Hong Kong Securities and Futures Commission Sets New Standards for Virtual Asset Trading Platforms (VATPs)

Hong Kong SFC issues cybersecurity and asset safeguarding measures for licensed virtual asset platforms

Hong Kong’s Securities and Futures Commission (SFC) has issued a circular outlining key compliance requirements for virtual asset trading platforms (VATPs).

Released on 16 January 2025, the document follows inspections of VATP applicants and introduces a stricter framework for cybersecurity, asset protection, and operational integrity.

The circular sets expectations for SFC-licensed virtual asset service providers (VASPs), focusing on client asset safeguarding, know-your-client (KYC) processes, and security protocols.

These measures aim to reinforce trust in the virtual asset industry while ensuring that trading platforms operate with transparency and accountability.

Strengthening Cybersecurity and Risk Management

With the rising risks of cyberattacks and fraud in digital finance, the SFC has prioritised network security and privileged access controls for VATPs. Platforms are required to implement:

• Robust encryption mechanisms to protect sensitive client data
• Privileged access management to prevent unauthorised transactions
• Continuous security monitoring to detect threats in real time

The SFC’s circular highlights weaknesses uncovered during inspections, stressing that some applicants lacked adequate monitoring tools or security protocols. The new requirements set clear expectations for VATPs to maintain rigorous cybersecurity defences to protect both their platforms and users.

Additionally, platform operators must conduct regular penetration testing and security audits, ensuring that vulnerabilities are identified and resolved promptly.

Client Asset Protection and Trading Requirements

Another major focus of the SFC’s circular is client asset safeguarding. The regulator requires VATPs to maintain strict separation between customer funds and platform reserves, preventing any commingling of assets.

Key measures include:

• Segregation of duties to ensure that trading, custody, and administrative functions remain independent
• Clear policies on large withdrawals and deposits, minimising the risk of fraudulent activities
• Mandatory insurance arrangements to provide coverage against potential losses

The circular also establishes specific requirements for cold and hot wallet asset ratios, addressing concerns about liquidity risks and unauthorised access. By setting clear regulatory expectations, the SFC aims to enhance investor confidence in Hong Kong’s virtual asset market.

Additionally, VATPs must conduct due diligence on third-party service providers and restrict access from jurisdictions where virtual asset trading is prohibited. These rules ensure that licensed platforms operate within legally defined frameworks while reducing exposure to illicit financial activities.