Hong Kong Virtual Asset Custodian Licence: Who Needs One

By the Guardian team Updated November 2026 6 min read

Quick answer. Businesses safekeeping private keys that can move clients' virtual assets would need an SFC licence or registration, with some exemptions. Standards will build on VATP Guidelines Chapter X and circular 25EC44. The bill has not yet been introduced.

Watch: Hong Kong Virtual Asset Custodian Licence: Who Needs One 1:40

Video transcript

Hong Kong licenses crypto trading platforms. Custodians are next, and the licence turns on one fact: who can move client assets.

The licence is not law yet. As of November 5, 2026, the bill has not been introduced, and no start date is set.

If you can move client assets alone, you would need a licence or registration. Non-custodial wallets are likely outside scope.

MPC is decided case by case. No licence is needed if clients can move their assets and rebuild the key, or retrieve access, without you. Otherwise, one may be required.

Keep evidence: client-held recovery kits, proof your shares cannot reach the signing threshold alone, and recovery that works when you are offline.

Standards will build on the SFC's Chapter ten custody rules and circular: segregated wallets, ninety-eight percent cold storage, no single person with a whole key, and keys stored in Hong Kong.

Minimum capital is ten million Hong Kong dollars paid-up, plus three million liquid capital. Banks are excepted.

No deeming period is planned. Custodians that skip pre-application will have to stop operations on the commencement date.

Contact the SFC or HKMA now. Get controls live first: the external assessment checks they are suitably designed and implemented.

Guardian assesses key generation, signing thresholds, cold storage and recovery against your custody rules. Read the full article, or talk to Guardian.

Hong Kong already licenses virtual asset trading platforms (VATPs). Custodians are next.

On December 24, 2025, the Financial Services and the Treasury Bureau (FSTB) and the Securities and Futures Commission (SFC) published conclusions on a custodian licence under the AMLO (Cap. 615).

Scope turns on one technical fact: who can move client assets. No deeming period is planned.

This article explains the technical and security side of the FSTB and SFC's Consultation Conclusions on the Legislative Proposal to Regulate Virtual Asset Custodian Services. It is not legal advice; confirm how it applies to you with counsel.

Where the Bill Stands

The licence is a legislative proposal, not law. No commencement date is set.

December 24, 2025: conclusions published; bill targeted for 2026.
May 26, 2026: VA advisory and management conclusions, also aimed at 2026.
June 1, 2026: an FSTB paper to LegCo targets one bill for four regimes "within this year".
November 5, 2026: no such bill on LegCo's 2026 list, gazetted or introduced.

The four regimes are VA dealing, custody, advisory and management. SFC codes and guidelines follow the legislation.

Who Needs a Licence

The licence covers custodians that "safekeep any instrument enabling the transfer of VAs for any person": private keys or similar instruments.

For example, a licence or registration would be required "where a person can unilaterally transfer its clients' VAs".

The conclusions name examples:

Associated entities of SFC-licensed VATPs, which would need a separate licence.
Type 13 licensed corporations, banks, local banks' subsidiaries and stored value facilities holding keys.
Licensed or registered fund managers that self-custody fund assets.

Banks and stored value facilities would register rather than take a licence, under HKMA supervision.

A custodian operating from Hong Kong would need a licence even if its clients are overseas.

How common setups fare:

Setup	Treatment in the conclusions
Provider can move client assets alone	Licence or registration required
Custodial staking that can transfer client assets	Licence or registration required
Non-custodial wallet with no ability to transfer	Likely outside scope
HSM or cloud key service	Not ruled on; the substance decides
Trustee or fund manager delegating custody	Not required

The MPC question

No licence or registration is needed, for example, where an MPC provider's clients meet both conditions.

They can transfer their own assets, with the provider or alone.
They can "reconstruct the complete private key independently or retrieve access to their VAs" without the provider.

Other MPC providers "may be required" to hold one where a client cannot transfer its assets alone, for example because no recovery kit was provided.

Each arrangement is decided case by case. Factors "may include" whether the provider can move client assets alone, and whether clients can independently access and manage them "at all times".

For an MPC vendor, the answer rests on evidence:

a recovery kit each client holds, and a dated client-run recovery;
proof your key shares cannot reach the signing threshold alone;
a recovery path that works when your service is offline.

Exemptions

An entity that does not safekeep keys needs no custodian licence. The SFC still intends to require licensed VA firms to use SFC-regulated custodians.

Planned carve-outs:

Stablecoin issuers: HKMA licensees holding only the stablecoins they issue.
Group companies: custody only for companies in the same group.
Professionals: lawyers and accountants holding key backups, or appointed by a court.
PE and VC managers: limited self-custody of new tokens, under consideration.

