The Hong Kong Securities and Futures Commission (SFC) has enforced new Hong Kong crypto custody rules that apply immediately to licensed custodians.
The measures set specific controls for cold wallets, ban the use of smart contracts in cold wallet setups, and outline tighter security standards.
Under the new rules, custodians must use a certified hardware security module to store private keys. Withdrawals can only be made to whitelisted addresses that have been pre-approved.
The SFC also requires a 24/7 security operations center to monitor wallets, networks, systems, and other infrastructure.
The regulator mandates that private keys must be generated and kept offline in an air-gapped and physically secured environment. Access to these environments must involve multi-factor physical controls.
Smart Contracts Ban for Cold Wallets
The new Hong Kong crypto custody rules include a clear ban on smart contracts for cold wallet implementations.
The SFC’s circular states that cold wallets must not contain smart contracts on public blockchains. This is to reduce online attack risks linked to on-chain smart contracts.
Smart contracts are currently used by many custodians. BitGo applies Ethereum-based smart contracts for both hot and cold wallets, using a multisignature (multisig) model for account-based chains.
Another provider, Safe (formerly Gnosis Safe), uses a smart contract-based custody system.
According to Messari, Safe managed $72 billion across over 25 smart accounts by the third quarter of 2024.
In March 2024, Coinbase called Safe the “leading provider” of multisig services. The SFC’s smart contracts ban may require changes to these operational models for custodians operating in Hong Kong.
New Standards for Virtual Asset Custodian Services
The Hong Kong crypto custody rules set out operational and physical security standards for virtual asset custodian services.
The SFC noted these rules form part of its core expectations for licensed custodians.
The guidance covers all custody stages, from generating private keys to signing transactions.
Custodians must keep cold wallet systems fully offline, use approved security hardware, and maintain continuous monitoring through their security operations centers.
Licensed exchanges offering custody must prove compliance with these rules before serving clients. This applies to both standalone custodians and platforms that integrate custody into their operations.
Hong Kong Expands Digital Asset Regulations
The SFC’s move is part of a wider regulatory plan. In April 2024, Hong Kong approved and launched spot Bitcoin ETFs and Ether ETFs, allowing institutional access through regulated products.
In February 2024, the SFC introduced the ASPIRe roadmap, which aims to expand market participation while setting strict custody and market structure standards.
Later in 2024, more licenses were granted to virtual asset trading platforms.
The stablecoin law took effect on August 1, 2025, with plans for a public registry of licensed issuers.
Combined with the Hong Kong crypto custody rules, these measures strengthen the city’s role in regulated virtual asset markets.
Editor at Kriptoworld
LinkedIn | X (Twitter)
Tatevik Avetisyan is an editor at Kriptoworld who covers emerging crypto trends, blockchain innovation, and altcoin developments. She is passionate about breaking down complex stories for a global audience and making digital finance more accessible.
📅 Published: August 4, 2025 • 🔄 Last updated: August 4, 2025
