SFC VA Custody Circular: Cold Wallet Standards

Updated November 2026 6 min read

Quick answer. The SFC VA custody circular (25EC44) set minimum custody standards for licensed VATPs from August 15, 2025. Cold wallets should not include public-chain smart contracts, keys should stay on air-gapped devices, and security should be monitored 24/7.

Watch: SFC VA Custody Circular: Cold Wallet Standards 1:41

Video transcript

Hong Kong's SFC has set minimum custody standards for licensed crypto platforms. Circular 25EC44 took effect on August 15, 2025, starting with client cold wallets.

It follows four weaknesses seen in overseas incidents: code injected into a third-party wallet, weak control of approval devices, poor independent transaction verification, and signers blindly approving forged transactions.

One case was the February 2025 Bybit theft, which the FBI put at about 1.5 billion dollars.

The biggest design change: cold wallets should not include smart contracts on public blockchains. Multisig and MPC are still named, but a contract-based multisig is a likely gap.

Operations must use air-gapped devices for keys, whitelisted addresses for transfers, integrity checks from creation to broadcast, dedicated approval devices, and human-readable form for anything signers check.

A SOC report or questionnaire is not a code review. Third-party wallet code needs independent review before onboarding and before material changes.

Platforms must reconcile onchain assets to the ledger in real time, and run a security operations center around the clock, holidays included.

Adherence is checked in the annual external assessment. Design documents show a control exists. Only records show it operates.

Guardian tests these paths, from signing flows and wallet code to monitoring. Read the full guide, or talk to Guardian at guardian.security.

Hong Kong's Securities and Futures Commission (SFC) published the SFC VA custody circular, 25EC44, on August 15, 2025.

It followed what the SFC called multiple cybersecurity incidents at overseas centralized platforms over the previous year.

It applies to SFC-licensed virtual asset trading platform (VATP) operators and their associated entities.

It sets minimum requirements, plus examples of good practice that are not compulsory.

Nothing is pending. The requirements took effect on the day of issue and feed each platform's annual external compliance and technology assessment.

This article explains the technical and security side of the SFC's Circular to licensed virtual asset trading platform operators on custody of virtual assets (25EC44). It is not legal advice; confirm how it applies to you with counsel.

Four Weaknesses

The circular names no platform. It lists four weaknesses exposed by the overseas incidents:

Malicious code injected into a third-party wallet solution altered the platform's user interface.
Inadequate access controls let attackers reach approval devices and alter approval requests.
Inadequate independent verification failed to stop signers approving fraudulent transactions.
Signers blindly approved forged transactions without verifying them.

The SFC adds that these vulnerabilities exist whatever the custody technology: HSMs, multi-party computation (MPC) or multisig.

One case from that period is the February 2025 Bybit theft. The FBI attributed it to North Korea and put it at about $1.5 billion.

The Safe Ecosystem Foundation said the attack came through a compromised Safe{Wallet} developer machine.

It said external review found no vulnerabilities in the Safe smart contracts, or in the source code of its frontend and services.

We cover that pattern in our post on securing signing interfaces after Bybit.

No Smart Contracts in Cold Wallets

First, ownership. Each platform should designate at least one Responsible Officer or Manager-in-Charge to oversee Sections II to VI.

Section II starts from the VATP Guidelines. Keys should, where practicable, be generated offline and kept in a secure environment such as a certified HSM.

It adds HSM vendor due diligence before onboarding and periodically after. A patched HSM should be validated and its certification updated promptly.

Paragraph 5 has the largest design impact: “Cold wallet implementations should not include smart contracts on public blockchains”.

The aim is to minimize potential online attack vectors.

It does not ban threshold signing. The circular itself names multisig and MPC as custody solutions.

What it rules out is a cold wallet that includes a public-chain smart contract, such as a contract-based multisig. The text makes no exception for contract wallets.

A platform holding client assets in cold storage through one should raise it with counsel and its case officer as a likely gap.

Operating Cold Wallets

Section III is the longest and the most testable.

Para.	Requirement	What to test
7	Seeds and private keys generated and safeguarded on air-gapped devices	Key ceremony records; no network path from the generation device
8	Attack-vector assessments; layered integrity checks from creation to broadcast	A dated threat assessment per material change; where each check sits
9	Whitelisted transfer addresses, with stringent controls on whitelist changes	Send to a non-whitelisted address; change the whitelist without approvals
10	Dedicated approval devices with restricted functionality and limited connectivity	Device inventory; are approval devices ever used for email or browsing?
11	Every detail of a manually checked transaction in human-readable form	Compare the signer's view with the raw transaction, for every type

The good-practice examples help. In one, the signing terminal shows the complete transaction and halts if it does not match the intended one.

