HKMA updates digital-asset custody standards for Authorized Institutions — Hong Kong key storage and 98% cold storage of client VAs
Authorized Institutions offering digital-asset custody in Hong Kong must keep keys onshore and 98% of client VAs in cold storage
Change
On 27 May 2026, the HKMA updated the expected standards for digital-asset custody by Authorized Institutions, covering client-asset segregation from insolvency claims, Hong Kong key storage, 98% cold storage of client VAs, restrictions on delegation, and AI liability for attributable losses.
Why it matters
The standards apply to AIs (and subsidiaries) holding client digital assets — VAs, tokenised securities, and other tokenised assets. Client assets must be segregated from the AI's own assets, protected from the AI's creditors in insolvency, with no lending, pledging or encumbrance outside narrow exceptions. For client VAs: 98% in cold storage; seeds and private keys generated, stored and backed up in Hong Kong, with HSMs, whitelisting and key-sharding to remove single points of failure. VA custody may be delegated only to another AI, an SFC-licensed VATP, or an HKMA-licensed stablecoin issuer with HKMA consent — the AI retains ultimate responsibility for attributable losses.
Implications
- — AIs providing or planning digital-asset custody must align custody operations with the updated standards — segregating client assets from the AI's own assets (insolvency-protected), holding 98% of client VAs in cold storage, and not lending, pledging or encumbering client assets outside narrow exceptions. Arrangements that fall short no longer meet the HKMA's expected standards for custody.
- — AIs holding client VAs are expected to apply the prescribed key controls — seeds and private keys generated, stored and backed up in Hong Kong; HSMs and key-sharding (no single point of failure); whitelisting; air-gapped signing devices; 24/7 security monitoring — these are generally required for AIs holding client VAs.
- — AIs delegating VA custody may do so only to another AI, an SFC-licensed VATP, or an HKMA-licensed stablecoin issuer with HKMA consent; the AI must conduct documented due diligence and retains ultimate responsibility for attributable losses — outsourcing does not transfer accountability or the segregation obligation.
Who is affected
- — Authorized Institutions and subsidiaries providing or planning digital-asset custody in Hong Kong
- — Digital-asset custody operations and security/key-management teams at AIs
- — Risk and compliance teams responsible for delegation and outsourcing of custody