Analysis of the Latest Regulatory Framework for Virtual Asset Custody Business in Hong Kong: Compliance Pathways and Strategic Considerations

Written by: pony

Recently, discussions on the regulation of virtual assets in Hong Kong have entered a critical phase. Given that many clients and friends are very concerned about the second round of consultations regarding virtual asset custody and OTC (VA Dealing) at the end of August, Aiying is able to share some of the latest information based on communications with relevant departments and informed sources: Currently, all practitioners must prioritize grasping two key pieces of information that will determine the future direction of their business:

Clear timetable: The formal introduction and implementation of the virtual asset custody legislation is expected to take about a year and a half. This is a clear preparation window, and companies need to plan in advance.

No unified transition period arrangement: Unlike some previous regulations, this legislation is expected not to establish a unified legal transition period. This means that the effective date of the bill is the time when unlicensed institutions must cease related business. The only "safe channel" is to proactively communicate effectively with the Securities and Futures Commission (SFC) before the bill is issued, seeking case-by-case transitional support to ensure the smooth continuation of business.

During this critical window period, Aiying serves as one of the bridges connecting the industry and regulators, committed to assisting enterprises in formulating forward-looking strategies. This article will provide you with a strategic roadmap that combines depth and practicality based on this context, guiding you on how to plan your path in the new regulatory landscape and prepare for the implementation of legislation in advance.

Part One: In-Depth Analysis of the Regulatory Framework: The "New Rules" for Virtual Asset Custody in Hong Kong

To participate in the virtual asset custody business in Hong Kong, it is essential to thoroughly understand its regulatory framework. This core regulatory blueprint delineates clear boundaries and access thresholds for the market.

Clarifying the current situation: TCSP license, trust license, and regulatory vacuum

1. License Scope: Who needs to apply for a custody license?

According to paragraph 2.13 of the "Legislative Proposal," any entity that "holds virtual assets on behalf of clients" or "holds tools that can transfer clients' virtual assets (including but not limited to private keys)" in a business manner will be subject to regulation. This definition has a significant "penetrating" characteristic, with the core focus on whether the actual control over the client's assets is held.

Directly licensed entities: independent third-party custodians, custodial subsidiaries of licensed virtual asset trading platforms (VATP), fund managers who self-custody client private keys, and banks and their affiliates providing such services.

Possible Exemption: Mainly concerning "Incidental Exemption". If a licensed institution (such as a brokerage) temporarily holds customer virtual assets without accessing private keys during the provision of its main business, it may obtain an exemption. Additionally, licensed issuers that only custody their own issued stablecoins are also included in this category.

2. License Threshold: Key Criteria Required for Application

The SFC has set strict admission standards for custodial licenses, aiming to筛选出具备雄厚实力和高度合规意识的「正规军」.

Financial Strength: Applicants must meet high capital requirements, including a minimum paid-up capital of HKD 10 million and a minimum liquid capital of HKD 3 million. This not only serves as proof of financial stability but also tests the applicant's long-term commitment to operations.

Core Personnel: At least two SFC-approved Responsible Officers (ROs) must be appointed, and all executive directors must serve as ROs. ROs are personally responsible for the company's compliance status.

Appropriate Candidate Principle: The SFC will conduct a comprehensive background check on the company and its major shareholders and executives, covering financial status, professional experience, reputation, and conduct.

Aiying's Deep Observation: Unraveling the "Experience Fog" of RO Personnel

The experience requirements for RO in the regulatory guidelines are principled and not quantified, which has caused confusion for companies in recruitment and appointment. Based on Aiying's long-term communication with regulatory authorities and analysis of past cases, we found that the SFC, when evaluating, conducts an in-depth examination of whether candidates possess the comprehensive ability to manage specific business risks, rather than focusing on a single dimension of experience. Key considerations include:

The compliance gene of traditional finance: Having custody, risk management, or compliance experience in traditional banks or financial institutions is considered an important advantage.

Practical experience in virtual assets: Holding a management position at a licensed Virtual Asset Service Provider (VASP), or having extensive experience in virtual asset trading and operations.

Understanding of technology depth: A solid understanding of core technologies (such as MPC, hot and cold wallet architecture, blockchain protocols) and the ability to assess technical risks.

Comprehensive ability in risk management: The ability to clearly articulate and effectively manage the unique risks associated with virtual assets, including technological risks, operational risks, and market risks.

The Aiying team can assist companies in evaluating potential RO candidates and tailor resumes and interview strategies to effectively showcase their comprehensive abilities to meet the implicit standards of the SFC.

