HKMA Stablecoin Licence: Technical and Security Requirements
Quick answer. Under the HKMA's guideline, no single party should run a high-risk token operation alone, and the most powerful keys should be air-gapped. Smart contracts should get third-party audits at least yearly and on every deployment, redeployment or upgrade.
Video transcript
Under the HKMA's guideline, no single party should run a high-risk token operation alone, and the most powerful keys should be air-gapped.
Hong Kong's Stablecoins Ordinance took effect on August 1, 2025. The HKMA granted its first two issuer licences on April 10, 2026.
Must marks a statutory requirement. Should marks an HKMA expectation, and the technology section uses should throughout.
A qualified third party should audit the smart contracts at least once a year, and on every deployment, redeployment or upgrade. Launching on a new chain counts as a new deployment.
Every lifecycle operation, from mint to freeze, should get approval matched to its risk. High-risk ones should need more than one party, such as a multisig. Where applicable, add velocity limits, whitelisted mint addresses and timelocks.
Significant keys, used to deploy or upgrade contracts, manage roles or make large mints and burns, should be air-gapped and used only in person.
The guideline also expects pentests, code reviews and attack simulations scaled to risk, with incident and continuity plans tested at least annually.
Each control pairs a paragraph with evidence a reviewer can check. The HKMA's Licensing Team may also request a smart contract audit report.
Guardian's regulatory readiness assessment maps each provision to its control and evidence. Read the full article, or talk to Guardian at guardian.security.
Hong Kong's Stablecoins Ordinance (Cap. 656) has been in force since August 1, 2025. The HKMA granted the first two issuer licences on April 10, 2026.
The HKMA's Guideline on Supervision of Licensed Stablecoin Issuers sets out what a licensee should build. Its technology section alone runs from page 24 to page 39.
This post turns those pages into a control list you can evidence, paragraph by paragraph.
This article explains the technical and security side of the HKMA's Guideline on Supervision of Licensed Stablecoin Issuers. It is not legal advice; confirm how it applies to you with counsel.
The Ordinance in Brief
| Item | What the HKMA texts say |
|---|---|
| In force | August 1, 2025 |
| Who needs a licence | Issuing a fiat-referenced stablecoin in Hong Kong, or an HKD-referenced one elsewhere |
| Capital | At least HK$25 million paid-up (authorized institutions excepted) |
| Redemption | Valid requests processed within one business day, unless otherwise approved |
| Supervisory text | Guideline on Supervision of Licensed Stablecoin Issuers, August 2025 |
| Licensees | Anchorpoint Financial Limited and HSBC, from April 10, 2026 |
The HKMA's register listed only those two licensees when we checked on November 6, 2026. It was last revised on April 23, 2026.
The guideline explains the Ordinance's minimum criteria, which a licensee must meet on an ongoing basis.
Paragraph 1.2 defines its verbs. "Must" marks a statutory requirement; "should" marks the HKMA's regulatory expectations.
Section 6.5, on technology risk, uses "should" throughout and never "must".
Token and Smart Contract Expectations
Start with documentation. For each stablecoin, paragraph 6.5.2 expects a licensee to document:
- the token standards used;
- every ledger the coin is issued on;
- the architecture of all its contracts, including token, proxy and multisig contracts;
- upgradeability, state variables, functions, modifiers, libraries and interfaces.
Paragraph 6.5.5 then asks for an assessment of each ledger. It covers cryptography, consensus, capacity, third-party audits, resistance to 51% attacks and security track record.
The same paragraph sets the audit rule. The licensee should engage a qualified third party to audit the smart contracts.
Formal verification and security review are the HKMA's examples. The audit should happen:
- at least once a year;
- whenever the contracts are deployed, redeployed or upgraded.
The audit should confirm the contracts are implemented correctly, match their intended functions and are, "to a high level of confidence", free of vulnerabilities.
To judge who is qualified, the HKMA lists factors including size, capabilities, expertise, track record, reputation and presence in Hong Kong.
A coin launched on a new chain is a new deployment. Our guide to multichain deployment verification shows how to prove each chain runs the audited code.
Mint, Burn and Freeze Controls
Paragraph 6.5.3 expects a licensee to list every operation in a coin's lifecycle. These include deploy, configure, mint, burn, upgrade, pause, blacklist, freeze, whitelist and use of operational wallets.
Each operation should have an authorization level proportionate to its risk, plus triggers and conditions for execution.
High-risk operations should be designed so no single party can perform them unilaterally, for example by multisig.
Where applicable, the HKMA expects extra safeguards:
- velocity limits on transactions;
- minting only to whitelisted wallet addresses;
- timelocks on certain operations;
- pre-signed transactions for certain operations;
- offchain simulation and checks of signed transactions before broadcast.
Paragraph 6.5.4 covers the people. Operations should be split between screened, trained staff, with a staffing plan so they run on time.
No authorized staff member should have full control over role management, such as assigning roles or changing how many approvers a transaction needs.
Two more checks tie the token to the books:
- any mint should be matched by an increase in reserve assets (3.2.1);
- for issuance and redemption, coins should move only to and from customers' pre-registered wallets (6.5.9).
Our freeze requirements comparison turns these paragraphs into a role design and sets them beside MAS and the GENIUS Act.
Key Management
Paragraph 6.5.7 covers the full key lifecycle.
