Update (Aug. 15, 2025, at 2:00 pm UTC): This article has been updated to add commentary by Chen Wu and Berndard Mueller.
The Hong Kong Securities and Futures Commission (SFC) issued immediately effective guidance on cryptocurrency custody standards, introducing sweeping security requirements and a ban on smart contracts in cold wallet implementations.
In a circular released on Friday, the regulator outlined prescriptive controls for licensed custodians of virtual assets. They include requiring a certified hardware security module, allowing withdrawals only to whitelisted addresses and maintaining a 24/7 security operations center to monitor systems, networks, wallets and infrastructure.
The environment where private keys are used to sign transactions should also be air-gapped and physically secured, with keys being generated and kept offline. The regulator recommended “strict multi-factor physical access control.”
“Going forward, these standards will also constitute core expectations for the providers of Virtual Asset Custodian Services, and help to foster a consistent framework for virtual asset custody across the industry,” the circular said.
Chen Wu, co-founder and CEO of licensed Hong Kong crypto exchange Ex.io, told Cointelegraph that the circular “is a critical step in raising custody standards” for local service providers. She also highlighted that the increased compliance burden may act as a barrier to entry for new or smaller players, leading to market concentration.
“Hong Kong’s stricter, institution-focused approach enhances its competitive positioning for global investors but must balance innovation and compliance costs to remain a preferred venue over Singapore, Japan and South Korea,” Wu said.
Related: Animoca and Standard Chartered form stablecoin venture in Hong Kong
No smart contract for cold wallets
One of the most striking changes is a ban on smart contracts in cold wallets. The circular states that “cold wallet implementations should not include smart contracts on public blockchains to minimise potential online attack vectors associated with on-chain smart contracts.”
Smart contracts are widely used by institutional custodians for both hot and cold wallets. BitGo, for example, uses Ethereum smart contracts that are optimized for both hot and cold wallets and previously outlined its smart-contract multisig model for account-based chains.
Safe, previously known as…
Click Here to Read the Full Original Article at Cointelegraph.com News…