In-depth analysis of the requirements and solutions for Hong Kong digital asset exchange and fund listing custody
Analysis of requirements and solutions for Hong Kong digital asset exchange and fund listing custody.
Over the past year, there have been significant developments in Hong Kong’s digital asset regulation. In October 2022, the Hong Kong government released a policy statement expressing support for digital assets and promoting industry development from all aspects. On June 1 of this year, the regulations for digital asset trading platform licenses issued by the Hong Kong Securities and Futures Commission (SFC) came into effect, requiring trading platforms to apply for a license to operate in Hong Kong. For regulated trading platforms, a license application must be submitted to the SFC within nine months, by February 29, 2024, or they must cease operations in Hong Kong by May 31, 2024.
Currently, several exchanges have publicly expressed their intention to apply for digital asset trading platform licenses in Hong Kong. Market rumors suggest that there may be hundreds of institutions planning to apply for exchange licenses, many of which come from the traditional financial sector. For institutions from the traditional financial sector, a potential challenge is the lack of previous experience with digital assets, especially in terms of underlying security, custody, and other technical infrastructure. Without proper support, if there are security vulnerabilities, there will be endless trouble.
To address this, we conducted an in-depth analysis of the SFC’s guidelines for digital asset exchanges and fund managers (SFC Type 9 license) in custody, hoping to help institutions intending to apply for digital asset trading platform licenses and fund manager licenses in Hong Kong better understand the SFC’s requirements, prepare for license applications, and provide Cobo’s solutions.
Custody requirements for exchange applications
- How can AI be fully integrated with Web3?
- What is the latest Launchpool from Binance and who is Maverick with...
- LTC20 Protocol: On-chain lottery + Inscription-based social network...
The SFC has issued more than 100 pages of guidelines for digital asset exchanges planning to apply for licenses. The key points for custody technology are as follows:
-
Custody must be provided by a wholly-owned subsidiary of the digital asset exchange
The SFC requires that the exchange use a wholly-owned subsidiary to provide custody in the form of a trust. This means that the use of third-party custodians by exchanges is not allowed. The reasoning behind this requirement is that the SFC must have the right to directly regulate the custodian company within Hong Kong. If the exchange uses an overseas custodian service provider, the SFC will not be able to directly regulate the overseas custodian and cannot ensure the safety of the assets of the exchange platform users.
-
Open attitude towards custody technology
The Hong Kong Securities and Futures Commission (SFC) is open to the custody technology adopted by exchanges. In the consultation conclusion document, the SFC stated that it is closely monitoring new custody technologies, such as MPC/Key Sharding. The premise is that private keys and backups must be stored on certified devices, such as certified HSMs.
-
Asset allocation and protection of hot and cold wallets
The SFC has clear requirements for the custody arrangements of exchange assets. 98% of user assets must be placed in cold wallets, and the other no more than 2% in hot wallets. In addition, the SFC requires the exchange to provide protection for 50% of assets in cold wallets and 100% of assets in hot wallets. The protection can be provided by third-party insurance, funds set aside in trust, and bank guarantees.
-
The exchange uses whitelist address mechanism to regulate customer deposits and withdrawals
To control the risk of money laundering, when users use the exchange platform to operate deposits and withdrawals, the SFC recommends that the exchange adopt a whitelist address mechanism to ensure that users trade with their own or acceptable third-party wallet addresses. As for judging whether the whitelist address is held by the user, the SFC mentioned that the “message signature test” or “micro-payment test” can be used.
-
Private keys must be stored in Hong Kong
The SFC requires that the exchange’s private keys must be stored locally in Hong Kong to ensure effective supervision and law enforcement.
Custody requirements for fund managers (SFC Type 9 license)
For fund managers investing in virtual asset portfolios, the SFC’s “Standard Terms and Conditions for Licensed Corporations Managing Portfolios that Invest in Virtual Assets” released in October 2019 outlines the custody requirements.
First of all, the fund manager must select and appoint a virtual asset custodian. In principle, the fund manager can choose self-custody or use a third party for custody, but if self-custody is used, sufficient reasons must be provided to the SFC to prove that the risk is controllable, so it is more common to appoint a third-party custodian.
Secondly, the client funds managed by the fund manager must be segregated from the fund institution’s own funds. If the fund uses third-party custody, the fund client’s funds must be segregated from the funds of other clients of the custodian.
In addition, the Hong Kong Securities and Futures Commission also requires fund managers to consider using more than one custodian service provider to avoid excessive concentration of risk. This gives fund managers more diversified choices, whether in custody technology, platform or mode, to diversify risks.
In terms of how to choose the right custody arrangement and custody service provider, the Hong Kong Securities and Futures Commission has also listed some factors that fund managers should consider. The main factors that fund managers can evaluate the custody arrangement and custody service provider are as follows:
-
The experience and track record of the custodian, the corporate governance structure and the background of the management;
-
Whether the custodian is compliant and regulated;
-
Whether the custodian has adopted fund segregation;
-
The financial resources of the custodian and whether it has appropriate insurance;
-
The operational capability of the custodian, whether it has perfect wallet and private key operation process and security risk control measures;
-
The hardware and software infrastructure of the custodian;
-
The types of assets supported by the custodian.
Cobo’s solution:
Based on the above analysis, combined with Cobo’s years of technology and experience in the custody field, we can provide a variety of flexible solutions for exchanges and fund managers planning to apply for licenses in Hong Kong:
For exchange custody
-
Outsourcing custody system development
The Hong Kong Securities and Futures Commission requires exchanges to use wholly-owned subsidiaries for custody. As a mature custody solution that has been deeply involved in the custody field for many years, Cobo has a mature technology and development team, as well as rich experience in processing custody and security, and can provide services to exchanges applying for licenses through outsourcing development.
The custody technology solutions that Cobo can provide include:
-
MPC-based collaborative and custodial solutions;
-
Centralized custodial solutions based on HSM;
-
Hybrid custodial solutions combining MPC and HSM;
In addition, based on the in-depth partnership established by Cobo with on-chain data analysis, on-chain security, transfer rule suppliers, law firms, audit firms, insurance providers and other partners in the industry, we can provide one-stop services for exchanges to assist in the quick setup of infrastructure and early submission of licensing applications.
For Fund Custody
-
Third-party custodial service provider
For fund management companies planning to apply for a license in Hong Kong, Cobo can act as a third-party custodial service provider to provide custodial services that meet the requirements of fund licensing, whether it is centralized custody or MPC-based collaborative and custodial solutions.
-
Outsourced custody system development
For funds planning to adopt self-custody, Cobo can provide technical services to funds through outsourced technical services.
Cobo’s Comprehensive Advantages
Since its establishment in 2017, Cobo has been focusing on digital asset custody technology and solutions, and has not experienced any security incidents in six years. It has strong technical strength, a highly recognized brand, and has accumulated rich security management experience.
-
Professionalism: Since its establishment in 2017, it has been focusing on digital asset custody technology and solutions, and has not experienced any security incidents in six years. It has strong technical strength, a highly recognized brand, and has accumulated rich security management experience.
-
Licensing and Compliance: It has a TCSP license in Hong Kong and can develop custody business in compliance. The company has passed Soc 2 Type 1 and Type 2 certifications and is highly secure and reliable.
-
Localization: Since opening an office in Hong Kong in 2019, the team has been operating in Hong Kong for many years, has strong hardware and software facilities, and ensures that private keys are securely stored locally in Hong Kong.
