The Securities and Futures Commission (SFC) is the body that regulates Hong Kong’s securities and futures markets. In recent years, the SFC has been placing an increasing focus on regulatory requirements for digital assets, especially for crypto-native firms and already regulated capital market participants.

A key regulatory change occurred in June 2023 when the SFC introduced a licensing regime for Virtual Asset Trading Platforms (VATPs). This licensing system requires crypto exchanges, brokers, and custodians serving Hong Kong-based customers to meet compliance standards covering aspects such as anti-money laundering (AML) transaction monitoring, custody standards, and more. As of February 2025, nine entities have been granted a Hong Kong Virtual Asset Service Provider (VASP) license, with the first one issued to a Fireblocks customer.

Key Implications of VASP Licensing

The introduction of the licensing regime has significant implications for market participants, especially in terms of compliance and regulatory obligations.

1. Licensing Requirements
   Traditional financial institutions (TFIs) and virtual asset service providers (VASPs) are now required to be licensed by the SFC. The key aspects of the licensing regime include:
   • Asset Safeguarding: Licensed platforms must adopt strict standards for custody, ensuring that assets are safe from fraud or theft.
   • Know-Your-Client (KYC) and AML: Platforms must implement KYC processes,comply with AML standards, run enhanced due diligence (EDD) for high-risk clients, and conduct transaction monitoring.
   • Market Integrity: The SFC requires platforms to avoid conflicts of interest, prevent market manipulation, and ensure fair trading practices.
   • Ongoing Compliance: Licensed VASPs must maintain continuous compliance with ongoing reporting and auditing obligations.

2. Ongoing AML and Custody Obligations

Once licensed, these entities have requirements that they must adhere to: 

• Customer Due Diligence: Financial institutions must conduct thorough customer due diligence, including monitoring for suspicious transactions and implementing Travel Rule compliance.
• Custody of Assets: The SFC demands the segregation of client assets from proprietary funds and requires that all assets are protected from misappropriation. The key management process, such as generation, storage, and destruction of keys, must meet high security standards.

Strategic Considerations for Market Participants

With the introduction of these new regulations, market participants must take a proactive approach to compliance. This involves a few key strategic considerations:

1. End-to-end safety architecture 

Implied in the regulatory guidelines of the SFC, and reinforced by custody architecture vulnerabilities exposed by the Bybit hack of February 2025, is the need for businesses holding digital assets to use a multi-layer zero-trust cybersecurity architecture whose layers protect against new attack vectors. 

2. Modular Custody Technology
   Businesses need adaptable custody solutions that can meet the evolving regulatory landscape while maintaining flexibility, for instance, layering key management and wallet temperature solutions that address Hong Kong’s 98% cold storage requirement. 
3. Increased Scrutiny and Documentation
   The licensing process involves a comprehensive review of a platform’s infrastructure, policies, and processes. Businesses should have the right systems and reporting mechanisms in place to meet  increased scrutiny from regulators. They should also proactively consider how they will  address potential compliance gaps highlighted during the VASP application and assessment process.
   
4. Regtech Solutions for AML and Trade Monitoring
   Adopting regulatory technology (regtech) solutions for AML monitoring, transaction tracking, and reporting is crucial. These SFC regulated entities will need to ensure they have the  tools in place to streamline compliance tasks and ensure ongoing adherence to regulatory standards.
   

How Fireblocks Helps Meet These Requirements

Fireblocks offers a secure, institutional-grade infrastructure designed to help the TFIs and VASPs in Hong Kong meet the  SFC regulatory requirements. Fireblocks ensures compliance with key regulatory obligations in a number of crucial ways:

1. Defence-in-depth Architecture for Cold, Warm, and Hot Storage Requirements
   Fireblocks offers institutional-grade custody solutions, enabling platforms to segregate client assets from proprietary funds, reducing security risks. The platform supports varying levels of asset storage (cold, warm, and hot) based on specific regulatory requirements.
2. Flexible Key Management
   Fireblocks supports HSM integrations, offering FIPS 140-2/3 compliance to meet Hong Kong’s custody standards. With secure, offline key generation and robust key management protocols, Fireblocks ensures that private keys are protected through advanced cryptographic solutions.
   
3. AML Compliance and Transaction Monitoring
   Fireblocks integrates with leading AML and transaction monitoring providers like Elliptic, Chainalysis, and TRM Labs so that businesses can meet their AML and KYT obligations. The Fireblocks Compliance suite also has real-time transaction screening  to prevent transfers to risk wallets.
   
4. Travel Rule Compliance
   Fireblocks collaborates with Travel Rule solution providers to help VASPs comply with mandatory data sharing requirements for virtual asset transfers, ensuring full regulatory compliance.
   
5. Risk-Based Access Controls
   Fireblocks offers granular risk-based access control features such as role-based permissions, approval policies, and multi-user authentication to prevent unauthorized transfers and ensure compliance with SFC guidelines.
   

Being Best-in-Class: Fireblocks’ is Your Trusted Partner  Experience

Meeting Hong Kong’s regulatory custody requirements isn’t just about checking boxes—it’s about having secure, and reliable infrastructure that will support your business through the long-term. Fireblocks is the trusted partner for over 2,000 institutions globally, including leading regulated entities across multiple jurisdictions. Our deep expertise in digital asset security, combined with a dedicated team of regulatory specialists, ensures that our solutions evolve alongside shifting compliance landscapes. Fireblocks ensures enterprises remain compliant not just today, but in the years ahead. By choosing Fireblocks, VASPs and TFIs can confidently navigate Hong Kong’s regulatory framework while securing their long-term operational success.