Core of Asset Custody for Compliance Virtual Asset Trading in Hong Kong

Recently, two virtual digital asset exchanges in Hong Kong have obtained the virtual asset service provider licenses approved by the Securities and Futures Commission, officially starting to provide virtual asset trading services to retail investors in Hong Kong. This marks a further consolidation of the position of compliant exchanges in the virtual asset field.

Since October last year, Hong Kong regulatory authorities have successively released a series of measures regarding virtual asset trading. Starting from June 1 of this year, more virtual asset exchanges can officially apply to the Securities and Futures Commission for a Compliance virtual asset exchange license. In such a policy environment, many exchanges hope to apply for licenses in Hong Kong to establish compliant centralized exchanges.

So, what are the requirements of the Hong Kong Securities and Futures Commission for centralized exchanges? Besides legal documents, what specific technical configuration requirements are there?

In fact, the current compliance trading regulatory framework in Hong Kong imposes very high technical requirements on exchanges regarding hardware and software compliance. There are several suppliers internationally providing various technical services under compliance frameworks for exchanges. The most critical area, which is also of the greatest concern to the Hong Kong Securities and Futures Commission, is the custody of client assets.

The Specificity of Asset Custody in Virtual Asset Exchanges

Unlike traditional finance, Hong Kong's regulatory requirements for compliant virtual asset trading require exchanges to play the role of banks. Customers' virtual assets are directly held in the exchange's cold wallet, which is equivalent to consolidating the functions of multiple traditional financial custody systems, such as banking and custody, into the entity of a compliant exchange. Therefore, the requirements for compliant exchanges in terms of software and hardware technology are much higher than those for brokers, approaching bank levels, while also needing to incorporate considerations of cryptography.

Security Challenges of Virtual Asset Trading

From a security perspective, blockchain can be simply divided into on-chain and off-chain components. On-chain smart contracts may be at risk of being attacked by hackers, while off-chain involves a systematic project for the operating platform, encompassing several aspects such as user authentication, network security, terminal security, and emergency response mechanisms.

From a compliance perspective, in recent years, regulatory policies in various countries have gradually become clearer. Especially after the FTX incident, regulatory agencies have realized that it is necessary to implement management rules and systems effectively to truly protect investors' interests. This year, Hong Kong has issued clear regulatory policies for virtual asset licenses, starting with trading platforms.

Regulatory Requirements for Asset Custody

Hong Kong's regulatory policies stand out in terms of logic and comprehensiveness:

1. It is required that the private keys of digital assets must be stored locally in Hong Kong.

2. Due to the fact that Hong Kong currently does not have a mature third-party custody regulatory system, applicants for virtual asset licenses are required to establish their own virtual asset security custody system.

3. In the selection of technical routes, regulatory agencies are both conservative and open. Conservatism is reflected in the tendency to choose proven mature technical routes in the field of traditional financial security; openness is reflected in the examination of new technological solutions and maintaining an open attitude.

4. It is required to have an authoritative third-party assessment agency conduct an evaluation to prove that the exchange meets regulatory requirements.

Measures to Protect User Asset Security

1. The IT requirements include network security, infrastructure, endpoint security, disaster recovery emergency response, and wallet custody systems. One of the requirements is that 98% of the assets must be stored in cold wallets.

2. Compliance requires the appointment of a professional Chief Compliance Officer, responsible for anti-money laundering, anti-terrorist financing, and other tasks.

3. Risk control involves the management of various aspects such as market manipulation, user fraud, counterparty risk, and credit risk.

4. The governance level needs to establish a sound system, clarifying the division of roles and responsibilities.

Potential Solutions to Be Introduced in the Future

1. With the maturity and acceptance of new technologies such as MPC (Secure Multi-Party Computation), it may see wider application in the custody sector.

2. In the future, more personal wallet solutions may emerge, complementing and interacting with centralized exchanges.

3. Custody services may be concentrated in a few leading institutions.

4. After the regulatory system is further improved, the accomplice role may become independent from the exchange, forming specialized third-party custody services.

5. With the maturity of new technology routes and the acquisition of global certification, the technical choices of custodians will become more diversified.