In another, each signed transaction is compared with the unsigned original, and broadcast is refused on any discrepancy.

Section VI targets the last weakness. Paragraph 28 requires robust measures against blind signing: approving or signing a transaction without reviewing its content.

Its examples are training on manual transaction validation and monthly phishing simulations for all staff.

Third-Party Wallet Code

Section IV speaks to the first weakness. Whether wallet code is built in-house or bought, the circular requires:

Gatekeeping (paragraph 14): code reviews, testing, supply chain management and secure deployment, with audit trails.
Independent code review of vendors (paragraph 15), before onboarding and before material changes.
Ongoing vendor review (paragraph 16), including incident reporting and disaster recovery testing.
Rehearsals (paragraph 17): regular end-to-end drills with the provider.

Paragraph 15 is the demanding one. A SOC report or a questionnaire is not a code review.

If the vendor will not let an independent reviewer read the code and see how releases reach you, that is the finding.

Reconciliation and the 24/7 SOC

Section V builds on the Guidelines' existing Security Operations Center (SOC) requirement. It adds:

Real-time reconciliation of onchain client assets with the ledger, alerting the SOC on any discrepancy (paragraph 19).
Intrusion detection for the vault, signing devices, databases, production binaries and code repositories (paragraph 21).
Dependency monitoring of vendors, protocols, encryption algorithms and common libraries (paragraphs 22 and 23).
24/7 coverage, holidays included, with a severity-based framework for alerts (paragraphs 24 and 25).

In the SFC's example, firms with a working 24/7 function caught an industry incident on social media around midnight Hong Kong time.

So monitoring includes the outside world, not only your own logs. Our post on Web3 MDR covers how that function is built.

Evidence for the Annual Assessment

The circular sets no test procedures. Adherence should form part of the annual external compliance and technology assessment.

Expect the assessor to ask whether each control exists and whether it operates. Design documents answer the first. Only records answer the second.

The designated Responsible Officer or Manager-in-Charge, in writing.
A cold wallet architecture diagram showing no public-chain smart contract.
HSM vendor due diligence, certification status and the patch commitment.
Key ceremony records showing air-gapped devices.
Dated attack-vector assessments for each material change.
Whitelist change approvals, and a test showing a non-whitelisted transfer is blocked.
The signer's view for each transaction type, set against the raw transaction.
Independent code review reports for each third-party wallet solution.
Reconciliation alert history, the 24/7 rota and rehearsal results.
Signer training records and phishing simulation results.

One related deadline sits in a separate circular. 26EC35, issued July 9, 2026, says firms should not use one-time passwords for client login or device binding.

Phishing-resistant methods, such as passkeys or bound devices, are expected as soon as practicable and no later than July 8, 2027.

How Guardian Helps

Guardian's regulatory readiness assessment maps the SFC VATP Guidelines provision by provision, including 25EC44 and the 26EC35 deadline.

For each provision, it records the control, the evidence that proves it, and any gap.

The tests behind that evidence include pentests of the infrastructure, web apps, APIs and browser extensions on the signing path.

Under Managed Security, Guardian reviews every multisig transaction before it is signed and monitors privileged calls, upgrades and large fund movements around the clock.

For another regulator's approach, see our guide to ASIC's proposed asset-holding standards.

Frequently Asked Questions

Does the SFC custody circular ban multisig wallets?

Not as such. The circular names multisig, MPC and HSMs as custody solutions. Paragraph 5 rules out a cold wallet implementation that includes smart contracts on public blockchains, such as a contract-based multisig.

Who does circular 25EC44 apply to?

SFC-licensed virtual asset trading platform operators and their associated entities. The SFC says the same standards will become core expectations for virtual asset custodian services under Hong Kong's proposed custodian regulation.

Do the requirements apply to hot wallets?

Sections II and III are written for client cold wallets. The sections on third-party wallets, monitoring and training are not limited to cold storage. The SFC notes the incidents point to vulnerabilities in both hot and cold wallet infrastructure.

What does the SFC mean by blind signing?

Approving or signing a transaction without reviewing its content. Platforms should show every detail of a manually checked transaction in human-readable form, train signers, and put robust measures in place to prevent it.

Sources

Test your custody controls before the assessor does

Guardian maps 25EC44 paragraph by paragraph to the controls, tests and records your annual external assessment will ask for.

Talk to Guardian Explore regulatory compliance