3. Cost of Violation: Strict Penalties and Regulatory Power

The new regulations grant regulatory agencies powerful enforcement powers, and violations will face severe penalties. For example, unlicensed operations can be fined up to HKD 5 million and imprisoned for seven years; transactions involving fraud can be fined up to HKD 10 million and imprisoned for ten years. This clearly indicates that compliance is the bottom line that all market participants must not cross.

Part Two: Analysis of Market Competition Landscape: The Game of Three Forces and the Future

With the clarity of the regulatory framework, the competitive landscape of the virtual asset custody market in Hong Kong is becoming increasingly clear, driven by three main forces, each shaping the future of the market with their respective advantages.

The virtual asset custody market in Hong Kong is composed of three main forces: traditional finance, digital native enterprises, and virtual banks.

Traditional financial institutions (such as Standard Chartered Bank): Their core advantages lie in strong brand reputation, substantial capital, and a mature compliance and risk control system. They mainly target institutional investors who are highly sensitive to risk, establishing trust barriers by providing "bank-grade" custody services. Their subsidiary Zodia Custody's layout in Hong Kong is a typical example.

Digital native enterprises (such as Fireblocks, Bitgo): Their core advantage lies in leading technological strength and deep industry understanding. They are typically positioned as technology infrastructure providers, offering underlying custody technology solutions for exchanges, funds, and even banks. Their strategic focus is to translate technological advantages into compliance advantages to meet Hong Kong's stringent regulatory requirements.

Virtual banks (such as ZhongAn Bank): The advantage lies in the combination of regulatory compliance from having a banking license and the flexibility of a technology company, particularly excelling in retail user experience and convenient fiat channels. They aim to provide one-stop virtual asset services for retail customers through partnerships with licensed exchanges, such as the collaboration between ZhongAn Bank and HashKey, thereby achieving breakthroughs in the retail market.

In the future, the ultimate outcome of the market will not be dominated by a single entity, but rather a diverse ecosystem where cooperation and competition coexist. In the short term, "license grabbing" will be the main theme; in the medium to long term, the market will experience differentiation, with various types of dominant players leading the institutional, technological, and retail markets, while cross-border cooperation will become the norm.

Part Three: Corporate Compliance Strategy Guide: From Response to Leadership

In the face of clear timelines and strict regulatory requirements, companies must develop comprehensive compliance strategies. Aiying suggests starting from the following aspects to turn compliance challenges into development opportunities.

1. Strategic Planning: From Passive Compliance to Active Communication

Companies should first conduct a comprehensive gap analysis to assess the discrepancies between their existing business models, technological architectures, and internal controls, and the new regulatory requirements. More importantly, they need to shift from passive waiting to proactive communication.

Aiying's core advice: Given that there is no unified transition period after the bill takes effect, passively waiting is tantamount to putting the business on the edge of a cliff. Enterprises must take the initiative within the one-and-a-half-year window period to establish effective communication with the SFC and seek case-by-case transitional support for themselves.

This is exactly what Aiying will assist enterprises with:

Accurate interpretation of regulatory intent: Transforming complex legal texts into clear business language and executable action items.

Building a Compliance Narrative: Helping enterprises to clarify and clearly articulate their business model, technical architecture, and risk control measures to regulatory authorities, demonstrating their compliance capabilities and long-term commitment.

Facilitating Effective Dialogue: With our long-term communication experience with regulators, we build efficient and professional dialogue channels for enterprises, ensuring the quality and effectiveness of communication, and laying a solid foundation for seeking transitional support.

2. System Construction: Build a solid internal compliance and risk control.

A sound internal system is the cornerstone for obtaining and maintaining licenses. Companies should focus on building in the following areas:

3. Implementation: Technology Selection and Group Management

On a practical execution level, companies need to focus on the selection of technology partners and internal compliance management. When choosing a technology service provider, priority should be given to their understanding of Hong Kong regulations and technical support capabilities. For group companies, a unified group compliance standard must be established, and the responsibilities of each legal entity should be clearly defined through Service Level Agreements (SLAs) to ensure that all key operational personnel comply with SFC regulatory requirements.

Conclusion: Embrace regulation, welcome new opportunities

The regulatory framework established by Hong Kong for virtual asset custody services, while presenting challenges, is more importantly creating unprecedented certainty and opportunities. By introducing the core element of "trust," it paves the way for institutional capital to enter the market and lays a solid foundation for the healthy development of the entire virtual asset ecosystem, including spot ETFs and RWA tokenization. Aiying will continue to work alongside industry colleagues, leveraging professional insights and rich experience to collectively embrace a broader future for Hong Kong's virtual asset custody business. In the next issue, we will interpret the latest developments and "intelligence" regarding the Hong Kong OTC legislation, so stay tuned!

Reference materials

Legislative proposal report on the regulation of virtual asset custody services: