Third-Party Wallet Providers: Asia-Pacific Rules Compared

By Owen Thurm Published November 6, 2026 6 min read

Quick answer. Hong Kong expects independent code reviews, incident reporting and joint drills. Japan will bar exchanges from unnotified custody system providers. Pakistan requires SOC 2 Type II or equivalent and PVARA audit rights. Australia’s draft adds custodian oversight.

Watch: Third-Party Wallet Providers: Asia-Pacific Rules Compared 1:42

Video transcript

Regulators across Asia-Pacific now write the wallet vendor into custody rules. Four texts reach the providers behind regulated platforms.

US and Japanese officials say a North Korean actor compromised a Japan-based wallet software firm. Two months later, DMM Bitcoin lost bitcoin worth 308 million dollars.

Hong Kong and Pakistan's rules are in force. Japan's law starts by Cabinet Order, and Australia's standards are still a draft.

Hong Kong expects an independent code review and a clear view of the provider's release process before onboarding, plus incident reporting and joint recovery drills.

Only Japan regulates the vendor directly. Providers of important custody systems must file prior notification, and exchanges may not use one that has not.

Australia's draft lets operators use a custodian only with adequate systems, then requires monitoring, a review every 13 months, and a written agreement. Whether software vendors count is for counsel.

Pakistan limits wallet providers to a support role. They need SOC 2 Type two or an accepted equivalent, and each arrangement must give PVARA audit rights.

A SOC 2 report attests to controls, but it is not a code review. Most packs also miss release integrity: who ships a build, how it is signed, and how platforms verify it.

Guardian reviews wallet code, key handling and release control. Read the full comparison, or book a system review call at guardian.security.

In late March 2024, a North Korean actor compromised a Japan-based wallet software firm, US and Japanese officials said. Two months later, DMM Bitcoin lost 4,502.9 BTC, then worth $308 million.

Hong Kong’s Securities and Futures Commission (SFC) cites a similar weakness in overseas incidents: attackers “compromised a third-party wallet solution by injecting malicious code.”

Regulators now write the wallet vendor into custody rules. Here are four texts that do.

This article explains the technical and security side of SFC circular 25EC44, Japan’s amended FIEA, ASIC’s draft asset-holding standards and PVARA’s custody regulations. It is not legal advice; confirm how it applies to you with counsel.

The Four Texts at a Glance

Jurisdiction	Text	Key requirement	Status
Hong Kong	SFC circular 25EC44, paras. 13 to 17	Independent code review before onboarding; incident reporting; joint drills	In force since August 15, 2025
Japan	Amended FIEA, Chapter 3-6 and Article 43-12	Provider files prior notification; duty of care and system safety	Enacted July 15, 2026; starts by Cabinet Order
Australia	ASIC draft asset-holding standards, ss. 22 to 25	Custodians vetted and monitored; arrangements reviewed every 13 months	Draft; comments close November 27, 2026
Pakistan	PVARA Custody Services Regulations, reg. 15	SOC 2 Type II or equivalent; PVARA audit rights	In force; notified August 21, 2026

Only Japan puts the vendor itself under a filing duty. In the other three, the duties sit with the platform or custodian, and reach the vendor through contracts.

Hong Kong, Australia and Pakistan also set reconciliation clocks. See our comparison of reconciliation rules.

Hong Kong: Code Review First

SFC circular 25EC44 was issued on August 15, 2025 and took immediate effect. Adherence should form part of each platform’s annual external compliance and technology assessment.

Section IV covers wallet solutions and third-party providers. Its duties fall on the platform operator, whether wallet code is built in-house or bought.

Paragraph 14 (must). Segregation of duties over wallet code: code reviews, testing, supply chain management and audit trails.
Paragraph 15 (should). Independent code reviews, and a comprehensive understanding of the provider’s development and release processes.
Paragraph 16 (should). Ongoing review, with timely incident reporting and regular disaster recovery tests.
Paragraph 17 (should). Regular end-to-end rehearsals with the provider, against the SFC’s recovery time objectives.

Paragraph 15 applies “before onboarding or implementing material changes.” A major vendor release may restart the review.

Paragraph 3 adds due diligence on HSM providers before onboarding, then periodic evaluation. Our guide to the SFC custody circular covers the rest.

Japan: Providers Must Notify

Japan’s Diet enacted the Act amending the Financial Instruments and Exchange Act (FIEA) and the Payment Services Act on July 15, 2026.

Its main provisions start on a date set by Cabinet Order, within one year of promulgation. Much of the detail is left to Cabinet Office Orders.

The FSA’s outline covers firms that continuously make available the information systems used to manage customers’ crypto assets. Under Chapter 3-6, they face:

a notification to the Prime Minister;
a duty of due care;
a duty to keep a business management system; and
exposure to supervisory action.

