By Eugene Wong (Head of Risk Management and Compliance of Cobo)

Hong Kong has made remarkable strides in establishing a legal and regulatory framework for virtual asset operations over the past year. In October 2022, the Hong Kong Government issued a policy statement setting out its support for virtual assets and commitment to fostering sustainable development of the industry in all aspects. On June 1st this year, the licensing regime for Virtual Asset Trading Platform (VATP) issued by the Hong Kong Securities and Futures Commission (SFC) came into effect, mandating VATPs to obtain a license to continue their operations in Hong Kong. Existing VATPs seeking a license must submit their applications to the SFC within 9 months, by February 29th, 2024. Failure to do so will require them to cease operation in Hong Kong by May 31st, 2024.

As of today, several virtual asset exchanges have publicly expressed their intention to apply for the VATP license in Hong Kong. According to market sources, there are currently more than a hundred institutions, with a significant number of them from the traditional financial sector, who have shown interest in the license. However, institutions from the traditional financial sector face a key challenge: a lack of experience in dealing with virtual assets, particularly in areas such as blockchain security, crypto custody, and technology infrastructure. It is crucial for these institutions to ensure they have adequate support during the planning and development stages, and seek expert opinions when needed, to comprehensively understand and mitigate potential security vulnerabilities that could pose significant risks, including irreversible asset losses.

To address this challenge, we have conducted an in-depth analysis of the custody requirements outlined by the SFC for VATPs and Type 9 licensed Virtual Asset Fund Managers (VA Fund Managers). Our aim is to assist institutions interested in applying for the VATP or VA fund management licenses in Hong Kong in better understanding the SFC's requirements and how Cobo can help with the license application.

Custody Requirements for VATPs

The SFC has issued comprehensive guidelines setting out the licensing requirements for virtual asset exchanges. The key points pertaining to custody requirements are as follows:

• Custody of client assets must be provided by a wholly-owned subsidiary of the VATP

The SFC mandates that VATPs hold client virtual assets through a wholly-owned subsidiary that has a Trust or Company Service Provider License (TCSP) in Hong Kong. The use of third-party custodians is prohibited, as the SFC must maintain a direct regulatory handle of the custody entity within Hong Kong. Utilising a non-Hong Kong custodian would hinder the SFC’s ability to directly supervise the custodian, and in turn, compromise the security of client assets held by them.

• Openness to new custody technologies

The SFC maintains an open-minded approach towards the custody technologies adopted by licensees. In the consultation conclusion document, the SFC states that they are closely monitoring new custody technologies, including MPC and key sharding. The primary requirement is that private keys and backups must be stored in devices with appropriate certifications, such as a certified HSM.

• Asset allocation and safeguards for cold and hot wallets

The SFC sets out specific requirements regarding custody arrangements for exchange assets. In particular, it stipulates that 98% of user assets must be stored in cold wallets, while the remaining 2% can be stored in hot wallets and/or other storage options. Additionally, the SFC requires VATPs to put in place a compensation arrangement covering at least 50% of the assets in cold wallets and 100% of the assets in hot wallets and other storage options. The compensation arrangement may include third-party insurance, funds set aside on trust, and bank guarantees.

• Implementation of a whitelisting mechanism on customer deposits and withdrawals

To mitigate the risk of money laundering, the SFC recommends VATPs implement a mechanism to whitelist addresses that users can transact with. This ensures the VATP clients only interact with their own wallets and/or approved third parties. Message signing and micropayment tests are cited by the SFC as examples of ways to verify whether a wallet address is indeed owned by the client.

• Private keys must be stored in Hong Kong

To ensure effective supervision and enforcement, the SFC requires private keys to be stored locally in Hong Kong.

Custody Requirements for Virtual Asset Fund Managers (SFC Type 9 License)

For VA Fund Managers, the SFC sets out the custody requirements in the "Proforma Terms and Conditions for Licensed Corporations which Manage Portfolios that Invest in Virtual Assets" released in October 2019.

VA Fund Managers are responsible for selecting and appointing custodians for client assets. While self-custody is allowed in principle, VA Fund Managers must provide strong justifications to the SFC and demonstrate the associated risks can be effectively managed. In practice, it is more common for VA Fund Managers to appoint third-party custodians.

