Hong Kong Digital Asset Exchange and Fund Application Custody Requirements and Solutions

Over the past year, Hong Kong has made significant progress in the regulation of digital assets. In October 2022, the Hong Kong government issued a policy declaration stating that it supports digital assets and will promote the development of the industry in all aspects. On June 1 this year, the Hong Kong Securities Regulatory Commission issued the license regulations for digital asset trading platforms, which stipulated that trading platforms must apply for a license to operate in Hong Kong. For regulated trading platforms, a license application must be submitted to the Securities Regulatory Commission within nine months, that is, before February 29, 2024, otherwise the Hong Kong business must be terminated before May 31, 2024.

At present, a number of exchanges have publicly expressed their intention to apply for a digital asset exchange license in Hong Kong. The information circulating in the market is that there may be hundreds of institutions planning to apply for an exchange license, and a large number of them are from the traditional financial field. For institutions from the traditional financial field, a potential challenge is the lack of experience in digital assets, especially in terms of underlying security, custody and other technical infrastructure. If they cannot get good support, once a security hole is left, there will be endless troubles.

To this end, we conducted an in-depth analysis of the Hong Kong Securities Regulatory Commission’s guidelines on custody of digital asset exchanges and fund managers (CSRC No. 9 license), hoping to help those who intend to apply for digital asset exchange licenses and fund managers in Hong Kong The licensed institution better understands the requirements of the Hong Kong Securities Regulatory Commission, prepares for the application for a license, and also provides Cobo's solution.

Custody requirements for exchange application

For digital asset exchanges planning to apply for licenses, the Hong Kong Securities Regulatory Commission has issued more than 100 pages of guidelines. Among them, the main points for hosting technology are as follows:

• Custody must be provided by a wholly-owned affiliate of the digital asset exchange

The Hong Kong Securities Regulatory Commission requires the exchange to use a wholly-owned subsidiary to provide custody in the form of trust. This setting means that the exchange is not allowed to use the custody services of third-party custodians. The starting point behind this consideration is that the Hong Kong Securities Regulatory Commission must have the right to directly supervise the custody company in Hong Kong. If the exchange uses an overseas custodian service provider, the Hong Kong Securities Regulatory Commission will not be able to directly regulate the overseas custodian, nor can it guarantee the asset security of exchange platform users.

• Open to hosting technology

The Hong Kong Securities Regulatory Commission is open to the custody technology adopted by the exchange. In the consultation conclusion document, the Hong Kong Securities Regulatory Commission stated that it is paying close attention to the current new custody technologies, such as MPC/Key Sharding. The main premise is that the private key and backup must be stored in a device with appropriate certification, such as a certified HSM.

• Asset allocation and protection of hot and cold wallets

The Hong Kong Securities Regulatory Commission also has clear requirements for the custody arrangement of exchange assets. 98% of user assets must be stored in cold wallets, and the remaining user assets of no more than 2% are stored in hot wallets. In addition, the China Securities Regulatory Commission also requires the exchange to provide protection for 50% of the assets in the cold wallet and 100% of the assets in the hot wallet. Protection can be third party insurance, funds set aside in trust and bank guarantees.

• The exchange uses a whitelist address mechanism to regulate customer deposits and withdrawals

In order to control the risk of money laundering, when users use the exchange platform to operate deposits and withdrawals, the Hong Kong Securities Regulatory Commission recommends that the exchange adopts a whitelist address mechanism to ensure that users are trading with their own or acceptable third-party wallet addresses. As for judging whether a whitelist address is held by a user, the China Securities Regulatory Commission mentioned that "message signature test" or "micropayment test" can be used.

• Private key must be stored in Hong Kong

The Hong Kong Securities Regulatory Commission requires that the private key of the exchange must be kept in Hong Kong to ensure effective monitoring and law enforcement.