The FSA’s explanatory material calls them providers of important custody systems. It lists prior notification and a duty to ensure system safety.

Under Article 43-12, an operator may not take these services from a provider that has not notified. It must also guide and oversee the providers it uses.

More in our guide to Japan’s FIEA amendment.

Australia: Vetting Custodians

ASIC released Consultation Paper 392 on October 15, 2026, with draft asset-holding standards in Attachment 2. Comments close on November 27, 2026.

ASIC plans final instruments in March 2027. The law commences on April 8, 2027.

An operator must not engage a third-party custodian unless satisfied it has adequate systems, controls, resources and people (section 22). From there, the operator must:

monitor each custodian under a written process, with access to its records (section 23);
require fixes, and move assets if a problem cannot be fixed in a reasonable period;
review the monitoring and the agreement at least once every 13 months (section 24); and
hold a legally enforceable written agreement (section 25).

The agreement must make the custodian verify each instruction, record who authorized each transaction, and reconcile each business day.

The custodian must also give notice of material changes and incidents, and test its business continuity arrangements.

These duties attach to third-party custodians and sub-custodians. Whether a software-only wallet vendor counts as one is a question for counsel. See our guide to ASIC CP 392.

Pakistan: SOC 2 and Audit Rights

PVARA’s Custody Services Regulations sit in S.R.O. 1420(I)/2026, notified on August 21, 2026. The general regulations come into force on notification.

Regulation 15 keeps the core of custody with the licensed custodian. That core includes wallet architecture, key management and control of access to client assets.

Wallet infrastructure and technology providers may work only “in a limited support capacity.” Selection criteria must require, at a minimum, that the provider:

shows institutional-scale custody or wallet infrastructure experience;
is under regulatory oversight in a jurisdiction PVARA accepts;
holds SOC 2 Type II or an equivalent PVARA accepts;
keeps segregation, resilience, business continuity and, where applicable, insurance; and
can support reconciliation, audit and supervisory reporting.

Each arrangement must give PVARA audit, inspection, access and information rights (regulation 15(8)).

Material custody incidents, including loss of keys, must be reported to PVARA as soon as practicable (regulation 16).

One Vendor Evidence Pack

A vendor selling across the region can build one pack:

Evidence	Asked for by
Independent code review of the wallet stack	Hong Kong para. 15
Walkthrough of the build, signing and release pipeline	Hong Kong para. 15
SOC 2 Type II report covering the wallet service	Pakistan reg. 15(7)
Custody system provider notification	Japan Ch. 3-6 and Art. 43-12, once in force
Incident and material-change notice terms	Hong Kong para. 16; Australia s. 25
Disaster recovery tests and joint drills	Hong Kong paras. 16 and 17; Australia s. 25
Audit and access rights for platform and regulator	Pakistan reg. 15(8); Australia s. 25

A SOC 2 report attests to controls over a period. It is not the code review Hong Kong’s paragraph 15 asks for.

Release integrity is the gap most packs miss. Show who can ship a build, how it is signed, and how a platform verifies what it runs.

How Guardian Helps

Guardian’s SDK audit covers EVM and Solana client libraries, from wallet kits to transaction builders. It reviews key handling, release control, and the gap between the repository and the published package.

Our regulatory compliance assessments review threshold signing services and the third-party register. They cover the contract terms regulators require and an exit plan tested against the vendor you depend on most.

To start, book a system review call: an hour with a Guardian engineer on the contracts, services and keys you actually run.

Frequently Asked Questions

Which Asia-Pacific regulator regulates wallet vendors directly?

Japan. Once the amended FIEA is in force, providers of systems that exchanges use to manage customers' crypto must file prior notification and owe a duty of care. Hong Kong, Australia and Pakistan put duties on the platform or custodian.

Is a SOC 2 report enough for the SFC?

Not on its own. Circular 25EC44 says third-party assessments should incorporate independent code reviews and a comprehensive understanding of the provider's development and release processes. A SOC 2 report attests to controls; it does not review code.

Do ASIC's draft standards cover wallet software vendors?

They cover third-party custodians and sub-custodians, which operators must vet and monitor, reviewing arrangements at least once every 13 months. Whether a software-only vendor counts is a question for counsel. The standards are a draft; comments close November 27, 2026.

What does Pakistan require of wallet infrastructure providers?

A custodian may use them only in a limited support capacity. Its selection criteria must require SOC 2 Type II or an accepted equivalent, regulatory oversight and resilience. Each arrangement must give PVARA audit, inspection, access and information rights.

Sources

Build one vendor evidence pack for four markets

Guardian reviews wallet SDKs, release pipelines and signing flows, and maps the evidence to each market’s text.

Talk to Guardian Book a system review call