For private funds, the May 2026 conclusions would let managers appoint qualified custodians globally. Where none supports a token, the SFC will prescribe "robust self-custody requirements".

Tokenized securities are not virtual assets under the AMLO, so holding only those needs no licence.

The Custody Standards

The SFC will build on the VATP Guidelines, "particularly Chapter X on Custody of Client Assets", as elaborated in circular 25EC44.

Para.	What Chapter X says
10.5	Client assets in designated wallets, segregated from the firm's own
10.6(c)	98% of client assets in cold storage, such as HSM-based
10.8(a)	Keys generated non-deterministically; where practicable, offline and in a certified HSM or similar
10.8(c)	No single person can access an entire seed, key or backup passphrase
10.8(d)	Distributed backups; no key can be rebuilt from one location
10.8(e)	Seeds and private keys stored in Hong Kong
10.10(f)	Withdrawal addresses cannot change before signing and broadcast

Circular 25EC44 adds the operating detail: no public-chain smart contracts in cold wallets, air-gapped key generation and human-readable signing.

Our SFC custody circular guide covers each section.

The 98% ratio may change. The SFC will "explore adopting a dynamic approach to custody technologies and storage ratios".

Respondents asked for insurance, SOC 2 Type II reports and annual cybersecurity audits. None is decided.

Who needs an individual licence

The conclusions anticipate a licence, or relevant-individual status, for:

senior management responsible for monitoring and supervision;
anyone with direct key access, or authority to initiate or approve transfers;
personnel in multisignature or threshold signing schemes;
anyone with access to key generation, storage or recovery systems.

Group staff in these roles should be accredited to the custodian, with a delegation before accessing keys.

Capital, Fees and No Deeming

Capital: at least HK$10 million paid-up and HK$3 million liquid capital.
Banks: excepted, because HKMA capital rules apply.
Fees: application and annual fees no less than SFO Type 3 (HK$129,730 each, per the consultation paper).

No deeming arrangement is planned for existing custodians. The regime would take full effect on commencement.

Providers that skip pre-application "will have to stop operations on the commencement date". In setting that date, the Government and SFC will consider the time firms need to adjust.

An expedited process will apply to VATP associated entities, banks and local banks' subsidiaries already assessed for, and providing, custody.

Unlicensed firms anywhere would also be barred from actively marketing custody to the Hong Kong public.

Pre-Application and Assessment

Existing custodians are encouraged to contact the SFC (fintech@sfc.hk) or the HKMA as soon as possible, for example to start pre-application. The SFC will walk them through engaging an external assessor.

The consultation paper's model, taken from VATP licensing:

it runs after all relevant systems and controls are deployed;
the SFC becomes a party to the engagement;
it checks that controls are suitably designed and implemented.

So controls must be live before the assessment.

Readiness Checklist

Inventory every key, share and backup, and who can use each.
For each arrangement, decide whether you can move client assets alone.
List every initiator, approver, signer and key-system administrator.
Test cold wallets against Chapter X and 25EC44, including keys held in Hong Kong.
Compare each signer's view with the raw transaction, for every type.
Commission independent code review of third-party wallet software.
Contact the SFC now, before a commencement date is set.

How Guardian Helps

Guardian's regulatory readiness assessment covers SFC licences. It assesses key generation and storage, signing thresholds, cold storage ratios and recovery against your custody rules.

Guardian's OpSec audit maps where keys live, who holds each share and what signers see before approving.

Our institutional practice advises on custody and signing models, and reviews the custodians you rely on.

To compare custody models, see our crypto custody guide.

Frequently Asked Questions

Does an MPC wallet provider need a Hong Kong custodian licence?

It depends on the arrangement. None is needed where clients can transfer their assets and rebuild the key, or retrieve access, without the provider. One may be required where a client cannot transfer alone, for example without a recovery kit.

When does the VA custodian regime start?

No date is set. As of November 5, 2026, the bill had not been gazetted or introduced into LegCo; the target is 2026. The regime would take full effect on commencement, with no deeming period planned.

Do VATP associated entities need a separate licence?

Yes. Associated entities of SFC-licensed VATPs that safekeep client keys would need a separate custodian licence or registration. An expedited approval process will apply to those already assessed.

What capital will a licensed VA custodian need?

At least HK$10 million in paid-up share capital and HK$3 million in liquid capital. Banks are excepted, as HKMA capital rules apply. The SFC may add requirements scaled to the business.

Sources

Get your custody controls ready for the SFC

Guardian tests key management, signing and recovery against VATP Guidelines Chapter X and circular 25EC44 before your external assessment.

Talk to Guardian Explore Guardian for institutions