Crypto Exchange Reconciliation Requirements in Asia-Pacific

By Owen Thurm Published November 6, 2026 6 min read

Quick answer. Real time in Hong Kong, every five minutes in Korea, at least daily in Pakistan, each business day in Australia. Hong Kong’s and Pakistan’s are in force; Korea’s is announced, without public rule text; Australia’s is a draft.

Watch: Crypto Exchange Reconciliation Requirements in Asia-Pacific 1:38

Video transcript

A day is too slow to catch a payout error or a drain. Asia-Pacific regulators now set the reconciliation clock.

After Bithumb's erroneous payouts, Korea's regulator found three of five major exchanges reconciled only every 24 hours.

Hong Kong's real time rule is in force. Korea announced a five minute cycle, without public rule text. Pakistan's daily minimum is in force, while Australia's business day rule is still a draft.

Korea plans a kill switch for large mismatches, while Hong Kong expects a prompt alert to security operations. Australia's draft wants shortfalls fixed by the second business day, and Pakistan wants PVARA told of material breaks after 24 hours.

Build once, to Hong Kong's real time standard and Korea's five minute cycle, and the daily rules follow.

Snapshot the ledger, read every wallet at a pinned block, track in-flight items. Compare against a tolerance band, and route every break to security operations, letting large ones trip the kill switch.

Start a clock on each break, and alert when a run is late. A check that stops running is a failure.

Guardian's Managed Security monitors contracts on every block, with engineers responding to alerts. Our offchain automation pentest checks that failing jobs halt safely, and our regulatory assessments map each provision to evidence.

Read the full comparison, or talk to Guardian at guardian.security about testing your reconciliation.

After Bithumb’s erroneous payouts, Korea’s Financial Services Commission (FSC) found that three of five major exchanges reconciled ledger to wallet only every 24 hours.

A day is too slow to catch a payout error or a drain. Regulators across Asia-Pacific now set the clock themselves.

This comparison covers four texts, from Korea, Hong Kong, Australia and Pakistan. For each: how often, what a break triggers, and its exact status.

This article explains the technical and security side of reconciliation rules for crypto exchanges and custodians in Korea, Hong Kong, Australia and Pakistan. It is not legal advice; confirm how it applies to you with counsel.

The Four Rules at a Glance

Jurisdiction	Text	Frequency	Status
Korea	FSC measures, April 6, 2026	Every five minutes	Announced; DAXA self-regulation. No public text sets the cycle
Hong Kong	SFC circular 25EC44, para. 19	Real time	In force since August 15, 2025
Australia	ASIC draft asset-holding standards, s. 16	Each business day	Draft; comments close November 27, 2026
Pakistan	PVARA Custody Services Regulations, reg. 9	At least daily	In force since August 21, 2026

Hong Kong’s is the tightest rule in force. Korea’s is the tightest stated as a number.

Rule by Rule

Korea: every five minutes

On April 6, 2026, the FSC said exchanges will be required to reconcile ledger to wallet in real time, every five minutes.

Specific criteria are to be introduced for an automated kill switch on a large-scale mismatch. External verification by accounting firms moves from quarterly to monthly.

The release is an announcement, not rule text. The FSC and the Digital Asset eXchange Alliance (DAXA), the exchanges’ self-regulatory body, planned rule changes within April and systems by May 2026.

Key details are to go into Korea’s pending framework law on digital assets.

DAXA publishes each member exchange’s daily reconciliation results. Our Korea reconciliation post found no public DAXA text setting the five-minute cycle as of November 5, 2026.

Hong Kong: real time, into the SOC

Paragraph 19 of SFC circular 25EC44 says platform operators should reconcile onchain client assets with the ledger balance in real time.

If unexpected transactions cause a discrepancy, the security operations center (SOC) or an equivalent team should be promptly alerted. It should then act with the relevant teams.

Paragraph 20 asks the SOC and domain experts to keep refining alert thresholds, with senior management overseeing the calibration.

The requirements took immediate effect on August 15, 2025. Adherence should form part of each platform’s annual external compliance and technology assessment. Our guide to the SFC custody circular covers the rest of it.

Australia: each business day, per class

Section 16 of ASIC’s draft asset-holding standards lets operators pool client tokens, with conditions.

Reconciliation must run each business day, or less often where that is ordinary and reasonable commercial practice. It runs for each class of token separately.

Any shortfall must be corrected by the end of the second business day after it arises.

