking services involve outsourcing to a third-party validator, a licensed VATP must exercise due skill, care and diligence in appointing the third-party validator including making arrangements to ensure the licensed VATP meets the requirements of the SFC Staking Circular for providing staking services. In particular, the licensed VATP or its associated entity must enter into a formal agreement with the third-party validator, which specifies the validator’s terms of services and responsibilities. This agreement must be regularly reviewed and revised to reflect any change to the services provided, the outsourcing arrangements and regulatory developments.

   • A licensed VATP must diligently and consistently monitor its appointed validator, ensuring proper oversight of staked client assets and validator performance (including server uptime, validation accuracy and regular reconciliation of staking rewards).

   • Additionally, the licensed VATP should continuously assess the validator’s suitability and financial stability, such as by reviewing audited financial statements.

Approval & Notification Requirements

• Prior SFC approval is required before a licensed VATP introduces or discontinues staking services for retail clients involving any blockchain protocol;

• For professional investors only, a licensed VATP must notify the SFC in advance (but does not need prior approval) when adding or terminating staking services for a blockchain protocol; and

• The licensed VATP must promptly report any material non-compliance with staking service terms and provide any additional information requested by the SFC, whether on a regular or ad hoc basis.

Record Keeping Requirements

VATP operators and their associated entities must maintain records of their staking services for at least 7 years, detailing “staked” client virtual assets, the owner of the “staked” virtual assets, validators, wallet addresses, staking and unstaking dates, and relevant returns. The records must also include information on the selection of blockchain protocols and the most appropriate arrangement for participating in the validation processes.

SFC Approval to Provide Virtual Asset Staking Services

If the SFC approves an application for a licensed VATP to offer virtual asset staking services, it will impose the following conditions on its licence:

• The licensed VATP can only provide staking services to its own clients;

• The licensed VATP must maintain possession or control of the withdrawal address private key and a pre-signed voluntary exit message at all times;

• The provision of custody of client virtual assets by a third-party service provider is prohibited;

• In providing staking services, a licensed VATP (and its associated entity) are expected to comply with the Guidelines for Virtual Asset Trading Platform Operators’ (the VATP Guidelines) requirements, including those relating to custody of client assets set out in Part X of the VATP Guidelines as if:

  • References to a virtual asset included a “staked” virtual asset;

  • References to a client included a person to whom the Licensed VATP or its associated entity provides staking services;

  • References to client virtual assets included “staked” client virtual assets; and

  • References to seeds or private keys included seeds or private keys through which the “staked” client virtual assets may no longer be “staked” (for example, the withdrawal address private key for the “staked” private client virtual assets).

Circular on SFC-authorised Funds with Exposure to Virtual Assets

The SFC also published a revised Circular on SFC-authorised funds with exposure to virtual assets (the SFC Circular on VA Funds), which supersedes the version published in December 2023. The amendments allow SFC-authorised investment funds with exposure to virtual assets (VA Funds) to stake their virtual assets through licensed VATPs and authorised institutions, subject to a cap on the amount of virtual assets that can be staked.

The key amendment to the SFC Circular on VA Funds is the newly added paragraph 27, which specifically allows authorised VA Funds to stake virtual assets and conduct other virtual asset-related activities through licensed VATPs and authorised institutions or subsidiaries of Hong Kong-incorporated authorised institutions. Paragraph 27 also sets out the guiding principles that authorised VA Funds must observe in conducting staking and other virtual asset-related activities:

1. the VA Fund manager must ensure that the staking activities align with the VA Fund’s investment objective and strategy;

2. the VA Fund manager must establish robust internal controls to monitor and manage material risks and conflicts of interest arising from staking and have in place proper custody arrangements to protect investors’ interests;

3. the VA Fund manager is required to conduct due diligence and ongoing monitoring of the counterparties and service providers it engages to provide staking services;

4. the VA Fund’s offering documents, including the Key Facts Statement, must clearly disclose the amount of fund assets that may be used for staking and other virtual asset-related activities and the key risks and features of staking and other virtual asset-related activities;

5. the VA Fund must give investors reasonable notice of any material change to its investment objective and strategy or overall risk profile resulting from its engaging in staking or other virtual asset-related activities. VA Fund managers also need to determine whether any such material change requires shareholders’ approval or amendments to their constitutive documents; and

6. VA Funds’ interim and annual reports are required to include additional disclosures (i.e., additional to the disclosure requirements in Appendix E of the Code on Unit Trusts and Mutual Funds) with respect to:

   1. the amount of virtual asset holdings committed to each type of virtual asset-related activity as a proportion of their net asset value;

   2. the revenue generated from each virtual asset-related activity; and

   3. the direct and indirect expenses incurred for each virtual asset-related activity.

Revisions have also been made to paragraph 30 of the SFC Circular on VA Funds to require prior consultation with and approval from the SFC where a VA Fund intends to engage in staking and other virtual asset-related activities.