It holds "Significant Seeds and/or Private Keys" to elevated standards. These are keys used for:
- deploying or upgrading the stablecoin's contracts;
- role management, such as setting or revoking minters;
- operations that materially affect supply, such as large mints and burns.
| Stage | What the guideline expects |
|---|---|
| Generation | Non-deterministic seeds in a certified HSM or similar; significant keys air-gapped |
| Storage | Secure media in Hong Kong, or a location the HKMA accepts |
| Multisig keys | Stored separately, in environments isolated from one another |
| Usage | Least privilege and MFA; significant keys used only in person, air-gapped |
| Backup | Multiple secure sites, in Hong Kong or as the HKMA accepts |
| Rebuilding | No key can be rebuilt from backups at one site |
| Recovery | Tested and rehearsed; the HKMA informed when triggered |
| Records | A key inventory, and logs tracing every access to a person |
Signing gets specific attention. Staff should be able to interpret what a transaction does, and what they see should match what they approve.
Licensees should also protect key holders against kidnap and extortion, and watch key use with tools including onchain monitoring.
The SFC's custody rules for trading platforms run along similar lines. See our post on the Hong Kong virtual asset custodian licence.
Testing and Resilience
Beyond the contracts, the guideline expects standard security testing and access controls:
- independent quality assurance reviews and pentests of major technology projects (6.5.17);
- peer and automated source code reviews (6.5.17);
- vulnerability scans, pentests and intelligence-led attack simulations, scaled to risk (6.5.19);
- MFA for high-risk activities, and tightly controlled privileged access (6.5.14).
Critical technology services should be outsourced only after an independent assessment of the provider's IT controls. The results should be shared with the HKMA (6.5.22).
Incident indicators name crypto events directly: smart contract exploits, forks, network outages, and lost or unauthorized access to private keys (6.8.3).
Licensees should set a maximum tolerable downtime, a recovery time objective and a recovery point objective (6.8.12).
Incident, continuity and exit plans should be reviewed and tested, including by simulation, at least annually (6.8.18 and 6.8.19).
The Audit-Ready Control List
Each line pairs a paragraph with evidence a reviewer can check.
| Control | Para. | Evidence |
|---|---|---|
| Architecture documented per coin and ledger | 6.5.2 | Contract inventory with proxies and upgrade paths |
| Every lifecycle operation risk-rated | 6.5.3 | Register of approval levels, triggers and conditions |
| No single party on high-risk operations | 6.5.3 | Role holders, thresholds and timelocks read onchain |
| Nobody controls role management alone | 6.5.4 | Who can grant roles or change thresholds |
| Mints matched to reserves | 3.2.1 | Supply-to-reserve reconciliation records |
| Third-party smart contract audit | 6.5.5 | A yearly report, plus one per deployment or upgrade |
| Significant keys air-gapped | 6.5.7 | Key inventory, ceremony records and access logs |
| Key recovery rehearsed | 6.5.7 | Dated recovery test results |
| Pentests and code review | 6.5.17, 6.5.19 | Reports with retest results |
| Plans tested yearly | 6.8.19 | Simulation results reported to the Board |
The HKMA's licensing note lists a smart contract audit report among the documents its Licensing Team may request (Annex B, item 29).
How Guardian Helps
Guardian's regulatory readiness assessment lists each technology, security, custody and resilience provision by citation, with the control that meets it and the evidence that proves it.
Guardian's evidence ledger maps:
- an audit report with fix review to 6.5.5;
- a privileged role and upgrade path map, read from the deployed contracts, to 6.5.3 and 6.5.4;
- a signing and automation review to 6.5.7.
Guardian's smart contract audits run in three passes: a design review, an invariant suite, then senior researchers attack what is left.
Frequently Asked Questions
When did Hong Kong start licensing stablecoin issuers?
The Stablecoins Ordinance took effect on August 1, 2025. The HKMA granted the first two licences, to Anchorpoint Financial Limited and HSBC, effective April 10, 2026. Its register listed only those two on November 6, 2026.
How often should an HKMA licensee audit its smart contracts?
Paragraph 6.5.5 says a licensee should engage a qualified third party to audit them at least annually, and whenever they are deployed, redeployed or upgraded. In the guideline, "should" marks the HKMA's regulatory expectations.
Where should a licensee keep its keys?
In secure storage such as a certified HSM, in Hong Kong or a location the HKMA accepts. Keys that deploy or upgrade contracts, manage roles or make large mints and burns should be air-gapped.
Sources
- HKMA: Guideline on Supervision of Licensed Stablecoin Issuers (August 2025)
- HKMA: Explanatory Note on Licensing of Stablecoin Issuers (July 2025)
- HKMA: Implementation of regulatory regime for stablecoin issuers (July 29, 2025)
- HKMA: Granting of stablecoin issuer licences (April 10, 2026)
- HKMA: Register of Licensees under the Stablecoins Ordinance (Cap. 656) (last revised April 23, 2026; checked November 6, 2026)
- HKMA: Stablecoin Issuers (accessed November 6, 2026)
- Guardian: Regulatory and Compliance Assessments
- Guardian: Smart Contract Audit
Get your stablecoin ready for the HKMA
Guardian maps your roles, keys and contracts to the paragraphs of the HKMA's supervisory guideline, then tests the controls a reviewer will check.