Section 20 adds a report of wallet arrangements and addresses within 10 business days after each quarter. Under section 25, custodian agreements must also provide for reconciliation each business day.

The standards are a draft in Consultation Paper 392, released October 15, 2026. ASIC plans final instruments in March 2027, and the law commences on April 8, 2027. See our guide to ASIC CP 392.

Pakistan: daily, with a 24-hour clock

Regulation 9 of the Pakistan Virtual Asset Regulatory Authority’s (PVARA) Custody Services Regulations requires reconciliation of client assets at least daily.

It must run more often where transaction volumes, asset values or risk call for it. Each run covers:

client ledger balances per asset;
onchain balances for the relevant wallets;
pending transactions and unconfirmed deposits or withdrawals; and
breaks, shortfalls, excesses and unexplained differences.

A material discrepancy not fixed within 24 hours must be notified to PVARA without delay. A final report follows within 30 days.

A shortfall must be made good immediately, from the custodian’s own resources or other arrangements. PVARA and affected clients must be told without delay.

Regulation 10 adds proof of reserves, which may use third-party attestation and cryptographic verification.

Under regulation 15 of the Exchange Services Regulations, an exchange that holds client assets must meet the applicable reconciliation requirements, including the custody rules where they apply.

Both 2026 regulations were notified on August 21, 2026. The general regulations come into force on notification.

What a Break Triggers

Jurisdiction	On a mismatch
Korea	Automated kill switch on a large-scale mismatch
Hong Kong	Prompt SOC alert, then action with relevant teams
Australia	Shortfall corrected by end of second business day
Pakistan	PVARA told of any shortfall, or a material break after 24 hours

Direction matters in all four. A ledger above the wallets means clients are owed more than you hold.

One Design That Meets All Four

Build to Hong Kong’s real-time standard and Korea’s five-minute cycle. The daily rules then follow.

Snapshot ledger balances per asset and token class, with an ID and timestamp.
Read every wallet at a pinned block height from your own node.
Treat each chain’s version of a token as its own class.
Track in-flight items: pending deposits, sweeps and unconfirmed withdrawals.
Compare the remainder against a tolerance band per asset.
Route every break to the SOC; let large ones trip the kill switch.
Start a clock on each break: 24 hours in Pakistan, two business days in Australia.
Alert when a run is late. A check that stops running is a failure.

Proof of reserves is the outside view of the same numbers. See how to verify an exchange’s proof of reserves.

Evidence to Keep

Supervisors ask two things: does the control exist, and does it run. Keep records that answer both.

Every run: time, block height, snapshot ID, both totals and the gap.
Alert history, with who responded and when.
Kill switch tests, timed, on every chain.
Shortfall records: when found, when fixed, who was told.
Threshold reviews signed off by management (Hong Kong, paragraph 20).
Quarterly wallet and address reports (Australia, section 20).
Proof of reserves results and attestations (Pakistan, regulation 10).

How Guardian Helps

Under Managed Security, Guardian monitors contracts on every block, including privileged calls, multisig transactions and large fund movements. When something fires, a Guardian engineer responds.

Guardian’s offchain automation pentest checks whether a failing job halts safely or keeps acting. A reconciliation job and its kill switch must halt safely.

Our regulatory assessments map each provision to the control that meets it and the evidence that proves it.

Frequently Asked Questions

Which Asia-Pacific regulator requires the most frequent reconciliation?

Hong Kong's SFC expects real-time reconciliation of onchain client assets, in force since August 15, 2025. Korea's FSC announced a five-minute cycle in April 2026, through self-regulation and a pending law.

Is Australia's daily reconciliation rule in force?

No. It sits in ASIC's draft asset-holding standards in CP 392, open for comment until November 27, 2026. ASIC plans final instruments in March 2027, and the law commences on April 8, 2027.

Does Pakistan require proof of reserves?

Yes, for custodians. PVARA's Custody Services Regulations require proof of reserves or equivalent assurance that client liabilities are fully matched, on an ongoing basis. Methods may include third-party attestation and cryptographic verification.

What happens when reconciliation finds a shortfall?

Korea plans an automated kill switch, and Hong Kong expects a SOC alert. Australia's draft requires a fix by the second business day. Pakistan requires an immediate make-good and notice to PVARA and clients without delay.

Sources

Test your reconciliation before a supervisor does

Guardian tests the jobs, alerts and kill switch behind your reconciliation, and maps the evidence to each market’s rule.

Talk to Guardian Explore Managed Security