In addition, fund assets must be segregated from the VA Fund Managers' own assets. If a third-party custodian is appointed, fund assets should be segregated from the assets of other clients of the custodian.

The SFC also requires VA Fund Managers to consider appointing more than one custodian to mitigate concentration risk. This provides flexibility in terms of custody technology, platforms, and security approaches, promoting risk diversification.

When selecting custody solutions and custodians, the SFC provides a list of consideration factors for VA Fund Managers. The factors include:

• Experience, track record, corporate governance structure, and background of senior management of the custodian;

• The regulatory status of the custodian;

• Whether asset segregation is in place;

• Financial resources and insurance coverage of the custodian;

• Operational capabilities of the custodian, including a wallet and private key management processes and security risk management measures;

• Hardware and software infrastructure of the custodian;

• Types of assets supported

Cobo's Solutions:

With over 6 years of proven track record and R&D in the digital asset custody field, Cobo is well-positioned to provide our full suite of institutional-grade solutions for virtual asset exchanges and fund managers applying for licenses in Hong Kong.

For Virtual Asset Trading Platform Operators (VATP)

• Outsourcing service for custody infrastructure and system development

The SFC requires VATPs to use wholly-owned subsidiaries for custody. Backed by years of experience and expertise in virtual asset custody and a strong team of experts in virtual asset custody technology and cybersecurity, Cobo can act as a technology service provider to assist VATPs in developing their own custody solutions.

As a pioneering omni-custody platform, Cobo offers a full spectrum of custody technologies designed specifically to empower institutions to secure and manage their digital assets their way. Our custody solutions include: :

• MPC-based co-managed custody;

• HSM-based full custody;

• Hybrid custody combining MPC and HSM;

• Smart-contract-based custody.

In addition, through our partnerships with on-chain data analytics, on-chain security, Travel Rule solution provider, law firms, auditors, insurance providers, and other partners in the industry, Cobo offers a one-stop shop for VATPs, enabling the VATP to submit their license application in a timely manner.

For Virtual Asset Fund Managers

• Third-party custody service provider

For VA Fund Managers, Cobo can act as a third-party custodian that meets the SFC requirements. We offer both centralised full custody for institutions that want convenience and prefer to entrust the responsibility of key security to experts and MPC-based co-managed custody services for institutions that prefer to manage and control their private keys.

• Outsourcing service for custody infrastructure and system development

For VA Fund Managers planning to adopt self-custody, Cobo provides outsourcing technology services to support their custody infrastructure and system development needs.

Why Cobo?

Cobo is a globally trusted leader in digital asset custody solutions. Established in 2017 and headquartered in Singapore, our industry-leading custody technologies inspire confidence in digital asset ownership by enabling safe and efficient management of digital assets and interactions with Web 3.0.

With a deep presence in Asia, including in Hong Kong, Cobo offers distinct advantages in supporting exchange and fund license applications:

• Specialisation: Since its inception in 2017, Cobo has been exclusively focused on digital asset custody solutions and blockchain security technology. With an impeccable track record of zero security incidents and a strong team of seasoned security experts, Cobo has built a highly respected brand, recognised by the digital asset community for its rich technical know-how and experience in the field of digital asset custody and security management.

• License and Compliance: Cobo holds a TCSP license in Hong Kong, enabling it to provide custody solutions in full compliance with local regulations. The company has also obtained SOC 2 Type 1 and Type 2 certifications, an industry benchmark in security, privacy, availability, processing integrity, and confidentiality.

• Strong Local and Regional Presence: With an extensive network and experience in the Asian market, including Hong Kong, Cobo is well-positioned to cater to the specific demands of exchanges and fund managers and to navigate the local regulatory landscape.  Cobo's robust hardware and software infrastructure based in Hong Kong also helps to ensure compliance with regulatory requirements of secure storage of private keys and digital assets locally.

In summary, Cobo's strong local and regional presence, comprehensive understanding of the regulatory landscape, tailored solutions for the Asian market, trusted relationships, and secure local storage infrastructure make it a preferred partner for exchanges and fund managers applying for licenses in Hong Kong. To explore how Cobo can assist you with your unique custody requirements and stay ahead of the competition, we invite you to reach out to our dedicated team for a personalised consultation. For more information, please visit the official Cobo website at https://www.cobo.com/ and connect with us today to see how we can help.