Management Summary
- Purpose / Background: The HKMA has updated its guidance on digital asset custodial services to account for rapid market growth, technological advancements, and the implementation of the Stablecoins Ordinance (Cap. 656). The circular aims to ensure Authorized Institutions (AIs) maintain robust security, governance, and operational controls for safeguarding client digital assets.
- One-line conclusion: AIs providing or planning to provide digital asset custody must immediately align their operational frameworks with the updated risk-based standards in the Annex and engage in prior consultation with the HKMA.
- Key Changes:
- Broadened scope covering virtual assets (AMLO), tokenised securities, and tokenised assets.
- Introduction of a risk-based approach, allowing AIs to tailor operational arrangements to the specific nature and risks of the assets.
- Inclusion of access management (private keys, seeds, backups) within the definition of custodial services.
- Explicit requirement for locally incorporated AIs to ensure subsidiary compliance.
- Mandatory pre-launch consultation with the HKMA for any new custodial service offerings.
- Key Dates / Deadlines: Immediate effect as of 27 May 2026. Existing service providers must conduct a gap analysis and upgrade systems/controls to meet the new standards.
- Applicability / Impact scope: Applies to all AIs and subsidiaries of locally incorporated AIs conducting digital asset custodial activities (excluding proprietary asset custody and limited purpose digital tokens).
- Recommended management actions:
- Conduct a comprehensive review of existing custodial systems and internal controls against the new Annex standards.
- Formalize a gap remediation plan and timeline for board/senior management approval.
- Engage in early dialogue with the HKMA regarding any planned expansion or existing service gaps.
- Update internal governance frameworks and risk appetite statements to reflect the specific risks of digital asset custody.
- Ensure robust oversight of subsidiaries’ custodial practices for locally incorporated AIs.
Detailed Summary
1) Document overview
The circular serves as the primary updated regulatory expectation for AIs regarding the custody of digital assets. It replaces the previous guidance from 20 February 2024. It emphasizes that while AIs are encouraged to innovate, they must maintain a security-first approach commensurate with the specific risks of cryptographic assets.
2) Main requirements
- Risk-based Controls: AIs must implement operational arrangements that reflect the nature, features, and risk profile of the digital assets in custody.
- Scope of Custody: Custodial duties extend to the safeguarding of digital assets and the "means of access" (private keys, seed phrases, backups).
- Governance: Locally incorporated AIs hold direct responsibility for ensuring that their subsidiaries’ business conduct and control environments satisfy these regulatory expectations.
- Consultation: AIs intending to launch new custodial services must demonstrate their compliance to the HKMA's satisfaction before commencement.
3) Key changes
- Alignment with the Stablecoins Ordinance (Cap. 656).
- Increased emphasis on the distinction between custodial services and proprietary asset holdings, specifically excluding proprietary assets from this circular's scope.
- Explicit inclusion of tokenised securities and tokenised assets alongside traditional virtual assets.
4) Important dates & transition
- Effective Date: 27 May 2026.
- Transition: AIs currently providing services must perform an immediate review of their systems and controls. There is no specified "grace period" provided, implying an expectation of immediate alignment.
5) Impact and risks
- Operational: Higher technical requirements for key management and security infrastructure.
- Regulatory: Mandatory notification and demonstration of competence to the HKMA for new initiatives.
- Compliance: Heightened oversight requirements for subsidiaries of locally incorporated AIs, potentially requiring changes to group-level reporting.
6) Compliance action checklist
- Perform a gap analysis between current infrastructure and the updated Annex requirements.
- Review and update internal policy manuals, specifically regarding key management and cybersecurity.
- For subsidiaries, verify that compliance monitoring programs capture digital asset activities.
- Coordinate with HKMA supervisors if the AI is already active in this space to confirm the current status of compliance.
7) Appendices/attachments summary
- Annex (Standards for Custodial Services): Contains the technical and operational benchmarks for safeguarding digital assets. It provides the core regulatory expectations regarding security, governance, and control that AIs must integrate into their existing operational frameworks to ensure compliance.