Custody Requirements for Fund Managers (No. 9 License of the China Securities Regulatory Commission)

With regard to fund managers investing in virtual asset portfolios, the Hong Kong Securities and Futures Commission issued in October 2019 the "Standard Terms and Conditions Applicable to Licensed Corporations Managing Portfolios Investing in Virtual Assets" regarding custody requirements .

First, the fund manager must select and appoint a virtual asset custodian. In principle, fund managers can adopt self-custody or use a third party for their custody, but if self-custody is adopted, they must submit sufficient reasons to the China Securities Regulatory Commission to prove that the risks are controllable, so it is more common to appoint a third-party custodian.

Secondly, client funds managed by the fund manager must be isolated from the funds of the fund institution itself. If the fund uses a third-party escrow, the funds of the fund client must be segregated from the funds of other clients of the custodian.

In addition, the Hong Kong Securities Regulatory Commission also requires fund managers to consider using more than one custodian service provider to avoid excessive risk concentration. This also gives fund managers more diversified choices, no matter in terms of custody technology, platform or method, so as to spread risks.

On how to choose a suitable custody arrangement and custodian, the Hong Kong Securities Regulatory Commission also lists some factors that fund managers should consider. It is recommended to evaluate custody arrangements and custodian service providers mainly from the following aspects:

• Custodian experience and track record, corporate governance structure and management background;
• Whether the custodian is compliant and regulated;
• Whether the custodian has adopted fund isolation;
• the financial resources of the custodian and whether it has suitable insurance;
• The operational capacity of the custodian, whether there is a complete wallet and private key operation process and security risk control measures;
• Hosting provider's hardware and software infrastructure;
• Asset types supported by the custodian.

Cobo's solution:

Based on the above analysis, combined with Cobo's years of technology and experience in the custody field, we can provide a variety of flexible solutions for exchanges and fund managers who plan to apply for licenses in Hong Kong:

For exchange hosting

• Outsourced Hosting System Development

The Hong Kong Securities Regulatory Commission requires that the exchange can only be managed by a wholly-owned subsidiary company. As a custody solution that has been deeply cultivated in the custody field for many years, Cobo has mature technology and development teams, as well as rich experience in handling custody and security. It can provide from MPC-based From technology to technical solutions based on centralized hosting, it provides services for exchanges applying for licenses through outsourcing development.

Cobo's managed technology solutions include:

• Co-management hosting solution based on MPC technology;
• HSM-based centralized hosting solution;
• Hybrid hosting solution combining MPC and HSM;

In addition, based on the in-depth partnership established by Cobo in the industry with on-chain data analysis, on-chain security, transfer rule suppliers, law firms, auditing, insurance and other partners, we can provide exchanges with one-stop services and assist in application Licensed exchanges quickly improve the construction of infrastructure, and submit license applications as soon as possible.

For fund custody

• Third-party hosting provider

For fund management companies planning to apply for a license in Hong Kong, Cobo can provide custody services as a third-party custody service provider. Whether it is centralized custody or MPC-based co-management custody, it can meet the requirements of the fund license.

• Outsourced Hosting System Development

For funds that plan to adopt self-custody, Cobo can provide technical services for the fund through outsourcing technical services.

Comprehensive advantages of Cobo

Cobo was established in 2017 and opened an office in Hong Kong in 2019. It is a leading hosting technology solution provider in the Asia-Pacific region and has won the support of many customers and partners in the Asia-Pacific region. Taken together, Cobo has the following advantages in supporting exchanges and fund applications for licenses:

• **Specialization: **Since its establishment in 2017, it has been focusing on digital asset custody technology and solutions. It has zero security incidents in six years, strong technical strength, highly recognized brand, and accumulated rich experience in security management;
• **License and compliance: **Has a TCSP license in Hong Kong, and can develop custody business in compliance; the company has passed Soc 2 Type 1 and Type 2 certification, which is highly safe and reliable.
• **Localization: **Since opening an office in Hong Kong in 2019, the team has been operating in Hong Kong for many years, with strong hardware and software facilities to ensure that the private key is safely stored in Hong Kong.